macOS has checked app signatures online for over 2 years

I agree with this, to some degree.

But I've also known that macOS verifies signatures for as long as it's been doing it. This was no secret, it was advertised as a feature.

I assumed it wasn't being done in plaintext, because who would be so foolish as to code it that way? and I'm still plenty mad about that. Anyone could have checked this at any time, presumably people did, and the only reason it became a story is because the server got really slow and we noticed.

Apple says there will be a fix next year, which... eh better than nothing, not even 10% as good as shipping the feature correctly to begin with.

But of the many things about this episode which are worthy of criticism, Apple being deceitful is nowhere among them. Never happened.

> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it.

Stronger privacy laws hurt Google, Facebook, and Amazon far more than Apple. Most of Apple's privacy gaffs are just bonehead moves like this one which shouldn't happen, but also don't drive revenue.

Vendors MAY use TLS, and Apple didn't (though they say they'll start).

You might want to read the RFC, rather than a blog post about it, before making such confident pronouncments.

I think you might be confusing accuracy and reliability. But I'm not here to argue about semantics, you can use whatever definition of accuracy you want. IP addresses are large attack vector for deanonymization/tracking, and people should be thinking more about how IP addresses get leaked and in what contexts. Whatever definition of "accuracy" you want to use, I don't think that changes the overall point that IP addresses matter.

To your earlier comment:

> Why would you not interpret this charitably as them not actually trying to spy on you?

I fully agree with this. I think Apple's intention is not to spy on users, it's to A) stop malware, and B) exert more control over their ecosystem in general.

I have a problem with point B, but that's a separate conversation.

To your later point:

> It is not possible to accurately connect an identity with an IP address.

This is just plain wrong; it is possible to accurately connect identities to IP addresses, people do it all the time. Reliability is a separate conversation. If you're working off of a different definition of "accurate", then, whatever, I don't care. But I stand by the point that IP addresses are a privacy risk and that they can be used to track/identify users in the real world, I don't think that's a disputable fact.

The privacy worry here is twofold. First that these requests are (currently) sent in plaintext. To their credit, I think Apple is fixing that issue. Which is good, because plaintext payloads allow adversaries on the same network to potentially sniff which applications you're using.

The second privacy worry is that regardless of whether or not Apple is trying to spy on users, they still might be storing that data, and we only have their word to go on that it'll be stored in a protected way or deleted regularly. If a court order comes down asking Apple to reveal that information, or if it gets hacked, that data increases the threat model for Apple users.

An adversary with access to Apple's data (whether that adversary is a hacker or a government) could theoretically tie app usage to real-world identities if the IP addresses are logged, especially if they can match IP addresses with logging of other data being sent to Apple's servers. That's the point m463 is making in his original comment -- the data here doesn't just exist in isolation, it's IP addresses that an attacker could correlate with other real-world identifying information.

I don't agree with the article's statement that this is necessary.

I'm sure it serves a purpose. But it should be more transparent to the user what's going on, and it should be possible to switch it off if the user decides they don't want this.

And really, the article also mentions Apple used to do this with a local cache but stopped doing this in Catalina. The question should be asked why. A local cache arguably offers better protection as it will work even without a network connection whereas the OCSP has no alternative other than failing open or stopping the system from working.