Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

331–340 of 355 posts

Re: Does Apple really log every app you run? A technical look

#331

> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective. Yes, and no. If you're using software that the state deems to be subversive or "dangerous", a developer certificate would make the nature of the software you are running pretty clear. They don't have to know exactly which program you're running, but j…

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

Maybe downgrade the macos would work. As I'm in old version of os, Little Snitch works quite well.

Re: Does Apple really log every app you run? A technical look

#332
post #303
post #285

Earlier quoted context omitted.

> this one is way too Apple apologetic for my taste. I'm not surprised. Apple fanatics routinely deny evidence to support their sorta-religion.

> Apple fanatics routinely deny evidence to support their sorta-religion. As do anti-Apple fanatics. That’s what being a “fanatic” means. You can say the same about gun fanatics, or meat fanatics, or vegetarian fanatics, or Android fanatics. It’s staggering how often people who are anti something fail to perceive the irony in behaving exactly in the manner they are decrying. Someone having a contrary opinion doesn’t…

that's crude whataboutism.

going back to the original topic, apple hardware/software, i've used apple hardware and software (company-issued macbook pro and iphone 7/8).

The software is great as long as you want to stay within apple-defined boudaries. If you want to go outside that, it's an experience similar if not worse than using gnu/linux.

The hardware is great when the machine is brand new but decays very quickly, it's not designed to be serviced by either end-users or specialized users or specialized shops -- you're supposed to return it to an apple store and pay an expensive price to basic maintenance. As an example, cleaning up the fans from dust is very important in those machines but you have to buy special hardware to take off the screws, and in generally you risk breaking something. Keyboards failed spectacularly in last gen, and apple waited like two years before fixing it. Audio is great, until it breaks. My macbook pro (15" top of the line) couldn't sustain full-audio, and distorted audio after ~30 sec of full volume audio (imagine that during a conference call in a meeting with other people). The screen is great, but the glass panel retained ALL of the fingerprints and it was a PITA to clean, i had to buy special glass-cleaning liquids. WTF.

All the above issues appeared all shortly after the first year of life of the laptop. Call me an anti-apple fanatic, I don't care, but I expected more from a 3500+€ machine.

At the new job i've been given a 13" dell latitude 7390. It works flawlessly, it rarely skips a beat and it has none of the problems stated above. Fuck Apple.

Re: Does Apple really log every app you run? A technical look

#333

Earlier quoted context omitted.

And then you need to do it again for every update you receive and create a new signature etc.

I guess we’ll have to see if the file gets reverted in updates. I don’t think that’s a given? I too am not happy about the root snapshot thing...

That doesn't matter. The total signature is still different from factory default, so if any change is made to any other file it will be different and need to be updated :)

What's being signed is a hash of all the individual file hashes, so any file being different from stock will mean a difference, whether it was changed in the latest update or not.

Re: Does Apple really log every app you run? A technical look

#334

Earlier quoted context omitted.

But they told people they had been worker-owned, and many actually believed it!

Yes, they were a despicable regime, and unfortunately their name still mars the idea of socialism. They also claimed they were democratic, and surely many believed that as well, but we haven't let that ruin democracy, so we shouldn't let their laughable claims to socialism ruin socialism.

You had like 120 years to create a version of socialism that didn't suck, or didn't degenerate into a form of oligarchy under whatever guise du jour you please. I'd call it a failed experiment by now. You know why?

Because "true socialism" (like your true Scotsman) requires ideal übermenschen on all levels everywhere. This is not how the humankind works. Humankind is full of flawed, sometimes outright malicious people, and you have to deal with that.

Most versions of socialism at some point came up with a need to breed ideal happy socialist people that won't keep breaking their paradise all the time. And until this Übermensch is born, they chose to break and bend the rest into behaving, like bonsai trees. Of course, Dear Leader and their team is exempted from being broken or bent, and many others aspire to become like them. This is how every socialist rule to date grew into a totalitarian oligarchy.

Thank you but no thank you. I'd better choose a form of government that adapts to and deals with people as they are, and doesn't try to force them into some better version according to their understanding.

Re: Does Apple really log every app you run? A technical look

#335
I see no reason why OCSP checks on developer certificates cannot be encrypted. This whole "oh no there could be a loop for a SSL cert check" argument seems like gaslighting. Why can't the client know if it wants to access an OCSP server using HTTP or HTTPS, and default to HTTPS when possible?

Re: Does Apple really log every app you run? A technical look

#336

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

THANK YOU. I also see no reason that OCSP checks cannot support both HTTP and HTTPS. If there is some reason then the protocol should be split into two, one for unencrypted checks for things like SSL certs, and another for all other/ dev cert checks over HTTPS.

Re: Does Apple really log every app you run? A technical look

#337

Earlier quoted context omitted.

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

Ok say we switch OSCP to HTTPS. How to we know the certificate presented by the OSCP server has not been revoked? We can’t ask the OSCP server cos that’s what we’re trying to handshake with! The loop is very real and non trivial to solve. I’d expect something similar to what ESNI/ECH does leveraging DNSSEC + DoH may be possible NOW, but that’s a recent development.

Why can't we use a combo of HTTP and HTTPS?

Re: Does Apple really log every app you run? A technical look

#338
post #332
post #303

Earlier quoted context omitted.

> Apple fanatics routinely deny evidence to support their sorta-religion. As do anti-Apple fanatics. That’s what being a “fanatic” means. You can say the same about gun fanatics, or meat fanatics, or vegetarian fanatics, or Android fanatics. It’s staggering how often people who are anti something fail to perceive the irony in behaving exactly in the manner they are decrying. Someone having a contrary opinion doesn’t…

that's crude whataboutism. going back to the original topic, apple hardware/software, i've used apple hardware and software (company-issued macbook pro and iphone 7/8). The software is great as long as you want to stay within apple-defined boudaries. If you want to go outside that, it's an experience similar if not worse than using gnu/linux. The hardware is great when the machine is brand new but decays very quickly…

> that's crude whataboutism.

You’ve missed my point, which is that you could remove the word “Apple” from your original comment and it would have made no difference. One kind of fanatic does not excuse another, nor have I claimed it does.

There’s no need to list Apple’s faults. I’m aware of them and support a large part of Apple criticism in the Tim Cook era (and not just technical[1]), including most of yours.

Where we disagree is in the insinuation the author is a fanatic simply for defending Apple. They’ve written a technical post and gave their conclusions, which may indeed sound apologetic but are far from rabid fanaticism.

> Fuck Apple.

In sum, it’s fine to decry the company but I disagree that people who like it and accept its tradeoffs should be immediately labeled as extremists.

[1]: https://news.ycombinator.com/item?id=24738345

Re: Does Apple really log every app you run? A technical look

#339

Earlier quoted context omitted.

They backup the private key to iCloud unless you manually disable backups. So even though iMessage is advertised as E2E encrypted, for the vast majority of users, Apple can read each and every message. (And even if you disable backups, Apple can still read most if not all of your messages, because the persons on the other side of the conversations have not disabled backups)

It's worth noting that Google, the big bad guys of privacy, uses a proper E2E encryption scheme.

iMessages is e2e encrypted, so I’m not sure what you’re saying here

Re: Does Apple really log every app you run? A technical look

#340
post #301

Earlier quoted context omitted.

For apple they are 100% forced to. Not sure what you’re getting at but have you ever seen an iphone simulator on windows or linux?

What platforms don’t force devs to buy developer kits or use their hardware? PlayStation and Xbox used to force devs to buy exotic hardware. Consoles are similar to phones and they lack simulators or emulators for the newer stuff.

We still use devkits because you cannot possibly develop a console game without one. They provide detailed hardware accelerated instrumentation, and also have specialized hardware that you can't emulate without a dramatic perf hit.

The difference in my mind is that no console markets itself as a general computing device, and the user understands they can't use it as such (you can't install whatever you want on an xbox).

Post reply on HN