41–50 of 355 posts
If anyone is concerned with ocsp activity and verifications being requested all over the web, then oh boy stay away from https. OCSP is a good thing, and the web - and your signed applications - are better off with it.
OCSP doesn't seem like the right protocol for this. Apple should probably just ship you a list of hashes of revoked certificates once a day, and should do the check locally. (Obviously, the global certificate database is too big to send to every user, but Apple should be able to determine the subset of certificates they trust, and the even smaller subset of those that are revoked or compromised.) To me, it sounds lik…
Earlier quoted context omitted.
> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816
if they keep doing like this I will block their entire ASN .
Earlier quoted context omitted.
It clearly shows that Apple is getting fed the dev certificate info for each application being launched. For developers with multiple applications, then sure, that's not going to be as clear as individually identifying the application. But there are plenty of developers around with just one popular application. Sending the dev certificate for them is effectively the same as sending the application hash itself.
They already know they exist (they sign them) and most of those are downloaded via the AppStore (they run that) and people tend to log in using iCloud (which they own). I get it, we're all supposed to trust nobody and have 7 billion independent islands where you don't have to trust anyone or work with anyone. I have not seen any solution, just people piling on. Having PKI and signatures using a central authority is t…
"They already know they exist ..." doesn't really seem to match up? Like, of course they do.
Anyway, I was just pointing out that the communication still seems pretty close to sending Apple the list of applications being run. At least, for applications created by dev's with only one major program for their certificate.
> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective. Yes, and no. If you're using software that the state deems to be subversive or "dangerous", a developer certificate would make the nature of the software you are running pretty clear. They don't have to know exactly which program you're running, but j…
> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816
(Just discovered MacOS includes at least two fonts and a printer driver I never asked for. How dare they?)
OCSP doesn't seem like the right protocol for this. Apple should probably just ship you a list of hashes of revoked certificates once a day, and should do the check locally. (Obviously, the global certificate database is too big to send to every user, but Apple should be able to determine the subset of certificates they trust, and the even smaller subset of those that are revoked or compromised.) To me, it sounds lik…
> You should be aware that macOS might transmit some opaque information about the developer certificate of the apps you run. This information is sent out in clear text on your network. Wow, that is bad from a privacy perspective! Since certificate revocation is rare, it makes more sense to simply periodically update a list of revoked certificates instead of repeatedly checking each certificate. That would solve the p…
Earlier quoted context omitted.
> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816
It's worth noting that on ios you can never block anything - just have to put up with it.
If anyone is concerned with ocsp activity and verifications being requested all over the web, then oh boy stay away from https. OCSP is a good thing, and the web - and your signed applications - are better off with it.
Yeah, I feel like I'm taking crazy pills; did everyone just not know about OCSP until Apple did it? Spoiler alert, you've probably already used OCSP on the web.
That’s why CT came around.
Some background for those unfamiliar.
Also i don't get the argument for using HTTP. Aren't these two separate systems?