61–70 of 355 posts
Earlier quoted context omitted.
A low effort comment. Doubly bad, because the actual post is about how Apple doesn't actually do the "tracks your every use of an app" peeping they original post that made all the fuss says they do.
Learn about Big Sur(veillance). You can't block telemetry and it bypasses any VPN.
It's not clear which standards are enforced by the mods here. It seems like the "don't start trouble" standard....
Not sure whether the non-privacy related aspect about OCSP is less worrying. Officially Apple does this to protect innocent users from malware, but as we've seen it also allows them to remotely disable any developers' software. Not really something that I'd want on my machine.
OCSP also allows CAs to revoke random websites’ certificates, yet nobody is making a big fuss about that (presumably because no OCSP server has encountered what Apple’s did and prevented websites from opening).
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
Wait. Is it not common knowledge that Android and iOS log every application you open down to the exact millisecond you open and close them? Is it not common knowledge how telemetry works for the operating systems? They generally batch up a bunch of logs like this, encrypt them, compress them, and then send them to the mothership (hopefully when you're on WiFi).
Earlier quoted context omitted.
Yeah, I feel like I'm taking crazy pills; did everyone just not know about OCSP until Apple did it? Spoiler alert, you've probably already used OCSP on the web.
Most browsers are stopping ocsp because of the privacy use and the triviality to block it. Did Chrome ever do it? That’s why CT came around. Some background for those unfamiliar. https://scotthelme.co.uk/revocation-is-broken/
https://medium.com/@alexeysamoshkin/how-ssl-certificate-revo...
Although OCSP stapling is used more now IIRC.
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
Wait. Is it not common knowledge that Android and iOS log every application you open down to the exact millisecond you open and close them? Is it not common knowledge how telemetry works for the operating systems? They generally batch up a bunch of logs like this, encrypt them, compress them, and then send them to the mothership (hopefully when you're on WiFi).
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html
Earlier quoted context omitted.
> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816
You also didn't ask them to put a clock in the top right corner. I hope that gets the same level of righteous exasperation. (Just discovered MacOS includes at least two fonts and a printer driver I never asked for. How dare they?)
I think it would help if someone could quote or reference Apple's official position / explanation on this (if there is one). You know, before declaring the end of the world, is there any information from the source (Apple)? Discussions here seem to have had several thousand comments without obtaining this basic info. It would be good to know, I would think?