821–830 of 996 posts
Earlier quoted context omitted.
Not related to the poster but it is surprising that HN is becoming like Reddit where non conformist opinions are downvoted extensively.
Stop caring about pretend internet points.
Earlier quoted context omitted.
You talk like this is some unique problem. This has been solved for a long time. Warranties have terms of service. If your car is under warranty and the engine fails due to a defect, warranty covers it. If your engine fails because you drove it into a river, then the warranty don't cover it and you'll pay out of pocket for repairs.
That's not a good analogy, though. What's the car equivalent of a ransomware app that pretends to be a video game? And, now that I think about it, I don't even know what the equivalent of "driving into a river" would be, and that's as a software engineer who's been working with computers for 25 years.
Earlier quoted context omitted.
I'm not sure why that's relevant. Am I only not dying of thirst because I agreed to the terms offered by the local water company? I think it's not contradictory to believe two things simultaneously: that people should not be held to the terms of a contract they signed when they were dying of thirst, and that it's okay that I needed to agree to certain terms with the water company in order to have running water in my…
> Am I only not dying of thirst because I agreed to the terms offered by the local water company? It is if they have a monopoly on water. Imagine their terms were manifestly unreasonable. If you want water service you'll have to pay $50,000/year. What would you do? If the answer is that it's reasonable to dig a well or something like that, they haven't got a monopoly. If the answer is to pay the $50,000/year because…
Earlier quoted context omitted.
You talk like this is some unique problem. This has been solved for a long time. Warranties have terms of service. If your car is under warranty and the engine fails due to a defect, warranty covers it. If your engine fails because you drove it into a river, then the warranty don't cover it and you'll pay out of pocket for repairs.
So you're effectively saying that Apple must allow a user to install malware (likely unintentionally), but then Apple is also responsible for paying to fix it? I feel like I have to be misunderstanding you because that makes no sense.
Most users do not want this, but some do.
Some users will consider a RAT a way to fix things, while others will consider some game to be a malicious drug. Both should be allowed to make their own decisions if they really want to.
Earlier quoted context omitted.
> On a device I own... And that's the issue. The overwhelming body of evidence in recent years suggests Apple does not consider the devices they make to be "yours." Rather, their attitude seems to be that those devices forever belong to Apple, and Apple simply allows you to pay for the privilege of using them.
Also, this is true for windows OS. Once you installed it, the computer would not belong to you. They would force updating, updating, and updating. Even if you were in meeting, that speaker stopped the talk and went back to find another computer. It is ridiculous. Nowadays, physician could do a surgery in remote. How about during operation there is an update.
Earlier quoted context omitted.
And so that's why I never liked nor trusted this whole idea of code signing with non-self-signed certificates, especially on desktop OSes. This notarization mechanism introduced a single point of failure: Apple. And now there is concrete evidence of how exactly this is bad. On a device I own, there should be no parties that are trusted more than myself. It's ridiculous I even have to write this.
Richard Stallman founded the Free Software Foundation (FSF) for this very reason. You might think it's ridiculous but the fight for the right to modify the software running on devices you own has been raging for 35 years and is bigger than ever.
What took me aback was the withdrawing permission to notarise their apps for Mac. That was only meant to be a check for known vulnerabilities/malicious software. Apple was more within their rights to kick Fortnite until the dust has settled from the iOS store, that was the retaliation, but now a mechanism supposedly for security has been repurposed as punishment. That's a pretty nasty move and I feel the mask has sli…
Epic expressly snuck code through the door to activate a user-visible feature in direct prohibition to App Store rules. Apple could have revoked their developer certificate in response, which would have essentially killed all installations of Fortnite iOS/Mac worldwide within 24 hours. That they are merely revoking their ability to sign new code and giving them 2 weeks to perform an orderly shutdown is far less draco…
I used to do consulting work as part of which I submitted Mac compatibility patches into the Unreal Engine source code repository. As is, it is not clear to me if I'll be hit by the Apple ban-hammer, too, or if they will limit it to "only" the 4000+ people directly employed by Epic.
What took me aback was the withdrawing permission to notarise their apps for Mac. That was only meant to be a check for known vulnerabilities/malicious software. Apple was more within their rights to kick Fortnite until the dust has settled from the iOS store, that was the retaliation, but now a mechanism supposedly for security has been repurposed as punishment. That's a pretty nasty move and I feel the mask has sli…
I've been warning my friends for years that giving Apple this much control was risky but without concrete examples like this those warnings were too easy to ignore.
Earlier quoted context omitted.
And so that's why I never liked nor trusted this whole idea of code signing with non-self-signed certificates, especially on desktop OSes. This notarization mechanism introduced a single point of failure: Apple. And now there is concrete evidence of how exactly this is bad. On a device I own, there should be no parties that are trusted more than myself. It's ridiculous I even have to write this.
It's important to note that you can still run unsigned Mac apps. Apple isn't preventing users from running a tool they want to run, it's just showing them a big scary warning and making them jump through some extra hoops. It's incredibly scummy and inappropriate, but I would put it more along the lines of an attack-ad than an outright ban. Edit: Now, one thing that isn't totally clear is whether or not devs who have…
Earlier quoted context omitted.
Myself. If not for IME, I could have a computer under my control, running software guaranteed to be free from the Trusting Trust attack, right now .
I respectfully disagree in my case. I don't consider myself a security expert at anything, especially at computers. This is probably 99.999% of the Apple customers. People like yourself can probably manage their own security, have a secure NAS, multiple firewalls, etc. Do you see it from the perspective of average Joe (or me)?