Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS unable to open any non-Apple application

twitter.com

Post reply on HN
Print view View original

871–880 of 1001 posts

Re: macOS unable to open any non-Apple application

#871

Post by phendrenad2 »

MeinBlutIstBlau wrote: post #139
elitepleb wrote: post #103

Don't you love it the ability to compile and run software on your hardware is controlled by a third party over the internet? I sure love the SAAS future we are heading forwards.

I will be a full on linux junkie when that happens.

This is a big conceit everyone holds - that Linux will be an acceptable substitute for MacOS. To be perfectly honest, if Apple shut down their Macbook factories and got out of the computer game entirely, and everyone flocked to Linux, it would be several painful years before Linux would be as usable as MacOS is today.

This is why I try out Linux every few years, and file lots of bug reports when I run into issues (mostly in applications - the core Linux kernel is solid). I've even contributed code to Linux apps that I don't intend to use right now.

Re: macOS unable to open any non-Apple application

#872

Post by mensetmanusman »

mav3rick wrote: post #699
ls65536 wrote: post #564

Earlier quoted context omitted.

> The HN crowd may seem fringe, but they are living in the future. The other thing that really can't be discounted here is that a lot of the HN crowd are likely the default go-to people in their circle of family and friends for this sort of stuff, and in many cases they may also have major purchasing influence and technical decision making power in their respective businesses. Turning off one of them may be inconsequ…

God the self importance of this community. The world can live without the 1000 people here.

The interesting thing about this community is that technically it could create its own OS. That is a threat to nation state level institutes that want to prevent that.

Re: macOS unable to open any non-Apple application

#873

Post by Spivak »

ehsankia wrote: post #584
_qulr wrote: post #52

OCSP is Online Certificate Status Protocol. The connection to ocsp.apple.com is checking the status of the certificate used to code sign the launching app. I wrote an article about this a couple weeks ago because of the temporary revocation of HP's signing cert for printer drivers on the Mac: https://lapcatsoftware.com/articles/revocation.html

I'm sorry if this was answered elsewhere, but can someone explain me how this works when you don't have internet connection? I assume you can still launch apps without internet connection. So then, what stops bad actors to just either block connection to ocsp or straight up turn off your connection entirely when running malware?

Through the very mechanism people are complaining about today.

If your machine is offline then it switches to a fail-open system and uses its cache to verify the binary and if it's not in the cache then it skips the check and allows it.

If your machine is online then it switches to a fail-closed system so that if you can't reach the servers because of something malicious then it blocks.

Re: macOS unable to open any non-Apple application

#874

Post by Spivak »

habosa wrote: post #821

Ok so let's say you actually want Apple to do this kind of security for you (I don't, but let's say). Currently they do a synchronous check before you launch any binary. Why don't they instead just log every binary signature and check them async on some regular schedule? Strict mode could be blocking the FIRST execution of a binary signature and after that you only recheck if that signature has been revoked on some r…

This is already how it works. After the first check the result is cached and then it can verify locally.

Re: macOS unable to open any non-Apple application

#875

Post by Wowfunhappy »

pfortuny wrote: post #696
Wowfunhappy wrote: post #38

Earlier quoted context omitted.

> How can launching apps be depending on a cloud service being available... It's not, per se. The apps will launch if you block the specific subdomain, or turn off internet. The problem is if the computer thinks it can connect and keeps trying.

So, yes: they do depend on the local (to the user) availability of that service. So they depend on that.

No, they don’t! If the server is unavailable everything works fine. The problem is when the server can be reached, but is nonresponsive.

I think that’s an important difference. If Apple’s servers ever go offline, the OS will continue to work.

Re: macOS unable to open any non-Apple application

#876

Post by mensetmanusman »

robocat wrote: post #669
augustl wrote: post #24

Earlier quoted context omitted.

That's correct. AFAIK Catalina will check online for everything, even binaries you compile yourself.

Microsoft Windows also uploads your private exe’s, and then runs them on Microsoft servers: https://medium.com/sensorfu/how-my-application-ran-away-and-...

Is this how we look for the next Stuxnet?

Re: macOS unable to open any non-Apple application

#877

Post by patrec »

babypuncher wrote: post #335
horsawlarway wrote: post #256

Earlier quoted context omitted.

People chose to use Apple because it seems like a benevolent dictatorship. And frankly, a benevolent dictatorship is basically the best government you can have, as long as you're part of the "in-group" who doesn't push boundaries, doesn't cause trouble, and supports the supreme ruler, Kim jon... cough* Apple. --- The problem is that no matter how good the dictatorship might be today, it will eventually bite you. You…

I think the difference between the Google and Apple dictatorships is the business model. Google's customers are not the users, they are the advertisers who rely on the data harvested by Google. The incentive to be evil is directly baked into the business model, and most users end up tolerating it because it is "FREE", and often the only viable option. Apple's customers are the users. If Apple rocks the boat too much,…

> Apple's customers are the users.

As are a crack dealer's.

Re: macOS unable to open any non-Apple application

#878

Post by peeters »

p1necone wrote: post #58
modeless wrote: post #19

You've got to be kidding me. When Apple's servers are down, all Macs worldwide start freezing randomly? My XCode is hanging during builds, is this why? This code signing enforcement stuff has gone way too far. Heads should roll for this.

Wait what happens if you don't have an internet connection? Can Macs not be used offline any more, surely that's still a relatively common use case for a laptop even today in a lot of places?

Often when I would see this type of error it would be when something silently drops TCP packets (rather than sending a RST). This is one way to configure a firewall, and it's indistinguishable from high latency. Hence the difference in behavior. If the address was unroutable, or immediately closed the connection, it would fail quickly (and presumably for the OCSP check, it would be skipped immediately). But when packets are silently dropped, it's up to the client to decide how long to wait for an ACK, which might cause a hang.

I've seen an identical problem where Chrome would hang for minutes when loading sites, and it was because I was in a firewalled environment that was outright dropping packets to Chrome's OCSP server.

Re: macOS unable to open any non-Apple application

#879

Post by binarycodedhex »

areoform wrote: post #533
submeta wrote: post #2

Unbelievable. When I read the tweet (tried to post here as well), I suddenly realized why my Mac was unresponsive an hour ago. Here is another tweet that describes the problem in more detail: https://mobile.twitter.com/llanga/status/1326989724704268289 > I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when `trustd` and `syspolicyd` are unable to do so,…

So yesterday I wrote about the blurring lines of ownership, and people came back with some fairly disparate responses. It's fair to say that I was mostly dismissed. https://news.ycombinator.com/item?id=25058952 And this is why I won't be moving to Apple silicon. Apple already has the ability to restrict whats apps I can run (they can simply toggle a switch for all users to "no unsigned binaries"), and congrats! Apple…

I don't think there's a one-sized-fits-all solution without something custom and extremely expensive ($15k+). Maybe a Lenovo T480 for most purposes and a dedicated second screen for color correctness? I had a Dell Studio XPS 1645 with an RGBLED screen with an insane gamut. It begs the question: Why aren't such screens widely available?
Post reply on HN