macOS has checked app signatures online for over 2 years
eclecticlight.co
macOS has checked app signatures online for over 2 years
1–10 of 458 posts
Re: macOS has checked app signatures online for over 2 years
#2A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible.
A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometimes they do, sometimes they don't.
Parts of the US Governments unlawful massive domestic surveillance apparatus were described in the open in IETF drafs and patent documents for years. But people largely didn't notice and regarded reports as conspiracy theories for a long time.
Information being available doesn't necessarily make any difference and making a difference is what matters.
Re: macOS has checked app signatures online for over 2 years
#3How does Windows check executables? I hope they don't do the same. Does it come with a master list of public keys from manufacturers to check the signature against?
How does that work for new vendors?
Re: macOS has checked app signatures online for over 2 years
#4"Privacy is not a feature".
Re: macOS has checked app signatures online for over 2 years
#5Is there any UI indication that OCSP checks have been consistently failing for some period of time?
My concern is less local malware (if something malicious has gained the privileges to filter OCSP, it's probably already game over) but rather networks filtering ocsp.apple.com (for whatever reason).
Re: macOS has checked app signatures online for over 2 years
#6How does Windows check executables? I hope they don't do the same. Does it come with a master list of public keys from manufacturers to check the signature against? How does that work for new vendors?
Microsoft SmartScreen is very similar to Apple's approach. Although I believe you can disable SmartScreen on Windows still which, afaik, you cannot do on macOS without resorting to "hacks" such as editing the hosts file to loopback the Apple OCSP server.
Re: macOS has checked app signatures online for over 2 years
#7How does Windows check executables? I hope they don't do the same. Does it come with a master list of public keys from manufacturers to check the signature against? How does that work for new vendors?
>Does it come with a master list of public keys from manufacturers to check the signature against?
That won't handle revocations.
Re: macOS has checked app signatures online for over 2 years
#8So, can you use macOS offline for extended periods of time?
Re: macOS has checked app signatures online for over 2 years
#9A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…
> The market can't act against what it can't see. Privacy loss is often irreversible.
You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. The market seems fine with it.
And I mean, at this point I could just gesture broadly at all of Facebook.
Re: macOS has checked app signatures online for over 2 years
#10How does Windows check executables? I hope they don't do the same. Does it come with a master list of public keys from manufacturers to check the signature against? How does that work for new vendors?
Microsoft SmartScreen is very similar to Apple's approach. Although I believe you can disable SmartScreen on Windows still which, afaik, you cannot do on macOS without resorting to "hacks" such as editing the hosts file to loopback the Apple OCSP server. https://en.wikipedia.org/wiki/Microsoft_SmartScreen
Good thing too because it is easy to screw up signing.
For example, even the dotnet team has trouble with it https://github.com/dotnet/core/issues/5202