4 ms·

No, that's not what he's telling you. You're getting ahead of yourself with your question. He's telling us that macOS will consult with Apple regarding the "fin

No, that's not what he's telling you. You're getting ahead of yourself with your question. He's telling us that macOS will consult with Apple regarding the "fingerprint" of an executable when you run it.

londons_explore 6y ago
But the fingerprint of photoshop is the same for everyone. If apple knows what the fingerprint of photoshop is (which they could easily find out), now they have a giant list of who installed photoshop and when, and from which IP address, and which IP location. That data would be a wet dream for some IP lawyer looking for pirate copies of software...
- daneel_w 6y ago
  I understand the privacy concern. We don't know if they store/log anything from the request, or even what it contains in itself besides the "fingerprint". I'm personally certain that Apple is not in cahoots with Big Software to put a squeeze on users in exchange for small money. It's not their business, and it's not something they are required by law to make their business.
  - ctrlcctrlv 6y ago
    > I'm personally certain that Apple is not in cahoots with Big Software to put a squeeze on users in exchange for small money Well, this is the problem people have I think - that it comes down good intentions on Apple's part, no matter how trustworthy they are deemed to be.
    - Operyl 6y ago
      With this logic you might as well not try at all. You have to trust Intel, your bios/UEFI, Apple/Microsoft, all the various builds of software closed and open source alike .. at some point you need to trust someone.
      - throwaway2048 6y ago
        how is that a justification to heap on more "required" trust into a system? Feels like somebody could flesh out this argument in terms of accidental vs necessary complexity, but in terms of how much you need to trust the other party. Few would accept the argument "This code is already very complex, why do you have a problem with doubling the complexity?" on its own merits, so why is it sensible in terms of trust?
- microtherion 6y ago
  The Photoshop binary is signed (presumably; it's been years since I last ran it), so this check would NOT be conducted. Edit: What I should have said is that the binary is signed, notarized, and the notarization stapled to it, as described here: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow?language=objc https://developer.apple.com/documentation/xcode/notarizing_m...
  - lloeki 6y ago
    The author of the article mentioned explicitly that he signed a binary, and the check still occurred.
    - tcoff91 6y ago
      Did he staple the notarization though? They are 2 separate steps.
- rmrfrmrf 6y ago
  My personal wet dream is that I can download any shady Photoshop torrent and Apple will block the ones that have trojans baked in. Given that Apple won't even open up their infrastructure to US law enforcement, I can't see them teaming up with IP lawyers anytime soon.

londons_explore 6y ago

But the fingerprint of photoshop is the same for everyone. If apple knows what the fingerprint of photoshop is (which they could easily find out), now they have a giant list of who installed photoshop and when, and from which IP address, and which IP location. That data would be a wet dream for some IP lawyer looking for pirate copies of software...

daneel_w 6y ago
I understand the privacy concern. We don't know if they store/log anything from the request, or even what it contains in itself besides the "fingerprint". I'm personally certain that Apple is not in cahoots with Big Software to put a squeeze on users in exchange for small money. It's not their business, and it's not something they are required by law to make their business.
- ctrlcctrlv 6y ago
  > I'm personally certain that Apple is not in cahoots with Big Software to put a squeeze on users in exchange for small money Well, this is the problem people have I think - that it comes down good intentions on Apple's part, no matter how trustworthy they are deemed to be.
  - Operyl 6y ago
    With this logic you might as well not try at all. You have to trust Intel, your bios/UEFI, Apple/Microsoft, all the various builds of software closed and open source alike .. at some point you need to trust someone.
    - throwaway2048 6y ago
      how is that a justification to heap on more "required" trust into a system? Feels like somebody could flesh out this argument in terms of accidental vs necessary complexity, but in terms of how much you need to trust the other party. Few would accept the argument "This code is already very complex, why do you have a problem with doubling the complexity?" on its own merits, so why is it sensible in terms of trust?
microtherion 6y ago
The Photoshop binary is signed (presumably; it's been years since I last ran it), so this check would NOT be conducted. Edit: What I should have said is that the binary is signed, notarized, and the notarization stapled to it, as described here: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow?language=objc https://developer.apple.com/documentation/xcode/notarizing_m...
- lloeki 6y ago
  The author of the article mentioned explicitly that he signed a binary, and the check still occurred.
  - tcoff91 6y ago
    Did he staple the notarization though? They are 2 separate steps.
rmrfrmrf 6y ago
My personal wet dream is that I can download any shady Photoshop torrent and Apple will block the ones that have trojans baked in. Given that Apple won't even open up their infrastructure to US law enforcement, I can't see them teaming up with IP lawyers anytime soon.