3 ms·

"You have to trust Apple", it's said. But I suspect that if you actually knew how much your Apple devices were phoning home to Cupertino, you wouldn't trust App

by _qulr 6y ago

"You have to trust Apple", it's said. But I suspect that if you actually knew how much your Apple devices were phoning home to Cupertino, you wouldn't trust Apple anymore. Using Little Snitch (the kernel extension) was a real eye opener for me. Especially when I allowed Little Snitch to block all Apple processes (by disabling the built-in iCloud Services and macOS Services rule groups). This may be a good time to remind folks of my blog post where I explain how Catalina phones home when you run unsigned executables, including shell scripts! In the article I mentioned that you can prevent this with Little Snitch. But that was the LS kext. Is it even possible anymore? https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm... Let me just quote one comment from the HN discussion of that article: https://news.ycombinator.com/item?id=23278253 https://news.ycombinator.com/item?id=23278253 "Making this about speed is burying the lede. From a privacy and user-freedom perspective, it's horrifying. Don't think so? Apple now theoretically has a centralized database of every Mac user who's ever used youtube-dl. Or Tor. Or TrueCrypt." It's all too easy to dismiss the privacy violations that we're not aware of. Out of sight, out of mind.

jachee 6y ago
Apply Occam's Razor. Why would the most successful company in history—a success gained in no small part through protecting users, selling hardware and services instead of their data, and promoting and enhancing privacy as a first-class feature—do that sort of thing? What possible benefit could such a centralized database serve? How's that gonna make them more money?
- _qulr 6y ago
  I'd love to apply Occam's Razor to Apple's network connections. Those entitles should not be multiplied without necessity. That's why I use Little Snitch! Seriously though, Tim Cook has been absolutely trashing Apple's hard won reputation by relentlessly pushing (via push notifications no less) TV shows and other garbage "subscriptions" on computer buyers. It's not what I signed up for when I became a Mac user many years ago.
- strogonoff 6y ago
  That quote—“Apple now theoretically has a centralized database of every Mac user who's ever used youtube-dl.”—is somewhat misleading. Apple doesn’t get script contents, it only gets a hash. Of course, if Apple really wanted, they could maintain a DB of hashed contents of every possible version of youtube-dl script, and do their best to match it up with what users execute. However, even that far-fetched scenario falls apart the moment you wrap youtube-dl invocation in a convenience script—as only the hashed content of the script you invoke is submitted for notarization check, not every binary or script further launched by it.
  - _qulr 6y ago
    Why are scripts even getting notarization checks when scripts cannot be notarized??? We shouldn't need to tell a story about how it would be difficult for Apple to exploit data they have about us, because they simply shouldn't have this data about us. The whole "We can trust Apple with our data" line starts with a flawed assumption: that Apple should be allowed to collect data from us. False. And it's important to note that none of this data collection was ever explained or even disclosed to users. We had to discover it by reverse engineering. Extremely shady practice by Apple. It doesn't matter if the "intentions" were good. Secretly collecting data is never acceptable. And let's never forget, Apple has been actively collaborating with authoritarian governments to shut down pro-democracy activism. That's not just a theoretical possibility, it actually happened. The very possibility of Macs phoning home for every shell script would have been considered a crazy conspiracy until we discovered that's it's actually a real thing. So it's a bit ironic to suggest that Apple's exploiting this data is just a crazy conspiracy theory.
    - strogonoff 6y ago
      > And let's never forget, Apple has been actively collaborating with authoritarian governments to shut down pro-democracy activism. That's not just a theoretical possibility, it actually happened. I wonder why any time I see these claims, they’re never accompanied by anything resembling reliable evidence. > The whole "We can trust Apple with our data" line starts with a flawed assumption: that Apple should be allowed to collect data from us. Apple is free to do that, as a private entity in a free market; you on the other hand are free to vote with your wallet and your time by buying their devices and developing for their ecosystem (or not). You’re entitled to not believe that the end goal (security) is not justified or achieved by the means (notarization, Gatekeeper, etc.), but somehow you are not making that argument.
tgv 6y ago
Even for shell scripts? I'm still on Mojave, and now I've got even less appetite to upgrade.

by _qulr 6y ago

jachee 6y ago

Apply Occam's Razor. Why would the most successful company in history—a success gained in no small part through protecting users, selling hardware and services instead of their data, and promoting and enhancing privacy as a first-class feature—do that sort of thing? What possible benefit could such a centralized database serve? How's that gonna make them more money?

_qulr 6y ago
I'd love to apply Occam's Razor to Apple's network connections. Those entitles should not be multiplied without necessity. That's why I use Little Snitch! Seriously though, Tim Cook has been absolutely trashing Apple's hard won reputation by relentlessly pushing (via push notifications no less) TV shows and other garbage "subscriptions" on computer buyers. It's not what I signed up for when I became a Mac user many years ago.
strogonoff 6y ago
That quote—“Apple now theoretically has a centralized database of every Mac user who's ever used youtube-dl.”—is somewhat misleading. Apple doesn’t get script contents, it only gets a hash. Of course, if Apple really wanted, they could maintain a DB of hashed contents of every possible version of youtube-dl script, and do their best to match it up with what users execute. However, even that far-fetched scenario falls apart the moment you wrap youtube-dl invocation in a convenience script—as only the hashed content of the script you invoke is submitted for notarization check, not every binary or script further launched by it.
- _qulr 6y ago
  Why are scripts even getting notarization checks when scripts cannot be notarized??? We shouldn't need to tell a story about how it would be difficult for Apple to exploit data they have about us, because they simply shouldn't have this data about us. The whole "We can trust Apple with our data" line starts with a flawed assumption: that Apple should be allowed to collect data from us. False. And it's important to note that none of this data collection was ever explained or even disclosed to users. We had to discover it by reverse engineering. Extremely shady practice by Apple. It doesn't matter if the "intentions" were good. Secretly collecting data is never acceptable. And let's never forget, Apple has been actively collaborating with authoritarian governments to shut down pro-democracy activism. That's not just a theoretical possibility, it actually happened. The very possibility of Macs phoning home for every shell script would have been considered a crazy conspiracy until we discovered that's it's actually a real thing. So it's a bit ironic to suggest that Apple's exploiting this data is just a crazy conspiracy theory.
  - strogonoff 6y ago
    > And let's never forget, Apple has been actively collaborating with authoritarian governments to shut down pro-democracy activism. That's not just a theoretical possibility, it actually happened. I wonder why any time I see these claims, they’re never accompanied by anything resembling reliable evidence. > The whole "We can trust Apple with our data" line starts with a flawed assumption: that Apple should be allowed to collect data from us. Apple is free to do that, as a private entity in a free market; you on the other hand are free to vote with your wallet and your time by buying their devices and developing for their ecosystem (or not). You’re entitled to not believe that the end goal (security) is not justified or achieved by the means (notarization, Gatekeeper, etc.), but somehow you are not making that argument.

tgv 6y ago

Even for shell scripts? I'm still on Mojave, and now I've got even less appetite to upgrade.