19 ms·

You've got to be kidding me. When Apple's servers are down, all Macs worldwide start freezing randomly? My XCode is hanging during builds, is this why? This co

You've got to be kidding me. When Apple's servers are down, all Macs worldwide start freezing randomly? My XCode is hanging during builds, is this why? This code signing enforcement stuff has gone way too far. Heads should roll for this.

augustl 6y ago
That's correct. AFAIK Catalina will check online for everything, even binaries you compile yourself.
- Aperocky 6y ago
  wait what, how?
  - szhu 6y ago
    https://news.ycombinator.com/item?id=23281564 https://news.ycombinator.com/item?id=23281564
    - jrochkind1 6y ago
      The behavior documented there is on FIRST run of a new executable. You can like that behavior or find it unacceptable, but the issue in OP is not that, it was applying to executables that had already been launched plenty of times on the machine.
      - SolarUpNote 6y ago
        [deleted]
        jrochkind1 6y ago
        Right. The recent problem (in top-level OP, and that you were presumably experiencing) was not just first run, but the behavior explained at the GP link (https://news.ycombinator.com/item?id=23281564 https://news.ycombinator.com/item?id=23281564 , HN thread for https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm...) is just about first-run, so the behavior explained at the GP link is not sufficient explanation for the recent problem, it's not talking about the same thing.
- robocat 6y ago
  Microsoft Windows also uploads your private exe’s, and then runs them on Microsoft servers: https://medium.com/sensorfu/how-my-application-ran-away-and-called-home-from-redmond-de7af081100d https://medium.com/sensorfu/how-my-application-ran-away-and-...
  - p410n3 6y ago
    Holy Shit. That should be illegal. All it needs is one rogue employee to potentially steal trade secrets? And dont tell me MS employees never go rogue after the recent events...
    - iso1631 6y ago
      Surely it's against copyright law
      - isakkeyten 6y ago
        A law is only dealing with the consequences, it's not prevention.
      - nordsieck 6y ago
        > Surely it's against copyright law It almost certainly is, but 1. You have to know it's happening before you can do anything about it 2. If your "work" isn't registered with the copyright office, you're limited to actual damages, which are probably close to $0
  - phendrenad2 6y ago
    TL;DR: It's an option that can be disabled, unlike on Mac. Also doesn't lock up your PC if Apple's network is having a bad day.
  - mensetmanusman 6y ago
    Is this how we look for the next Stuxnet?
twoodfin 6y ago
Almost certainly so. Apple has built chains of certificate trust very deep into the OS, along with apparently an assumption that this particular revocation service check is reliable & fast enough to call out to the network a lot.
- Aperocky 6y ago
  Oh man, imagining a DDOS to fail that over. Imagine how many people would lost their productiveness, maybe not at the big corps or govt (I assume they use a version of mac that call somewhere else/don't). But very very many people.
  - notnap 6y ago
    Today I was late to join a corporate conference call. It took like 5 mins to start conferencing software. First time ever I'm genuinely frustrated with apple - macs are not those unicorn tools anymore that work reliable
  - octoberfranklin 6y ago
    > Oh man, imagining a DDOS to fail that over. That might be what we just saw happen.
  - pfortuny 6y ago
    SelfDDOS. The first ever.
p1necone 6y ago
Wait what happens if you don't have an internet connection? Can Macs not be used offline any more, surely that's still a relatively common use case for a laptop even today in a lot of places?
- josephcsible 6y ago
  My understanding is that if you're offline, it skips this check and everything works fine. The reason this is a big deal is that the problem's on their end, so you're not offline, so it keeps trying and waiting instead of just letting you skip the check.
  - Spivak 6y ago
    Unfortunately there’s not a way to differentiate “we’re online but Apple’s servers are having issues — probably fine” and “we’re online and something something is preventing us from talking to them — something nefarious might be happening.”
    - alistairSH 6y ago
      Local copy of whatever Apple is checking? Update that daily (on sign on or something). Not going to catch zero day type stuff, but better than making the laptop unusable.
      - Spivak 6y ago
        I think the point is that that database is too large to store on a single machine which is why it has to be ad-hoc queried and cached. I mean it will have the signature of every program run on a Mac.
        salawat 6y ago
        Funny how DNS has that same issue, and yet, we still decentralized it to a point, even if there is some inertia going on to keep it as centralized as possible.
guac 6y ago
This seems to explain why my Mac was nearly unusable after a reboot last week. Turns out bind crashed on my firewall leaving me with no DNS. After I restarted it I could actually launch apps other than terminal again.
grezql 6y ago
"Heads should roll for this" - careful with the language. Nowadays you may get banned for preaching "beheading".
- craftinator 6y ago
  There's a non-zero chance that this bug has caused at least one death.
  - philistine 6y ago
    Scary, but most likely true.
- cyberlurker 6y ago
  Are you referring to Steve Bannon who said Dr. Fauci should be beheaded? Or something else?
dschuetz 6y ago
You need to set up your own DNS caching resolver and start selectively filtering out Apple domains. Pihole does that wonderfully. Ask your Apple geniuses whether they would help you setting it to make your Macs work.
grishka 6y ago
Code signing is an okay thing as long as the signing identities don't get discriminated. Android has had code signing ever since it was released, but you always generated the certificate yourself, and the purpose was simply to stop someone else from making an apk with the same package id that would install over yours and gain access to its data. The thing Apple does, on the other hand, with trusting themselves more than the user, is disgusting. I'm mostly libertarian, but if I ever become a president, this would be one of the first things I'd make illegal, right after shortening the copyright term to like 3 years.
- iso1631 6y ago
  Give me, the owner of the computer, over the keystore for the root certificates I trust, and code signing is great. > I'm mostly libertarian, but if I ever become a president, this would be one of the first things I'd make illegal, right after shortening the copyright term to like 3 years. As a libertarian I can see the argument for getting rid of presumptive copyright (and tanking the US economy), but the government preventing people from entering into contracts that you don't like? That's just hypocritical.
  - grishka 6y ago
    > but the government preventing people from entering into contracts that you don't like? It's not that. Plain and simple: in an ideal world, more money shouldn't grant more power and immunity. Governments should disincentivize this growth into the sky by, for example, progressive taxation for companies. The world would be a better place if tech companies actually competed with each other by making better products, not trying their damnest to lock everyone into their walled gardens to earn even more money they have no clue what to do with. Currently, when choosing something like a computer or a phone, you just pick one that sucks the least. There's no healthy competition.
    - iso1631 6y ago
      That does not sound like a libertarian view at all.

augustl 6y ago

That's correct. AFAIK Catalina will check online for everything, even binaries you compile yourself.

Aperocky 6y ago
wait what, how?
- szhu 6y ago
  https://news.ycombinator.com/item?id=23281564 https://news.ycombinator.com/item?id=23281564
  - jrochkind1 6y ago
    The behavior documented there is on FIRST run of a new executable. You can like that behavior or find it unacceptable, but the issue in OP is not that, it was applying to executables that had already been launched plenty of times on the machine.
    - SolarUpNote 6y ago
      [deleted]
      - jrochkind1 6y ago
        Right. The recent problem (in top-level OP, and that you were presumably experiencing) was not just first run, but the behavior explained at the GP link (https://news.ycombinator.com/item?id=23281564 https://news.ycombinator.com/item?id=23281564 , HN thread for https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm...) is just about first-run, so the behavior explained at the GP link is not sufficient explanation for the recent problem, it's not talking about the same thing.
robocat 6y ago
Microsoft Windows also uploads your private exe’s, and then runs them on Microsoft servers: https://medium.com/sensorfu/how-my-application-ran-away-and-called-home-from-redmond-de7af081100d https://medium.com/sensorfu/how-my-application-ran-away-and-...
- p410n3 6y ago
  Holy Shit. That should be illegal. All it needs is one rogue employee to potentially steal trade secrets? And dont tell me MS employees never go rogue after the recent events...
  - iso1631 6y ago
    Surely it's against copyright law
    - isakkeyten 6y ago
      A law is only dealing with the consequences, it's not prevention.
    - nordsieck 6y ago
      > Surely it's against copyright law It almost certainly is, but 1. You have to know it's happening before you can do anything about it 2. If your "work" isn't registered with the copyright office, you're limited to actual damages, which are probably close to $0
- phendrenad2 6y ago
  TL;DR: It's an option that can be disabled, unlike on Mac. Also doesn't lock up your PC if Apple's network is having a bad day.
- mensetmanusman 6y ago
  Is this how we look for the next Stuxnet?

twoodfin 6y ago

Almost certainly so. Apple has built chains of certificate trust very deep into the OS, along with apparently an assumption that this particular revocation service check is reliable & fast enough to call out to the network a lot.

Aperocky 6y ago
Oh man, imagining a DDOS to fail that over. Imagine how many people would lost their productiveness, maybe not at the big corps or govt (I assume they use a version of mac that call somewhere else/don't). But very very many people.
- notnap 6y ago
  Today I was late to join a corporate conference call. It took like 5 mins to start conferencing software. First time ever I'm genuinely frustrated with apple - macs are not those unicorn tools anymore that work reliable
- octoberfranklin 6y ago
  > Oh man, imagining a DDOS to fail that over. That might be what we just saw happen.
- pfortuny 6y ago
  SelfDDOS. The first ever.

p1necone 6y ago

Wait what happens if you don't have an internet connection? Can Macs not be used offline any more, surely that's still a relatively common use case for a laptop even today in a lot of places?

josephcsible 6y ago
My understanding is that if you're offline, it skips this check and everything works fine. The reason this is a big deal is that the problem's on their end, so you're not offline, so it keeps trying and waiting instead of just letting you skip the check.
- Spivak 6y ago
  Unfortunately there’s not a way to differentiate “we’re online but Apple’s servers are having issues — probably fine” and “we’re online and something something is preventing us from talking to them — something nefarious might be happening.”
  - alistairSH 6y ago
    Local copy of whatever Apple is checking? Update that daily (on sign on or something). Not going to catch zero day type stuff, but better than making the laptop unusable.
    - Spivak 6y ago
      I think the point is that that database is too large to store on a single machine which is why it has to be ad-hoc queried and cached. I mean it will have the signature of every program run on a Mac.
      - salawat 6y ago
        Funny how DNS has that same issue, and yet, we still decentralized it to a point, even if there is some inertia going on to keep it as centralized as possible.

guac 6y ago

This seems to explain why my Mac was nearly unusable after a reboot last week. Turns out bind crashed on my firewall leaving me with no DNS. After I restarted it I could actually launch apps other than terminal again.

grezql 6y ago

"Heads should roll for this" - careful with the language. Nowadays you may get banned for preaching "beheading".

craftinator 6y ago
There's a non-zero chance that this bug has caused at least one death.
- philistine 6y ago
  Scary, but most likely true.
cyberlurker 6y ago
Are you referring to Steve Bannon who said Dr. Fauci should be beheaded? Or something else?

dschuetz 6y ago

You need to set up your own DNS caching resolver and start selectively filtering out Apple domains. Pihole does that wonderfully. Ask your Apple geniuses whether they would help you setting it to make your Macs work.

grishka 6y ago

Code signing is an okay thing as long as the signing identities don't get discriminated. Android has had code signing ever since it was released, but you always generated the certificate yourself, and the purpose was simply to stop someone else from making an apk with the same package id that would install over yours and gain access to its data. The thing Apple does, on the other hand, with trusting themselves more than the user, is disgusting. I'm mostly libertarian, but if I ever become a president, this would be one of the first things I'd make illegal, right after shortening the copyright term to like 3 years.

iso1631 6y ago
Give me, the owner of the computer, over the keystore for the root certificates I trust, and code signing is great. > I'm mostly libertarian, but if I ever become a president, this would be one of the first things I'd make illegal, right after shortening the copyright term to like 3 years. As a libertarian I can see the argument for getting rid of presumptive copyright (and tanking the US economy), but the government preventing people from entering into contracts that you don't like? That's just hypocritical.
- grishka 6y ago
  > but the government preventing people from entering into contracts that you don't like? It's not that. Plain and simple: in an ideal world, more money shouldn't grant more power and immunity. Governments should disincentivize this growth into the sky by, for example, progressive taxation for companies. The world would be a better place if tech companies actually competed with each other by making better products, not trying their damnest to lock everyone into their walled gardens to earn even more money they have no clue what to do with. Currently, when choosing something like a computer or a phone, you just pick one that sucks the least. There's no healthy competition.
  - iso1631 6y ago
    That does not sound like a libertarian view at all.