8 ms·
Maybe it's just me but the idea that my computer lets Apple (+ any LE organizations) surveil my app launches seems so much scarier than any malware.
by Lammy 6y ago
Maybe it's just me but the idea that my computer lets Apple (+ any LE organizations) surveil my app launches seems so much scarier than any malware.
- brundolf 6y agoI don't know about you, but hashes of the binaries I run don't exactly reveal any sensitive personal information about me. That said, obviously they should have much more graceful degradation in place for when something is wrong with the service.
- djsumdog 6y agoIn this case, isn't the hash of the binary consistent across all devices, so Apples can in fact derive exactly which binary you're running (assuming they have a large database of application binary and hashes)?
- ardy42 6y ago> assuming they have a large database of application binary and hashes A database like an "app store"?
- deleted 6y ago[deleted]
- refulgentis 6y agoyup! and the variety of ways to leak that information along the way...Privacy(tm)!
- brundolf 6y agoYes. My personal data involves what I do within those apps, not which ones they are.
- thelean12 6y agoThat's not even close to true. Apps that you have downloaded can reveal a massive amount of potentially personal information. Think about someone having a dating app that would out them. Or a therapy app that they don't want people to know about. And that just scratches the surface.
- valuearb 6y agoOnly if linked to personally identifiable information. Do we have any evidence this is happening?
- thelean12 6y agoThat's unrelated to my comment. I was simply responding to the astoundingly wrong claim that "My personal data involves what I do within those apps, not which ones they are."
- deleted 6y ago[deleted]
- gpm 6y agoYou are moving the goal posts. It is also trivially linked to ip address, which is usually personally identifying.
- valuearb 6y agoDo you have any proof this is happening? This is Apple we are talking about, which has the strongest privacy commitment of any device maker, and no advertising business outside of the App Store. Linking IP addresses to app certificate requests provides them zero benefit and exposes them to substantial brand damage.
- gpm 6y agoDo I have proof they have your ip address? Of course, that's how the internet works. Do I have proof that they could be ordered by a court to store it? Of course, that's how warrants work. Do I have proof they are currently storing it? No, nor was that ever the claim.
- cortesoft 6y agoIt reveals how often I am running new software, it reveals what time of day I run new software, it reveals what networks I connect from
- Lammy 6y ago"Hey Siri, select every Tor Browser user in America for additional screening."
- twistiti 6y agoThat's scary. What if you set it up inside a Virtual Machine?
- doubleunplussed 6y agoIronically, if tor was already running, the check would run over tor and not be traceable. But to start it in the first place it would be traceable. Damn.
- ben-schaaf 6y agoThe connection would run over tor, but the app you're running and any other PII could/would still be sent regardless.
- amelius 6y ago> I don't know about you, but hashes of the binaries I run don't exactly reveal any sensitive personal information about me. If they know the hash of (let's say) a pr0n app which you run, then I'd say that's pretty damn sensitive information Apple is getting.
- OkGoDoIt 6y agoWhat about the hash of a password cracking binary or the hash of some sort of binary used for piracy or stripping DRM off of something? Or just in general the ability to profile users based on the apps they use seems completely trivial. I imagine it would not take a particularly brilliant data scientist to correlate people who use FTP programs or developer programs or whatever else with people who buy high value items from certain e-commerce sites, for example. Seems like a marketer’s dream if they could ever get access to that. And sure Apple wouldn’t do that, today, on purpose, but are you 100% certain that could never happen? And if there was some way to tie that illegal piracy app binary hash to you personally and the government came knocking with a subpoena, seems like something Apple might be forced to comply with. It’s a very slippery slope.
- jlokier 6y agoI run Tor browser occasionally. That fact alone is sensitive personal information about me. It makes me stand out. Someday it might be held against me. I already expect the ISP to detect my Tor traffic. But I didn't expect Apple, of all companies, to have a detailed audit trail of every time I've ever opened it, to the nearest minute.
- sneak 6y agoDon’t forget that client IP geolocation gives coarse location, so they have your timestamped track log, too. Big Sur prevents Little Snitch from blocking these system level connections, and these OS apps will also bypass any configured VPN.
- jlokier 6y agoThe information reveals in exquisite detail what times of day I'm working, what times I'm slacking off, which days I work too. And whether I'm taking a long or short lunch break, or lots of breaks. Whether I stay in bed until late, or work late at night. It's enough to predict whether I'm a "good" worker. It also reveals whenever I travel, which coffee shops and libraries I frequent and what times of day. It also reveals what time I open any of several video conferencing apps. And the sort of thing some HR would like to browse when assessing job candidates. They wouldn't need to ask "do you know X", they could just consult the Apple log of how often I run the relevant commands. Things like "we see you ran 'git' an average of 145 times per day last month, tell us more about that". And whether I'm running tools I "shouldn't". All that seems quite sensitive and personal to me.
- brundolf 6y ago> It's enough to predict whether I'm a "good" worker. If your employer is willing to be that invasive, they already have a much easier route for getting that information: forcibly installing surveillance software on your work machine. > It also reveals whenever I travel, which coffee shops and libraries I frequent and what times of day. How...? How would the binaries you're running have anything remotely relevant to say about this? > They wouldn't need to ask "do you know X", they could just consult the Apple log of how often I run the relevant commands. Things like "we see you ran 'git' an average of 145 times per day last month, tell us more about that". That's a pretty contrived use-case for a pretty significant and unscrupulous bit of data-sharing. From a PR perspective Apple would never intentionally and publicly share this data. So assuming this data is even stored anywhere after the check is complete, and assuming any personal identification is kept with it, both of which are huge ifs, that leaves a couple of possibilities: - Hackers gain access to the data - Government subpoenas the data - Extremely lucrative contracts, probably from advertising companies, are enough to motivate Apple to sell the data despite the risk of a massive PR scandal I don't see any of those falling under your proposed scenario of random employers casually perusing the logs.
- jlokier 6y ago> If your employer is willing to be that invasive, they already have a much easier route for getting that information: forcibly installing surveillance software on your work machine. The question was whether the information gathered is personal and sensitive. The fact there is another way it could be gathered doesn't make the information less personal or sensitive. > How...? How would the binaries you're running have anything remotely relevant to say about this? Because your temporary IP address is part of the hash request, and that's usually enough to identify which major organisation's network you are on, not counting any geolocation. Thus, coffee shop (which brand), library (government network), home or mobile, at least. I expect the websites and services I'm using to have this when I'm using them. That's reasonable, I'm reaching out to them. Apple itself is not a service I'm using constantly, so I don't expect it to be sent a minute-by-minute update of my movements whenever I'm doing work in a CLI, and happen to have wifi on. (I don't use iCloud, btw. Perhaps people using iCloud expect activity to be streamed constantly.) > From a PR perspective Apple would never intentionally and publicly share this data. Again, the question was whether the information is personal and sensitive. That's a property of the information itself. Not whether Apple intends to store it and share it.
- marcolussetti 6y agoI think that for some users, the applications they run and the frequency they run them at would be enough to identify them across time and accounts. I could change my identifier, even my name, but at the end of the day, I've been using the same apps for at least a decade more or less.
- eslaught 6y agoIs this the one-time signature checking that has been in place since Catalina, or is this something else? (And if so is there any information about it?)
- cdubzzz 6y agoI experienced the issue with Mojave while this was happening. So not just Catalina.
- eslaught 6y agoOk, but this doesn't answer the question. If this is the same behavior since Mojave, why aren't those users complaining about this outage on their Mojave and Catalina based system? Presumably something changed, but so far I haven't heard an explanation that makes sense of it.
- pfortuny 6y agoBecause you do not notice until they f*ck up like this.
- robotfelix 6y agoAccording to statcounter.com [1] there are over 4x as many Catalina users as there are Mojave users (62% vs 14% of MacOS users), so I think it's just that the people complaining about Catalina are louder. Anecdotally, I'm using Mojave and experienced this issue, a person I was trying to have a Zoom call with was experiencing the same issue on their Mojave. I think there are enough comments scattered across Hacker News to safely conclude that it affected Mojave too - although it's possible the timeout behaviour / error handling is different to Catalina. [1] https://gs.statcounter.com/macos-version-market-share/desktop/worldwide https://gs.statcounter.com/macos-version-market-share/deskto...
- dclowd9901 6y agoHas anyone confirmed if this outside the error-reporting agreement step?
- romanovcode 6y agoThis has happened since forever on Mac, Windows and Ubuntu.
- jchw 6y agoNo it has not.
- mehrdadn 6y agoI'm fairly sure Windows does upload at least some hashes if you have it enabled in Windows Defender (which it is by default). Don't expect Ubuntu does this though.
- jchw 6y agoYeah, Windows Defender does worse if you let it have sample submission on. It'll send binaries to Microsoft and they will run in Azure! https://medium.com/sensorfu/how-my-application-ran-away-and-called-home-from-redmond-de7af081100d https://medium.com/sensorfu/how-my-application-ran-away-and-... That said, "this has happened forever" is false too. These behaviors are relatively new and relatively under the radar. Many people don't know they exist to get upset about it.
- romanovcode 6y ago> Don't expect Ubuntu does this though. Ubuntu uploads (at least it did couple years ago) your data to Amazon. https://www.gnu.org/philosophy/ubuntu-spyware.en.html https://www.gnu.org/philosophy/ubuntu-spyware.en.html
- bkovacev 6y agoCan you please provide resources for Ubuntu?
- deadbunny 6y agoI would guess they are referencing the Ubuntu Amazon search thing from about 5 years ago (IIRC)
- valuearb 6y agoWhy is it scary that your computer checks for malware? It’s not like Apple us building a database of apps you’ve launched linked to your address and social security number.
- TameAntelope 6y agoI don't know they're not doing that, is the problem. They probably aren't, but as Bill Kristol offered recently, 99% sure isn't 100% sure, and the fact that I'm not 100% sure is a problem unto itself.
- mtnygard 6y agoI can't tell if you're being sarcastic or serious. Schrodinger's sarcasm.
- saagarjha 6y agoPoe's law.
- goatinaboat 6y agoIt’s not like Apple us building a database of apps you’ve launched linked to your address and social security number. Linked to your identity if you have a credit card saved for say iTunes.
- valuearb 6y agoAny proof of that audacious claim?
- reificator 6y agoIn the modern age isn't the audacious claim that they're not?
- tshaddox 6y agoNo. Apple has a history of being extremely careful with personal data, and almost always goes out of its way to make sure it never even collects anything personalized. Of course, those could all be lies, I suppose.
- thrwwy90876 6y agoIf you haven't downloaded your data from Apple recently I suggest doing that. The amount of personal info they collect has exploded over the last couple years. Their Services business is moving them into Google levels of data collection.
- Lammy 6y ago> The amount of personal info they collect has exploded over the last couple years. Since maybe 2016-ish? https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute
- e_proxus 6y agoFor anyone who wants to do this, you can do it here (at least if you are in the EU): http://privacy.apple.com/ http://privacy.apple.com/
- st1x7 6y agoHaving downloaded my data from both Apple and Google, "Google levels of data collection" seems inaccurate.