9 ms·
Apple outages affecting Mac apps, Big Sur updates, iMessage, and more
- qz2 6y agoThey really screwed this one up. Negative privacy impact, unreliable services, features lost.
- stordoff 6y agoI haven't been following this closely - what was the privacy impact?
- qz2 6y agoCert validation unencrypted (not confirmed personally but rumoured)
- tialaramex 6y agoOCSP is deliberately done with plaintext HTTP, because otherwise it's potentially infinitely recursive. To be clear: Cryptographically this is fine, the OCSP answer itself is signed, so an imposter can't show you a bogus answer (though they could potentially show you an older but not yet expired answer pretending it's the latest they have). But in privacy terms it has negative consequences. You could in principle fix this (with technologies that were invented later, like OCSP mandatory stapling) or you could use CRLs for everything. But we don't. When used as Apple apparently did, the effect of OCSP is that any certificates being examined are reported (by serial number, but you can look up the certificate itself of course) to their issuer by your machine each time it checks. This is why browsers like Chrome or Firefox do not do OCSP checks. Suppose (in a browser) you visit Porn Hub. Well it makes sense that Porn Hub know you visited, but it would probably surprise most visitors if DigiCert (the Certificate Authority which issued their certificates) were told you visited Porn Hub too. Likewise then if you're running some hypothetical porn app, the CA would be told each time on Mac OS apparently.
- qz2 6y agoThanks for the details. Nasty stuff :(
- fsflover 6y agohttps://news.ycombinator.com/item?id=25075490 https://news.ycombinator.com/item?id=25075490
- maskedinvader 6y agoWhats up with Apple's QA lately, update issues, the other issue with third party apps not working, I was really looking forward to try out the new safari (with all the promised battery life improvements). sigh
- woahAcademia 6y agoWhen does "lately" start? 2010?
- qz2 6y agoIt's a good point. Apple always had terrible QA. It just wasn't as bad as all the other vendors. The other vendors have possibly surpassed them now so it's more obvious.
- Wowfunhappy 6y agoAround 2014. I’m (quite intentionally) running OS X Mavericks, and it’s very solid. I suspect the problems stem from Apple combining their iOS and Mac divisions.
- m12k 6y agoI read somewhere that the iOS division has a culture of secrecy from the beginning, and this now permeates the whole software org, meaning that teams are more siloed, and crucial coordination and integration doesn't happen until far too close to release.
- whereistimbo 6y agoOther major cloud vendor also had outage this year.
- brown9-2 6y agoQA doesn't really help with online services having scaling issues
- 6y ago
- banachtarski 6y agoWhy do people buy chastity belts instead of phones and laptops.
- yepthatsreality 6y agoI was wondering this myself. The common criticism you’ll see in these Apple threads is that people don’t care to configure their device/software as required in Linux. Or desktop OS is rough around the edges. However anyone wanting to avoid these issues is now required to configure their Apple device. Anyone want to shift to Apple silicon will also experience a rough around the edges situation. In the previous days, Apple documentation for building on their no-config required platform is rough all around, not just the edges. People are allowed to have criticisms and be hypocritical but it’s sometimes astounding how much Apple gets away with their choices because of marketing.
- spacekitcat 6y agoLinux doesn't run the software I need it to run, so it's not fit for my purposes and Windows is someone's idea of a sick joke. I also value aesthetics and UX in a computer, Linux and Windows are actually offensive to me in those two areas. I don't feel there's an alternative for users like me and Apple know it. Edit: This news story has annoyed me, I think Apple have crossed the line, but I need to buy a new personal computer in March and a MacBook seems to be my only option.
- vulcan01 6y ago> Linux doesn't run the software I need it to run Fair enough. Lots of software either doesn't exist for Linux or doesn't run well. Also, I don't want to have to deal with all the smaller bugs that exist on Linux. At least the bugs with macOS are widespread and well-documented. > I also value aesthetics and UX in a computer Yes, Windows is bad in this aspect. Have you seen r/unixporn (safe for work) though? Many of the posts look pretty good.
- spacekitcat 6y ago
- tchalla 6y agoApple Support System Status Page - https://www.apple.com/support/systemstatus/ https://www.apple.com/support/systemstatus/ > macOS Software Update - Resolved Issue Yesterday, 7:00 PM - Today, 2:15 AM Some users were affected Users may not have been able to download macOS Software Updates on Mac computers. > iMessage - Resolved Issue Yesterday, 9:00 PM - 10:47 PM Some users were affected Users may have been unable to sign in to iMessage. > FaceTime - Resolved Issue Yesterday, 9:00 PM - 10:47 PM Some users were affected Users may have been unable to sign in. > iCloud Mail - Resolved Issue Yesterday, 1:49 AM - 5:00 PM Some users were affected Users may have been unable to send or receive mail. > Maps Traffic - Resolved Outage Yesterday, 9:00 PM - 10:40 PM Some users were affected This service may have been slow or unavailable. > Maps Routing & Navigation - Resolved Outage Yesterday, 9:00 PM - 10:40 PM Some users were affected This service may have been slow or unavailable.
- macintux 6y agoRelated, extensive discussion. https://news.ycombinator.com/item?id=25074959 https://news.ycombinator.com/item?id=25074959
- cartothemax 6y agoLikely the last straw that breaks the camels back for me. * Have always had to do some mental gymnastics to rationalize the price increases for similar hardware * MacOS has slowly been more and more hostile towards my user flow * Butterfly keyboards and touchbar have made it more difficult for me to use * Lack of memory upgrades (with steep price increases) * And now we have a phoning home operation that raises privacy concerns and grinds my laptop to a halt :( Been eyeing a System76 laptop for a while... https://system76.com/laptops/galago https://system76.com/laptops/galago
- tarasmatsyk 6y agoCompletely agree with all your points here, even though I bought a 2020 pro (big sur is badass). However, every time I read comments like that I feel like someone from the System76 is monitoring HN and posting evil marketing comments :D PS. Love System76, going to order it LOL
- SkyPuncher 6y agoMac is offering one thing that I can't find elsewhere: an amazing TouchPad. I'm sure I could break away, but, right now, I'm hugely dependent on my touchpad for my workflows. * For some reason, windows cannot get scrolling working correctly on touchpads. * OSX gestures work incredibly well. I have them tied into many different actions.
- matheweis 6y agoThere is a fellow from here working on getting it right in Linux. Apparently they’ve looked into it and it seemed like the obstacles aren’t insurmountable, but the developers want to be paid. https://bill.harding.blog/2020/04/26/linux-touchpad-like-a-macbook-pro-may-2020-update/ https://bill.harding.blog/2020/04/26/linux-touchpad-like-a-m...
- no_wizard 6y agoAs they should be, one thing I want to knock System76 for here is for not doing more around making the Linux Desktop experience more seamless. Still requires a ton of fiddling. It would be worth paying for, and honestly, I think it should be Bourne by the manufacturers of linux machines, not end users.
- gwbas1c 6y agoJust a random thought: How many total hashes of applications does Gatekeeper track? It's not that hard to have a SQLite database of the 50,000+ most common hashes physically on the computer... It would be tiny. If there even are that many!
- justin_oaks 6y agoValid point. Even if Apple wants you to have the most up-to-date information for "security reasons", it would be more effective to perform continual syncing of that database to each computer. If your computer's internet is offline then Gatekeeper could use that cache of information to make decisions. The downside is that Apple wouldn't get any information about who opened which app at what time... which is arguably a privacy violation in itself. I wonder if desire for that tracking information influenced the design.
- lmilcin 6y agoYou don't even need a database. A Bloom filter would be very compact, easy to check, would not divulge any extra information and could adequately store hashes for orders of magnitude more apps.
- pdpi 6y agoA bloom filter would also have a non-zero probability to produce false positives, which I don’t think is acceptable at all.
- marricks 6y agoIt's just weird none of the high profile tech sites or social media I followed mentioned this outage? I really hoped for more of a noticeable backlash for a high possibility of change.
- badwolf 6y agoHN crowd would of course immediately notice it. Of my non-developer friends, not one person even notice any outage or issues.
- Redoubts 6y agoMy whole office noticed when the Corp backup software had an awful failure mode in this case. Zoom also kinda crapped itself.
- qz2 6y agoProbably because iMessage craps out about once a week already so users are just getting more patient with unreliability.
- tpush 6y agohttps://www.theverge.com/2020/11/12/21563092/apple-mac-apps-load-slow-big-sur-downloads-outage-down-issues https://www.theverge.com/2020/11/12/21563092/apple-mac-apps-...
- marricks 6y agoDang, I was actually checking The Verge for a story but didn't see it, perhaps it was mostly below headline stories?
- justin_oaks 6y agoIt still amazes me how companies often underestimate their server capacity at the launch of a new product. I would think they'd have a backup plan to offload some of of the load to some cloud providers like AWS, Azure, or Google Cloud.
- martimarkov 6y agoI really think it was a CDN cache issue the macOS one. If you look at the installer download you’d see it is served by Akamai
- justin_oaks 6y agoFair enough. I don't imagine there are capacity problems at Akamai.
- benlumen 6y agoI'm probably stating the obvious, but I think it's always worth keeping in mind that these software verification systems, both on Windows and now MacOS, are not for us. Ten years ago, I was constantly getting laptops dropped off at my house from friends and family who'd picked up some virus and needed a clean install. That doesn't happen anymore, and it's not because they're no longer using laptops - they are. It's thanks to these security systems. And yes, there are privacy implications. But for most people, you'd have to compare those to the privacy implications of having some virus sweeping your hard drive. If you're the sort of person who reads Hacker News you can probably spot a fake program or dodgy link in e-mail a mile off. But if you're not interested enough to care enough to know the difference, there's no free lunch on the privacy issue.
- _ph_ 6y agoI agree and actually are happy about security facilities on my computer. The question is, whether the way Apple implemented this is the right way. Except for launching a program the very first time on a computer, the security check shouldn't block program execution. The check should run asynchronously. Especially, as it seems to be fine to start any program, when your computer is off the network. Also, the system could be reacting better detecting that the Apple server is unresponsive. If a certain number of requests didn't answer in a timeout of a few seconds, it should not lock up but treat the server as not reachable.
- caycep 6y agocould these be done on-device, esp since they built in all that Secure Enclave crytographic stuff, vs in the cloud? At least partially? I mean having it phone home to the authentication server every time seems laborious vs. say, downloading a set of definitions every night that gets checked against some hash in the Secure Enclave or something.
- Spivak 6y agoYou don't really need the secure enclave for this since it's the kernel doing the enforcement. I'm sure Apple considered syncing, since it's hard to implement something and not even glance at the other solutions on the market. My guess is * They expect the database to be too large to practically fit on every device. If this is really going to be literally every program or script ever run on macOS then that's gonna be huge. * They don't want to deal with "virus definitions out of date" issues or "please update your AV" in response to an incident. * They want to be able to revoke a malicious program immediately and not worry about cache expirations which is why the cache is only used when it's really really offline.
- xenadu02 6y agoThis was a bug exacerbated by a server-side misconfiguration. GateKeeper notarization checks already "fail open" by allowing the launch if something goes wrong. Unfortunately a bug in certificate revocation checks caused excessive delays when the server fails to respond so unlike notarization checks this didn't "fail open" as intended.