5 ms·

Now if they would just address the more serious issue that allows them to evade network restrictions and VPNs.

m463 6y ago
Seriously, why do they have to collect ANYTHING without opt-in? People pay them for hardware, their revenue stream has a different source than facebook or google. I think it's fear (useful telemetry) or greed (valuable telemetry) or vanity (look how many people launch x). Really, just do it. So some customers shoot themselves in the foot. That is how they learn. Others who are perfectly capable of managing things will also be happy with actual privacy. That is how trust is built up, and with trust comes unfettered trade. Right now power users are alienated, regular customers feel deceived and apple could just do better.
- aemreunal 6y ago
  While I'm a fan of having a choice (as I consider myself a "power user"), I do think Apple is making the right decision in making certain things (like this OCSP check) default-on. It is true that the overwhelming majority of Apple users won't ever know enough of the technical details to make an informed decision about this, nor should they need to know. Where Apple went wrong, IMHO, is: 1) not giving people a way to opt out (not just for OCSP, but so many power user-hostile decisions they're making recently), and 2) programming it in a poor way where slow responses ground the machine to a halt (it did mine in the middle of the work day, stopping my work completely for 30-45 minutes). I don't think malice (i.e. greed) was involved in how this whole thing turned out. As Hanlon's Razor states: Never attribute to malice that which is adequately explained by incompetence.
  - sneak 6y ago
    They also did wrong by not encrypting the connection, and by not doing it in a privacy-preserving way like with a bloom filter precheck. This is a company that has world class cryptosystem designers on staff, remember. They know how to pcap a fresh install before the GM goes out the door to see if it’s still speaking plain HTTP like OSes did in the years back before we ever heard the name Ed Snowden. Cut them some slack, but not an infinite amount. They can and should well know better, and pledging to delete the logs, encrypt it, and add a knob to turn it off is as close to a “we fucked up” as you’ll ever get from them. I appreciate their response.
- lawnchair_larry 6y ago
  They aren’t collecting anything. This isn’t a telemetry feature. It’s more like antivirus. Before it lets an app run, it queries an online blocklist. Apple uses this to immediately shut down attacks on their customers. People who have been hit by ransomware and lose their entire digital life really do appreciate features like this. Apple has a different, unrelated telemetry feature that is clearly labeled.

m463 6y ago

Seriously, why do they have to collect ANYTHING without opt-in? People pay them for hardware, their revenue stream has a different source than facebook or google. I think it's fear (useful telemetry) or greed (valuable telemetry) or vanity (look how many people launch x). Really, just do it. So some customers shoot themselves in the foot. That is how they learn. Others who are perfectly capable of managing things will also be happy with actual privacy. That is how trust is built up, and with trust comes unfettered trade. Right now power users are alienated, regular customers feel deceived and apple could just do better.

aemreunal 6y ago
While I'm a fan of having a choice (as I consider myself a "power user"), I do think Apple is making the right decision in making certain things (like this OCSP check) default-on. It is true that the overwhelming majority of Apple users won't ever know enough of the technical details to make an informed decision about this, nor should they need to know. Where Apple went wrong, IMHO, is: 1) not giving people a way to opt out (not just for OCSP, but so many power user-hostile decisions they're making recently), and 2) programming it in a poor way where slow responses ground the machine to a halt (it did mine in the middle of the work day, stopping my work completely for 30-45 minutes). I don't think malice (i.e. greed) was involved in how this whole thing turned out. As Hanlon's Razor states: Never attribute to malice that which is adequately explained by incompetence.
- sneak 6y ago
  They also did wrong by not encrypting the connection, and by not doing it in a privacy-preserving way like with a bloom filter precheck. This is a company that has world class cryptosystem designers on staff, remember. They know how to pcap a fresh install before the GM goes out the door to see if it’s still speaking plain HTTP like OSes did in the years back before we ever heard the name Ed Snowden. Cut them some slack, but not an infinite amount. They can and should well know better, and pledging to delete the logs, encrypt it, and add a knob to turn it off is as close to a “we fucked up” as you’ll ever get from them. I appreciate their response.
lawnchair_larry 6y ago
They aren’t collecting anything. This isn’t a telemetry feature. It’s more like antivirus. Before it lets an app run, it queries an online blocklist. Apple uses this to immediately shut down attacks on their customers. People who have been hit by ransomware and lose their entire digital life really do appreciate features like this. Apple has a different, unrelated telemetry feature that is clearly labeled.