6 ms·
One of the hallmarks of Apple news and commentary is how whenever Apple merely announces it will do something, Apple is treated like it already did it, while ex
by yyyk 6y ago
One of the hallmarks of Apple news and commentary is how whenever Apple merely announces it will do something, Apple is treated like it already did it, while exactly matching its own promises.
The current headline* hints Apple has already made changes, while the article only says Apple 'plans' on making changes over the next year. Any other company would have been torn to shreds on HN if it kept sending cleartext logs and merely 'planned' to sometime patch this out.
The plan is odd too - why does Apple need 'a new encrypted protocol for Developer ID certificate revocation checks' when existing encryption protocols can do this?
* "Apple Addresses Privacy Concerns Surrounding App Authentication in macOS"
- mosselman 6y agoI am not saying it isn’t true what you are saying, but do you have links to the companies that were collectively ‘torn to shreds’ over similar issues? I have seen this argument a few times now without any references. Were, for instance, Microsoft or Amazon torn to shreds over similar claims?
- yyyk 6y agoThink MS telemetry which AFAIK is encrypted and less invasive than the current Apple solution.
- Veen 6y agoAccording to my dictionary, "addresses" means: > think about and begin to deal with (an issue or problem) It doesn't imply that the solution has been fully implemented.
- yyyk 6y agoIt implies Apple has 'begun to deal' with the issue when the only thing we may have is a plan to do this sometimes in the near future. [EDIT: every definition of 'address' I've found suggests it's a synonym for 'deal with' not 'begin to deal with']
- Veen 6y ago> To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks Seems like they have begun to deal with it. [EDIT: Perhaps it's because my definition came from Apple's dictionary app /s]
- yyyk 6y agoIf you read the original thread, nobody complained Apple got his/her IP. Apple already has that IP from a thousand other vectors. The real issues (cleartext, being able to build a profile using Application data, etc.) aren't yet dealt with at all.
- jb1991 6y ago> every definition of 'address' I've found suggests it's a synonym for 'deal with' not 'begin to deal with'] And "deal with" does not mean "fix" -- the word "addresses" makes perfect sense for this headline.
- tinus_hn 6y agoOCSP is not ‘an Apple protocol’. They didn’t design it and it is typically used without encryption. Look at the certificates on sites you use, like this one. The OCSP server is http://ocsp.digicert.com http://ocsp.digicert.com . Http, so no encryption.
- totalZero 6y agoFair, but my opinion is that OCSP became 'an Apple protocol' the moment that Apple implemented it on the device that they sold to me.
- robin_reala 6y agoThat’s a weird perspective. Is HTTPS an Oracle protocol because Oracle Linux includes curl?
- totalZero 6y agoYou're telling me that you don't hold a developer responsible for the way he implements things, if he isn't the originator of the implementation?
- robin_reala 6y agoOf course, but in that case it’s more appropriate to talk about “Apple’s implementation of the standard OCSP protocol” rather than ”Apple’s protocol”.
- totalZero 6y agoI don't agree, and moreover I note that this is a purely semantic point that you are making. Apple is a major hardware manufacturer and software developer, and it seems totally appropriate to suggest that Apple is responsible for how it chooses to implement certain features. Saying "well, we just took it off the shelf" may work for a small-potatoes business, but not the largest public company in the world. Additionally, it's like the Nuremberg Defense of software. Any protocol (or tool in general) is appropriate for certain situations, and inappropriate (in this case, vulnerable) in other ones. You shouldn't suggest that others must bend over backwards semantically to try to pass the buck away from Apple, because Apple is responsible for using the protocol. Saying "Apple's protocol" indicates that Apple made the conscious choice to use that protocol, and that Apple has ownership of the consequences of using that protocol.
- jb1991 6y ago> The current headline* hints Apple has already made changes, I didn't read the headline that way at all, because the word "addresses" doesn't mean what you are suggesting it means.
- Ensorceled 6y ago> One of the hallmarks of Apple news and commentary is how whenever Apple merely announces it will do something, Apple is treated like it already did it, while exactly matching its own promises. And yet, this thread and every other Apple thread is full of comments like yours assuming negative intent. Check out other comments in this thread, you'll see comments asserting that of COURSE this feature is for harvesting or that Apple doesn't want you to own your devices any more. You comment is another critique based entirely on what they might do: that are not going to do what they promised.
- yyyk 6y agoThe point is the headline implies something more expansive than the article's content; and if some other company would promise to fix sending private data in cleartext sometimes later in the next year, HN would have a fit.
- Ensorceled 6y agoOthers have pointed out that you are misunderstanding what the word "addresses" means. If they had announced that "tough shit, we ain't changing it" that would still be addressing the issue. Addressing does not mean "fixed" or "resolved".
- ksec 6y agoThis type of PR changes after Tim Cook took over. I think the change of PR personnel and direction were to blame.