6 ms·
> "Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have c
by DavideNL 6y ago
> "Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them."
A simple opt-out toggle, for privacy reasons, would be a good start... people should stay in control of their own data and be able to choose themselves whether or not they are willing to trade in their privacy (for security in this case).
- dilap 6y agoApple has said they plan to do this, and also encrypt the checking payload. Sounds good to me, though definitely a privacy failure that they didn't do this in the first place. The other thing I'd like to see is the app open immediately, w/ the check happening asynchronously in the background. (This seems like super-basic good engineering to me.) No idea if they're planning to fix that or not.
- ascagnel_ 6y ago> The other thing I'd like to see is the app open immediately, w/ the check happening asynchronously in the background. (This seems like super-basic good engineering to me.) No idea if they're planning to fix that or not. How would this work? The point of the check is to block malware from running, and opening without the check would, by definition, negate the entire system. If malware authors get wise to the async scheme, they can write programs that deliver their payload in the opening milliseconds of an app’s execution, while the network call is running (even the fastest pings would leave 1 or 2 ms worth of window).
- angry_octet 6y agoSurely this check could be done on install/first run, then cached? If you want rapid blacklisting, a frequent call to Apple to say "anything new blacklisted?" would suffice. Same as push notification.
- deleted 6y ago[deleted]
- dilap 6y agoFair question. My thinking was the system is already not designed to be failproof, just mitigitive (it turns off entirely if no internet), and that malware would be pretty limited in what it could do in just a few hundred ms. Waiting to open an app based on a network request is basically just guaranteed to give you a terrible experience some % of the time. Maybe fancier solutions like a local blacklist are needed. (Which weirdly it looks like Apple had and then moved away from?)
- originalvichy 6y agoThis is turning out to be a bit of a similar case as the iPhone battery degradation performance throttling issue. Instead of clearly messaging what they were doing to your phone, they did things behind the scenes because they knew better, and decided not to give the user the choice to run the phone at full performance.
- zepto 6y agoThe throttled performance is full performance. Without throttling the phone would simply crash.
- Bud 6y agoYou clearly need to familiarize yourself with the actual facts of this case. Also, I'm pretty sure that for 99% of users, "full performance" is not characterized by "randomly crashing due to lack of intelligent power management".
- darksaints 6y agoBut that would defeat the purpose. Apple can be thought of as the equivalent of the NSA: they "care" about your privacy in the sense that they don't want anybody but themselves to have access to it. Unfortunately we don't have an Apple competitor that cares enough about your privacy to not want anybody, including themselves, to have access to it.
- zepto 6y agoAnd yet, this claim about Apple’s intent isn’t made with a shred of evidence.
- darksaints 6y agoOh, you mean the article up at the top of the fucking page? Yeah, I didn't think it was necessary.
- zepto 6y agoThat article contains no evidence that Apple has a hidden agenda.
- darksaints 6y agoI'm sure it probably doesn't to an Apple Cultist with their head in the sand. But for those people, gesturing broadly at all of the evidence available doesn't seem to work either.
- zepto 6y agoGesturing broadly doesn’t work because it’s not evidence. It is only innuendo. If you had evidence you’d be able to be specific.
- darksaints 6y agoThere are mountains of evidence available in all corners of the internet. You should know because as one of Apple's elite True Believers, the vast majority of your HN activity is trying vigorously to handwave away any and all evidence of Apple's malfeasance. The real problem is that for someone like you, no amount of evidence is sufficient. Someone could post a video of Steve Jobs masturbating furiously to Kim Kardashian's iCloud photos folder, and you'd still find some way to spin it as him having an erotic fetish for Apple's data security and privacy practices.