4 ms·

Proxy macOS and notice that it phones home almost every moment you’re using it, including details like which programs you’re executing.

traceroute66 4y ago
Sorry but that smells like pure FUD to me. Apple sending details every moment about what programs you're using ? Pull the other one !
- dep_b 4y ago
  Might have to do with notarization. Notarized apps are checked against an Apple API every time they're launched if I'm correct.
- hobs 4y ago
  You need to read the news, this was a big deal that was widely reported when it was enabled (for supposedly security purposes.)
  - traceroute66 4y ago
    I don't read Apple bashing news sources which frankly smells like where this FUD originated. I'm not going to name names, but I think we all know there are one or two very well-known IT news sites that hold a grudge against Apple due to stupid reasons. Any time they publish anything about Apple its barely disguised Apple bashing.
    - smoldesu 4y ago
      Whether or not you choose to believe it, this is a documented feature of MacOS and one that even Apple supporters will acknowledge as a serious concern: https://eclecticlight.co/2021/08/12/is-apple-keeping-its-promises-over-online-ocsp-certificate-checks/ https://eclecticlight.co/2021/08/12/is-apple-keeping-its-pro...
- user3939382 4y ago
  You can install programs like mitmproxy (CLI) or Charles Proxy (GUI) and have a look for yourself. Apple claims they need this information to protect you from malware. Meanwhile, IMHO, using the strategy they have, they are the malware.
simonh 4y ago
That's part of the malware and privacy protection system, checking the developer certificates and fingerprints of the application binaries. For most applications it only does this once on first launch then 'staples' the notarization to the binary so it doesn't have to do it again, and so that the system still works when offline. You can disable it.
- jve 4y ago
  Nice that you bring it up as it actually makes system more secure than less secure. MS Windows Defender also has extensive cloud protection enabled: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defe... Which of course can be disabled. CLR check can also be disabled on windows if someone wants less requests from hosts and could be harmless for some specific configurations.
  - 57FkMytWjyFu 4y ago
    Spoken like someone that's never actually tried to disable Defender.
    - jve 4y ago
      Yes, at our org we actually roll out/enable protections step-by-step and monitor the impact. We are conservative on cloud dependencies, but Defender Cloud protection components is only one of the very few we opt-in. Obviously it's just one tool in a toolbox, but under that umbrella there are very much protections that are very useful. Tip of the day: Did you know that there are Attack surface reduction rules that can be enabled to, for example "Block Office communication application from creating child processes" https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defe... ? :)
      - 57FkMytWjyFu 4y ago

traceroute66 4y ago

Sorry but that smells like pure FUD to me. Apple sending details every moment about what programs you're using ? Pull the other one !

dep_b 4y ago
Might have to do with notarization. Notarized apps are checked against an Apple API every time they're launched if I'm correct.
hobs 4y ago
You need to read the news, this was a big deal that was widely reported when it was enabled (for supposedly security purposes.)
- traceroute66 4y ago
  I don't read Apple bashing news sources which frankly smells like where this FUD originated. I'm not going to name names, but I think we all know there are one or two very well-known IT news sites that hold a grudge against Apple due to stupid reasons. Any time they publish anything about Apple its barely disguised Apple bashing.
  - smoldesu 4y ago
    Whether or not you choose to believe it, this is a documented feature of MacOS and one that even Apple supporters will acknowledge as a serious concern: https://eclecticlight.co/2021/08/12/is-apple-keeping-its-promises-over-online-ocsp-certificate-checks/ https://eclecticlight.co/2021/08/12/is-apple-keeping-its-pro...
user3939382 4y ago
You can install programs like mitmproxy (CLI) or Charles Proxy (GUI) and have a look for yourself. Apple claims they need this information to protect you from malware. Meanwhile, IMHO, using the strategy they have, they are the malware.

simonh 4y ago

That's part of the malware and privacy protection system, checking the developer certificates and fingerprints of the application binaries. For most applications it only does this once on first launch then 'staples' the notarization to the binary so it doesn't have to do it again, and so that the system still works when offline. You can disable it.

jve 4y ago
Nice that you bring it up as it actually makes system more secure than less secure. MS Windows Defender also has extensive cloud protection enabled: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defe... Which of course can be disabled. CLR check can also be disabled on windows if someone wants less requests from hosts and could be harmless for some specific configurations.
- 57FkMytWjyFu 4y ago
  Spoken like someone that's never actually tried to disable Defender.
  - jve 4y ago
    Yes, at our org we actually roll out/enable protections step-by-step and monitor the impact. We are conservative on cloud dependencies, but Defender Cloud protection components is only one of the very few we opt-in. Obviously it's just one tool in a toolbox, but under that umbrella there are very much protections that are very useful. Tip of the day: Did you know that there are Attack surface reduction rules that can be enabled to, for example "Block Office communication application from creating child processes" https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/security/defe... ? :)
    - 57FkMytWjyFu 4y ago