104 ms·

The wonderful news is that Ventura implements the checks at every run, not only when the file changes, see: https://eclecticlight.co/2022/06/17/app-security-cha

The wonderful news is that Ventura implements the checks at every run, not only when the file changes, see: https://eclecticlight.co/2022/06/17/app-security-changes-coming-in-ventura/ https://eclecticlight.co/2022/06/17/app-security-changes-com... Those interested to block the check should look at this list : https://support.apple.com/en-us/HT210060 https://support.apple.com/en-us/HT210060 and block the IPs associated with notarization. It is possible to do that with pf, which is integrated in macOS but it should be done after every update since the pf.conf file will get overwritten.

sph 4y ago
Why is a file checked every run? A binary of hash X still has the same instructions as yesterday, if the hash is unchanged.
- Someone 4y ago
  The only sure way to know the hash didn’t change is by recomputing it. File modification dates can be faked.
  - sph 4y ago
    With control over the whole stack like Apple has, it might be easier to just store a bit on the file system level after checking a binary, and if the file is modified, to reset it. But I guess with how fast computers and storage is today, it's probably easier to recompute the hash every run. My desktop can do SHA-512 at 1 GB/s (`openssl speed sha512`), which is fast enough to be imperceptible for 99% of binaries. Anyway, I thought OP meant Ventura sends the hash to Apple's server every run. That would be far too expensive to be reasonable.
    - solarkraft 4y ago
      They do have a "quarantine bit" that prevents unsigned binaries downloaded from the internet (?) from running.
    - Someone 4y ago
      Any slowdown wouldn’t be due to CPU speed, but to disk speed. To compute the checksum you have to read the entire executable, but to execute it, you only have to map the parts that are needed at startup into memory. That, I think, is the reason Apple didn’t do this at every process launch before: their OS supported (too many) systems that booted from a spinning disk.
- kevincox 4y ago
  But their server-side list of malware is always growing. So it could be valuable to recheck that list. I'm not sure how valuable, but it does have minor upsides. Of course: 1. If you have run it in the past aren't you already screwed? Maybe this can effectively "disarm" otherwise entrenched malware? 2. Could they track the list of signatures that you have asked about in the past $timeframe and your system can frequently check for newly flagged signatures? This would allow longer caching without high delay until new blocks take effect. (Similar to moving from OCSP to CRLs)
lapcat 4y ago
This doesn't actually imply that it's running an online notarization check on every launch. An offline signature check is different.

sph 4y ago

Why is a file checked every run? A binary of hash X still has the same instructions as yesterday, if the hash is unchanged.

Someone 4y ago
The only sure way to know the hash didn’t change is by recomputing it. File modification dates can be faked.
- sph 4y ago
  With control over the whole stack like Apple has, it might be easier to just store a bit on the file system level after checking a binary, and if the file is modified, to reset it. But I guess with how fast computers and storage is today, it's probably easier to recompute the hash every run. My desktop can do SHA-512 at 1 GB/s (`openssl speed sha512`), which is fast enough to be imperceptible for 99% of binaries. Anyway, I thought OP meant Ventura sends the hash to Apple's server every run. That would be far too expensive to be reasonable.
  - solarkraft 4y ago
    They do have a "quarantine bit" that prevents unsigned binaries downloaded from the internet (?) from running.
  - Someone 4y ago
    Any slowdown wouldn’t be due to CPU speed, but to disk speed. To compute the checksum you have to read the entire executable, but to execute it, you only have to map the parts that are needed at startup into memory. That, I think, is the reason Apple didn’t do this at every process launch before: their OS supported (too many) systems that booted from a spinning disk.
kevincox 4y ago
But their server-side list of malware is always growing. So it could be valuable to recheck that list. I'm not sure how valuable, but it does have minor upsides. Of course: 1. If you have run it in the past aren't you already screwed? Maybe this can effectively "disarm" otherwise entrenched malware? 2. Could they track the list of signatures that you have asked about in the past $timeframe and your system can frequently check for newly flagged signatures? This would allow longer caching without high delay until new blocks take effect. (Similar to moving from OCSP to CRLs)

lapcat 4y ago

This doesn't actually imply that it's running an online notarization check on every launch. An offline signature check is different.