4 ms·

This page was updated yesterday to remove the following text from the final section, which was added in November 2020: In addition, over the the next year we

This page was updated yesterday to remove the following text from the final section, which was added in November 2020: In addition, over the the next year we will introduce several changes to our security checks: • A new encrypted protocol for Developer ID certificate revocation checks • Strong protections against server failure • A new preference for users to opt out of these security protections

lapcat 3y ago
> A new encrypted protocol for Developer ID certificate revocation checks Done. > Strong protections against server failure Unknown, but presumably done. > A new preference for users to opt out of these security protections Never done. Apple lied. https://lapcatsoftware.com/articles/ocsp-privacy.html https://lapcatsoftware.com/articles/ocsp-privacy.html
- saagarjha 3y ago
  I’m counting on you bringing it up the next time their service experiences downtime ;)
- paws 3y ago
  Thank you for pointing this out. The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "a preference for users to opt out of these security protections" never materialized, and the copy just disappeared from the website, is quite disappointing. Great write up here [0] - thanks @lapcat! Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since. If anyone at Apple reads this, I want to be given the choice. Warn me, stuff the setting into whatever plist -- whatever, but give me the choice. Frankly for a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - which is why, in addition to the clearly negative privacy implications, Apple should give users who care a clear opt-out. [0] https://lapcatsoftware.com/articles/ocsp.html https://lapcatsoftware.com/articles/ocsp.html

lapcat 3y ago

> A new encrypted protocol for Developer ID certificate revocation checks Done. > Strong protections against server failure Unknown, but presumably done. > A new preference for users to opt out of these security protections Never done. Apple lied. https://lapcatsoftware.com/articles/ocsp-privacy.html https://lapcatsoftware.com/articles/ocsp-privacy.html

saagarjha 3y ago
I’m counting on you bringing it up the next time their service experiences downtime ;)
paws 3y ago
Thank you for pointing this out. The macOS appocalypse was a really shocking moment -- it was so disappointing to learn that despite the privacy marketing shtick, macOS engineers chose to have Macs phone home sensitive data in an seemingly aggressive way, with no opt out. Now in 2023 the fact that "a preference for users to opt out of these security protections" never materialized, and the copy just disappeared from the website, is quite disappointing. Great write up here [0] - thanks @lapcat! Anecdata: Ever since that day I've blackholed ocsp.apple.com/ocsp2.apple.com at the DNS level, and all my Mac apps have launched just fine since. If anyone at Apple reads this, I want to be given the choice. Warn me, stuff the setting into whatever plist -- whatever, but give me the choice. Frankly for a company with Apple's resources, it's hard to believe the OCSP test suite somehow didn't consider half-open TCP connections. If a global catastrophe like that can happen once, it can happen again - which is why, in addition to the clearly negative privacy implications, Apple should give users who care a clear opt-out. [0] https://lapcatsoftware.com/articles/ocsp.html https://lapcatsoftware.com/articles/ocsp.html