3 ms·

> OSCP is the macOS antivirus It's not. There are multiple layers of security, including notarization and XProtect. > I'm pretty sure I know what the first th

by lapcat 2y ago

> OSCP is the macOS antivirus It's not. There are multiple layers of security, including notarization and XProtect. > I'm pretty sure I know what the first thing any malicious software is gonna do. What? > macOS preferences aren't magically locked away from the rest of system, regular users can change their own user preferences, and root can change system preferences. An antivirus has to still work against an attacker who has root. You sound confused about admin vs. root. Anyway, if you have a local attacker running on your Mac, then it's already too late for OCSP.

Spivak 2y ago
Those aren't so much layers as the different parts, and OSCP is how notarization actually provides security, the developer cert is what's being checked to run the app. This scheme isn't really designed to prevent attacks so to speak, it's to stop the malicious software on everyone's system all at once. You can say theoretically it's too late because the software is already doing what it's doing and you should consider the machine compromised. But the rubber meets the road for regular users who aren't going to wipe their machines in response to malware and so this lets you purge it. I don't think I'm confused about admin vs root. I'm talking about the System Administrator user, The oops I ran malware with sudo user, uid 0, the user who is only constrained by the kernel via SIP. But yeah, admin is the more common use-case for regular users and I'm not sure the point you're making, malware can get admin and if you put the preference somewhere changeable by admin then welp. You could put the preference in recovery mode same as SIP, I think that would be fine.
- lapcat 2y ago
  > Those aren't so much layers as the different parts Mkay. > OSCP is how notarization actually works, that's what's being checked to validate the notarization. No, you are misinformed. OCSP is checked by the trustd process on ocsp2.apple.com, whereas notarization is checked by the syspolicyd process on api.apple-cloudkit.com. OCSP is simply checking whether the Developer ID certificate has been revoked. Notarization, on the other hand, requires uploading a build to Apple and receiving a special notarization ticket. The notarization ticket is either "stapled" to the app or downloaded from Apple when the app is first launched.
  - Spivak 2y ago
    > Mkay Well they're not. What would you call it? Windows Defender and Microsoft's code signing requirement aren't super related. You could purge discovered malware with a signature/scan but that's not impossible to get around. I'm not sure I really grok the difference from a security perspective when the main thing with notarization is ensuring it's signed with your developer cert. I guess the Venn diagram isn't technically a circle but is it not that the actual security of notarization is provided by OSCP? I suppose I could have phrased that bit better. Is there a case where a hypothetical notarization process that excludes that bit provides any real security? Because Apple "scanning it for malware" isn't going to be that different from Xprotect. I'm really not sure what I did to get such an, idk hostile? response.
    - lapcat 2y ago
      > the main thing with notarization is ensuring it's signed with your developer cert. It's not the main thing. > is it not that the actual security of notarization is provided by OSCP? No. I tried to explain the difference in my previous reply, but I'm not going to sit here and write an entire essay on the subject (though I could). The information is out there, for example on developer.apple.com. Or even on my own website. Inform yourself, or at least stop spouting falsehoods.
      - sroussey 2y ago
        Oh god, don’t send people to developer.apple.com. It’s apple’s worst product. I’d rather you shill your own blog posts. Even without reading them, I know they are better. ;)
    - Vegenoid 2y ago
      > is it not that the actual security of notarization is provided by OSCP? The security of notarization is provided by Apple's signature over the hashes of the executables in the app [0]. The hashes and signature are put into a "ticket". This ticket is stored on Apple's servers, and can also be "stapled" to the app. Gatekeeper (one of the macOS security systems) will prefer to fetch the ticket from Apple if possible, and fall back to the stapled ticket if available. Notarization is meant to guarantee that the code was sent to Apple and checked for malicious code. OCSP checks that the Apple Developer ID certificate used to sign the app hasn't been revoked. They are two separate checks done by the Gatekeeper system, which is meant to ensure that only trusted software runs on macOS. I believe it makes sense to call the OCSP check part of the Gatekeeper system, but this may be incorrect. [0]: https://forums.developer.apple.com/forums/thread/710738 https://forums.developer.apple.com/forums/thread/710738

by lapcat 2y ago

Spivak 2y ago

Those aren't so much layers as the different parts, and OSCP is how notarization actually provides security, the developer cert is what's being checked to run the app. This scheme isn't really designed to prevent attacks so to speak, it's to stop the malicious software on everyone's system all at once. You can say theoretically it's too late because the software is already doing what it's doing and you should consider the machine compromised. But the rubber meets the road for regular users who aren't going to wipe their machines in response to malware and so this lets you purge it. I don't think I'm confused about admin vs root. I'm talking about the System Administrator user, The oops I ran malware with sudo user, uid 0, the user who is only constrained by the kernel via SIP. But yeah, admin is the more common use-case for regular users and I'm not sure the point you're making, malware can get admin and if you put the preference somewhere changeable by admin then welp. You could put the preference in recovery mode same as SIP, I think that would be fine.

lapcat 2y ago
> Those aren't so much layers as the different parts Mkay. > OSCP is how notarization actually works, that's what's being checked to validate the notarization. No, you are misinformed. OCSP is checked by the trustd process on ocsp2.apple.com, whereas notarization is checked by the syspolicyd process on api.apple-cloudkit.com. OCSP is simply checking whether the Developer ID certificate has been revoked. Notarization, on the other hand, requires uploading a build to Apple and receiving a special notarization ticket. The notarization ticket is either "stapled" to the app or downloaded from Apple when the app is first launched.
- Spivak 2y ago
  > Mkay Well they're not. What would you call it? Windows Defender and Microsoft's code signing requirement aren't super related. You could purge discovered malware with a signature/scan but that's not impossible to get around. I'm not sure I really grok the difference from a security perspective when the main thing with notarization is ensuring it's signed with your developer cert. I guess the Venn diagram isn't technically a circle but is it not that the actual security of notarization is provided by OSCP? I suppose I could have phrased that bit better. Is there a case where a hypothetical notarization process that excludes that bit provides any real security? Because Apple "scanning it for malware" isn't going to be that different from Xprotect. I'm really not sure what I did to get such an, idk hostile? response.
  - lapcat 2y ago
    > the main thing with notarization is ensuring it's signed with your developer cert. It's not the main thing. > is it not that the actual security of notarization is provided by OSCP? No. I tried to explain the difference in my previous reply, but I'm not going to sit here and write an entire essay on the subject (though I could). The information is out there, for example on developer.apple.com. Or even on my own website. Inform yourself, or at least stop spouting falsehoods.
    - sroussey 2y ago
      Oh god, don’t send people to developer.apple.com. It’s apple’s worst product. I’d rather you shill your own blog posts. Even without reading them, I know they are better. ;)
  - Vegenoid 2y ago
    > is it not that the actual security of notarization is provided by OSCP? The security of notarization is provided by Apple's signature over the hashes of the executables in the app [0]. The hashes and signature are put into a "ticket". This ticket is stored on Apple's servers, and can also be "stapled" to the app. Gatekeeper (one of the macOS security systems) will prefer to fetch the ticket from Apple if possible, and fall back to the stapled ticket if available. Notarization is meant to guarantee that the code was sent to Apple and checked for malicious code. OCSP checks that the Apple Developer ID certificate used to sign the app hasn't been revoked. They are two separate checks done by the Gatekeeper system, which is meant to ensure that only trusted software runs on macOS. I believe it makes sense to call the OCSP check part of the Gatekeeper system, but this may be incorrect. [0]: https://forums.developer.apple.com/forums/thread/710738 https://forums.developer.apple.com/forums/thread/710738