4 ms·

>You cannot directly download or install High Sierra (the latest supported OS) for reasons I don't remember. This one’s a doozy because i hit it last month. T

>You cannot directly download or install High Sierra (the latest supported OS) for reasons I don't remember. This one’s a doozy because i hit it last month. The updates are over https. The default certificates are 10year expiry. I had an elderly relative (who disabled updates because they were scared of the computer changing) really upset everything was broken. Gmail app gave obscure can’t connect messages, almost all websites failed to load. When i went there of course the os wouldn’t update as well. We use https for everything now. The keychain system is so hidden from users it was hard to even get to for myself. Took a usb key of a set of certificate updates. Harder than you think because when you look in keychain you’re not sure of which certificate is used for which and it’s a pain to find what you need. In the end a transfer from a healthy mac worked enough to get a manually downloaded os update running and from there it was fine. What a doozy though! If you know of people with old macs that stopped working at the start of this year this is why

JadeNB 8mo ago
> The keychain system is so hidden from users it was hard to even get to for myself. These days, keychain access is under /System/Library/Core Services/Applications/Keychain Access.app. That's not intuitive, but, once you know it's there, it's not hard to navigate to it. Was it different under older versions?
- latchkey 8mo ago
  command-space... type "keychain access"
  - rz2k 8mo ago
    command+shift+g Then s<tab>/l<tab>/cores<tab>/a<tab> Simple! However, while Spotlight works well when you know what you are looking for, it can still be useful to navigate the filesystem, and it's too bad that Apple hides tools in relatively obscure locations rather than somewhere like /Applications/Utilities.
- conradev 8mo ago
  Apple moved it there in macOS Sequoia, from Utilities, because they were worried it would be confused with the Passwords app. Apple reminds you that you're actually looking for the Passwords app at every turn: Tip: You can find all your passwords, passkeys, and verification codes in the Passwords app on your Mac. https://support.apple.com/guide/keychain-access/what-is-keychain-access-kyca1083/mac https://support.apple.com/guide/keychain-access/what-is-keyc...
easyThrowaway 8mo ago
> The updates are over https. The default certificates are 10year expiry. I wish I knew this last week while trying to restore a 2010 21" iMac. Apart from this, I encountered another annoyance mid-way; the official download urls for Sierra and High Sierra were nowhere to be found. I somewhat remember being able to download the official dmg/disk image from some official repository, probably some App store public url?
- fouc 8mo ago
  can look for macos downloader scripts in github. I noticed the readme here shares some URLs though I'm not sure if they still work https://github.com/Comp-Labs/Download-macOS https://github.com/Comp-Labs/Download-macOS https://github.com/chris1111/Download_Install_macOS https://github.com/chris1111/Download_Install_macOS could also be another option. I know I used one of the macos downloaders from github before, I just forget which one though.
  - easyThrowaway 8mo ago
    Thanks!
eleveriven 8mo ago
How modern computing quietly depends on this constantly-maintained layer of trust infrastructure
- embedding-shape 8mo ago
  Well, to be more specific, "modern internet/web". Most of the applications that ran on a Windows XP computers still run on a Windows XP computer without hiccups, unless they do a lot of network connectivity for the functionality.
- grishka 8mo ago
  And no one can even give a concrete answer why root certificates need expiration dates. It's just because reasons. IMO the whole PKI thing is a terrible idea to begin with. It would make much more sense to tie the trust in TLS to DNS somehow, since the certificates themselves depend on domains anyway. Then you would only have a single root of trust, and that would be your DNS provider (or the root servers). And nothing will expire ever again.
  - westurner 8mo ago
    Root certificates need expiration dates for the same reason that LetsEncrypt certs need an expiration date: risk of cert compromise and forgery increases over time. Over a long enough timeline, there will be vulns discovered in so much of the software that guards the CA certs in RAM
    - grishka 8mo ago
      > risk of cert compromise and forgery increases over time. And what if the certificate is compromised before it expires? Right, there's a revocation mechanism for that. So why expire them then if they can be revoked anyway IF they get compromised? The reason why domain TLS certificates expire is that domains can change owners. It makes sense that it should not be possible for someone to buy a domain for one year, get a non-expiring TLS certificate issued for it, and then have the ability to MitM its traffic if it ever gets bought by someone else later. Domain certificates are sent as part of the connection handshake, so them expiring is unnoticeable for the end users. However, root certificates rely on the OS getting updates forever, which is unsustainable. Some systems lack the ability to install user-provided root CAs altogether, and some (Android) do allow it but treat them as second-class.
nonamenoslogan 8mo ago
If you have High Sierra on USB, it installs just fine. You need a High Sierra machine to make the USB stick, but once you have one, its simple to reinstall.

JadeNB 8mo ago

> The keychain system is so hidden from users it was hard to even get to for myself. These days, keychain access is under /System/Library/Core Services/Applications/Keychain Access.app. That's not intuitive, but, once you know it's there, it's not hard to navigate to it. Was it different under older versions?

latchkey 8mo ago
command-space... type "keychain access"
- rz2k 8mo ago
  command+shift+g Then s<tab>/l<tab>/cores<tab>/a<tab> Simple! However, while Spotlight works well when you know what you are looking for, it can still be useful to navigate the filesystem, and it's too bad that Apple hides tools in relatively obscure locations rather than somewhere like /Applications/Utilities.
conradev 8mo ago
Apple moved it there in macOS Sequoia, from Utilities, because they were worried it would be confused with the Passwords app. Apple reminds you that you're actually looking for the Passwords app at every turn: Tip: You can find all your passwords, passkeys, and verification codes in the Passwords app on your Mac. https://support.apple.com/guide/keychain-access/what-is-keychain-access-kyca1083/mac https://support.apple.com/guide/keychain-access/what-is-keyc...

easyThrowaway 8mo ago

> The updates are over https. The default certificates are 10year expiry. I wish I knew this last week while trying to restore a 2010 21" iMac. Apart from this, I encountered another annoyance mid-way; the official download urls for Sierra and High Sierra were nowhere to be found. I somewhat remember being able to download the official dmg/disk image from some official repository, probably some App store public url?

fouc 8mo ago
can look for macos downloader scripts in github. I noticed the readme here shares some URLs though I'm not sure if they still work https://github.com/Comp-Labs/Download-macOS https://github.com/Comp-Labs/Download-macOS https://github.com/chris1111/Download_Install_macOS https://github.com/chris1111/Download_Install_macOS could also be another option. I know I used one of the macos downloaders from github before, I just forget which one though.
- easyThrowaway 8mo ago
  Thanks!

eleveriven 8mo ago

How modern computing quietly depends on this constantly-maintained layer of trust infrastructure

embedding-shape 8mo ago
Well, to be more specific, "modern internet/web". Most of the applications that ran on a Windows XP computers still run on a Windows XP computer without hiccups, unless they do a lot of network connectivity for the functionality.
grishka 8mo ago
And no one can even give a concrete answer why root certificates need expiration dates. It's just because reasons. IMO the whole PKI thing is a terrible idea to begin with. It would make much more sense to tie the trust in TLS to DNS somehow, since the certificates themselves depend on domains anyway. Then you would only have a single root of trust, and that would be your DNS provider (or the root servers). And nothing will expire ever again.
- westurner 8mo ago
  Root certificates need expiration dates for the same reason that LetsEncrypt certs need an expiration date: risk of cert compromise and forgery increases over time. Over a long enough timeline, there will be vulns discovered in so much of the software that guards the CA certs in RAM
  - grishka 8mo ago
    > risk of cert compromise and forgery increases over time. And what if the certificate is compromised before it expires? Right, there's a revocation mechanism for that. So why expire them then if they can be revoked anyway IF they get compromised? The reason why domain TLS certificates expire is that domains can change owners. It makes sense that it should not be possible for someone to buy a domain for one year, get a non-expiring TLS certificate issued for it, and then have the ability to MitM its traffic if it ever gets bought by someone else later. Domain certificates are sent as part of the connection handshake, so them expiring is unnoticeable for the end users. However, root certificates rely on the OS getting updates forever, which is unsustainable. Some systems lack the ability to install user-provided root CAs altogether, and some (Android) do allow it but treat them as second-class.

nonamenoslogan 8mo ago

If you have High Sierra on USB, it installs just fine. You need a High Sierra machine to make the USB stick, but once you have one, its simple to reinstall.