_qulr

43 ms·

361.
by _qulr 6y ago
"I always advocate against opt-outs for security features like this" The author conveniently overlooks the fact that customers pay literally thousands of dollars for Apple computers. We're not talking about a free online serv
362.
by _qulr 6y ago
> If you'd like to block the notarization check, you can block trustd (/usr/libexec/trustd) access to ocsp.apple.com Technically speaking, OCSP and notarization are two different things. The notarization check is actu
363.
by _qulr 6y ago
> A certificate revocation request signed by the private key is proof of private key compromise. There's no such thing in this case. In the blog post, I quoted from Apple's Certification Practice Statement: "The Subscriber
364.
by _qulr 6y ago
> If a web cert gets revoked a browser won't accept it when making a connection to a domain/server anymore even if they previously did The difference is that you can just get a new web cert, install it on the server, and you&#x
365.
by _qulr 6y ago
> Replace Apple with any CA on the world wide web This is what everyone misunderstands. The Developer ID code signing program is not analogous to web certs. The usage of these certs is entirely different. Apps installed on a user's
366.
by _qulr 6y ago
OCSP is Online Certificate Status Protocol. The connection to ocsp.apple.com is checking the status of the certificate used to code sign the launching app. I wrote an article about this a couple weeks ago because of the temporary revocation
367.
by _qulr 6y ago
Sure. But we've seen cases where so-called "trusted" https sites such as ebay are probing your LAN, so the fundamental problem remains. https://nullsweep.com/why-is-this-website-port-scanning-me/
368.
by _qulr 6y ago
> the problem is always quality But writing quality apps requires quality API documentation. I don't know how developers fumbling around in the dark can result in quality apps. Being "dedicated" to Apple platforms is not t
369.
by _qulr 6y ago
> the Apple events alone can make Apple's market value jump or fall by hundreds of billions The stock price is down since Monday, so I guess they screwed up?
370.
by _qulr 6y ago
This change can't come soon enough. My only objection is that the rollout is way too slow, and the first step is only a baby step. What we have now is essential a 0day situation. Unfortunately a lot of commenters completely misundersta
371.
by _qulr 6y ago
The other day someone referenced this post by an Apple engineer: https://developer.apple.com/forums/thread/663858 Why in the world is this a random undiscoverable post in the (terribly designed) developer discussi
372.
by _qulr 6y ago
> The poor documentation defends expert third party developers against competition from new entrants. It ensures a shortage of competent developers and so enhances the revenue of established experts. Why in the world would Apple want to
373.
by _qulr 6y ago
You can find some good Mac/ObjC docs in the archive: https://developer.apple.com/library/archive/navigation/
374.
by _qulr 6y ago
I have quite a few of those domains blocked, but other than optimizely, blocking seems to have no effect on functionality.
375.
by _qulr 6y ago
I just want to point out that I was unable to fill out my 2021 marketplace application on healthcare.gov until I stopped blocking optimizely.com in Little Snitch.
376.
by _qulr 6y ago
It's a literal statement. Apple has phone calls with developers on occasion, especially in cases like this. Unusual, but not at all unprecedented. I'll just mention the famous case when a developer actually recorded the phone call
377.
by _qulr 6y ago
I wonder what "needs" means, though. As I get older, my body just naturally sleeps fewer hours than when I was younger, and there seems to be nothing I can do to change that. I don't use an alarm clock, I go to bed at around
378.
by _qulr 6y ago
> it's a sad excuse for a competitive advantage True. It may be less of a "promotional" article than either I or the original commenter implied. After all, it says: "Older employees who are suffering from burnout face
379.
by _qulr 6y ago
In fairness, it's an article written by the AARP promoting older people, so the motivation is very clear. Also in fairness, older workers face widespread age discrimination, so it may be worth pointing out some of their advantages.
380.
by _qulr 6y ago
What do you mean by "removed"? Obviously millions of people were removed from the workforce this year, but that had nothing to do with burnout. In general, a non-wealthy person cannot simply retire because they feel burned out.
381.
by _qulr 6y ago
Also, people generally sleep fewer hours per night as they age. As a result, they have more free hours per day as they age. "Sleep deprivation" has a very different meaning for the young and the old.
382.
by _qulr 6y ago
> One of the uses of certs is to sign test builds with a different cert from the production release, so that you can ask Apple to disable them after release. So Apple gets requests to revoke certs for this, and other reasons all the time
383.
by _qulr 6y ago
The truth could be both of those. ;-)
384.
by _qulr 6y ago
> it is not apples job to work out if you really wanted to revoke a cert, or you just screwed up. It is literally Apple's job. From the Certification Practice Statement: "The Subscriber may initiate a revocation request by send
385.
by _qulr 6y ago
> It is no different from any other cert - TLS certs, S/MIME, etc are all the same. No, this is where the argument is fatally flawed. The usage of code signing certs and web certs is completely different. At any time, you can put a
386.
by _qulr 6y ago
> You just The reason we're even discussing this issue is that there was a huge public fallout. You don't "just" do anything. This was a nightmare for many HP users, who just couldn't print at all. How do you &qu
387.
by _qulr 6y ago
The one and only purpose of Developer ID is to prevent malware. Apple imposed the Developer ID code signing requirement on Mac developers a number of years ago. If you don't sign your Mac app with a Developer ID cert, then macOS will w
388.
by _qulr 6y ago
That's not the suggestion. Nobody is suggesting that browsers shouldn't be able to load http://192.168.0.1 in the address bar. The suggestion is that an http://web.url.com page should be blocked from making
389.
by _qulr 6y ago
> Apple has offered this service to their developer customers This is unfortunately a complete misunderstanding of Developer ID. The program isn't a "service" for developers, it was imposed on developers as a requirement f
390.
by _qulr 6y ago
> Apple gets certificate revocation requests all the time, to disable test builds, disabled badly bugged software versions, to disable software for licensing reasons. How do you know this? What is the evidence for this claim? The strange

More ›