back
430 comments
A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible.

A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometimes they do, sometimes they don't.

Parts of the US Governments unlawful massive domestic surveillance apparatus were described in the open in IETF drafs and patent documents for years. But people largely didn't notice and regarded reports as conspiracy theories for a long time.

Information being available doesn't necessarily make any difference and making a difference is what matters.

The market only acts fairly when the product is a commodity. The time for the market to react for a product with the complexity of a mac is decades.

As the ecosystem grows, the cost of switching increases. Therefore market starts acting more and more inefficiently.

This is why countries have state intervention in such cases. And anti trust exists.

If the option was a mac with privacy vs a mac without privacy but $10 cheaper, I'd think the market would pick the mac with privacy. No such choice within the budget exists, and if a company has a monopoly on the ecosystem, then the market cannot react when held hostage. The cost to transition to a different ecosystem is thousands of $'s when you've been using a mac your entire life. It's not like you'd want to relearn many things when you get older, perhaps the sunk cost fallacy as many would define it.

It's a bundled deal, it's not like you can pick the parts you like and throw away the ones you don't like it would be in an efficient market.

If even someone like me cannot be bothered to move to more privacy friendly platforms, then I don't have hope for other people. It's just not worth it. Until the majority face the consequences of their apathy, any action you take is fruitless. Let them taste the pain, then offer the solution.

I know I can be tracked. So what? I can't verify the silicon in my device, can I? Gotta trust someone, maybe blockchain will solve the problem of trust among humans, in a verifiable way.

> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it.

Stronger privacy laws hurt Google, Facebook, and Amazon far more than Apple. Most of Apple's privacy gaffs are just bonehead moves like this one which shouldn't happen, but also don't drive revenue.

This isn’t that. I’ve been aware of this for some time, pretty sure it was in the security white paper and talked about as a feature.

People forget about CRLs because browsers mostly ignore them.

People just go crazy for any Apple story because it attracts attention. People have been paying to send all sorts of app launch analytics to AV companies for example since the 90s.

Lying to the customer about what your product does, or having secret functionality, should be a criminal offence in the same way as breaking and entering or stalking are.

Then, we would find out very quickly what people value.

I firmly believe this ecosystem (as in privacy violating ad and data selling business model) is only dominant because companies are able to mislead with impunity, so it's basically a form of fraud

Perhaps this is why Apple did not ask for permission from the user to add some delay every time the user launches an application. If the user were presented with the choice what would she choose.

If we look at the example of OCSP in the website certificate context, the notion of the delay added by OCSP (not to mention privacy concerns) being objectionable has already been acknowledged. As a result we have OCSP stapling. For some reason, in the Apple developer certificate context, OCSP is deemed acceptable by default.

> A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometimes they do, sometimes they don't.

And there are cases where it's not practical for "people to notice." For instance: a privacy leak that only uses the cell network connection of a phone, which would avoid easily-sniffed connections.

> The market can't act against what it can't see. Privacy loss is often irreversible.

You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching for profiling, that's been known for a while now. The market seems fine with it.

And I mean, at this point I could just gesture broadly at all of Facebook.

On argument to make is that the market only cares about the majority of their customers, not all of them. If 0.5% of their customers has their privacy busted by a backdoor, or that 0.01% of google users have their account arbitrarily deleted, this percentage of users is screwed like no one and the company doesn't suffer any damage.
Yes, unfortunately there is no safe harbor.

Companies can make mistakes or add backdoors and we won't know. See this clusterfuck.

Open Source, likewise, can make mistakes and (much more rarely) add backdoors, and we could know, but few have the resources to so. See heartbleed.

> Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them.

I agree that anyone critiquing Apple's OCSP design should understand it, and the critique should be more nuanced than "just turn that feature off." Computers are now skeleton keys to our lives and we have to go forward rather than back in figuring out how to design them so they can safely do everything we need them to do.

But it's not hard to justify the sudden criticism here -- it happened after Apple's bad design of the OCSP feature broke local applications, drawing a lot more attention to how it worked. It's reasonable to then ask whether other parts of the design were also poor, as Apple itself obviously is from the changes it's already announced.

To take the author up on what should replace OCSP checks -- how about using something like bloom filters for offline checks, and something like haveibeenpwned's k-anonymity for online checks, to remove the possibility that either Apple or a third party could use OCSP for surveillance?

It kind of feels like there's a bit too much noise around this topic.

I'm getting the same feeling I did years ago when it was discovered that the iPhone had a historical database of all the locations you'd been to. There were rather a lot of articles about how Apple were "tracking you everywhere you went" and so on.

The reason it's similar – they are both dumb, technically bad, and privacy-compromising decisions, and in both cases much of the public discussion about it has been a little hysterical and off-base.

Apple should 100% be criticised for this particular failure. It's obviously a bad implementation from a technical and usability point of view; the privacy implications are bad, and this features should not have been able to make it out as-is.

But I've legitimately seen people describe this as "Apple's telemetry" which is just obvious nonsense and distracts from the actual problem – how did such a bad implementation of a useful feature end up in a major commercial product, and how are they going to make sure it doesn't happen again?

Another fun fact about this system: something changed in how the binaries are evaluated and one VST plugins I've downloaded months ago was marked as malware. The plugin is quite popular in community so I think it's unlikely it contains actual malicious code (in fact I've contacted the developer and he said he has done some fixes for Apple's security policies recently). Imagine my shock when I open an old project in Ableton and suddenly some sounds just don't work. This really sucks, I don't want to worry about whether my music will work five or ten years from now (I can imagine I may I want to remix some old piece). I suppose I can err on side of safety and export all tracks to wav.

However, it's not an isolated problem. It feels that every other week something happens that undermines my confidence in Macbook as good device for making music.

Interesting, but reading the conclusion I'm fascinated in this affaire how technically knowledgeable people loose common sense to defend their favorite brand: - Per launch verification is terrible for privacy, vis-a-vis Apple and the whole network when it happens in plain text - "They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all", another key issue: user information, consent and control. - Additionally, the public was made aware because it malfunctioned, which is also a security issue. - Considering the current corporate culture, there are legitimate concerns of what those choices might lead towards
> "Those who consider that Apple’s current online certificate checks are unnecessary, invasive or controlling should familiarise themselves with how they have come about, and their importance to macOS security. They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them."

A simple opt-out toggle, for privacy reasons, would be a good start... people should stay in control of their own data and be able to choose themselves whether or not they are willing to trade in their privacy (for security in this case).

I sometimes wonder if the mods won't end up banning "political" talk on HN. Because these days everything becomes political, even if it really is a technical issue.

Case to the point: online signature check was a technical decision, to fight malware. It was implemented similarly by other OS vendors (Microsoft) and it's been this way for years.

Now we discover that it has the unfortunate side-effect that it lessens privacy. Apple (and probably other OS vendors) are working to improve that in the future. Also, a technical issue.

It was never about privacy. It was never a political issue. Can we please just discuss it from a technological standpoint?

> What has been puzzling me ever since is that these OCSP checks have been well-known for a couple of years, and only now have attracted attention.

It's not much of a puzzle. Everyone's Mac essentially froze simultaneously, and that's what drew all the initial attention. Then people were digging into why, and the cause of it got a lot of play. Privacy advocates took the opportunity to advocate privacy and had a large and annoyed audience.

Honest question I'm not an expert: The initial commments in this thread are painting it as a severe privacy violation. (The actual OP article author does not necessarily share this perspetive). How is what is being done with OCSP different in more concerning way for privacy (if it is) from Firefox or Chrome's use of OCSP?
> explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all

I didn't "enjoy their benefits" - I hated this change when I switched from Mojave to Catalina, and it severely impacted my workflow.

Catalina's change to OCSP and online validation adds little if any value, compromises privacy, reduces performance, and introduces unnecessary new failure modes. It's simply a bad idea whose negatives greatly outweigh any minimal positives.

> what should replace them

Very obviously a Certificate Revocation List, like we had in Mojave.

This is the right approach and should not have changed in the first place.

A fantastically bad take. "You're more secure because Apple has been careless with your privacy for a long time and you didn't complain before -- be grateful."
I don't agree with the article's statement that this is necessary.

I'm sure it serves a purpose. But it should be more transparent to the user what's going on, and it should be possible to switch it off if the user decides they don't want this.

And really, the article also mentions Apple used to do this with a local cache but stopped doing this in Catalina. The question should be asked why. A local cache arguably offers better protection as it will work even without a network connection whereas the OCSP has no alternative other than failing open or stopping the system from working.

How does Windows check executables? I hope they don't do the same. Does it come with a master list of public keys from manufacturers to check the signature against?

How does that work for new vendors?

Security and privacy are not parallel concerns, they’re orthogonal. Strong security absolutely does not imply utmost privacy. I find this to be the most dangerous misconception of the late privacy trend. You can’t just turn security and privacy dials to 11. They’re actually two ends of the same dial, or opposing poles of the same sphere. To increase privacy you must move away from perfect security.

Why? Because security is all about who you trust (and who you don’t). Privacy is about concealing things from people you trust (and especially from those you don’t). Security is best served with strong identity and periodic integrity checks/monitoring. Privacy is best served via anonymity and opacity. If something is private, by definition there lacks the transparency to audit its integrity.

So what I lament is not that a company is trying to achieve both, but rather that as a consumer I’m not educated on the topic and able to make a choice as to where I want to set the dial.

You will continue to see “headlines” like this so long as socially we’re obsessed with trying to implement both security and privacy and fall subject to marketing suggesting some service provides the maximum of both.

If you trust Apple to verify the integrity of apps on your devices and secure your system from unwanted software, then you trust Apple to maintain the privacy around the data needed to achieve such. That’s the whole value prop of their platform and ecosystem. It’s a walled garden with abundant privacy koolaid fountains.

The only reason this is news is because people don’t understand the privacy vs security dichotomy. And because Apple does not provide a way for consumers to choose just how much security they’re comfortable with.

If you don’t trust Apple then stop pretending you do by using their hardware/ecosystem.

"Privacy is not a feature".
I know this because if my internet drops out - the router still is up, but packets are going nowhere - opening an app, especially one of mine, takes north of 10 seconds, which is the time for this thing to give up on talking to Apple.
> They should also explain how, having enjoyed their benefits for a couple of years, they’ve suddenly decided they were such a bad idea after all, and what should replace them.

I mean, this is very very presumptuous... the people I know who were "in the know" on this--including myself--never upgraded to Catalina (in addition to doing a SIP disable), in no small part to avoid this intrusive behavior.

(Further, there actually was outcry about this a year ago, when a similar issue happened: just, instead of the system not running software at all, it ran all new software super slowly.)

The online component of ocsp is only necessary for revocation lists. There is absolutely no reason to open a network connection every time an app is opened.

The state of OSX is unacceptable.

What I find a lot scarier is that macOS seems to store your local user's password as a hash with Apple.

A few months ago I was signing in on my MacBook, and it asked me (assuming because I did not have a mobile number attached) for my Hackintosh local user's password to 2FA.

May be buried in the depths of the EULA, but I most definitely never agreed for my LOCAL account password to be uploaded to Apple.

At least signature checks can be blocked (for now) on a DNS level. What about my passwords?

> What has been puzzling me ever since is that these OCSP checks have been well-known for a couple of years,

This is where you’re wrong. It was known, but not well-known. Users do not expect an HTTP request to be blocking their application executions.

Personally, I don’t see why CRL is not sufficient. Yes I want malicious signatures blacklisted, but can’t I just get a list instead? Some of the reasons CRL is no longer used do not apply to code signatures.

How long they've done it has no bearing on whether it is an outrageously bad idea. It was bad in Catalina and it's bad in Big Sur.

I found it particularly annoying in Catalina to have these slow, unnecessary and intrusive online checks every time you run a Python script and it drove me up a wall until I figured out you could turn off the idiotic behavior in preferences.

The only charitable understanding of this program is that Apple has no actual table connecting software to hashes, but that they could use the information to understand outbreaks of botnets/spyware that they could then help inform ISPs/global law enforcement to help stop.

Is this even reasonable?

Is there any UI indication that OCSP checks have been consistently failing for some period of time?

My concern is less local malware (if something malicious has gained the privileges to filter OCSP, it's probably already game over) but rather networks filtering ocsp.apple.com (for whatever reason).

Certainly explains why having terribly slow internet makes my mac insanely slow. Shutting off I cloud helped immensely, but this is probably the deeper root.

Sucks to have a cellphone only internet.

Did people miss how Apple has already said they've removed all the logs retroactively for this and they're adding a feature to opt-out of this?
yes. with no personally identifying details included. and it was publicly documented.
So, can you use macOS offline for extended periods of time?
It seems that many tend to overlook the main issue with this.

Because of this feature, there are people on this lovely planet of ours who may be in actual physical danger at this very moment.

Apple doesn't have ads and tracking they said... Anyway that was never worth the premium for me when I can put ad blocking on Lenovo and save a few hundred €.
Surprised this is news to some.
I wonder how long until Macosx checks hashes of all media played on devices.
So you guys know AV's randomly upload ur files to the cloud right?
The irony of arguing that the rapid rate of certificate revocations is proof of the system being necessary and secure. No, it's proof that the system is useless. Code signing is a dead end, and we have known that latest with Stuxnet.
Any opt out protection racket should be illegal. Even if it is "anonymous", someone could be identified from their behavioural patterns which are unique to each human. I hope that Apple gets at least hundred billion fine for such brazen violation of privacy so they will learn their lesson and they should be ordered to delete all personal data they don't have legitimate business need for.