Apple Responds To Gatekeeper Issue With Upcoming Fixes (techcrunch.com) 54
Apple has updated a documentation page detailing the company's next steps to prevent last week's Gatekeeper bug from happening again. The company plans to implement the fixes over the next year. From a report: Apple had a difficult launch day last week. The company released macOS Big Sur, a major update for macOS. Apple then suffered from server-side issues. Third-party apps failed to launch as your Mac couldn't check the developer certificate of the app. That feature, called Gatekeeper, makes sure that you didn't download a malware app that disguises itself as a legit app. If the certificate doesn't match, macOS prevents the app launch. Many have been concerned about the privacy implications of the security feature. Does Apple log every app you launch on your Mac to gain competitive insights on app usage? It turns out it's easy to answer that question as the server doesn't mandate encryption. Jacopo Jannone intercepted an unencrypted network request and found out that Apple is not secretly spying on you. Gatekeeper really does what it says it does. "We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are launching or running on their devices," the company wrote.
Re: (Score:1)
What I however DO CARE ABOUT is the reports that Apple Apps bypass VPNs. That is absolutely not acceptable.
Re: (Score:1)
Re: (Score:2)
Just like voting. Once you're validated yourself at your polling location the first time you go to vote there, you should not be required to revalidate yourself every time you go to vote. Has my hash changed since the last time I voted?
Re: Yay! Apple is finally implementing fixes! (Score:1)
Re: (Score:2, Redundant)
"OK, not in this case, but they spy everywhere else." - #2
Re: (Score:1)
>> Slashdot was abuzz with claims of phone-home traffic
>> Evidence to the contrary
If you move the goalposts over to "spying" then yeah, I guess a company statement of "we don't USE the data" is evidence against spying.
If you want something contrary to the traffic, you'll have to tweak your hosts.
Re: (Score:3)
Slashdot was abuzz with claims of spying, spyware etc. etc. In the face of evidence to the contrary, wondering when the anti-Apple crowd here is going to double down?
The world would be a better place if we could just put these cynics in psych wards, or at least re-education camps.
Thinking that an American company would act against your interest is psychotic paranoia, pure and simple. Why can’t corporate America be given the benefit of the doubt? After all, they earned it.
Anti-Apple people make me sic
Re: (Score:2)
Slashdot was abuzz with claims of spying, spyware etc. etc. In the face of evidence to the contrary,
What evidence? Apple simply said today "trust us". That's not evidence.
Re: (Score:2)
Mulder said "Trust no one" and I'm still following his tip.
Then again... I have no reason to trust him, so... I should not trust no one?!
I call bullshit (Score:5, Insightful)
Jacopo Jannone intercepted an unencrypted network request and found out that Apple is not secretly spying on you.
It may not link the user and ther usage pattern directly, but it does build a usage pattern. Wait long enough (not very long probably), or combine that with other naturally de-anonymising requests from the same IP, and Apple has a pretty good profile on you. All this Jannone guy discovered is that Apple doesn't do it blatantly.
And don't tell me I should trust Apple to be virtuous, because that's beyond naive. There's a metric shitton of money to be made in dataraping your customer base, and I see no reason why Apple would refrain from engaging in it just as much as the other Big Data sumbitches.
Re: I call bullshit (Score:2)
Re: (Score:1)
These people who say these things do not deserve Apple’s love!
Sued?
For loving their customers too much?
Sure whatever you say, child molester.
Re: (Score:1)
Re: (Score:2)
HAH, you think a lawsuit is going to stop them? They've already made billions of dollars off of the people who put blind faith into them.
Dollars. That’s all you see, baby seal-clubber.
They are called “units of love” asshole, and yes, Apple made billions while you sat around and spewed bile and hate speech.
Re: (Score:2)
And the flow of billions of dollars would stop if they abused their users like Google and Microsoft do.
Follow the money? Apple is making money just fine selling products and services to their users.
If they lost their users by selling them, they'd have to drop down to Google and Microsoft's level and fight for a third of those profits, at best.
Re: (Score:2)
In other words:
"I've decided that Apple is evil and, regardless of the amount of evidence to the contrary that I'll be presented with now and in the future, I'll never change my mind."
There are plenty of legitimate reasons to hate Apple as a company without having to make up fake ones.
Re: (Score:2)
"I've decided that Apple is evil and, regardless of the amount of evidence to the contrary that I'll be presented with now and in the future, I'll never change my mind."
Right???
Psychotic, the lot of them. My god if you can’t trust a large US corporation then who can you trust?
You know who else thought Apple was evil?
Hitler!
Not just Hitler, but Hitler’s Czar of Evil!
Sig Heil, you evil chunks of horse excrement!
Re: (Score:2)
You don't have to assume they're being virtuous, assume they're being greedy.
1. They wouldn't want to collect this data for OTHER people
2. They don't really sell anything that would benefit from collecting this data themselves—Apple doesn't charge for most of their apps
3. They already know you're buying their product and have your information through iCloud. They already have a direct-to-consumer relationship that they can advertise to you through; collecting this data is meaningless indirection
4. Thi
Re: (Score:1)
Re: (Score:2)
You don't have to assume they're being virtuous, assume they're being greedy.
Please wait by the door with your hands up and your pants off. Someone will be along to collect you shortly. An anal probe will be involved.
You were warned many times about this shit, but you just had to push it.
Re: (Score:2)
It didn't break though, it just took a long time to happen.
The question then becomes, what timeout is appropriate? Because it's trivial to check if you can make a connection to the server if you have no network connected. But a lot less trivial if there is a connectio
Re: (Score:3)
And don't tell me I should trust Apple to be virtuous, because that's beyond naive. There's a metric shitton of money to be made in dataraping your customer base, and I see no reason why Apple would refrain from engaging in it[...]
Perhaps because as the off-and-on most valuable company in the world (at least based on market cap), Apple has shown that there's even more money to be made by selling premium-priced products that respects their users' privacy?
Of course, you needn't take my word on it. Apple updated its documentation for Gatekeeper [apple.com] (the feature in question) in response to the concerns that were raised, adding a section about privacy at the very end. Read through it and you'll find the following that directly contradicts you
Trust, but verify. (Score:5, Interesting)
Security researchers investigating network traffic and pointing out vulnerabilities is a good thing. Rushing to conclusions that (insert_company_name_here) is spying on users based on this data is careless at best, and makes the "researcher" out to be a fool.
I trust what Apple says - they make their money selling products. Their users are not their products. Apple haters would love to prove this false, but I just don't see Apple as being naive and short-sighted enough sell customer data for comparably minuscule revenue.
Re: (Score:1)
This.
Coupled with the fact that there are 2 glaring errors in the original blog post (e.g. hashes of the application itself are not sent, and the OCSP requests are not sent every time an app is launched), it is clear that this was agenda driven. The "researcher" apparently didn't do very thorough research.
Re: (Score:2)
I trust what Apple says - they make their money selling products. Their users are not their products.
OF COURSE, Apple sells users. Why do you think they have 30% AppStore cut? They are selling users to third-party developers.
Re: (Score:2)
I trust what Apple says
Well of course you do. You’re sane. Apple loves you and you feel that love. I trust Apple implicitly too. In fact, I went to the Apple store yesterday, and totally just fell backward.
Even though ten workers were around, I hit the floor, hard, seriously that shit hurt, but that just proved to me how much they loved me.
See, it would have been easy for them to to catch me, but I wouldn’t have learned anything. They loved me enough to let me get the concussion.
It’s
Check on every launch is unnecessary (Score:2)
Basically download a local copy of the hash for each application as you install it and then store a hash of that in the Apple equivalent of the TPM.
Then you can verify every application locally without requiring an internet connection. The only reason to actually require an internet connection to get the hash is to collect data.
This is especially true when you consider that given the request is not encrypted then the whole thing is pointless as you can trivially launch a man in the middle attack on the proc
Re: (Score:1)
You're correct, it is unnecessary. Which is why Apple doesn't do that. OCSP has a validation period that can be several days between checks. Jacopo Jannone confirmed this in his blog post.
Re:Check on every launch is unnecessary (Score:5, Informative)
This is especially true when you consider that given the request is not encrypted then the whole thing is pointless as you can trivially launch a man in the middle attack on the process.
This isn't an Apple thing so much as a OCSP thing. The requests are sent over HTTP but the reply is cryptographically signed to help prevent MITM tampering attacks. Of course, a MITM would be in a position to cause the OCSP call to fail, which can negate the revocation check when the bad actor has compromised the certificate in question. However a MiTM attack on a code-signing cert would be pretty difficult, as they would need to compromise the signing cert AND manage to insert themselves between the end user and the target OCSP servers. Not impossible, but not practical outside of a very target attack against a single company. And quite frankly, if your company traffic is compromised to that extent, you have bigger problems.
On the privacy side, there is OCSP stapling, which conducts the OCSP check over HTTPS inside the HTTPS callout to the target webserver, but that really only works for web certs, since a code signing cert won't have a HTTPS session based on that cert. Overall the OCSP system needs some work, but this isn't just an Apple problem, it's a standards problem.
Just use linux ... (Score:5, Insightful)
Then you can have full control of what your OS is doing.
Re: (Score:2)
The result: Apple doesn't know about the app, and if it has been hacked, you are on your own. Like the standard behaviour in Linux.
Re: (Score:2)
Don't you have a kernel to patch or a compatible driver to locate or something?
At least you've got Full Control. No bluetooth after that last install, but Full Control.
Re: (Score:2)
Then you can have full control of what your OS is doing.
Pffft, like Linux will slow down my shit when it needs more revenue.
No thanks.
Summary is 180 degrees wrong (Score:4, Informative)
Re: (Score:2)
I assume you did not read Apple's official post since they clearly did attempt to address the privacy concerns:
Excerpts:
To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.
Seems like they are addres
Re: (Score:2)
Guess Who Else Doesn’t Trust Apple? (Score:2)
Terrorists.
Re: (Score:2)
Terrorists.
Funny that you say that, but UK and European police got the complete messages sent mostly by criminals over the course of three months, using a very expensive Android app (about $1,800 a year if I remember right). These criminals didn't trust Apple.
Police got _every_ _single_ user of that app and all their messages. Estimates are that of the 60,000 users, 50,000 were serious criminals and 10,000 rich and paranoid people.
Re: (Score:2)
You may think that 1800$ per year is very expensive, but it's pocket change for a police department. That's only 150$ per month, or 5$ per day. If they caught 50K criminals over a year, that's only 0.036$ or 3.6 cents per criminal caught.
Even at 100 times that price, it would be worth it.
Bidding their time... (Score:1)
Once all of their devices are on ARM, they will close "sideloading" and force everyone to their store.
Sweet 30% cut here we come!
Yea right (Score:1)
So why when on a macOS Mojave (and other versions) when you click Apple -> "About This Mac" there is request made to "com.apple.geod.xpc, gsp-ssl.ls.apple.com, gsp64-ssl.ls.apple.com, gsp19-ssl.ls.apple.com, gsp35-ssl.ls.apple.com" ? and this is just one of hundreds request that modern OSX OS will make if you let it go.
They all harvesting/telemetry data like there is no tomorrow & we are the product.
Apple -> kiss my ass!
Re: (Score:2)
Duh, that's where they store the OS icon and the font for the "About This Mac" window.