←back to thread

2603 points mattsolle | 1 comments | | HN request time: 0.21s | source
Show context
submeta ◴[] No.25075156[source]
Unbelievable. When I read the tweet (tried to post here as well), I suddenly realized why my Mac was unresponsive an hour ago.

Here is another tweet that describes the problem in more detail:

https://mobile.twitter.com/llanga/status/1326989724704268289

> I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when `trustd` and `syspolicyd` are unable to do so, the entire operating system grinds to a halt.

EDIT:

As others pointed out, I put this to my `/etc/hosts` file and refreshed it like so:

    sudo emacs /etc/hosts # add `0.0.0.0 ocsp.apple.com` 
    sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # refresh hosts
replies(26): >>25075338 #>>25075481 #>>25075547 #>>25075666 #>>25075887 #>>25076053 #>>25076387 #>>25076568 #>>25076811 #>>25077902 #>>25077923 #>>25077940 #>>25079234 #>>25079856 #>>25079879 #>>25080093 #>>25080357 #>>25080370 #>>25080849 #>>25081772 #>>25081989 #>>25083938 #>>25087820 #>>25090415 #>>25090991 #>>25095226 #
vsskanth ◴[] No.25075338[source]
Can apple not use security certificates to verify publishers ? why does it need to go to their servers ?
replies(4): >>25075370 #>>25075733 #>>25076033 #>>25078236 #
loeg ◴[] No.25075733[source]
The URL mentioned in sibling comments suggests this has to do with certificate revocation (OCSP): https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...

I agree that breaking system availability when an OCSP server isn't available is user-hostile and unnecessary.

replies(6): >>25075811 #>>25075817 #>>25076021 #>>25076039 #>>25076087 #>>25076418 #
freeone3000 ◴[] No.25075811[source]
The alternative is OCSP being allowed if internet isn't available, which is a security risk for reasonable defense-in-depth strategies.
replies(2): >>25075905 #>>25075987 #
1. loeg ◴[] No.25075987[source]
MacOS already fails-open if the OCSP server resolves to the local host (see: every suggestion to edit /etc/hosts in this discussion).