←back to thread

2603 points mattsolle | 1 comments | | HN request time: 0s | source
Show context
modeless ◴[] No.25075336[source]
You've got to be kidding me. When Apple's servers are down, all Macs worldwide start freezing randomly? My XCode is hanging during builds, is this why?

This code signing enforcement stuff has gone way too far. Heads should roll for this.

replies(7): >>25075369 #>>25075380 #>>25075549 #>>25075960 #>>25076693 #>>25079741 #>>25080072 #
p1necone ◴[] No.25075549[source]
Wait what happens if you don't have an internet connection? Can Macs not be used offline any more, surely that's still a relatively common use case for a laptop even today in a lot of places?
replies(7): >>25075778 #>>25075945 #>>25076204 #>>25078280 #>>25078541 #>>25081169 #>>25083116 #
josephcsible ◴[] No.25075778[source]
My understanding is that if you're offline, it skips this check and everything works fine. The reason this is a big deal is that the problem's on their end, so you're not offline, so it keeps trying and waiting instead of just letting you skip the check.
replies(3): >>25075909 #>>25076399 #>>25076495 #
8note ◴[] No.25076399[source]
That still seems weird. Why does running unrecognized software become safe when you're off line?
replies(3): >>25076483 #>>25077222 #>>25082161 #
sprt ◴[] No.25076483[source]
Yes, can someone clarify this? What the hell is going on here?
replies(1): >>25077571 #
1. db48x ◴[] No.25077571{3}[source]
It doesn't become safe when you're offline, it's just that you're no worse off than you were. OCSP is s a certificate revocation protocol. It's only used for disabling certificates which were issued in good faith but now need to be revoked. Suppose Apple signs application X, and the signature is good for a year. Six months later, Apple discovers that application X contains malware, so they revoke the certificate. However, your computer doesn't know about the revocation until it checks the OCSP server, which requires you to be online. If you're offline, it just skips the check; the certificate wasn't revoked yesterday, so it's probably fine today too. The bug is that if you're connected to a network but can't contact the OCSP server (either because the OCSP server is down, or because you're not connected to the internet) then OSX keeps trying to connect and becomes sluggish and/or unresponsive. This is how we know that it's a defect rather than a deliberate choice; if they had decided to make the OS non−functional unless connected to the internet they would have done a better job of it.

It wouldn't surprise me if they one day wanted to require you to be online 100% of the time so that you can't skip the OCSP checks on applications, but I don't think that would go over very well. Apple wouldn't even be the first to produce applications that refuse to work if there's no internet connection. If you don't like the thought that they might one day spring this on you, I recommend investigating Linux.