←back to thread

2603 points mattsolle | 4 comments | | HN request time: 0.001s | source
Show context
modeless ◴[] No.25075336[source]
You've got to be kidding me. When Apple's servers are down, all Macs worldwide start freezing randomly? My XCode is hanging during builds, is this why?

This code signing enforcement stuff has gone way too far. Heads should roll for this.

replies(7): >>25075369 #>>25075380 #>>25075549 #>>25075960 #>>25076693 #>>25079741 #>>25080072 #
p1necone ◴[] No.25075549[source]
Wait what happens if you don't have an internet connection? Can Macs not be used offline any more, surely that's still a relatively common use case for a laptop even today in a lot of places?
replies(7): >>25075778 #>>25075945 #>>25076204 #>>25078280 #>>25078541 #>>25081169 #>>25083116 #
josephcsible ◴[] No.25075778[source]
My understanding is that if you're offline, it skips this check and everything works fine. The reason this is a big deal is that the problem's on their end, so you're not offline, so it keeps trying and waiting instead of just letting you skip the check.
replies(3): >>25075909 #>>25076399 #>>25076495 #
8note ◴[] No.25076399{3}[source]
That still seems weird. Why does running unrecognized software become safe when you're off line?
replies(3): >>25076483 #>>25077222 #>>25082161 #
type0 ◴[] No.25077222{4}[source]
It's a security theater
replies(4): >>25077806 #>>25078011 #>>25079751 #>>25080381 #
1. johncolanduoni ◴[] No.25078011{5}[source]
Mandatory OCSP is security theater? That’s a pretty bold claim.
replies(1): >>25078132 #
2. josephcsible ◴[] No.25078132[source]
Mandatory OCSP that fails open when you're offline is security theater.
replies(1): >>25078452 #
3. snowwrestler ◴[] No.25078452[source]
OCSP fails open by definition because it is a revocation protocol. In the absence of revocation, a valid cert continues to be valid.

The problem here is simply that Apple did not build a short enough timeout into their client.

replies(1): >>25080027 #
4. anticensor ◴[] No.25080027{3}[source]
Make OCSP fail locked and it would be a software imprisonment protocol instead.