←back to thread

2603 points mattsolle | 3 comments | | HN request time: 0.67s | source
Show context
modeless ◴[] No.25075336[source]
You've got to be kidding me. When Apple's servers are down, all Macs worldwide start freezing randomly? My XCode is hanging during builds, is this why?

This code signing enforcement stuff has gone way too far. Heads should roll for this.

replies(7): >>25075369 #>>25075380 #>>25075549 #>>25075960 #>>25076693 #>>25079741 #>>25080072 #
p1necone ◴[] No.25075549[source]
Wait what happens if you don't have an internet connection? Can Macs not be used offline any more, surely that's still a relatively common use case for a laptop even today in a lot of places?
replies(7): >>25075778 #>>25075945 #>>25076204 #>>25078280 #>>25078541 #>>25081169 #>>25083116 #
josephcsible ◴[] No.25075778[source]
My understanding is that if you're offline, it skips this check and everything works fine. The reason this is a big deal is that the problem's on their end, so you're not offline, so it keeps trying and waiting instead of just letting you skip the check.
replies(3): >>25075909 #>>25076399 #>>25076495 #
8note ◴[] No.25076399[source]
That still seems weird. Why does running unrecognized software become safe when you're off line?
replies(3): >>25076483 #>>25077222 #>>25082161 #
type0 ◴[] No.25077222[source]
It's a security theater
replies(4): >>25077806 #>>25078011 #>>25079751 #>>25080381 #
nmg ◴[] No.25077806[source]
Thank you. Phrased perfectly.

It's an invasive restriction, cynically designed, poorly engineered and improperly managed, that impairs your ability to function.. masquerading as security.

macOS is my favorite OS, but I don't need to use it. I was so psyched reading about the new Macbooks, and I've had to walk all that excitement back now. I cannot invest in a computer that locks me out of my job if a cable gets cut by a maintenance crew in Cupertino.

replies(2): >>25077953 #>>25078576 #
snowwrestler ◴[] No.25078576[source]
If you point the request at localhost, the problem resolves. This means that a cable getting cut in Cupertino won’t matter. It is a revocation protocol; it fails open.

The problem today is that not that the connection to the server failed, but that it succeeded very slowly. The result was an accidental denial of service on the client.

It is a bug, and an easily fixed one at that.

replies(1): >>25078757 #
tomxor ◴[] No.25078757[source]
This particular issue is easy to work around for technical users; the _problem_ is the philosophy that made it possible.

This is the reason I can no longer use Apple computers - the continuous battle they are waging against the users freedom on all fronts - the anxiety of what they will do next to _my_ computer is too much.

replies(1): >>25079438 #
jachee ◴[] No.25079438[source]
Good luck finding a suitable replacement. Microsoft does unpredictable things to Windows. Linux maintainers do unpredictable things to all sorts of things.

Your only real recourse is to compile everything from source after a thorough review every time...

...or else trust someone.

Sure Apple had a problem here, but there are so many other reasons to trust them over any other org that I can't in good conscience switch platforms, because there's so much more anxiety elsewhere.

replies(2): >>25079462 #>>25087766 #
heavyset_go ◴[] No.25079462[source]
> Linux maintainers do unpredictable things to all sorts of things.

With Linux you don't have to worry about every program you launch being reported to the mothership, or that failure of the mothership to respond would cause your computer to not function.

replies(1): >>25079548 #
jachee ◴[] No.25079548[source]
If you're not reading all the source of everything you're running, any or all of it it absolutely could be reporting usage/stats/your data to a "mothership".

Just because there's no single central org involved doesn't mean there aren't risks.

replies(3): >>25079992 #>>25081276 #>>25086229 #
inimino ◴[] No.25079992[source]
You don't need to read it, you just need to be able to read it.

Just because there are risks doesn't mean the risks are meaningfully comparable.

replies(1): >>25080967 #
1. muraiki ◴[] No.25080967[source]
Ken Thompson won a Turing Award for showing how that isn’t the case: http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...
replies(2): >>25088083 #>>25090093 #
2. teddyh ◴[] No.25088083[source]
May I direct your attention to https://reproducible-builds.org/
3. inimino ◴[] No.25090093[source]
That what isn't the case? Pointing out additional threat vectors doesn't in any way contradict my point.