macOS unable to open any non-Apple application
twitter.com
twitter.com
https://news.ycombinator.com/item?id=25074959&p=2
Here is another tweet that describes the problem in more detail:
https://mobile.twitter.com/llanga/status/1326989724704268289
> I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when `trustd` and `syspolicyd` are unable to do so, the entire operating system grinds to a halt.
EDIT:
As others pointed out, I put this to my `/etc/hosts` file and refreshed it like so:
sudo emacs /etc/hosts # add `0.0.0.0 ocsp.apple.com`
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # refresh hostsI agree that breaking system availability when an OCSP server isn't available is user-hostile and unnecessary.
I don’t think the design is wrong, I just think it’s tuned a little too cautious. If you’re going to verify certs then checking the CRL is something you really should do before approval. And you can’t sync the database entirely because it’s too big.
There really aren’t any good solutions to this unless you can solve the cache invalidation problem.
I think it's probably an unintended bug that this failure mode was fail-closed.
The costs of this unintended bug are going to be huge to Apple's reputation, as demonstrated in this whole HN thread, where many assuming what's going on is even WORSE than it really is.
(Personally I think having signed certs (with opt-in ability to run unsigned apps, as MacOS has) is fine. And fail-open OSCP revocation check is also fine-ish, although it would annoy me if it's making it slower to launch apps on the regular. The problem here is a bug, not one of design. But most of this thread is assuming Apple was doing something different than this. Of course, how often a company produces fairly catastrophic bugs is also on them).
Much faster, updates relatively quickly, and not subject to network outages.
A better option is to asynchronously update a Certificate Revocation List ("CRL") and perform any check local to the machine. This avoids disclosing to Apple every single time you run a program, which program it is, and what network you're on. It could also emergency-revoke certificates just as quickly as the OCSP design by polling at the same frequency (every app startup).
Based on the OP tweet... depending on the way it is unavailable, the failure is indeed ignored in some cases. "Denying that connection fixes it, because OCSP is a soft failure (Disconnect internet also fixes.)"
So it may be an actual unintended bug that a particular failure path results in a DoS instead?
Edit:
Just reached out to Dang with a request to correct my typo.
And just before this, I finally managed to fix Spotlight pegging one core at 100% constantly. Next thing, I reboot into a laggy system. macOS is my favorite OS, but the shit I put up with... it's basically an abusive relationship at this point.
/s obviously.
Right there with ya.
Apple folks in this thread, this was terrible
I almost cannot believe the actual cause. Absolutely awful experience.
Idk, the several Linux distros I’ve used recently, and Windows, have a much longer list of “shit _I_ put up with”
(P.S. I despise Windows from a technical standpoint though)
This is a good point actually - with their walled garden approach, Apple has a much easier job with drivers than Windows or Linux have.
Of course, the end user may not care a jot, but it's an interesting point from a technical perspective.
I just replaced that pos with a mac mini....
I use centos 7 for my daily driver, it'll get 8 on it next hardware upgrade. Touch wood not a single problem with that for years now, and amd5000/nv3000 are looking very tasty.
In a previous company the IT dept had to revert a forced by MS update manually on each machine by “hacking” and deleting and replacing files as it was causing BSOD.
A co-worker keeps telling me to try Manjaro. I'm just not sure if I want to spend a weekend reinstalling all the stuff I use.
As for the Safari issue, I have no idea off the top of my head.
Oh, I do like the gesture support, though even Windows 10 supports gestures nowadays.
[1] https://www.techradar.com/in/news/microsoft-kills-off-window...
[2] https://www.techradar.com/news/dont-install-this-windows-10-...
[3] https://www.techradar.com/in/how-to/windows-10-may-2020-upda...
Meanwhile on Linux, I cannot upgrade to the new kernel that contains a lot of support and fixes for my new shiny AMD Ryzen chip because it completely breaks the Nvidia driver, refusing even to boot.
Apple may suck, but it still sucks less than the alternatives
Well that's the problem with Linux distros for the desktop in general. A user upgrading a newer version of a single system component risks breaking the whole desktop: systemd, libdrm, x11, whatever and something else doesn't work. I'm even excluding drivers here but again it's clear what happens when a user finds that out for themselves on Linux. If they even have the time and energy to do all that digging and googling of cryptic errors.
To save yourself the time and frustration, Just keep using Windows 10 with WSL2. I don't have any reason to dual boot to a Linux desktop any more due to this.
It is - quite clearly - a gross exaggeration that "every update borks the system".
Aside from MacOS, I use Windows 10, and have done for several years. I have the Microsoft Action Pack, which means I get multiple Windows 10 Enterprise licenses - and no forced updates.
- Lack of little useful apps in the $10 range. Windows seems either freeware or costly bloatware.
macOS' problem is fixable but OS being worse isn't something you can wait to get fixed quickly.
https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...
It is my understanding that a lot of modern GPUs that are cutting edge ship with non-oss binary blobs, which goes against Debian's core principals.
Unfortunately, it means that Debian has poor support for hardware vendors that mandate these binary blobs.
[0] https://packages.debian.org/buster/firmware-amd-graphics
Yikes. This is painfully true. Maybe Apple knows they have a ton of breathing room here.
I’ll jump through a few more hoops to continue using the machines they make. Then again all I do is edit text.
Anxiety from what Apple's agenda will do to your computer next update? anxiety from if a 1hr windows update is awaiting you when you turn your pc on? ... Linux awaits.
Linux awaits and then when it comes it borks AMD driver, because AMD decided not to support older cards on the new FOSS driver, and the old perfectly working driver is not compatible with modern kernels, driver ABI be dammed.
Linux awaits and then when it comes it breaks hard disk encryption forcing a full install, and feeling lucky that I actually backup /home regurlarly.
Linux awaits and then when it comes half of the stuff doesn't work in Wayland.
Eventually I rather just deal with macOS, Windows, Android and leave Linux just for the kernel itself.
No man gets to deal with all of the possible computer problems, thankfully. But in my experience, most Linux problems have been fixable and I managed to fix them, while more closed OSs have left me stumped many times. I no longer believe that a computer can work without problems, so my priority is making sure that when problems appear, I can diagnose them and fix them easily.
So I agree, Linux problems are usually much more fixable.
If you have any other insights, I'd be happy to hear them. We have a workaround, but It'd be nice to get imports working again.
As for Windows... really no issues there other than forced errors of whatever absurd company policies are in place that cause software I don't want or need being forced on my machine.
Every time I've tried using Linux on the desktop, it's worked just fine until I tried to update something. Sooner or later, there's some broken patch or some incompatible thing here or there that breaks my window manager and throws me to the command line, ruins my network settings, overwrites my boot config or some other maddening mess. Linux works brilliantly, AS LONG AS YOU NEVER TOUCH ANYTHING
Today my mouse and keyboard were acting as if they weren't plugged in. Just no power, no reason, no change. Reboot fixed it for now
The thing that's changed recently is that I had to update the kernel to support my audio interface.. which was also a pain in the tits
The only relevant search results are StackOverflow spam talking about a version 10 years old
Linux awaits
Ain't that the truth with every OS. I use Windows for gaming, PopOS for work on my desktop and MacOS for work on my laptop. The amount of weird issues is about constant.
But linux is free both as in free beer and in free speech, windows required you to pay the Microsoft tax to use, and lastly macOS required you to pay a premium on hardware.
Paying $100 for Windows seems like a better solution if you just want a working OS without a hassle.
And what premium do Mac hardwares have? It seems I paid what they deserved as I can't find anything better in the market. Even moreso now that M1 is out, it seems all Windows machines have premium.
Yeah, I don't use peripherals as it's only a gaming machine (I don't see other reason to use Windows) but it's working as intended for years.
A level of detail I value is that none of that BS is baked into systems I use. Doesn't matter whether those who did not do so were paid for it or not.
I had to make a phone call since none of the methods Windows or the internet suggested worked and that phone literally took 30 min to reactivate my license again. That wasn't fun.
(wink wink)
>> Paying $100 for Windows seems like a better solution if you just want a working OS without a hassle.
I've been running Fedora for 15 years and haven't had any of those pesky Linux issues for at least 8 of those years. Meanwhile, I was issued a new Windows laptop at work just last week and it Sucks pretty bad. It's smooth and polished, but with all the advertising and "first ones free" preinstalled shit it feels a lot like Facebook rather than a computer. I'm glad its me-at-work being monetized and not me at home...
I can't help but think you meant, "I've accepted there's no real way to salvage and diagnose my computer when it breaks so reformatting it has become second nature. I always keep an up to date Win10 install USB ready, and I even have a second hard drive that I keep all my files on."
With Macs, you have to put up with MacOS and Apple (one big premium is lack of choice). It's also not that easy to self-administrate without MDM, and software options are relatively limited if you come from either Linux or Windows.
FWIW I switched from XP to Vista 1 or 1.5 year after its release date. It has been a great OS for me, I never had a problem with it (except that it's then they started with the bullshit telemetry).
Of course YMMV, but since late Vista stability isn't a major issue anymore.
I wish you weren't wrong.
If Windows 10 was unstable I should be swamped. But I spend more than 90% of my time on software dev.
And the machines are not new with fresh installs, I all migrated them manually from Windows 7.
> software options are relatively limited
When was the last time you used macOS? I see the options limited on Windows rather and even moreso on Linux.
What do you mean "take care of the level of detail"?
I can download Debian right now, install it on hardware in about 10min, and get everything to work rock solid without any hitch.
I can't say the same about either Windows 10 or macOS.
In fact, I had mojave crash and reboot more times in the last month than Ubuntu 18.04 since it was released, and mojave is preinstalled in its own target hardware, which is supposed to be high-end, while Ubuntu is installed on a cheap laptop that cost between a third and a fourth of my apple laptop.
What exactly do you mean by level of detail?
Half of the apps I use are on Linux as well but that won't get me to the productivity on macOS.
Or just run macOS in a virtual machine
- Logic had the pole position for non-pro-tools music at the time, and sold (IIRC) for about $600
- Apple bought Logic and stated publicly "we will not discontinue it on windows"
- I think a year later, might have been two, they cancelled it on windows
- Some time later, they dropped the price, and also put out garage band, using Logic's engine.
- Logic's product roadmap (from what I've heard) became more general user friendly (can't attest to this personally though)
Basically, anything Apple owns becomes part of the plan to get you on a mac and iEverything, secondary to whatever it's originally purpose is. I won't touch any music software now that doesn't run on at least 2 operating systems. Fortunately most of them now realize the importance of this.
I'd recommend looking at other options like Reaper, Cubase, or Digital Performer, all of which have been improving steadily and can on windows or OSX.
Personally I'm sticking on High Sierra, and doubt my next machine will be a mac. Man I'm going to miss Bash everywhere though. Sigh
As developers and engineers, we ought to be jumping off this platform like a sinking ship. It's clear that they want to lock it down like the iPhone. Why else would they be measuring which apps are in use if they didn't want to control it?
If your argument is "compatibility research", you're missing the other warning signs.
This is about when I remember seeing it: https://medium.com/@acecilia/apple-is-sending-a-request-to-t...
Disclaimer: not affiliated.
I have machines around the house with OS'es going back a ways...
Yeah, these _could_ be unrelated issues to what has been going on in Apple land today, but it's uncanny...
When was `trustd` introduced?
I think you were just lucky to not open non-Apple applications during the outage.
And this is why I won't be moving to Apple silicon. Apple already has the ability to restrict whats apps I can run (they can simply toggle a switch for all users to "no unsigned binaries"), and congrats! Apple is the sole decider of what we get to use on our computers.
Of course Apple's Craig Federighi assures us that the people making such assertions are "tools" (https://youtu.be/Hg9F1Qjv3iU?t=3177 , timestamp 53:33) and they have no intention whatsoever of taking away our ability to do general compute on the machines we buy and own.
Except...
Apple can already decide what binaries you can execute. Should they choose to.
Apple is now restricting what other OSes you can boot into. As they've chosen to.
Apple can now make their machine reject a new, third-party repair part like a bad transplant. Should they choose to.
It's clear where they're going. And I'm jumping ship. It's painful to do so, given how invested I am in the ecosystem, but we're already beyond the threshold that many of us would have left earlier in the decade.
---
edit - It's also really hard as a designer + developer + would-be researcher in the making to find a good computer. Most non-Apple laptops don't have very good color accuracy. They also don't have good trackpads, and their keyboard + trackpad alignment is wonky (it's off-center in a lot of cases! How weird is that???)
I'm trying to find a laptop with good build quality, long battery life, a good display that I can design on, a good trackpad so that I don't have to carry around a mouse, good speakers would be a plus, and light enough that I don't feel like I'm lifting weights while working on my laptop. And this package should ideally come with 512GB of SSD storage and, at least, 16GB to 32GB of RAM.
Oh and it shouldn't be more expensive than a Mac as many of these laptops are!
Any suggestions?
The 2009-2015 era of Macbooks are, not were, truly phenomenal machines.
I use arch linux on a Lenova Thinkpad T580, and I'm really happy with it, but I'm not sure about the colour accuracy of the screen. I doubt it's as good as you find on an Apple.
I, for one, am really interested in good, high quality alternative to apple laptop hardware, that meet the parent's criteria.
Dave2d on YouTube gives pretty short and decent laptop reviews. I think he has a discord channel discussing the machines too
* Once a month or so, the touchscreen flips out and starts registering dozens of random finger taps per second. There are tons of complaints on the internet, but Razer never acknowledged it as a known issue.
* One of the long rubber pads on the bottom fell off after about a year and a half.
* The USB-C power cord's insulation was frayed from day one.
* When running Linux, the kernel continuously reports "correctable" pci-e errors, indicating a signal integrity issue. I had to turn down the verbosity of the messages to keep from spamming the journal.
* When running Linux, a monitor connected via HDMI has random "snow" noise. When playing any sound through the builtin speakers, the monitor blacks out every 10 seconds or so. Plugging in headphones "fixes" it.
* The bios' ACPI implementation is buggy and doesn't properly report whether the lid is open or closed. As a result, the laptop sometimes fails to go to sleep when I close it, and sometimes fails to wake up when I open it. It works most of the time but not always in windows, and linux got into a perpetual sleep-wakeup-sleep loop until I found the right workaround.
* A plugable brand thunderbolt dock "glitches" every 10-20 seconds when typing on a USB3 keyboard. Plugable claims it's due to buggy Intel firmware in the laptop. To be fair, a different brand of dock works fine, though.
It boggles my mind how they can be so successful.
Dell Precision, HP Elite Book, MSI Prestige
In the consumer world the Dell XPS, Asus Zenbook, Asus Pro Art are the way to go for a designer.
Dell Precision is probably the overall best laptop. MSI Prestige is targetted right at you though, with color accuracy and a good display. The only brand I can personally vouch for is Dell. I and my partner use XPS's, and a good friend of mine has a super nice Precision that I am jealous of (specifically the ports! I'm so over USB-C)
There are also boutiques like System76, that white label, upgrade, and manage driver compatibility for Clevo laptops which may be worth considering, they just came out with a new Lemur Pro like yesterday.
As far as I know this issue is still not fixed so I have to use this hack: https://github.com/erpalma/throttled
I’ve also had tremendous Thunderbolt-related firmware issues that could only be fixed in Windows. If you use Linux, there are much better options than Lenovo. I still use my T480 daily but I miss my old XPS 13, which gave me no issues ever.
The trackpad is bearable, and I have a 3rd generation so my 1080p screen isn't IPS, but it works well enough for $200.
Absolutely no trouble on x395. It's been running Linux (Arch) for a year, and it is my main system.
Their competitor was Compaq NX series (HP EliteBook of today). Dell was late to the party and closed the gap by actively developing software for Linux (DKMS, Privacy Drivers, etc.).
Lenovo's ThinkPad line is still quite differentiated from their other offerings. What are your objections to it?
While it's entirely possible there's a connection between decisions like that and IBM's PC division being unprofitable enough they sold it to Lenovo, it might be reasonable to hope that Lenovo would make the effort to offer competitive panels when it's obviously possible for their competitors to source them.
They're explicitly sold with FreeDOS option to imply that you can directly install Linux on them.
Even my run on off the mill desktop shows more soft-errors about IO layout and memory mapped devices on board.
I don't need to use throttled on my X1 Carbon 7th and they recently added mainline support for the fingerprint reader. All I had to do was enable it in GNOME Settings.
Try to run performance test with s-tui if you see a difference.
On Arch the command to enable the fix is:
sudo systemctl enable --now lenovo_fix.service
I am not into gaming or graphics though. Still, with my (unusual) usage pattern I get almost 10 hours battery life time on the road, and all the CPU power I need locally. For heavy stuff, I compile remotely anyway.
I can't for the life of me get it to be bright enough to use in a lit room. A bit of hyperbole here, but I basically have to hide in a closet and stuff a towel under the door to see the fucking screen. I love the keyboard, but I basically won't use the thing now because it's such a drag to use.
Edit: the joke is that the house of horrors is my code
Turned out windows power saving and battery settings actually capped my brightness. So my user-controlled "100%" (via keyboard) actually becomes more like 60%, depending on the power profile.
As soon as I got a new m2 ssd, I shelved Windows and installed Fedora WS, which has no such issue. That is, if I say I want 100%, it obeys.
You can quickly test with either a live USB, or tweaking your power profiles.
for backlight in leds/tpacpi::kbd_backlight backlight/intel_backlight; do dir="/sys/class/${backlight}"; if [ -d "${dir}" ]; then echo 0 > "${dir}/brightness"; fi; done
How is that exceptionally bad support? I'd say that's the opposite.
I get firmware updates on my X1C because Lenovo decides to work with fwupd and the open source community, something most manufacturers refuse to do.
The screen was something like 30% color accurate
Using something like F.Lux or Redshift to shift the color space at night resulted in...this
Linux: https://www.youtube.com/watch?v=UhLBx4mmPrM
Windows: https://www.youtube.com/watch?v=QgjqeDF9c50
Lenovo refused to replace the panel with a less atrocious SKU, claiming I could instead purchase it for a "mere" $600 USD(!)
Thankfully Australia has strong consumer protection laws and I was able to get the unit returned and refunded
I have a P72 and it is garbage. Plugged into a docking station it works OK as really expensive mid-range workstation. Trying to use it as a laptop causes the fans to spin like crazy, performance throttled to shit and the and battery life of maybe 90 minutes for even fairly modest workloads. The similarly specced Dell Precision I had before was much better in every way and was actually usable as a laptop.
The P5X series that many of my colleagues have seem much better.
So, just like macbook?
Not sure I'd recommend it. Build quality is very good however.
I know I'm not alone; even just in my circle there are two other stories of horrible mishaps with this company.
Lenovo makes some decent machines, sometimes, but their warranty service is not to be trusted.
I got these results from, https://www.notebookcheck.net/MSI-Prestige-15-A10SC-Laptop-R...
When i configured the Laptop i could choose from these options:
FHD IGZO4, 1.920 x 1.080, 100% sRGB
UHD IGZO4, 3.840 x 2.160, 100% AdobeRGB Touch
UHD OLED, 3.840 x 2.160, 100% DCI-P3
I have to use a Dell XPS 9560 and had two issues with it, most people never realize:
1. The Intel Thermal management driver is buggy so the device shuts off on very high-load tasks. You have to find the old driver on the internet and install it, and prevent windows from reverting to a new driver.
2. Only after two years of hanging connections and dropped UDP-packets I ran a speedtest and realized that this is not my home-internet being weird, but a systemic problem of the Wifi-card, which others have reported on the internet as well. Switched cards - getting windows to recognize the new one was difficult - and now I have normal Wifi.
Both of these issues are terrible for customers, and I still wish I wouldn't have ignored/overlooked the Wifi-issue for so long, as it interrupted work for a very long time.
Second is the same as yours, the Killer Wi-Fi is subpar. Can't keep a steady connection. Can trigger bluescreens if resuming without power cable and running Firefox (I think). Have not changed my Wi-Fi card yet.
In as much as I love the Mac touchpad for kanji/hanzi input the 2015 pro will probably be my last.
I'm currently in the same boat as you and my next machine will be from these guys when my (admittedly very new) Macbook Pro gives up or gets taken over by Apple.
Those are laptops with numeric keypads, the trackpad is still centred relative to the "main area" of the keyboard (the home row and in particular the rest keys - the two keys with a little bump, F and J on a QWERTY) but it is off-centre relative to the body of the laptop due to the presence of the keypad.
Macs don't have numpads so if you've always used Macs it's understandable that you're not familiar with this type of layout.
In any case that type of placement makes no difference while you are using the laptop, because keys and touchpad are still where they are supposed to be relative to each other.
So unless I scoot the laptop off-axis or I have to move my hands off axis to type.
I'm unsure how this isn't unergonomic. It's not something to get used to. It's bad design. Period.
I haven't used a Mac in years but the one thing they always nailed was the trackpad. It's big and actually centred on the laptop body.
https://upload.wikimedia.org/wikipedia/commons/thumb/b/b4/De...
https://i.pcmag.com/imagery/reviews/05RhNkV9HnULG0LW4YRfKzZ-...
https://www.tec-int.com/media/catalog/product/cache/2/image/...
It’s much easier and more comfortable to adjust my hands over a slightly offset keyboard.
I gave it a try for one minute when I unpacked my new laptop in 2014 and I immediately shifted it to the right: typing as you suggest was terrible for wrists, shoulders and probably the spine.
My workaround: I move the windows I work more often (eg: the editor) to the left part of the screen.
To be fair: there is no way to fix an ergonomically broken design. There are only mitigations and those a probably subjective: everybody is a little different and muscles/skeletons/etc can accommodate different twists.
That switch was toggled with Big Sur and Apple silicon: https://mjtsai.com/blog/2020/08/19/apple-silicon-macs-to-req...
> There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long-established policy that our users and developers can run arbitrary code on their Macs, and is designed to simplify the execution policies on Apple silicon Mac computers and enable the system to better detect code modifications.
(Source is the link you provided.)
I switched away from Macbook Pro about a year ago, after using Apple hardware for about a decade.
It's working great, GNOME interface is solid and productive, Manjaro and AUR libraries just work. Highly recommend making the move, sooner the better as I'm sure you see the writing on the wall.
It is basically a milestone; since new binaries are needed, they might be as well as signed.
Its very similar to the x1 carbon but converts to a tablet and it has an aluminum body.
I can't say I'm out of the apple ecosystem entirely, but I decided to spend my money elsewhere given the abysmal quality of the macbook pro line these days.
https://slate.com/technology/2015/02/lenovo-superfish-scanda...
Linux is not magically immune to this attack. One could argue it is more susceptible than other OS due to lack of binary signature checks on executables at runtime (at least by default).
* Chromium-based applications (the browser and Electron apps like VS Code) still don't know how to render themselves with fractional scaling and end up ever so slightly blurry (but correct sized) on fractionally scaled displays. Think like very old applications (like Control Panel) on Windows 10. I use Firefox so it doesn't bother me that much. There's a issue in Chromium bug tracker following this, but I can't find it right now.
* Screen sharing full screen or other windows than browser tabs doesn't work on Google Meet / MS Teams. This is and has been an issue in Wayland since forever.
This is most likely because they don't support Wayland. The scaling with XWayland doesn't really work great a lot of the time.
I don't use scaling for my 4K monitor, and just set text sizes larger. It feels a bit weird for a while but eventually it's actually quite a nice balance where the content is relatively larger vs. the chrome.
Chrome has experimental Pipewire support; enable it in here: chrome://flags/#enable-webrtc-pipewire-capturer
Firefox (at least on Fedora) has enabled it out of the box.
Electron apps are blurry, tracking https://github.com/electron/electron/issues/10915
And then almost none of those bad things happen. I've witnessed this dozens of times now, so a safe interpretation would be to assume that this time none of those things happen.
Do you want to be burdened with layers of backwards compatibility and end up like POSIX or Autoconf with provisions for things that once run on some long forgotten UNIX OS version?
I'm aware end users with discontinued software were forced into some no-win choices. But as an ecosystem, it's one example where this happened and was given a ~15 year possible window and an explicit 4 year window to transition.
We have been effectively boiled like obedient frogs.
I love macOS but my next laptop won’t be a mac and my next phone won’t be an iPhone. Divesting from the ecosystem will be painful but we’re well past any grace period at this point.
Then they disabled execution of all unsigned binaries. To run on a default Mac, you either pay Apple or compile on the user's own machine which is obviously unsustainable. https://eclecticlight.co/2020/08/22/apple-silicon-macs-will-...
They've also removed any 32bit support, in case you could make do with old programs that don't make Apple some money.
I'm still on Mojave and will not upgrade. Personally, my last MBP was bought in 2016 and I have no intention of getting another one as long as they continue exploiting developers and the public in this way.
This is not true. Apple silicon runs code with any signature, even an ad-hoc one.
same here. I hope this will lead to a leap in quality in alternative mobile & desktop OSes, because at the moment the situation looks pretty bad.
Sounds like you might want a Microsoft surface (or surface book).
Not sure about the TouchPad - but at least there's a pen for drawing on the screen.
Pros that Macbooks don't have: USB-A (along with USB-C), no touch bar, 3:2 screen, can enable secure boot if I choose so feel like I'll be able to run whatever I want on it, replaceable SSD, etc.
Pros that Macbooks also have: still has a great build quality, full day battery
Cons that both have: Non replaceable RAM
The only downside is that I have Windows 10 on it, and considering Microsoft actively destorys user data and has for 15+ years as company policy...I won't use it for serious work, only entertainment. :(
User state is also a time investment, so rebooting and destorying this is not ok even if all files by some stroke of luck were saved first
> 3:2 screen
It feels like if they play the next iteration right Huawei could blow most of the top end out the water, there's so little choice at the top end and they all seem riddled with build quality, hardware or software issues.
I'm glad I took the risk on the Huawei and I don't really regard the Chinese spying moral panic as an issue. If they want to spy on you I'm sure there's far easier ways online than trying to backdoor a highly scrutinised laptop.
Here's a list of the laptops with the best displays: https://www.notebookcheck.net/The-Best-Notebooks-with-the-Be...
And here's a list of general multimedia laptops that would be roughly equivalent to a MacBook Pro: https://www.notebookcheck.net/Notebookcheck-s-Top-10-Multime...
Edit to add: The other thing is that for their percentage laptop score, you should generally subtract 80 and multiply by 10. I've never seen them review a laptop below 60% or above 92%.
I woukld agree on desginer.
Absolutely not on developer or researcher.
Actually MacOS is for the reasons you mentioned incredibly developer-unfriendly (unless you target is of course the iOS ecosystem).
And for research there is no better platform but Linux. Unless you are in clicky-colorful frontend applications where I would doubt you are doing serious research.
Laptops and gaming is a terrible combination because of the thermals.
To be fair, it's like being trapped in a silver gray aluminum cage with uniform body and irreplaceable bars. I wish more companies would make a PC laptop that doesn't suck aesthetically. Even when they use aluminum, most PC manufacturers don't spend much time on designing a good keyboard (arrow keys not having the same shape comes to mind.)
Graphic designers because the nice display...
Otherwise i don't get it. I think for most other people it's a status symbol ;)
I especially don't understand why IT affine people buy it. Just buy DELL, HP, Lenovo, Alienware and install linux. Gives you more bang for the buck...
Unfortunatly Linux isn't really an option just yet for a lot of us.
Buy something without a number pad. Unfortunately most 15" laptops do have one.
If anybody from HP is reading this, I'll pay an extra for a keyboard without number pad on your 15" ZBooks with 3 buttons on the touchpad. Space bar and touchpad aligned with the center of the screen please.
Trackpad is as good as it gets outside Apple, I'd say.
The display looks gorgeous. Can't say about color accuracy/fidelity though.
Clearly there's no need to jump ship if it's more expensive on the other side.
Recommendations for linux laptops (or checkout https://linuxpreloaded.com/ ):
* Tuxedo https://www.tuxedocomputers.com
~1000$ 1.5kg, Their "15, 1080p flagship is configurable with AMD Ryzen 7 4700U, 32GB RAM, 500GB M.2
They also have more expensive versions with 4k OLED displays if that's what you're into. Also "13.
* KDE Slimbook https://slimbook.es/en/store/slimbook-kde/kde-slimbook-15-co...
~1200$ 1.5kg, "15, 1080p, AMD Ryzen 4800 H, 32GB RAM, 500GB NVMe
* System76 https://system76.com/laptops/gaze15/configure
~1350$ 2.2kg, 15", 1080p, i7-10750H, 32GB DDR4, 500GB NVMe
* Purism http://shop.puri.sm/shop/librem-15
They're trying to become and opensource Apple --> high prices, own linux distro, trying to make their own ecosystem, etc.
~2000$ 1.8kg, "15, 4K, Core i7 7500U (Kabylake), 32GB RAM, 500GB NVMe
It seems the iPhone 12 is already rejecting non-original parts, even if the part comes from another iPhone 12: https://news.ycombinator.com/item?id=24924761
Linux also has native support for hardware pass-through if your machine has an IOMMU, so you can give virtual machines direct access to graphics cards and get GPU acceleration in your VM, along with USB devices, etc. VirtIO is built into the kernel and can provide you with paravirtualized network and storage access, which can speed things up considerably.
For "easy" for people who don't have time or experience, I would instead recommend Pop!_OS https://pop.system76.com/ flash a liveusb stick and you can try it out on your hardware without needing to install it first.
In this regard, only NixOS compares. Even macOS is much much worse, as you need to go through upgrades. I have used the same Arch install for 8 years.
I've noticed a trend where people who are new to Linux will jump on Arch because they believe it'll give them more power, or that they'll learn more by using it. Or people will install Kali because they think it is what hackers use, and completely miss the fact that Kali isn't meant to be installed at all.
It's all Linux under the hood, and you get the same amount of power no matter which distro you use. And when you use a distro with sane defaults like Ubuntu, you're able to dig into the internals whenever it suits you, and not because an update broke your computer.
I've been very happy with Ubuntu 20.04. Not without issues, but overall it's been quite stable and snappy (pun intended) and I prefer it to macos and windows.
Windows can out-of-the-box do HiDPI, multiple monitors, multiple desktops, trackpad gestures, hardware accelerated UI rendering, facial recognition logins, and more. It was designed as a desktop OS.
On Linux some things are getting better if you stick to the Wayland+GNOME stack, but it's still so bad I can't recommend it to people on technical grounds. Use it if you believe in free software, not because you think it's "better" (it's not).
Edit: forgot one more annoyance. The laptop seems to frequently power off completely overnight even though it should just be sleeping/hibernating.
If lenovo would come out with a laptop with no trackpad I would be the first to order it, I normally disable the track pad completely..
Traditional mouse or even a trackball are far far better
I occasionally have need to use a laptop in conditions where a mouse is inconvenient, so i prefer to have a trackpad, but I find that even the best trackpad is far inferior to a mouse. (Trackball, at least the kind that gets integrated into a laptop, isn't an improvement, IMO over a trackpad.)
As for screen availability, I think it's more to do with the fact that these are business computers. Lenovo only recently started blurring the line between their premium and business class devices.
I think every post-Haswell ThinkPad comes with a 720p screen in it's default configuration. At least up until Tx90/5 series.
It is off center if they have a number pad to the right of the normal keyboard layout. At first glance it looks weird, but it is 100% what you would want if you were using the laptop. Otherwise the trackpad would end up being right over where your right wrist is.
I don’t like the boot thing either, and it’s a bit scary not being on intel as everyone else is right now, but I also think ARM feels really interesting and it might turn out to be a great new platform!
Edit: i mean it is not like they never listen, they did take bake the mac pro, they did fix the keyboards, you have cli tools to make a lot of changes in how macos works, etc. Of course I would like hundreds of things to be different, but I believe that is true of all platforms.
The onyx pro model, it’s not great on battery when using the nvidia graphics but it can play 3D games via steam.
I do kinda like the pop! Os Linux distro.
Wifi that works... Audio that works... Plugging in and out external monitors that work... Netflix/Youtube in HD without burning the cpu and draining all battery
Basic hygiene essentially.
I use linux on a laptop every day for the past years and have tried Dell, HP, Lenovo, Asus, Ubuntu, Arch, Mint. Lately things are working, but only most of the time, never really really 100% as a Windows/OSX machine does. You always have to live with those 1/20 times sleep did not wake up or oh time to reinstall pulseaudio again for microphone to work.
Apple has a pretty broad utility patent around their trackpads, which requires other manufacturers to work around what would seem like pretty obvious things.
PDF: http://assets.sbnation.com/assets/2017767/USD674382S1.pdf
My requirements have all been fulfilled with the Huawei MateBook X Pro.
You could say it's heavily inspired by the MacBook. Aluminum case. Chiclet keyboard with decent travel. 2000x3000 display (2:3 ratio!). Awesome trackpad. Good battery life. Portable. Solid. 2x USB-C and 1x USB-A. Sustained multiple drops.
For context, I am able to pull solid 12-hour days on the device, without a mouse, without fatigue or frustration.
Cheaper than a MacBook. Might be worth a look.
Not the best idea security and privacy wise.
In any case, everyone has their own level of comfort, and that's important.
[1]: https://support.lenovo.com/us/en/product_security/ps500035-s...
That's another case of a product not doing its primary function - OS running apps - because company placed their own (data gathering) objective above it. See thermostats not turning on heat when the internet connection is down and other equally stupid examples...
My Twizy and Ioniq haven't got a single touch of data gathering neither a SIM card/wifi connectivity.
Otherwise, my car is very secure when I never use it. Like, totally. Flying also has become very very much safer.
Edit: is/use/
Nobody cares what you intended, they care how you actually affect them.
What actions on Apple's part have tangibly compromised their user's privacy?
But when the endpoint is dying and it gets called every time you try to run any binary…
So when you open an app, how else are they going to check whether the certificate is still valid or whether it has been revoked?
Can anyone confirm whether this lookup applies to unsigned as well as signed binaries? As far as I know if I build a brand new binary with cargo, and run it, it doesn't do any checks.
Never block me from opening something, but warn me about bad stuff on a regular basis.
Or if you do, only do it for a set of known bad ones, as antivirus products do.
Do not put a cloud service (or anything for that matter) between the users and their ability to run what they want.
I think perhaps a better tradeoff would be if a revocation list could be synced hourly or so and the app could be checked sync locally and then asyncronously on open. And of course, always give the power user an option to ignore things.
Just a small reminder that this can soon stop working: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur - https://news.ycombinator.com/item?id=24838816
I've been using Big Sur beta for some time and one of the things that annoyed me a bit was the sudden lack of responsiveness, which is a tad annoying given that I upgraded to a 16inch MBP earlier this year and everything felt so snappy.
You can also run these commands to disable ocsp (and crl) since it can no longer be accomplished in Keychain Access → Preferences:
defaults write /Library/Preferences/com.apple.security.revocation.plist CRLStyle None
defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None
defaults write com.apple.security.revocation.plist CRLStyle None
defaults write com.apple.security.revocation.plist OCSPStyle NoneDisable IPv6: sudo networksetup -setv6off Wi-Fi (where Wi-Fi is the name of the network service)
Last time I played with a Mac they also had the BSD `ipfw` command for kernel packet filtering [1]. Could try something there if it still exists.
Apple VPs who are listening, especially Craig Federighi - here is an early warning for you. The HN crowd may seem fringe, but they are living in the future. I de-Googled my entire life over similar transgressions by Google and several of my friends are gradually going through the same process, albeit more slowly.
And even though I just bought an MBP16, Apple monitoring every binary I run makes me want to sell it immediately and never buy another iPhone, Watch or Macbook. No one is going to catch Apple on performance and form factor for a long time, but I'm willing to invest in a long-term ecosystem that won't allow things like this...as long as I don't need to debug audio drivers. I am done with that phase of my life.
So if I had to choose an alternate path, what would such a path look like that could eventually approach the build quality of an Apple Macbook Pro? That product doesn't have to exist yet, it just has to be on the path.
(I looked at Alienware's M2 and M3, but it cost about the same as an MBP16 but with more blue LEDs.)
There was a time I remember when various things with Linux installations were often quirky or troublesome to get working well with certain laptop hardware, but I'm convinced now that this situation has improved tremendously since then...at least from my recent experience and hearing other good things about the Dell XPS and various ThinkPad models, and of course System76 (although I haven't had a chance to try one of those myself yet).
So if the dev edition fits your need consider buying this one
I was also hit by this outage today, at work, on my work laptop, while I was working. Apple literally cost me time and my employer money today, because their lack of foresight or inadequate provisioning of servers or whatever the fuck it was, fucked up my laptop. No good reason. They just fucked up, and it cost something.
Apple iphones seems even worse than Android, honestly.
I would have bought a Linux phone, but seeing that a few months ago they had trouble making calls on a Librem 5, I chose not to take the risk.
I wish there was a phone ecosystem I could invest in that ran Clojure near the metal. Some kind of Lisp machine would be awesome and make it more palatable to endure missing libraries and apps.
Actually it looks like it's possible : https://github.com/clojure-android
Myself I'm learning Flutter to be able to develop my own apps when I can't find what I need on FDroid.
The other thing that really can't be discounted here is that a lot of the HN crowd are likely the default go-to people in their circle of family and friends for this sort of stuff, and in many cases they may also have major purchasing influence and technical decision making power in their respective businesses. Turning off one of them may be inconsequential on its own in the short term, but it could seriously add up to a lot more destroyed mindshare and significantly more "lost" sales over time.
I'm experimenting with Linux these days. There are some minor annoyances with using an outdated version of macOS. Unfortunately those apply to not just one or two apps, but every part of the OS when using Linux. Basic things like WiFi drivers or sleep support. I'm encouraged by the trackpad driver project, but it's not there yet. So I'm still hanging on to my 2014 Retina MacBook Pro using 10.13, until some Linux distro catches up. I feel like that will happen soon though.
https://eclecticlight.co/2020/05/26/how-to-make-time-machine...
They mop it up and move on.
Big Co.'s must be allowed to fail. Don't hinder new contenders from rising to replace them.
Relative to my community in South Africa, I have spent more money on Apple products than anyone I know. And here I am saying that if these privacy issues are not resolved, I am willing to vote with my wallet as soon as I can find an alternative.
I only mention that I've de-Googled my life so that those who doubt my intent will know it's not an idle threat. These things take time to change, but they can and do change if you make your voice as a customer heard.
When you want to enact change at a Big Co:
1.) Communicate why you are forced into a buying position and ideally how to resolve it.
2.) Be willing to walk away, or you can't negotiate.
3.) Actively seek alternatives.
The vast majority of people here couldn't program a linked list given an hour and full access to the Internet.
The impact is just different and sometimes causes big issues if ignored
I used to think it didn't matter what tools I chose as a lone developer making consumer tech products and DSP audio applications. But over time, I saw that consumers rely on frontier-makers for fast-moving tech choices more than you’d think, even if they lag a few years behind.
When enough people make a choice, a tipping point forms in the future. Paul Graham wrote about this in "The Return of the Mac", and I believe a tipping point is forming: http://www.paulgraham.com/mac.html
If Apple wants to ride on privacy, then it will fall on privacy.
Keyboard sucks. Is it a tablet trying to be a laptop? Or a laptop moonlighting as a tablet?
Stylus sucks. It doesn’t have the accuracy of the iPad. And it always had a weird parallax feeling, so I gave up on using it. And the software was just mediocre.
I gave up and bought a Lenovo T4xx series laptop. Installed a dual boot Linux Ubuntu on it. Best. Computer. Laptop. Ever.
The Singles Day ad on the landing page made me think it was a domain squatting ad page.
Try to install an apk without internet connection, and then try over a slow 3G connection to see the several(!) minutes it takes.
If your phone has the old style data arrows, you will see the upload one all the time while you stare at the "installing" screen.
I am short Google and have been trying to figure out how to short their stock from ZA without losing opportunity on growth of other, better stocks.
Look into what state law protections you have. High ticket mail order items can usually be returned for a full refund for a fairly long time.
Finding out that it's phoning home about every binary you run is absolutely a good justification to return it. I would sooner throw out a computer that did that rather than use it.
Also everyone developing applications in the cloud was eventually targeting Linux as the production OS, which is a pain if your development OS is pretty much hostile do anything command line.
MS then put a lot of money into getting a Linux like command line and support into Windows with WSL.
They also got a bunch of influencers and devs do their thing with improving that kind of developer's experience.
Apple, however, has been sitting on their hands in this regard. They are moving exactly the opposite direction with this crowd.
I have no idea what rationale is behind that. Did they come to a different conclusion than Microsoft or are they just failing to execute on the strategy?
Apple sells silicon. They don't really care about developers; as long as they can pull enough users through the iPhone->iPad->Mac funnel, they have done their job of selling as much hardware as they can. In their view, developers bitch and moan but in the end will have to go where users go - at which point, Apple can tax them for access to the walled garden.
I really don’t think the HN community is at all representative of what the masses think about. Just like in any online community, it is easy to think that the thoughts of that community somewhat resemble that of most people when that simply isn’t true. HN’s base consists highly of developers who are up to date with most things in the technology industry.
The rest of the world doesn’t really care enough to compromise the comfort and reliability of Google’s suite, which lets be honest, outperforms its competition by a size-able margin, and does so with a “free” price tag.
People on HN have talked about de-googling for years and I have yet to see someone outside of the computer development scene do it (or even talk about it for that manner).
A surprisingly handful of non-tech people have asked me, "Hey, I see you use DuckDuckGo. Why not Google?" And then we have the conversation - it's a short conversation:
Well, you cannot prosper in an environment if you operate on inaccurate or censored information. Google & YouTube censor information and track everything you search for or watch. Today your views align, tomorrow they may not.
Secondly, you must insure yourself against tail risks, and having your Gmail account "cancelled" is a yuuuge tail risk. Therefore, avoid bundled Google products.
Then a few months will go buy, and I'll see they are now using Firefox and DDG.
When you have these conversations, it's important that it not be about your identity (open source! Linux!), but about risk-aversion.
The point is, things like this should never happen in the first place.
They are probably checking how far they can go, before it affects their bottom line.
It has some design flaws („hybrid power“) but what is really messed up is the QC: I have ProSupport and already had 4 technicians over and am currently awaiting my third full replacement.
Issues are all over the place: faulty trackpad, extreme coil whine, broken display, etc. Perfect device for me if they could figure out their QC. If the next one is bot perfect, I am getting a G14 which is the best performance/watt, performance/notebook volume and one of the best performing notebooks in general.
They have burnt a lot of good faith post Steve Jobs. But judging from current Apple management, they wont act until Sales numbers decline. As shown by the MacBook Pro Keyboard fiasco. And to make it worst, they seems to think most of these problem as PR and Marketing problem and dial up the marketing instead of actually fixing it.
( You can see that with Apple's marketing, especially with recent iPhone 12, with VPs explaining in podcast )
Thinkpad X1 Extreme Gen 2 is what I use and I'm very happy with it. My requirements were a moderately high-performance laptop, hybrid/discrete graphics, not excessively bulky and good Linux support. I can't fault my choice. The only issue I had with hardware compatibility under Linux was due to me receiving it a couple days after launch and the drivers for the wifi card not yet being in the kernel used by Debian or Ubuntu (no longer an issue iirc). Happy to answer any specific questions you have.
Reference: https://en.wikipedia.org/wiki/Microsoft_SmartScreen#Windows
(also I should know, I worked on a tiny part of this feature in IE9 and Windows 8)
But overall I am pretty happy with Windows being my daily driver now that they have WSL.
You'll keep buying Apple stuff. I know it, you know it and Apple knows it. If all of their past transgressions hadn't changed your mind you'll keep doing it. Cut the shit.
This code signing enforcement stuff has gone way too far. Heads should roll for this.
You can like that behavior or find it unacceptable, but the issue in OP is not that, it was applying to executables that had already been launched plenty of times on the machine.
https://medium.com/sensorfu/how-my-application-ran-away-and-...
It almost certainly is, but
1. You have to know it's happening before you can do anything about it
2. If your "work" isn't registered with the copyright office, you're limited to actual damages, which are probably close to $0
Imagine how many people would lost their productiveness, maybe not at the big corps or govt (I assume they use a version of mac that call somewhere else/don't). But very very many people.
First time ever I'm genuinely frustrated with apple - macs are not those unicorn tools anymore that work reliable
That might be what we just saw happen.
It wouldn't surprise me if they one day wanted to require you to be online 100% of the time so that you can't skip the OCSP checks on applications, but I don't think that would go over very well. Apple wouldn't even be the first to produce applications that refuse to work if there's no internet connection. If you don't like the thought that they might one day spring this on you, I recommend investigating Linux.
It's an invasive restriction, cynically designed, poorly engineered and improperly managed, that impairs your ability to function.. masquerading as security.
macOS is my favorite OS, but I don't need to use it. I was so psyched reading about the new Macbooks, and I've had to walk all that excitement back now. I cannot invest in a computer that locks me out of my job if a cable gets cut by a maintenance crew in Cupertino.
I’m wondering, suppose it was designed this way because part of the goal is to prevent the spread of malware, the fastest means of which is an internet connected computer. In that event, the feature only intrudes when the computer, by virtue of it’s internet connection, is a member of the threat class.
So... plausible?
Apple does not own the computer.
If Apple wants to own the computer, they can pay me instead.
You didn't pay for that. You licensed it from them.
I presume this setup wasn't public knowledge.
The problem today is that not that the connection to the server failed, but that it succeeded very slowly. The result was an accidental denial of service on the client.
It is a bug, and an easily fixed one at that.
This is the reason I can no longer use Apple computers - the continuous battle they are waging against the users freedom on all fronts - the anxiety of what they will do next to _my_ computer is too much.
Your only real recourse is to compile everything from source after a thorough review every time...
...or else trust someone.
Sure Apple had a problem here, but there are so many other reasons to trust them over any other org that I can't in good conscience switch platforms, because there's so much more anxiety elsewhere.
With Linux you don't have to worry about every program you launch being reported to the mothership, or that failure of the mothership to respond would cause your computer to not function.
Just because there's no single central org involved doesn't mean there aren't risks.
Just because there are risks doesn't mean the risks are meaningfully comparable.
Linux won't report to the mothership by design. If things work 100% correctly, you don't have to worry about some company knowing what programs you run and when.
If you're a media person then yeah, I feel bad for you, i've been there and it sucks, you're stuck with mac and windows if you require mainstream design apps.
The problem here is simply that Apple did not build a short enough timeout into their client.
I hate it too, but 'theater' implies it isn't useful in any way.
"Why were you offline when using your computer?"
If your computer is able to resolve DNS for ocsp.apple.com but to connection-timeout all traffic, yes, you could possibly reproduce today's issue.
Remembering the notarization problems people were having months ago I did some tests and confirmed.
Now have little snitch installed again and my laptops going to be an Apple orphan. So I never noticed this problem today by virtue of it pissing me off 2 days before.
Basically you'll get the usual GateKeeper window, but with a slightly different message, along the lines of "I can't check this binary in realtime but I trust the embedded notarization".
I've seen an identical problem where Chrome would hang for minutes when loading sites, and it was because I was in a firewalled environment that was outright dropping packets to Chrome's OCSP server.
After I restarted it I could actually launch apps other than terminal again.
The thing Apple does, on the other hand, with trusting themselves more than the user, is disgusting. I'm mostly libertarian, but if I ever become a president, this would be one of the first things I'd make illegal, right after shortening the copyright term to like 3 years.
> I'm mostly libertarian, but if I ever become a president, this would be one of the first things I'd make illegal, right after shortening the copyright term to like 3 years.
As a libertarian I can see the argument for getting rid of presumptive copyright (and tanking the US economy), but the government preventing people from entering into contracts that you don't like? That's just hypocritical.
It's not that. Plain and simple: in an ideal world, more money shouldn't grant more power and immunity. Governments should disincentivize this growth into the sky by, for example, progressive taxation for companies. The world would be a better place if tech companies actually competed with each other by making better products, not trying their damnest to lock everyone into their walled gardens to earn even more money they have no clue what to do with. Currently, when choosing something like a computer or a phone, you just pick one that sucks the least. There's no healthy competition.
So yeah, always gotta find out what a person means when they say "Libertarian"
https://www.weforum.org/agenda/2016/11/shopping-i-can-t-real...
Author's note: Some people have read this blog as my utopia or dream of the future. It is not. It is a scenario showing where we could be heading - for better and for worse. I wrote this piece to start a discussion about some of the pros and cons of the current technological development. When we are dealing with the future, it is not enough to work with reports. We should start discussions in many new ways. This is the intention with this piece.
The article sohuld not be read as an endorsement of that future. It's her prediction of what the world is going to look like, for better or for worse.
> Every year Stallman seems more correct.
In the sense that the exact risks he was trying to mitigate are in fact materializing in mainstream computing platforms.
Exactly this is happening with Apple now. Although Apple computers were fairly hackable in the past, with users being able to install Linux or Windows, that is changing. Apple is changing the hardware _and_ software to make it more difficult to do things that Apple does not approve of.
Stallman was keenly aware of this type of behaviour, and he was also aware that companies that have the potential to use this behaviour to this advantage, will often do so.
Apple wants to be in a position where they sell computers as appliances, and Apple Silicon is their step towards doing so.
By the way, I'm typing this on a Macbook pro that is no longer supported by Apple, but running Linux. I am not sure this would be possible in the world of Apple Silicon.
For infrastructure parts, it makes sense to be even permissive open source. For something in applications level, it would be nice to make money from it by charging corporations using it, while still being freely available for students and hobbyists. This could have combined best of open source and commercial software.
Stallman's belief is that everything is either good or bad, and there is nothing in between. He is write about consumerization of computing devices though.
For years now, I've seen a large portion of the HN crowd praising Apple for its (alleged) respect of privacy and cursing at Microsoft for Windows "calling home" all the time. Now that this has happened, the only comments I see are "heads should roll", and "we must complain and be heard by high-level execs", but never "let's move away". This just reinforces my impression of the Apple ecosystem as something akin to a cult: Once you get in, you never get out again.
There are good alternatives - many people, including software engineers, use non-apple solutions on a daily basis and they are still productive. Why not give Linux a shot, or gasp even Windows? The age-old argument of "MS is evil, Apple good" is moot. Companies are generally not good or evil, they are profit-oriented. If the market demands privacy, they care about it, otherwise probably not so much.
That's very uncharitable. Suggesting Windows as a potential alternative also sounds slightly comical given their history with Windows 10 and many people's required workflows, required because of work or other outside influence, make Linux less tenable.
A lot of people seem to suggest that if you have something to complain about then you should be moving on to something else, a vibe of 'appeal to perfection'. I think this is the same mentality that drives the distro hopping phenomenon. I'm not brainwashed because I live with the flaws of my OS choice and complain when things are changed that I don't like.
Windows is no better for telemetry, and the user experience doesn't at all fit well with how I work.
Linux I prefer to Windows but generally find the desktop experience lacking.
Additionally, in order to move to Linux I need to find a good alternative to many other software that I'm using. Most commercial software only target Windows or OSX.
For the record, I've written large parts of KDE, so I'm acutely familiar with running Linux as a Desktop Environment.
Linux only makes sense as a desktop operating system if your top priority is telling people online that you use Linux as your desktop operating system.
For other things? Maybe. Some nice GUI applicatipns are, while in theory be run on Windows through cygwin, work well on Linux as well.
And some people just like performance / look-and-feel. Windows is often sluggish, while most Non-GNOME IDEs are pretty fast on usual hardware.
Then there is updates problem. I have had Windows downloading updates even if network was marked as metered in past.Some LTS distro is often better. Unless you use Fedora or Arch, updates should be minimum.
I don't want to imply Linux desktop is mature enough for all people. Just reminded there are valid reasons tech savvy people prefer it.
As they say, nothing is black and white.
I sure love the SAAS future we are heading forwards.
What the hell? You have to wait 30 seconds before you can run unsigned code on Windows without calling home to Microsoft about it? How is that considered sane? (I mean, forking on windows is slow but it's not that slow.)
How do people (and corporations! Especially ones sensitive to sharing IP!) put up with this stuff?!
(This scenario is itself a security flaw that existed for some combinations of Windows system utilities, so this is a real concern.)
Now, you could change WinSudo.exe to disable SmartScreen, sure -- but this requires you to be able to modify WinSudo.exe (which should require Administrator), and the mismatched binary would ALSO flag SmartScreen.
I'd assume that's what most corporations do, since that's what it's there for.
I wouldn't 100% forsake the benefits of this stuff, since it does protect normal users - defender on modern Windows installs is good software and really does its job well, while staying out of your way most of the time. I'd leave it on for my parents.
I downloaded steam from the steam page, windows blocked it. I downloaded Chrome, windows blocked it. What's even the fucking point?
To make you use Microsoft Store.
Defender is a traditional hueristic-based AV with on-disk and live load scanning and an offline database. SmartScreen is a reputation-based (certs + "how many people ran this") checker, and is much more visible. Win10 runs both.
This is why I try out Linux every few years, and file lots of bug reports when I run into issues (mostly in applications - the core Linux kernel is solid). I've even contributed code to Linux apps that I don't intend to use right now.
Most things are more than doable on Linux but often you're choosing between stuff that works and stuff that looks pretty.
Even beyond unintentional glitches at Apple, just imagine what this could mean when traffic to this infra is disrupted intentionally (e.g. to any "unfavorable" country). That sounds like a really serious cyber attack vector to me. Equally dangerous if infra inside the USA gets compromised, if that is going to make Apple computers effectively inoperable. Not sure how Apple will shield itself from legal liability in such an event, if things are intentionally designed this way. I seriously doubt that a cleverly crafted TOS/EULA will do it, for the damage might easily go way beyond to just users in this case.
Again, maybe (and in fact: hopefully) I'm just getting this all wrong. If not, I might know a country or two where this could even warrant a full ban on the sale of Apple computers, if there is no local/national instance of this (apparently crucial) infrastructure operating in that country itself, merely on the argument of national security (and in this case a very valid one, for a change).
All in all, this appears to be a design fuck-up of monumental proportions. One that might very well deserve to have serious legal ramifications for Apple.
Consumer and commercial software is just all bad.
I'm thinking specifically of Firefox, but others too.
Still sounds to me like Apple rolled out a huge (logical) trojan horse, as a potential weapon in terms of nation state cyber warfare.
Probably not at all with that intention. But I doubt that any government willing to abuse this "opportunity" will give a fuck about that. Don't underestimate the power (and disruptive) effects of being able to practically disable a whole brand of popular computer hardware. Heck, even the ability to threaten with it (privately, through diplomatic channels) can (and probably should) be considered a serious weapon. So yeah .. "thank you" Apple.
Or can you still reboot without wifi?
(And that's after I realized that they will eventually open. Originally I rebooted the machine before any app had had a chance to open.)
Like so much of the modern security activity, it doesn't seem to be fully thought out, nor was the possibility of failure considered.
Or maybe such failures were considered and then dismissed? I don't know.
They may move to edge servers instead of centralized datacenters now though...
Considered but not tuned. I've never noticed any delay launching or using software that doesn't require an internet connection while not being connected to the internet. (I definitely did notice slowdowns today - Zoom in particular which I tend to quit out of when I'm not using it because I don't trust it one bit but am compelled to use it for work)
Seems like apple was accepting connections for the signature check but were unable to actually service the connections, leading to the timeout/failover.
I honestly like the idea of signature checks on software that give me some confidence that the code that is running is the code that it claimed to be when it was published/installed and has not been manipulated via some other vector.
Whether apple is the appropriate steward of that system is certainly up for debate, but certainly other companies that run app stores have similar systems and similar risk. It certainly doesn't seem obvious to me what a secure, anonymous, performant and federated system to solve such a problem would actually look like.
What is frustrating is they didn’t handle this situation like they do if I’m offline - don’t get a ping back in less than 500ms or whatever? Go ahead and open anyway. would have solved this eventuality
how do you do that without defeating the security? Now a malicious attacker just has to wait for a moment when you aren't connected before launching their payload.
The thing is, this is not a new security problem/challenge. It essentially can not be properly solved if you don't have a tightly controlled environment. If it's a general purpose environment, where you can't fully control what ends up running on it, this particular approach to "security" is pretty much doomed, no matter how you address it.
In seriousness though, the problem with offline databases that are changed a lot is a problem antivirus programs always had: they need updating. You can’t have the “latest and greatest” protection if you don’t know about the newest threat. That’s probably what Apple is doing here: using a database on their end that they wouldn’t have to distribute to end users. It’s not the best way around it, but there isn’t really a “best” way.
Use compressed probabilistic data structures and ship minimal diffs to save bandwidth and storage; you can fall back to phoning home if there's a possibility of a collision with a known-bad hash. Apple's solved push messages at scale; it could piggyback an update mechanism on that, or use the techniques Dropbox uses to notify about file updates. It can do this at the OS level so there's no threat of a user process not being active to pull updates. And the check is already soft-failing (per the OP) so it won't break if the system is offline, so they're already not caring about threats that are so new, they were found while the computer was offline.
You need to solve a lot of timing diagrams and race conditions (and, if we're being snarky, maybe it's for the best that Apple isn't trying to do this!) but it should be doable.
Also, my understanding is that it’s a hash of the binary being checked so if it failed the verification the first time when you were connected you would have received a warning and the OS would block that executable on your system or given a warning or something? Not sure tbh.
You should. It's noones business when and how often you run a known tor browser binary.
Don't limit freedom at once. Do it one by one so the impact seems low.
What are the chances that any of the big tech companies take orders from a fascist to block all the harmful software in their country?
Non zero. People in HK know this. I want to know how they felt about their choice to buy iPhone at that moment.
And frankly, a benevolent dictatorship is basically the best government you can have, as long as you're part of the "in-group" who doesn't push boundaries, doesn't cause trouble, and supports the supreme ruler, Kim jon... cough* Apple.
---
The problem is that no matter how good the dictatorship might be today, it will eventually bite you. You will either develop a need that isn't addressed, or they will change the rules so you are no longer able to satisfy an existing need.
We're seeing this now with Google - Their motto was literally "don't be evil" for a long time. And during that golden period their users loved them. But as Google has shifted from "don't be evil" to "Make lots of money" people are starting to shift away.
Apple is still in the golden phase, but I'm not really convinced they're going to be there much longer.
> "Don't be evil" is a phrase used in Google's corporate code of conduct, which it also formerly preceded as a motto.
> Following Google's corporate restructuring under the conglomerate Alphabet Inc. in October 2015, Alphabet took "Do the right thing" as its motto, also forming the opening of its corporate code of conduct.[1][2][3][4][5] The original motto was retained in Google's code of conduct, now a subsidiary of Alphabet. In April 2018, the motto was removed from the code of conduct's preface and retained in its last sentence.[6]
I know saying Google removed Don't Be Evil is something of a trope, but the truth is a little more complicated. And, of course, the presence or absence of this phrase has no necessary bearing on the degree to which they are perceived as evil or not!
“Don’t be evil” is nearly the opposite guidance.
The honeymoon is already over. A post like yours would have got several downvotes up to less than two years ago. I noticed that honest critics to Apple are tolerated now, since at least about one year ago.
I also still consider Apple's PR game to be top notch. Which is why so many folks are talking about loving the Apple app store in the thread about the recent Epic case that also popped up today. Although I'll note it's interesting that originally those threads seemed about evenly divided on the topic, and currently the pro-apple, pro-dictatorship voices seem to be getting mostly downvoted.
Regardless - I'd strongly recommend everyone out there to consider free and open software, on devices that you own (and you don't own a device if you don't have root access). Open source just keeps getting better - We happily re-implement the ideas and products generated by these companies, but we care about you - not the bottom line -because we are you.
I got a bunch of 'Why on earth would I do that. I love the app store and will only ever have Macs.'
I feel like I've "bought" a ton of games through Steam, and now that my kids are a bit older, they want to play some of them. Unfortunately they can't play different games at the same time - even with Steam's family sharing. When one person plays a game, it locks the whole game library.
GOG all the way.
You can get around this by running steam in offline mode.
Have you seen Louis Rossmann's videos on Apple hardware repair?
Google's customers are not the users, they are the advertisers who rely on the data harvested by Google. The incentive to be evil is directly baked into the business model, and most users end up tolerating it because it is "FREE", and often the only viable option.
Apple's customers are the users. If Apple rocks the boat too much, their users might not feel so good about paying the premium prices Apple demands for its products. Making users upset is a direct threat to their business model.
You can't really compare Google to Apple. You can switch to a different company if you don't like pixel phones and get almost the same experience. You can switch between manufacturers and use windows/Linux as well. The same isn't true about Mac os or iOS.
While you may think customers still have a choice, the reality is that they are locked in through their school, work or relationships (can't use imessage to talk to your spouse?). Apple makes it difficult to use third-party hardware and software it competes with so you will buy more and more Apple over time. People are prone to sunk cost fallacy and consistency. It's sales manual 101. I really can't recommend reading a good sales manual enough.
This doesn't really make much sense to me. Unless you are going with a niche privacy-oriented fork of AOSP, any non-iOS smartphone you move to will still be controlled by Google. And if you do move to one of those forks, you are essentially migrating to an entirely new ecosystem anyways. It's no easier to leave Google's Android ecosystem than it is to leave iOS or macOS.
Also, thanks to PinePhone finally providing open yet easily available hardware, there is now a new crop of fully open source mobile Linux distros being developed: https://wiki.pine64.org/index.php/PinePhone_Software_Release...
Sire, not everything might work yet & PinePhone is not at the same level as the latest Android flagship phone (well, you can hardly expect that for $150) but there are multiple people communities of people building new mobile operating systems, right now! Ones that are not controlled by a control freak (Apple) or spymaster dropping services left and right (Google).
In my opinion, right now Apple is rocking the boat for 3rd party developers. Historically, that hasn't worked out that well for platforms, but we also don't have a ton of data to work with. It's conceivable that Apple becomes the "Company store" on Apple hardware, and their users only use Apple software.
But if that happens, I think they'll suffer more regulation and governmental interference (and rightfully so, imo).
This doesn't mean, however, that Apple's incentives are aligned with the user's incentives. It's important to see that Apple's devices are also a sales channel for Apple. For example, an iPhone is essentially a vending machine for entertainment. And Apple will exert its power to use that sales channel (using the same techniques as advertising companies, like user tracking), whether the user likes it or not.
Just today I heard a colleague say how tough it would be to move away from Apple because of their iCloud. Then you have all the apps and content (iOS and macOS) you already paid for.
The difference in business model between G, Apple (or other tech behemoths) are very superficial. Yes, to google and apple operations they are very different, but to a consumer: it's the same. Both try to become essential, all encompassing locking you in and increasing the cost of switching. All brands try to do this. But it's much easier for me to pick a new brand toothpaste after I'm done with previous one than for me to move app ecosystems, specially when those apps ecosystems are all locked down as all non-libre app ecosystems are.
You may "feel" like you're an Apple product because you think you can just buy less Apple products or not at all. That's until you consider the consequences of losing access to third-party content/products you purchase.
Users en masse would not switch, not from Apple, not from Microsoft. Their price is not that high in dollars, it is high in freedom. And most users do not value that.
Of course, you are quite right to point out that Google's business model does incentivize behavior that isn't what their users would want. But the same is true of Apple - their business model strongly incentivizes them to create lock-in to the platform. Whether this bothers you more or less than Google's need to mine your data is I guess a matter of personal preference.
As are a crack dealer's.
Let P = "Don't be evil" and Q = "make lots of money".
Q was nothing new. They always wanted Q. But Google made a fundamental breakthrough in business logic, discovering that P -> ¬Q.
It should be noted that ¬P -> Q is not automatically implied. Plenty of companies are ¬P ∧ ¬Q. Perhaps they are not ¬P enough? Perhaps they are too much ¬P? But very few manage to be purely P ∧ Q.
EDIT: I'd add another way in which Google is like Russia and Apple like Singapore. Everyone kinda knows that Russia's leaders are a bit/a lot evil. There's still a debate about whether Singapore's leaders are evil.
I think it makes Linux some sort of United States: users like the principles, but almost all use one of the 50 major implementations, which tend to have small differences. When defending any perceived shortcoming, they will point to a different implementation without the particular flaw, or argue that the feature is not only unnecessary but undesirable.
Many outsiders are uncomfortable with the unwavering commitment these users have for the principles. Others often talk about moving to the USA, or how they plan to, but few make the effort to do so.
[The last paragraph convinced me the analogy was better with the USA than the EU.]
It looks scary for outsiders — how to choose state? Building own house requires so much energy and time, why would anyone do this? Just rent an apartment, maybe change wallpapers and door, bring appliances. Yes, sometimes owner moves switches, adds cameras, puts advertisement, forbids all but own groceries where he takes 30% cut, but apart from that life is good.
And even when I've created a problem or chosen to do something way outside of standard usage, there has been a WEALTH of documentation, stack overflow discussions, and live Linux community support. I've never run into a problem that hasn't already been chewed over by the Linux community, solved, and the solution been posted in a clear, educational, and technically descriptive manner.
I've NEVER has that kind of support from Apple or Microsoft. From them, it's always some half baked, high level / middle management overview type of solution, usually outdated, that discusses why it's a problem, why fixing it is dependent on the system (their system, that I've paid for), and how I should contact my system administrator, who's going to go read through the same page, then spend the afternoon sipping Pepto and dreaming of having a more sane job. Using their OS's is like wading through mud.
But after about the third time that upgrading my system made it unbootable because I had missed some crucial step buried in the changelog or release notes, I also developed a deep appreciation of all the things modern distros handle for you. I rarely fear a dist-upgrade the way I did an emerge world.
Apple is more like a Vatican and Google is like Saudi Arabia. Both corrupt in different ways.
The benevolent days of Apple ended when they removed the expansion slots from their computers, if not earlier.
The central company server didn't go down. If it was down there would be no problem. The problem is that the server is slow.
The search is useless. On Linux, it's so much better.
I had to download and run a bunch of scripts to get rid of the amount of data it was sending back home. I had to remove the bloat and ads it came with.
Give https://pop.system76.com/ a try if you don't believe that Linux is easier to use. Most people don't need to open the terminal anymore.
Sorry what do you mean you can't install steam or chromium in Windows? Millions of people run this software on Windows. - A mint user.
But besides this bad example, I agree with you. Windows has always been a black box, but as time goes by it's become a stupid black box. It feels so incredibly refreshing when I go back to Linux and I feel in control of the entire system. Almost like a physical sensation.
For my grandpa, yes. Windows smart screen hides the run anyway button as more info link.
While OSX was demanding that I identify a bluetooth keyboard... I don't have a bluetooth keyboard at all.
OSX is buggy and getting less and less usable. I'm finding myself working on Ubuntu and Windows more, than OSX these days.
The answer is pretty simple: these problems are extremely rare, they don't last very long, and they tend to have fairly simple workarounds. You seem to have a principle that any non-zero chance of being affected by a problem of a certain type is a complete deal-breaker, but most people when buying a computer probably just subconsciously estimate the likelihood and impact of this type (and all other types) of problems and weigh that against other unrelated factors like price.
in this context those are simply weasel words in my opinion
Not caring about this now is like not caring about government or corporate privacy invasions because "I have nothing to hide". It completely ignores all the variables that have to align to make this benign that happen to at this point, but are in now was assured for the future.
Okay, sure, you could attempt to estimate future damage from what appears to be a simple (albeit bad) bug in MacOS. Maybe it means all Macs will completely stop working in 2 years. But again, I think consumers will subconsciously estimate the likelihood of this to be extremely low.
> Not caring about this now is like not caring about government or corporate privacy invasions because "I have nothing to hide".
What? I thought we were talking about the immediate user-visible bug here, where some third-party apps could not be opened on some Macs for some period of time today. Sure, there are separate potential privacy concerns any time an OS phones home for any reason. But the problem here is just a blatant bug that manifests when the OS phones home and the servers are having problems. Macs continue to work fine when they're not connected to the internet, so it's pretty clear this is just a bug that's not actually related to the privacy concerns with phoning home.
>>>>> these problems are extremely rare, they don't last very long, and they tend to have fairly simple workarounds.
This is about Apple controlling what software you can run on your computer, for all third parties, and in a way that if the system/service is malfunctioning or shut down there's a chance it blocks all non Apple software.
You can either choose to accept that Apple is a good steward of this because they haven't screwed up too much yet, and that you're okay with it because you have no or little need for third party software it might affect (or are willing to deal with it), or you can view this as an erosion of your rights to control the hardware you bought, which while only slightly inconveniencing now are still fundamentally the same as what could be used egregiously in the future.
You either vigorously defend the rights (or what you want to be a right) now, or you watch it erode slowly. That's how the system works. You want privacy or believe it's important? Protect it now and even if you don't have anything to hide. You want the ability to control your own computer and run your own software, and not be beholden to some companies deprecation schedule affecting things they didn't write, or at least believe it's important for a possible future? Then defend it now.
Given how iOS functions, and how Apple is moving to their own silicon for their other products, do people seriously doubt that a future where you actually can't run anything on MacOS except what you get through their store isn't at least a possible future? If that's something we care about, it's something we should be vocal about now.
I've set up a few Linux installations for people who only use their computers as Facebook and YouTube machines, and I haven't had a complaint. They also wouldn't be able to break their systems if they tried.
I'm of the opinion that if ChromeOS would fit a user's use case, then so would Ubuntu with Firefox or Chrome, most of the time.
Those same Linux systems would fit my needs as a developer with only a few small changes.
Security, simplicity, power and ownership don't have to be mutually exclusive. You can have a simple and secure computer, and also have power over your system and own your hardware.
Yet at the same time it makes it possible for the user to "grow" and make use of more advanced features of the system for creative endeavors.
On the other hand on a locked down mobile device or chromebook, there is not really any room to grow and be creative, it's only good for consuming content.
This does not mean car crashes can be ignored, or cannot happen to be dangerous.
There is a balance between the possible damage because of not checking signatures remotely, and the possible damage from not being able to run a program when the remote checking service is unavailable. But there is no situation where the average damage is exactly zero :-/
And in this analogy, I'm not saying "we should ignore car crashes." I'm saying "the reason people still buy and operate automobiles despite the possibility of accidents is pretty simple."
After decades of production operations, I have no complaints about how this was handled, and I expect they’ll investigate and patch any defects exposed by the outage.
I went for a walk when this happened and when I got back it was fixed. Works for me.
There’s also not exactly a huge market for rental computers when you consider that libraries offer them for free, and often with better Internet connections than those renting a computer could offer.
Renting computers is a lot easier if you host them in the cloud and deny physical access to your customers, though — they generally can’t do permanent damage, and there’s no issues with theft/loss. But this isn’t typically viewed as “renting” anymore, but instead something like “colocation” or whatever EC2 is.
Why do you ask?
What happens if you're trading securities, or if you have an imminent deadline? Apple sells a fail-closed security feature, without investing the resources necessary to keep it as near to 100% serviceable as possible, and never really discusses it with the user. When it hangs, most users don't even know why.
WTF!
Seems like they could partner with Akamai (or one of its competitors) to make the server-side component of this feature more robust.
If they are going to sell the MBP as a premium professional product, then they must recognize that it will sometimes serve as the linchpin of users' mission-critical activities.
Take a billion dollars out of the stock buyback, invest it in the product instead, and make this problem go away.
A month from now? Different story.
I know, and I _want_ this. In general, it effectively eliminates the possibility that I'm going to install malware.
Can't comment on the Surface, never looked into them much.
Feels problematic.
That's exactly what happened in Hong Kong: https://www.nytimes.com/2019/10/09/technology/apple-hong-kon...
But it could never happen here...
(As someone pointed out, this does more than just prevent apps from running - it also leaks which apps you use and how often. Someone could ask Apple exactly when you started Tor browser, for example)
Furthermore, I would sort of disagree with the answer to why people would buy this. In terms of "most people buying a computer", the overwhelming majority of Apple customers are likely ignorant to this issue, and will continue to be.
I knew and didn't care. If you care, you're going to be real upset when you look at your other alternatives.
That said, I don't think many people here actually care. I firmly believe that most of the people on this site just like to shit on Apple, because they prefer that to trust their privacy to an Advertising company.
I don't understand what you mean.
What you said is like saying nothing except a social security number is used to identify you, as if that wasn't linked to the rest of the info about you.
(Hint: I have literally never seen an example of one of our bank's customers being unable to bank because of this. I have seen heaps and heaps of examples of endpoint compromises resulting in people having their accounts cleaned out.)
I don't want that. I don't think it would serve Apple's customers to get rid of binary signing either.
Since there are no legal ramifications for security bugs that cause downtime, or for bugs that cause other functionality that goes down, I'm not sure why this particular bug would be any different. It's certainly not as bad as losing one's Google account permanently without recourse.
I really had no idea until today.
Imagine if the USA actually comes under an attack.The apple spaceship would be high on the list of targets. All of sudden hospitals can't run their computers or communications. Disaster!
If Apple servers actually go down, there's no issue.
> All of sudden hospitals can't run their computers or communications.
If the scenario is an attack by the USA, there are so many better avenues.
If a country wants to defend from this (assuming they are heavily invested in Apple hardware), they just have to block at their firewalls. Done.
I believe this is why there has never been any mass pushback against iOS/Android (even if Android is slightly better in this respect).
Further, neither iOS nor Android (and now OS X) have instituted huge restrictive changes all at once. Restrictions are gradual & creeping, basically moving the overton window of what is accepted.
Or just run BlueStacks, which is necessary to run Among Us (the popular game since lockdown), which isn’t signed because it’s an emulator. And it requires the “Control this mac” permission. Unsigned. There are many, many cases in which users are faced with unsigned apps.
Because we can't have nice things, Apple has to check that apps are signed with a current certificate for safety and security reasons. OCSP tells the client if the certificate has been revoked or not.
Try opening a non-https web page; you'll get a bunch of ominous warnings from all major browsers.
Browser certificates need to be OSCP signed for the browser to trust them. You can't even get a new cert if the issuer’s OCSP server goes down, which does happen on occasion.
There are so many dependencies to ensure we're not running malware infected apps that sometimes things break.
Let’s not get carried away; every major tech company has had some version of this happen at one time or another.
FWIW, I haven't experienced any issues with my iMac running Big Sur running Apple or 3rd party apps all day.
This is a very serious concern for Enterprise PKI systems: revoking certificates is now virtually impossible. CRLs and OCSP do practically nothing.
Google especially has unilaterally decided that Enterprise PKI systems don't matter. They have established a new "standard" called Certificate Transparency, which they use to make CRLSets that they publish as Chrome updates.
Which is fine I suppose for public CAs, but utterly useless on internal-use private CAs on local networks, especially those with lots of BYOD or guest/partner systems. Think universities or hospitals.
Google has become a juggernaut with more control over computing in general (not even just the Internet!) than all of the world governments put together.
They're getting truly terrifying.
But these browsers won't trust a cert if it can't be found a Certificate Transparency log. Yes, a cert should be in at least two of them but if there's a networking problem or infrastructure issue, you're SOL.
With the introduction of CRLite, the default is disabled, but those using Firefox with internal-use private CAs on local networks can renable via preferences, which can also be controlled by enterprise policies and tooling.
OSCP is flawed because you can block the connection, meaning
1) Your browswer has to accept it (thus an attacker feeding you the bad certificate can bypass OSCP)
2) Your browswer blocks completely (thus DOSsing all connections), and people use another browser
CRLs don't scale - you can't keep a cached list of every revoked cert globally.
However I pull down the CRLs for my internal CA every few hours onto my internal https sites, which rely on a client presenting a valid certificate to connect. If that doesn't get pulled down, I get a warning about it in the monitoring system. When a client with a client certificate connects, I check against my local cache of the CRL, and if it's been revoked, it can't connect.
What problem do you have on your private CA internal network that CRLs fix but browsers don't? Are you that concerned that your server certificates get compromised? You should be working to massively reduce the time those certificate are valid.
For the same reason every human frequently makes decisions with greater-than-zero risk: because we're either unaware of the risk, or because we believe the tradeoff is a good one, and the benefits are worth the risk-adjusted costs.
Apple don't publicly go out of their way to tell you that this is how it works. You make a great point that the way it works is bad and I think everyone agrees with that. But it's the limited knowledge that the OS operates this way that keeps consumers purchasing their products.
I'd love it if someone other than Apple made a competent PC that was as clean, reliable, and comparatively free of bullshit. Unfortunately Apple has a monopoly on cleanly designed computers.
If I knew - I might still have ordered one, because I like ARM and battery life. But this reaffirms the observed trend of Apple becoming more of an owner of the machine that supposedly I own.
I'll attempt to shut it down (at least now, it still observes /etc/hosts) - but when I can no longer do that, I'll leave Apple forever, hopefully by then other hardware manufacturers have caught up in UX.
Having said that, it's not enough to get me to switch platforms. I'm able to work around the problem (using Little Snitch, see other replies), and there are a ton of factors that go into my decision of which hardware/OS to use, all of them involving tradeoffs. The only viable alternatives, Windows and Linux, have their downsides too. Some people prefer those over macs and that's fine; it's a choice people make based on their particular situation.
They know what times you're at home, and what apps you're using there. They know what times you're at work. They know what times you're tethered. They know when you travel, and to which cities. They know when you're on a friend's Wi-Fi, and they know which apps you open from that connection.
Apple is a partner in the US military’s PRISM spying program, so this log is available to US military intelligence at any time without a warrant.
Thanks to API changes in Big Sur, it’s impossible to use Little Snitch to block these system level connections, and they will also bypass any configured VPN. To control this, you’ll need to use external network hardware, like a travel router that you can operate a vpn/firewall on.
Big Sur is the only OS that will run on the new Apple Silicon macs, so it’ll be impossible to use the new machines without leaking your track log and app usage history in a way that is available to the FBI/CIA/et al whenever they want it.
Note also that Apple recently backdoored iMessage’s end-to-end encryption by defaulting the non e2e-encrypted iCloud Backup to on for all users: it backs up (to Apple) your device’s complete plaintext iMessage history, as well as your device’s iMessage keys, using Apple keys, each night when you plug it in. You should immediately stop using iMessage as a result of this, because even if you have disabled iCloud or iCloud Backup, your conversation partners likely have it enabled. iMessage is no longer meaningfully encrypted.
Apple’s marketing about privacy is lip service, not real.
False
I'm sure I'll get downvoted, but I just had to get this off my chest. Why people still buy Apple today, I positively can not comprehend.
i really don’t get these kinds of comments.
It will get fixed pretty easily: Apple will add some combination of a timeout and a request back-off to their client, to properly handle the situation of a server that is reachable but not sufficiently responsive.
Apple clearly does not mean to make their devices unresponsive if the server is offline, because pointing requests at localhost resolves the issue.
The solution won't be to fix a defect, but to change the design, which is completely flawed. They should have pushed revocations from the beginning rather than requiring every system on the planet to poll a service. What were they thinking? And that does make one wonder whether there weren't other reasons for this behaviour besides "security".
This is the only reason I had to move away from (arch) linux and it saddens me every day.
Apple gave a detailed explanation. It was a server misconfiguration combined with a CDN issue which caused the OCSP certificate check to stop working, which caused Apple's system for ensuring certificates haven't been revoked to stop working:
“We have never combined data from these checks
with information about Apple users or their
devices. We do not use data from these checks
to learn what individual users are launching
or running on their devices,” clarified the
company.
“Notarization checks if the app contains known
malware using an encrypted connection that is
resilient to server failures,” says Apple,
further emphasizing, “These security checks
have never included the user’s Apple ID or the
identity of their device. To further protect
privacy, we have stopped logging IP addresses
associated with Developer ID certificate checks,
and we will ensure that any collected IP addresses
are removed from logs,” details Apple.
Turns our Apple's MacBook business grew 39% last quarter: https://appleinsider.com/articles/20/11/16/apples-macbook-bu...
A database like an "app store"?
Think about someone having a dating app that would out them. Or a therapy app that they don't want people to know about. And that just scratches the surface.
It is also trivially linked to ip address, which is usually personally identifying.
This is Apple we are talking about, which has the strongest privacy commitment of any device maker, and no advertising business outside of the App Store. Linking IP addresses to app certificate requests provides them zero benefit and exposes them to substantial brand damage.
Do I have proof that they could be ordered by a court to store it? Of course, that's how warrants work.
Do I have proof they are currently storing it? No, nor was that ever the claim.
1. Do you need an apple account to use the app store?
2. Do you need to provide personal information to use an apple account (I'm thinking at least enough to get a credit card working for app purchases/subscriptions)?
3. Is the data sent to this anti-malware service linked to your Apple account or an apple hardware id? (Has someone wiresharked the data to confirm/deny)
2. Yes
3. I doubt it
But regardless of 3, simply by using the App Store at all (similarly to any other App Store out there) you're already giving them more information than they get from these hashes (at least for the apps that come from the store). I know for a fact that they keep a record of which apps you've downloaded there, associated with your account, because they check for updates and let you re-download them. As does the Android store. As does the Windows store.
Android, yes playstore requires an account but you can install an alternative store without signing in.
And anyway, when we are talking about a phone, it would be literally impossible to run an app store without recording (and personally identifying!) that information. Maybe that's one more argument to allow third-party app stores, which I'm not against (though who knows if they're more trustworthy with that data?), but nevertheless.
My point is that in the grand scheme of privacy concerns, this is a very silly hill to die on. In the grand scheme of system reliability, on the other hand, it's totally legitimate to be upset that this effectively took down thousands of expensive workstations across the world for a few minutes.
Translation: "I've got nothing to hide".
Take a look at the macOS App Store medical section. Doing a quick scan of the top apps there is one app to help with some diabetes pump, one for a personal ECG machine, one that says it's a "mobile lactation consultant". Those can reveal a lot about a person that they might want to keep private. Searching "therapy" or "dating" also shows many results that people might want to keep private.
If they know the hash of (let's say) a pr0n app which you run, then I'd say that's pretty damn sensitive information Apple is getting.
I already expect the ISP to detect my Tor traffic.
But I didn't expect Apple, of all companies, to have a detailed audit trail of every time I've ever opened it, to the nearest minute.
Big Sur prevents Little Snitch from blocking these system level connections, and these OS apps will also bypass any configured VPN.
And whether I'm taking a long or short lunch break, or lots of breaks. Whether I stay in bed until late, or work late at night. It's enough to predict whether I'm a "good" worker.
It also reveals whenever I travel, which coffee shops and libraries I frequent and what times of day. It also reveals what time I open any of several video conferencing apps.
And the sort of thing some HR would like to browse when assessing job candidates. They wouldn't need to ask "do you know X", they could just consult the Apple log of how often I run the relevant commands. Things like "we see you ran 'git' an average of 145 times per day last month, tell us more about that".
And whether I'm running tools I "shouldn't".
All that seems quite sensitive and personal to me.
If your employer is willing to be that invasive, they already have a much easier route for getting that information: forcibly installing surveillance software on your work machine.
> It also reveals whenever I travel, which coffee shops and libraries I frequent and what times of day.
How...? How would the binaries you're running have anything remotely relevant to say about this?
> They wouldn't need to ask "do you know X", they could just consult the Apple log of how often I run the relevant commands. Things like "we see you ran 'git' an average of 145 times per day last month, tell us more about that".
That's a pretty contrived use-case for a pretty significant and unscrupulous bit of data-sharing. From a PR perspective Apple would never intentionally and publicly share this data. So assuming this data is even stored anywhere after the check is complete, and assuming any personal identification is kept with it, both of which are huge ifs, that leaves a couple of possibilities:
- Hackers gain access to the data
- Government subpoenas the data
- Extremely lucrative contracts, probably from advertising companies, are enough to motivate Apple to sell the data despite the risk of a massive PR scandal
I don't see any of those falling under your proposed scenario of random employers casually perusing the logs.
The question was whether the information gathered is personal and sensitive.
The fact there is another way it could be gathered doesn't make the information less personal or sensitive.
> How...? How would the binaries you're running have anything remotely relevant to say about this?
Because your temporary IP address is part of the hash request, and that's usually enough to identify which major organisation's network you are on, not counting any geolocation.
Thus, coffee shop (which brand), library (government network), home or mobile, at least.
I expect the websites and services I'm using to have this when I'm using them. That's reasonable, I'm reaching out to them.
Apple itself is not a service I'm using constantly, so I don't expect it to be sent a minute-by-minute update of my movements whenever I'm doing work in a CLI, and happen to have wifi on.
(I don't use iCloud, btw. Perhaps people using iCloud expect activity to be streamed constantly.)
> From a PR perspective Apple would never intentionally and publicly share this data.
Again, the question was whether the information is personal and sensitive. That's a property of the information itself.
Not whether Apple intends to store it and share it.
Okay. You realize that you literally have to turn off the network connection completely to prevent dozens of companies from getting this information every waking moment? Windows and even Ubuntu constantly send back basic telemetry, not to mention the many more less-trustworthy apps that are refreshing in the background, the websites you interact with (even with ads/tracking blocked, the site itself still knows your IP address and time of access!), and so on.
Maybe it's not the exact point I was making originally, but my point now is that this is a ridiculous thing to focus on in the grand scheme of privacy concerns. It might be the single least-privacy-significant network request that any of your devices ever makes. Personally, if that's the only cost, I'll take the tradeoff for the security benefits. But even if I didn't feel that way, it's not what I would be spending my energy worrying about.
I do. (A look at my comment history would show I know quite a bit about networking.)
Again, the question being addressed, or actually the assertion being challenged, was: "hashes of the binaries I run don't exactly reveal any sensitive personal information about me"
I replied to show that those hashes do reveal that information.
But I threw in that how the hashes are sent (revealing the IP constantly) also reveals sensitive and personal information.
You might think that's inevitable, maybe so trivial it doesn't merit a mention. But in fact it isn't. It's purely a consequence of a technical decision. There are many ways Apple could perform the hash check without revealing your ephemeral IP to Apple.
Still, you asked what I thought was "how does sending your hash to Apple reveal where you go?".
Since you asked, I answered.
But perhaps I misunderstood your question, and you were asking how does Apple having the hash reveal where you are, not the act of sending it to them.
Fair enough.
Presumably something changed, but so far I haven't heard an explanation that makes sense of it.
Anecdotally, I'm using Mojave and experienced this issue, a person I was trying to have a Zoom call with was experiencing the same issue on their Mojave.
I think there are enough comments scattered across Hacker News to safely conclude that it affected Mojave too - although it's possible the timeout behaviour / error handling is different to Catalina.
[1] https://gs.statcounter.com/macos-version-market-share/deskto...
https://medium.com/sensorfu/how-my-application-ran-away-and-...
That said, "this has happened forever" is false too. These behaviors are relatively new and relatively under the radar. Many people don't know they exist to get upset about it.
Ubuntu uploads (at least it did couple years ago) your data to Amazon.
There was a connection between the search bar for awhile, if you typed in pants you'd get potential amazon links. It was easy to turn off and disappeared awhile later.
The Ubuntu Amazon fiasco is, if anything, evidence of extreme resistance to this kind of thing. The Linux community rejected Canonical's opt-out ad partnership with Amazon collectively and almost unanimously. The program was relatively benign, but it went against ideals of both users and developers, and there have been no repeats.
Did it happen? Yes. And that is enough information.
You have been called out for multiple falsehoods in your comments here and you've still failed to provide any evidence.
It’s not like Apple us building a database of apps you’ve launched linked to your address and social security number.
Linked to your identity if you have a credit card saved for say iTunes.
But not for Apple where advertising revenues a rounding error on a rounding error, and they’ve built their brand on their commitment to privacy.
They also run the app store, which is an advertising platform
It's hilarious: most of the journalism I'm finding via DDG search is anti-Apple from the advertisers perspective. All these bloggers and Forbes writers decrying the fact that Apple keep making it harder for third parties to exfiltrate user data. Outraged that Apple would use this data internally making the marketplace non-competitive to both "tiny ad networks" and "Apple's corporate rivals" alike.
This is bogus. It seriously strangles the capabilities of the rival giants to get hold of that trove of data, but the small ad networks, representing businesses with whom Apple has a formal supplier relationship (the Apple Developer Program) and no direct competition are really no worse off.
Shock and awe.
The big change that caused this flurry of self-serving smear? Making 3rd party advertising opt-in. Forgive me if don't swoon with relief that they are now holding off on this user-empowering, privacy focussed change until next year: "to give advertisers and publisher more time to prepare" and come up with ways to subvert the new order.
Throughout this whole discussion users are talking about "ecosystems" and buying in to one or the other, and the effort of changing. The original issue in this thread was serious, reasonably short-lived, and an infrequent screw up (though that frequency is increasing if you ask me). The issue of Apple's ads is moot. They protect their right to be custodians of the user data they hold (or own, I'm still kind of unclear on that) and they continue to shore up the fences that keep the wolves at bay.
Point me to another major hardware/software/data vendor who shares those values.
I certainly trust that they are better than Facebook or Google on the privacy axis. I don't blindly trust that they are innocent.
They have a couple: https://searchads.apple.com, https://support.apple.com/en-gb/guide/adguide/apda0878bbd9/i....
They cover ads in Apple News, the App Store Search ads and promotions, and there's the results of Siri search I suppose too. But all of these are internal Apple products and marketplaces. They are not running advertising auctions to any bidder on the basis of guaranteed user groups or targeting strategies.
If you are in fact suggesting that they sell ads beyond their internal marketplaces I'd consider that motivation to move away from them myself, and I converted away from OSS when I got bored fixing my workstation more than my work.
Proof that if you are signed into any of their cloud services they know who you are? Is this a serious question?
It isn't just checking for malware, its broadcasting your app opening behavior to apple and anyone else who might be listening.
> It’s not like Apple us building a database of apps you’ve launched linked to your address and social security number.
You know this how? Seriously, I don't get why you would believe that.
They don’t have any significant advertising business. They don’t need to collect any personally identifiable information. They’ve promoted their brand by putting their customers privacy first.
So why would you believe they would intentionally risk all of that here?
A corporation's nature is determined by their business model.
If you want to apply that fable to, say, Apple's relationship with independent repair shops, I'd 100% agree.
> They don’t have any significant advertising business.
This refutes that they're the scorpion in this relationship.
Why would private company not utilize leverage? You have no source, you can't even turn off these checks without hacks. Privacy first is open source and audit. It is removing feature people don't want.
Yes... now. Can you say that with certainty 10 years from now? 15? 20? Would you want an evil Apple 10 years from now having that? Or one that a 3-letter agency forced to collect it and they could never tell anyone because National Security Letter? Is that a bet you want to take? One you NEED to take? Is it truly unavoidable, sufficient to justify such a thing?
The best bulwark against overreach is to not create the capacity for it in the first place. Power will only ever do 1 thing, and that's amass more power.
You could easily see knowing how often an app is used on an OS to be useful business information if apple wanted to create software to get into a trend before it gets to big.
Of course that doesn't require fine grained time data just daily would be more than good enough.
However you could also see the business use of knowing if two pieces of software are often used together or sequentialy which could inform creating an all in one/integrated experience that would do well in a market. So you need that finer application timing.
Of course that doesn't require tying it to a particular user account,not even a device ID, just a sessionID that changes each time the device restarts would probably be granular enough.
However since we've got that other stuff in place per device wouldn't it be great to see if there's a correlation between people using an app on there Mac and using it or another App on there iphone, ipad, or watch. What piece of data can we include to match up a user across all their devices? Maybe some kind of obfuscated or derived userID.
Of course you'd hope that other interests such as a commitment to privacy would rule out the use of such a dataset. If Apple did have such a dataset then you'd hope they'd be doing whatever processes (social, business, and technical) it can to obfuscate and seperate how that dataset is tied to a specific user.
The only real argument against Apple not having it is the balance between the cost of creating/exploiting such a data set, the expected profit, and the legal and reputational costs of such behaviour.
Their Services business is moving them into Google levels of data collection.
Since maybe 2016-ish? https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute
I wrote an article about this a couple weeks ago because of the temporary revocation of HP's signing cert for printer drivers on the Mac:
If you've suffered inconvenience from no checks but not suffered inconvenience from having checks, then it's good.
If your machine is offline then it switches to a fail-open system and uses its cache to verify the binary and if it's not in the cache then it skips the check and allows it.
If your machine is online then it switches to a fail-closed system so that if you can't reach the servers because of something malicious then it blocks.
Well, how interesting that Apple's software is going to be bypassing Little Snitch, making it harder to discover and fix this sort of issue.
Source?
They are disallowing custom kernel extensions and instead requiring apps like Little Snitch to use their system API. This means that Apple has total control of how these apps function and what they can see.
But where is the issue though? While you won’t be able to “own” your MacBook Air there are so many alternatives available such that crowding-out computers with open Bootloaders seems implausible.
EDIT: Apparently there is a way to load your own os using bputil
I'm not sure this is confirmed. Though either way it's somewhat moot as Linux drivers for key Apple Silicon components (e.g. GPU, radios) are unlikely to be available any time soon.
Edit: working as usual now, moments after i wrote this. But seriously Apple, how can you allow this to happen? Your services hanging should _never_ prevent my device from running things locally. This is seriously making me reconsider my next computer purchase.
This is really terrible, but at least the workaround is simple.
And people somehow still love their macs...
If you could point to any documentation of Windows performing app-start OCSP checks, I'd love to learn more (and recant my earlier statement).
If you can provide a Wireshark filter that will show a certificate check on a vanilla Ubuntu 20.04 system when the following commands are executed in a bash shell, then I will donate $25 to a charity of your choice. Commands follow:
cat <<HEREDOC >/tmp/file.c
#include <stdio.h>
int main() {
printf("Hello World");
return 0;
}
HEREDOC
gcc /tmp/file.c -o /tmp/app
/tmp/appLinux does provide application-level and per-application security, as well as sandboxes, but they exist to help the user and the user has complete control over them and their system.
Imagine no car or train in the region starting because of a server outage. People would riot on the streets. But for some reason in the IT world this kind of crap is marketed as a feature.
However... Where can I buy a computer free of all of those issues?
I was in the middle of a call to fix a problem with a customer, I need to near-panic telling them MY computer was frozen.
Thanks Apple!
What’s the matter with privacy? That’s a basic signature check, and you can do so while preserving privacy by using salted hashes or a similar solution.
1: among Windows, macOS and Linux only Linux distros don’t do such checks, and most of end-user Linux installations are arguably secure in spite of this—mostly because they are very rare and thus not a priority target for malware.
2: this only concerns files you launch. If you wrap your binary invocation in a shell script, that shell script’s hash will be sent, not your binary’s.
Linux distros can arguably get away without these checks since their users are typically more aware of what they are launching, but importantly also because they are not as big a target due to smaller user bases.
Another reason is that if a cert (or a cert in the chain) is known to be compromised it can be revoked—would the mechanism used on Linux give some equivalent of that, or one has to be rely on bug trackers or apply updates to ensure trusted signatures are up-to-date?
But... this way the also gather some data.
It's not, per se. The apps will launch if you block the specific subdomain, or turn off internet. The problem is if the computer thinks it can connect and keeps trying.
It’s a huge problem on Windows where Explorer.exe still blocks the UI thread while it checks SMB shares if it thinks it can connect to them, but it skips them if it knows the computer is disconnected from a network. So using a Windows computer on a very spotty WLAN is actually more painful than being disconnected due to all the timeouts and dropped packets. Office Outlook is another main offender. I have a Windows Firewall rule just for Outlook.exe when I know it’s going to lock-up a lot.
I think that’s an important difference. If Apple’s servers ever go offline, the OS will continue to work.
But seriously, I have installed Ubuntu 20.04.1 LTS on my personal Lenovo ThinkPad P1 Gen 2, and work Dell Precision 5550, and it works fine in both cases. Stick with it for a month and macOS becomes old news. Also I think OEMs are wising up to "Linux = free" and charging for Windows on their laptops again, so you can also save some money on OS licensing going forwards.
Use linux folks! It doesn't communicate with a third party when a process starts up!
The biggest draw of mac:
1. slim, light 2. long battery life. 3. track pad.
That's all I want, but nobody else offers it on the same spec, the difference is even bigger with M1.
Does no one here have principles?
Your description of them was also not exactly flattering.
I thought your reply to a "Stallman was right" comment with "but trackpad!" had the most contrast between principles and minor convenience.
For things like computers though, I don't tend to hold a big grudge - I do whatever is the most comfortable and productive.
I have the opinion that if someone have too many principles, either they'll suffer an unhappy life or they will end up violating many of it.
I have an expensive chair, that I could only really get fixed by the company that made it. I could have a shitty chair that hurts my ass, messes with my posture, costs 1/12th the price, that I could sit in and re-assure myself that I'm free to get commodity parts anywhere I want, but I'd prefer not to do that unless I had no choice.
[0] https://nathandyer.me/2019/01/27/magic-trackpad-2-linux.html
Alternativelym you can also run macOS on linux. I had luck with Docker-OSX
For example, I have used a 13 inch MacBook Air (Early 2015) for almost 4 years now exclusively with Linux and I have had a very good experience with it so far. WiFi, Bluetooth, webcam, touchpad, card reader and sleep all work well. Battery time is very similar to OS X. The configuration took some time but it is well documented on the Arch Linux wiki.
This model is now quite old and relatively many people use it with Linux. That is probably the reason why there are no major outstanding issues with it. When it was new, the situation might have been different.
Otherwise they're mostly the same, until M1.
I do not use track pads for actual work so I can't compare but I've heard that you can't really beat the Mac ones.
(As someone else already linked: https://www.gnu.org/philosophy/right-to-read.en.html)
Currently they do a synchronous check before you launch any binary.
Why don't they instead just log every binary signature and check them async on some regular schedule? Strict mode could be blocking the FIRST execution of a binary signature and after that you only recheck if that signature has been revoked on some regular interval.
There's absolutely no good reason why an app which I've run 100 times needs to phone home before running the 101st time.
Have they launched the same executable before, though?
I have a lot of automatic updates. I doubt week-to-week or day-to-day, even, the signature of the programs I run are the same.
How? Have a look here: https://cutecoder.org/programming/notarize-disk-image-develo...
Enjoy your $1500 dumb terminal. If you're still buying Apple products, then you're simply unforgivable.
These sweet dumb terminals can last 15 hours on a charge? nice, I'll just update the /etc/hosts when I get it.
What does this even mean? Are you unable to forgive me for buying an Apple product? Why exactly should that matter to me?
I also noticed that the symptoms go way if you manually disable WIFI.
Who architected this solution? Imagine an OS that needs to ping a server every time you launch an application and if the server down it renders your system useless.
The dev-community needs to push back on this issue and perhaps apple will re-think this solution
Any recommendations? I’ve heard good things about System76.
(it's still prudent to Google for compatibility before the purchase though, since sometimes peripherals (like the webcam) on new models can be problematic)
Dell's XPS 13 line has Linux support (the Dev Edition comes with Ubuntu), I bought one of these and it's great. Only big problem was thermald/RAPL would keep the SOC at 15W after a very short 'boost' - updating to master fixed this problem... but Linux still requires 'tweaking'.
Another example: sleep on the XPS is not S3, but S2Idle - so it uses extra power when sleeping (A compromise so it wakes up faster). This can be fixed with some tweaking, if desired.
I've also heard good things about Lenovo laptops running Linux.
I'd check the archwiki (even if you don't want to run arch) for any laptop you're considering. There's good advice in the articles.
If I had to buy again, I'd look closer at what S76 offers. I really liked my old Chromebook Pixel 1 because of its open firmware (after I re-flashed) and excellent Linux support. I wish I had looked closer at S76, honestly.
I use a Dell xps13 (several years old now) for work, and it's fine. I have no complaints except that the aging battery is not what it used to be (I'd normally be due for a replacement system this year, but we're limping along on old hardware due to the recession).
I can't understand how picky people seem to be about things like the MacBook touchpad. Since my last Apple computer purchase was well over a decade ago, maybe I just don't know what I'm missing, but the touchpad on the Dell seems to control my pointer well enough.
It's conceivable that someone could push bad updates to Tesla autopilot software, or briefly stop peoples' radios from working, but quiet OTA systems like that are the exception rather than the rule.
That seems to happen on MacBook Pros when the computer boots or wakes from sleep with the WiFi turned on, but the WiFi router can't connect to the Internet for whatever reason.
Are you using Logitech keyboard and mouse, by any chance?
Basically Final Cut Pro and Logic Pro might forever be faster than any 3rd party software package by having access to IP blocks that aren't exposed to other developers complete with signature check to prevent reverse-engineered use...
The current Oracle API-debacle also doesn't give me much hope that this would hold up in court. It's their hardware and by now they could even argue that Macs aren't general computing devices anymore. After all, what's the difference between the M1 and AMDs SoCs that power XBox and Playstation?
(I should be careful - I can always hear Apple's lawyers taking notes;)
You can also add this to your /etc/hosts file:
0.0.0.0 ocsp.apple.com
I tried to attach the notarization to every Mac App Bundle in the past but with MacOS 11 this doesn't help either?
Wait for at least one week and check out other people's experiences first.
To save yourself the headaches and frustrations, wait for the bug fix releases and updates to come first before installing this very first new release.
It makes no sense to immediately update the system and then risk your computer being rendered unusable with such bugs and problems whilst having a deadline hanging over your head.
I don’t know what to tell you, beyond the fact that all use cases are not the same, apparently.
Must be an absolute nightmare trying to handle every possible configuration someones Mac could be in. I dont envy the devs.
Of course if everyone does this, there is no experience upon which to draw.
Furthermore, the title is straight up wrong: this is not related to Big Sur and is in fact also affecting other versions with Gatekeeper.
Great example of how you should never block UX on network requests.
tbh, I'm a huge fan of macs but only really because I use it as a client/screen.
And of course there's the rest of the internet, which is a large part of my computer time.
> A better fix to this is:
> - Turn off Wifi (to be usable)
> - Add "0.0.0.0 http://ocsp.apple.com" to `/etc/hosts`
> - Turn on Wifi
> This is temporary, don't forget to remove it tomorrow.
or maybe don't depend on apple to allow you to run programs on your OWN computer. that hosts rule should stay in place...
Do you put URLs in /etc/hosts now? The mind boggles at the ways of Apple
I'm sure some devops folks were getting screamed at while running around with their hair on fire, but what's the cause and response. Hopefully they'll issue a public after action report that isn't jammed with marketing talk like "we were unfortunately caught by surprise and due to the unprecedented massive interest in the latest macOS with its great features for users and developers, blah blah".
(Do iPhones really send the current location to Apple?)
Another case is WiFi mapping. Your phone helps build a database of WiFi network locations to improve your location accuracy, again they don’t need your personal identity to build that.
I bought a new AMD PC and initially hackntoshed it. This actually worked out great but after some time I decided to jump over and see if I could live with WSL under Windows.
Windows is not as nice as MacOS, but WSL1 (tried WSL2 for a few months but still prefer WSL1) has allowed me take advantage of affordable high performance hardware and maintain support for the software I use daily.
I may buy a low powered MacBook laptop in future (because there are no Windows laptops with a trackpad that compares) but I don't think I will ever use it as a primary desktop environment again.
I can kinda see a noble intention behind this: protect system integrity by making sure no "known evil" application runs, like say a ransomware. But I have two problems with it.
First, it seems to assume that the call-home server will always be available, which seems a bad assumption from an engineering standpoint. Even the mighty and holy Apple can suffer outages, for a myriad of possible reasons. Be it a fat-fingering of some parameter during an approved maintenance window, the criticality of of which was heretofore unappreciated, a cascade of on-their-own-innocuous failures transforming into a deadlocked hard-down situation, or the fact that the North-American Fiber-Seeking Backhoe is not and never will be an endangered species, the result is ultimately the same: the mother-may-I server is not available.
The second reason, giving Apple further capability of evil shenanigans is already well covered by other comments here.
Apple seems to do all kinds of weird networking _stuff_ [...] https://news.ycombinator.com/item?id=24838816
I have preferred Apple/MacOS since 2007. However, my 2019 MBA suffered the infamous shaky keypress issue, randomly inserting an extra space when I typed. After 6 trips to the Apple store to fix under warranty I told myself it is my last Apple product.
I wanted the MBA for the portable form factor. Now I work from home and portability is no longer a consideration. I will mostly likely ditch this device in favor of a linux system.
What a disappointment.
sudo route add -net 17.253.17.207 255.255.255.255 -blackhole;
sudo route add -net 17.253.17.202 255.255.255.255 -blackhole;
dig +short ocsp.apple.com |grep -E ^[1-9]
17.253.17.207
17.253.17.202
sudo route delete -net 17.253.17.207 255.255.255.255;
sudo route delete -net 17.253.17.202 255.255.255.255;
HP accidentally revoked their certificate, and since macOS automatically checks it before loading code printing and scanning with my HP printer no longer works.
My mom called me with the same issue. She didn't do anything, but all of the sudden her printer stopped working.
There is no way I know of to override the accidental revocation.
Installing updates from Apple and HP didn't help.
Online certificate revocation is a really bad idea for desktop software.
You can't boot your self-written software on your "own" Apple Silicon Mac. There is no way to disable the locked down boot process.
You may argue that it's still your computer and you can do what you want with it. You're wrong.
You’ll discover there is no way to do so.
You may argue that it’s still your car and you can do what you want with it. You’re wrong.
Wait - what am I saying? - that makes no sense. Of course it’s your car.
Ahh, this is a bogus argument!
Just because there are things you don’t know how do with something doesn’t mean it isn’t yours.
It turns that all objects are this way!
https://medium.com/@acecilia/apple-is-sending-a-request-to-t...
Synchronous remote calls should not exist in the OS like this
A simple test for whether a product will stand the test of time is whether it'll cease to work once their creator's servers go down.
Imagine Apple goes bankrupt tomorrow. Is your overpriced device suddenly useless?
EDIT: This might indeed be Big Sur-release-day related. Most certificate revocation failures are "soft", but with ocsp.apple.com black-holed in /etc/hosts I can't resume downloading the update.
[1] https://twitter.com/lapcatsoftware/status/132699029641299148...
Now when I get my new mac, I'm going to find a way to opt out of this.
Anti-virus software have been working with "definition files" ever since the dial up days. Check locally. Update when you can.
This is a completely brain dead implementation.
All the extra connections are enough of an issue that there's OCSP stapling, where a web server attaches a copy of the OCSP check to the response.
Seems like it'd be possible to inject a file into Cool.app/Contents/ocsp.staple in a downloaded .dmg.
That could be considered valid for a few days so that, for the common case of "download app and try it out", there's no need to phone home.
Good connection -> Fine
Spotty connection -> Problematic.
Basically, they didn't include a timeout in their network code.
One of the things that's easy to take for granted these days when working on desktop or server software is a mostly stable network connection, but on mobile this goes completely out the window, or down the elevator shaft as the case may be. :)
The 'network states' are online, offline, all packets dropped, and various simulated network connections.
This is achieved by preloading the next click everywhere.
As it turns out, there are some downsides.
How would you prevent something like [0]?
I think all the game consoles regularly verify downloaded games too.
[0] https://blog.malwarebytes.com/threat-analysis/2016/09/transm...
I've found a work around for now.
* Turn off wifi
* Reboot
* Open everything you need
* Turn wifi back on
ocsp-lb.apple.com.akadns.net
which looks like does the same and should be blocked too!
Remember everyone's eagerness to eliminate bare, unencrypted HTTP? How self-signed certs are "sketchy?"
Has this been yet another way to pull the plug on certain parties? Could someone get Cloudflared by a maintainer of certs somewhere along the chain revoking a site's cert because they woke up in a bad mood?
Phoning home on every app launch seems insane to begin with.
But if you're gonna go there, at least be prepared for the inevitable.
cs_enforcement_disable=1 amfi_get_out_of_my_way=1
`sudo defaults write /Library/Preferences/com.apple.security.libraryvalidation.plist DisableLibraryValidation -bool true`
There are some work around in this thread but in reality you don't know how and when Apple may choose to automatically re-enable it without your consent.
* You should probably just smack you Mac with a rock just to be sure ;)
I bought the new mac, but I'm planning to dwell in the terminal and browser. My exposure to Apple's closed garden is very limited but I dread the day when it's forced upon me. Then I would need to switch hardware despite Apple's form factor being my ideal type (light and battery life+++).
First, just trying to get the system updater to display: https://i.imgur.com/waEF4kc.png
Second, after downloading 12gig of new OS: https://i.imgur.com/4HKMkPJ.png
I guess I should wait a few weeks.
For past few days I'm also experiencing the similar behaviour on my personal laptop.
Contrary to popular belief, ChromeOS devs do know that people might want to use Chromebooks on airplane or train trips without network. Google Docs / Sheets / Slides work on a cached copy and sync when online again.
Esp. rational corporate buyers are not going to want some 'cool new hardware' if they can't do basic things.
Makes you think about MS's existential 'always backwards compatible' philosophy.
- Turned off wifi and everything started working again.
- While watching network stats, noticed a little burst of network traffic on each attempt to launch an application.
But I'm running Mojave.
So ... huh.
Anyways I don't understand why this process would not be completely asynchronous.
Shouldn't it really say:
macOS unwilling to open any non-Apple application
macOS refuses to open any non-Apple application
Who’s selling those?
Your Mac hardware is a brick if Apple's servers aren't running!
I get what they were trying to do with it to improve security/privacy, but the execution fell flat (as we've now witnessed).
I'm curious what security researchers think of this. Further evidence that security is a doomed endeavor, since it's necessarily at odds with convenience?
Can't believe Big Sur is somehow affecting my Mohave Mac! Yikes!
macOS Software Update - Resolved Issue Today, 10:00 AM - 5:15 PM Some users were affected Users may not have been able to download macOS Software Updates on Mac computers.
Anyone else with this problem?
echo '127.0.0.1 ocsp.apple.com' | sudo tee -a /etc/hosts
https://medium.com/@acecilia/apple-is-sending-a-request-to-t...
So maybe things are improving?
I was deeply considering one of the new M1 MacBooks last night, but held off on completing the order.
Now today, I can't use my computer for nearly an hour. And my daughter as well during school time... all because a remote server can't respond. I just do not find that acceptable for a computer I own to simply stop working because of remote non-response.
I am now deeply considering not getting a new m1 machine.
Strange though, flushing my network cache completely fixed my issue.
I bought the new mac, but I'm planning to dwell in the terminal and browser. My exposure to Apple's closed garden is very limited but I dread the day when it's forced upon me. Then I would need to switch hardware despite Apple's form factor being my ideal type (light and battery life+++).
It is literally like this with every major release now.
-- Apple apologists
Unix workflows like to call hundreds of small programs.
If Apple doesn't respond in time, your system halts.
I think this is about MacOS Big Sur, aka MacOS 11, which released today?
https://arstechnica.com/gadgets/2020/11/macos-big-sur-launch...
Should disable gatekeeper. Have not verified with little snitch though.
I used to do this kind of thing to get around Adobe's DRM stuff. Not a good look Apple.
In my case, Finder hung badly.
This is exactly the kind of application Facebook was called out for (https://techcrunch.com/2019/01/29/facebook-project-atlas/). Just here it's much more worse as it's installed and activated by default on all Macs.
Dear Developer,
Compatible iOS and iPadOS apps will automatically appear on the Mac App Store when the first Apple silicon Macs become available this year. However, we noticed the following issues with one or more of your apps that are opted in to appear.
The following apps will not be made available on the Mac App Store until you address the issues and select Make this app available on Mac in the app's Pricing and Availability section of App Store Connect.
Once you get over the lack of polish, you'll find that it was hiding seams that are useful to know about.
A couple years later, snippets of code worth sharing will be lying around. Which you can share, or not.
I use desktops 99% of the time (it's more ergonomic), but I have an old XPS for occasional travel.
ocsp.apple.com 127.0.0.1 in /private/etc/hosts got it moving again.
After 11 years of MBPs as my main computer, I left because of crappy hardware (keyboards, missing Esc and Fn keys). I'm now very happy on a System76 laptop running PopOS.
With each new release of the OS, getting more and more locked down, I am happier that I moved on when I did.
The long term trend with Apple is for their computers to get more and more closed. First hardware, and now software. I get that for a phone, but it is completely antithetical to what a COMPUTER is supposed to be. They really should stop calling these things computers.
Huh.
After typing the above, I decided to check. THEY DO NOT call Macs "computers". I searched the pages for MBPs, iMacs, and Mac Pros. They use the word "computer" in connection with trade-ins, (for the thing you are trading in), and they use the phrase "computer system" in fine print, and never to refer to their products directly.
APPLE, IN THEIR OWN WORDS, NO LONGER BUILDS COMPUTERS. That explains so much.
;; ANSWER SECTION:
ocsp.apple.com. 3593 IN CNAME ocsp-lb.apple.com.akadns.net.
ocsp-lb.apple.com.akadns.net. 53 IN CNAME ocsp.g.aaplimg.com.
ocsp.g.aaplimg.com. 8 IN A 17.253.21.201
ocsp.g.aaplimg.com. 8 IN A 17.253.119.201
Even with lots of redundancy, there are still lots of ways all that can fall over. You can have a batch of servers that soft-fail: they're not responding to real queries but the load balancer thinks they're healthy.