Hacker News Reader

Comment by LeoPanthera | Hacker News Reader

Can you expand on "horrible telemetry" please? And since no Macs have a touch screen, I'm not sure what you mean by the "one interface" thing. Big Sur may resemble iOS but it is not the same interface at all.

View on HN

When installing Windows, I had to unplug the ethernet during a particular setup screen to avoid having every login checked against my cloud account. It put Candy Crush and Farmville ads in my start menu without consent. I remember having to spend effort to get Cortana to go away and (maybe) not send my searches to the cloud.

In MacOS, we've recently seen: pushy siri, sending search results to the cloud, and yesterday the OCSP failure made it obvious they were sending logs of every app launch to the cloud :/ . It's the same direction, even if they aren't yet quite as lost as Microsoft.

You opted in to enabling Siri and they are simply validating the signatures on the apps.

I don't think I ever opted in to Siri. How can I turn it off? I've disabled it from the menu bar but it's still on the touchbar, just waiting for me to slightly miss the delete key

System Preferences -> Siri and then disable the Ask Siri checkbox in the left.

Alas, that didnt remove it from the touchbar

System Preferences -> Keyboard -> Personalize Control Strip

It is hard with sys Perf. and keyboard ... and not good in interpreting one’s voice as well.

It’s one of the installer screens you get every time you install or upgrade OSX.

You would’ve seen it at least a dozen times by now.

To remove Siri from the touchbar:

System Preferences -> Keyboard

Click on "Customize Control strip"

You then drag and drop items on and off the touchbar. It is a totally inane, unintuitive interface and it took me forever to find it. Also, I couldn't figure out how to change it because the option DISAPPEARS if you're trying to customize in clamshell mode. The touch bar has to be open

I can't tell if it's deliberately bad UX, but I spent months being asked if I wanted to turn on Siri typing on this keyboard...

I feel like macOS asks me about Siri and privacy at login after every major update, with an unskippable setup window, but at least after account creation. Open System Preferences > Siri and disable Ask Siri. You can edit the Touch Bar via a menu in Finder.

I know, right? What's with all these people, expecting their personal computers to respect their privacy? If you want cool features, just be quiet and let Apple send whatever data they want to their servers. It's fine!

Did you miss the part where the parent reply said "opted in enabling Siri"?

I mean, if you enable a completely optional feature that requires giving up a bit of privacy for its literal intended functionality, how is it Apple's fault? And unlike Cortana on Windows 10, you can disable Siri feature just with a click of a button, or you can just click a button to not enable it in the first place. When you start your new Mac for the first time, it asks you very explicitly if you want it enabled or not.

I complained about Siri being _pushy_. It is. That's Apple's fault. If you opt out of Siri, that should be the end of it. It should not constantly nag you to enable it with an update-available style box and it should not drop a button in the button bar right above the delete key where it is guaranteed to get accidental presses.

This annoys me too. Every time I update my phone it asks and doesn’t go away until I go into settings.

Really off-putting and unexpected from Apple.

I feel like there's some over-reaction here. You pretty much have to either: 1. allow blanket access to all executables 2. perform some sort of validation/verification

Most people are not as technical as the people on this site, and we know that blanket access to all executables is not a great idea. MacOS is not immune to malware.

Having executables be signed means the signature has to be checked and the certificate has to be checked to see if it hasn't been revoked. I don't see how to do that without "phoning home" and checking, tbh.

I mean yes Apple could enable some expert setting or something for developer/expert types where you can say "trust me I know what I'm doing" but a lot of people who don't know what they're doing will enable that and then malware will run rampant again.

It's a shitty situation. But I'm not going to go down the paranoia rabbit-hole of assuming this is done to spy on me. At least not yet.

They could use bloom filters and inherited trust to avoid having to send the signature of every executable to the internet. And there really should be a switch to turn this off for people who don’t want to be treated like children and will accept the risk of malware. Make it something on the command line and I guarantee no regular user will enable it.

There's probably a middle ground but you know that within a day of making it optional, the various "Clean my Mac" utilities will have an option to disable it and soon enough instead of 99% of people having it enabled, 75% will have it dibbled. And then some malware hits and spreads like wildfire and the same people who were so adamant on disabling it are now complaining that Apple isn't doing enough to protect them and woowee Macs are just as insecure as Windows.

Speaking of Windows, they also moved to a "we know what's best for you" model with Windows 10.

Definitely a "damned if you do, damned if you don't" situation.

I understand why "power users" feel frustrated but also understand the company's POV. A story like "Macs are invulnerable to this latest ransomware attack" looks pretty good to investors; the random complaints of nerds and power users go mostly unnoticed.

I bet $100 this latest scandal will not affect Apple's bottom line nor will anyone care within a month - there'll be other reasons to be outraged over on Twitter.

Ever tried to opt out of Siri? I have. It nags you constantly. You search, looking for a gist to nuke it, but what you find doesn't work. Finally, you give in, just to get the damn thing to shut up.

I'm currently opted out and haven't been getting nagged at all on MacOS 10.15

How'd you do it? Any chance you remember the command that worked?

Just uncheck the box on System Preferences: https://i.imgur.com/FCuNZMO.png

I don't even remember Siri also exists on Mac OS most times.

If I put my preferences in that state I get nagged to enable Siri every morning. I'm on 10.15.5 (19F101).

I guess I'm in the wrong leg of the A/B test. Fing fantastic.

This sounds like you may have a corrupt preference file somewhere - perhaps deleting ~/Library/Preferences/co. On a normal install, you'll only be asked to enable on major OS releases. Since you're also on an old version of Catalina it'd be a good idea to install the security updates, too.

You could try to delete all of the preference files:

    find ~/Library/Preferences/ -iname com.apple.siri\* -delete

How does one disable the signature validation?

In /etc/hosts:

  0.0.0.0 ocsp.apple.com

then:

  sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # refresh hosts

Or alternatively:

  defaults write /Library/Preferences/com.apple.security.revocation.plist CRLStyle None
  defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None
  defaults write com.apple.security.revocation.plist CRLStyle None
  defaults write com.apple.security.revocation.plist OCSPStyle None

Disabling OCSP (I believe you have a typo in your hosts file suggestion, by the way) presumably doesn't actually disable notarization, just the OCSP (checking for revoked certificates) part of that process.

Yes, thanks. Edited to fix.

> Can you expand on "horrible telemetry" please?

Phoning home on every executable launch. Both because it's bad for privacy, and because the implementation of it is absolutely horrific such that when Apple's servers went down it basically locked up everyones computers at the same time.

It's on the front page still, even: https://news.ycombinator.com/item?id=25074959

Is it even really telemetry as we'd consider it? It's OCSP digital signature verification... to check if an app signature wasn't revoked. (or a website cert, or anything really)

It sends a hash of every executable you launch to Apple, how would that not be considered telemetry?

Not the hash of the executable, but the certificate that it's signed with.

What's the ratio between certs and applications on your Mac? Is it pretty close to 1:1, excluding Apple's own products?

Big Sur incorporates apps from iOS using Catalyst. iOS devices all have touch screens.

I think the thought is since the tap targets all got so much bigger for Big Sur it no longer feels like an OS designed for a pointer, more one designed for a finger.

Reply on news.ycombinator.com