You go for a walk, you carry an umbrella, or go dressed. You are at home, you do not expect it to "rain" or for someone to "watch you".
Like: Houdini Emacs Latex A file manager Audacity A Terminal ... Off the tip of my head, used almost daily.
> I didn’t mean to imply that one could not name programs that don’t communicate.
Can you understand how people would read your first comment that way, though?
I was trying to think of a regular program I use on my macOS (work) laptop that doesn’t connect to the Internet “unexpectedly” and I came up blank.
There is just no way to defend an underhand tactic that you didn't know about. If it was so necessary and so good and so pure, why does it have to be revealed like that?
It is not.
Imagine that I don't have that great wifi coverage in all places around the house. But I take my laptop there.
You know what happens when you have poor wifi connection and you wake up laptop? Even the keyboard+mouse are unresponsive. I was wondering why on earth my keyboard stoppe working on a brand new laptop.
All suddenly started to work when I moved to a different room.
I don't have issues with notarization if and only if it does behave normally when the internet connection is spotty - it is a laptop for gods sake, not a desktop with ethernet.
Missing or too-high timeout should be fixed, but I don't think that'd be enough to to satisfy critics in this thread? Would it you?
[Not setting a timeout on a network request is a common bug in, say, web development. It does make me lose some confidence in Apple's technical abilities if they make that bug in a place with such high consequences. But that's different than ill-intent or a privacy violation]
People seem to object to the basic idea of OCSP, which I think means objecting to the basic idea of app signing.
App signing seems reasonable to me (although it is important to me there be a way for users to choose to launch un-signed apps; there still is in MacOS). And OCSP seems important part of a app signing implementation. Improvements to the particular OCSP implementation for both privacy and performance may be advisable though.
A fix in /etc/hosts is all I needed, but if there was a timeout of 2 seconds I wouldn't even notice the problem -> so I wouldn't block notarization.
I am. It's one of the reasons I ditched OS X when 10.7 came out despite using Mac OS since 7.6. It's nobody else's business what I run on my machine.
You have three cases here: 1. Working internet connection 2. Slow internet connection 3. No internet connection
Everything works fine in 1 and 3, but breaks the OS when in 2 (and it is very common, just walk further from your router and you'll notice it - e.g. when waking up the mac from sleep).
What is strange to me is that I had an old Macbook Air with latest pre-BigSur macos, bought a new Macbook Air (early 2020) with the same OS and I saw the problem only on it - at first I thought it was broken.
What OS are you using? Purely off the top of my head, Linux programs I don't expect to be regularly connecting to the overall Internet in the background (at least unless I set an explicit opt-in setting or use a user-initiated action):
- Keepassxc
- Krita
- Blender
- Nearly all of my CLI tools
- digiKam
- VLC
- Audacity
- etc...
Programs I have that do check for updates or otherwise send activity to the Internet on boot:
- Firefox
- Calibre
- Emacs (Spacemacs)
- (Probably) something somewhere else that I'm forgetting?
Admittedly, I'm kind of cheating by using Linux instead of Windows/Mac. Those are OSes that don't have good update managers, so many apps manage updates themselves.
But even with those apps, there's a difference between an app itself initiating an Internet connection opportunistically in the background, and an app initiating an Internet connection that actually interrupts the app from launching. Very few of my native apps (side-eyes Emacs irritably) will stop working or freeze on boot if their update server is down or responding slowly.
Remember that the reason people found out about this in the first place is that they went to start launching apps on their Macs and found out none of them would start. That's the kind of behavior I would expect from a web browser if some global server was getting hammered (even if I would still be irritated to see it), but that I basically never expect for a native app.
I don’t think that is cheating. I was primarily thinking of my own work development environment in macOS but comparing that to Linux is perfectly valid. Again though, I didn’t mean to say, “I bet you can’t name a single program that doesn’t use the Internet!” I just meant to point out that programs using the Internet are probably a fairly considerable majority for most regular users.
I use KeepassXC on macOS and it definitely does check for updates. Does it not do that on Linux?
Programs like Spacemacs (updating ELPA repos on boot, which I actually kind of think is a mistake) and Calibre (just kind of doing its own thing) are the exception to that rule, but they're pretty rare in my personal experience. Even Firefox doesn't update itself on my Linux box.
That's kind of why I was thinking of Linux as cheating on some level. Windows/Mac programs basically can't do the same thing, since they don't have the same infrastructure.
> I just meant to point out that programs using the Internet are probably a fairly considerable majority for most regular users.
I would push back a tiny bit on this -- I don't think regular users would be surprised by a native program contacting the Internet, but I do think they would be surprised if that rest request failing meant that the program couldn't launch.
I fully agree. The only point I was aiming to make with my original comment was that the mere act of a program connecting to the Internet “unexpectedly” is by no means abnormal.
> That's kind of why I was thinking of Linux as cheating on some level. Windows/Mac programs basically can't do the same thing, since they don't have the same infrastructure.
MacOS, at least, is definitely headed in that direction with its App Store and the move to Apple silicon.
Ok but will those programs magically break if there is no internet? I would then argue nearly all applications work offline just fine. It's the exception that a program REQUIRES an internet connection..
> When you run software, you do not expect (sic) "unexpected" Internet use.
When I run software, I _do_ expect unanticipated Internet use. That’s why I use and love Little Snitch on macOS.
I wonder how the field of software development has changed so radically that this is somehow considered acceptable and even perhaps normal?
Back in the 90s to mid 00s even, it was considered a clear violation of user expectations and not even remotely acceptable. Back then at Sun it was a big rule to never initiate such opaque network activity that wasn't directly related to user action and the purpose of the code. Requesting exceptions to that would have to be escalated pretty high up and generally rejected. It was something you Just Don't Do.
Even running half a dozen machines at home, my networks connection was entirely silent except for the occasional NTP packets, unless I was actively doing some user-initiated network activity.
These days, well, the outgoing pipe is always active even when no machine is doing anything. Most of that traffic is just variants of spyware, reporting back to HQ on what the user is doing at all times. This should not be considered normal and its on us as the software industry to try to claw back on this problem.
[X] Query OCSP responder servers to confirm the current validity of certificates
You cannot uncheck anything in macos.
Arguably firefox won't let you opt-out of automatic updates and a bunch of other annoying stuff, but apple is significantly worse.
Yes it will, but you need to create a policy and be using version 60 which includes the Enterprise Policy Engine.
https://support.mozilla.org/en-US/products/firefox-enterpris...
The Enterprise Policy Generator add-on will help create the policy file.
I actually did the enterprise thing when I found out about it:
sudo defaults write /Library/Preferences/org.mozilla.firefox EnterprisePoliciesEnabled -bool TRUE"
echo "sudo defaults write /Library/Preferences/org.mozilla.firefox DisableAppUpdate -bool TRUE
shavar.services.mozilla.com
firefox.settings.services.mozilla.comBecause online OCSP checks damage privacy and don't help much with security, browsers are moving away from them:
https://www.ssl.com/article/how-do-browsers-handle-revoked-s...