Ask HN: Is Apple really phoning home every time I start an application on macOS?

13 points by mahathu 5y ago ↗ HN

I'm not sure if this sort of question is welcome here, but I'd imagine it could allow for some interesting discussion beyond the scope of the initial question.

I'm living on an extremely restricted internet connection right now that completely drops out every few minutes (my ISP is Vodafone, fellow German users will know what I mean.) I noticed that when my internet connection stalls, but I'm still connected to the wifi, I'm unable to open certain apps. So far I've experienced it with VLC, VS Code and Firefox. I remember some time ago there were rumours that apple was actually sending usage statistics every time I launch an app back to their servers. If the connection is interrupted, the apps don't start. Is this actually the right explanation? If that is true, this would be so nightmarishly dystopian to me I'd consider switching back to linux. Thank you!

9 comments

[ 3.3 ms ] story [ 31.9 ms ] thread

__d 5y ago ↗

It's kinda true.

I think macOS will check that the developer certificate used to sign the application you're about to start hasn't been revoked.

Search for ocsp.apple.com, around November 2020, for details.

mahathu 5y ago ↗

I found this related HN thread: https://news.ycombinator.com/item?id=25076588

I wonder why this didn't blow up more, it sounds like such a privacy nightmare.

__d 5y ago ↗

Yeah.

For me, I accept that there's a tradeoff between being able to revoke the signed status of an application, and doing a certificate check at launch time.

And you're already trusting Apple with a bunch of stuff, so one more thing isn't that much worse.

But yeah, it's still creepy, and ripe for abuse.

blondin 5y ago ↗

shouldn't be happening every time you open these applications though.

rurban 5y ago ↗

Buy a proper firewall, like Little Snitch. Also beware of the Safari downloads sqlite DB.

Engineering-MD 5y ago ↗

I was under the impression Apple first party apps could bypass these with special privileges?

peterwandering 5y ago ↗

Not anymore. https://www.zdnet.com/article/apple-removes-feature-that-all...

ixacto 5y ago ↗

Yes they do. Also for account changes.

runjake 5y ago ↗

It's checking for certificate status, not so much phoning home. To my knowledge, it is only sending some hashes to Apple. It is not sending any personal data.

Here is a good write-up on the issue:

https://www.sentinelone.com/blog/what-happened-to-my-mac-app...

I recommend that people not block oscp.apple.com as it has security benefits. If your threat model dictates blocking oscp.apple.com then you probably should not even be running macOS (or Windows).