Top all-time · #5995
Jacopo Jannone
Personal blog · blog.jacopo.iosecurityprogramming
Jacopo Jannone's personal blog at blog.jacopo.io covers security and programming. Since 2020, 13 different Hacker News readers have linked it 13 times, most often “Does Apple really log every app you run? A technical look”. The last post was in 2024, but the archive is still widely read.
Too few sampled comments (12) to say how often HN recommends it.?
Why HN links it
Linked mainly for a post on macOS OCSP checks, which covers what Gatekeeper sends to Apple when an app runs. Commenters also cite it for a post on Italian digital ID apps and TOTP.
Summarised by Claude from a sample of 12 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Does Apple really log every app you run? A technical look12 people · 12 mentions · first linked 2020-11-14
What Hacker News says?
OCSP isn't "scanning". It checks if a certificate is revoked. https://blog.jacopo.io/en/post/apple-ocsp/
Comment linking /en/post/apple-ocsp/
on “Apple’s Mistake”Submitted Does Apple really log every app you run? A technical look as a story · 621 points
HN discussion> "Whilst the software doesn’t offer the best the hardware can offer, with time, as developers migrate their applications to native Apple Silicon support, the ecosystem will flourish." I think that more developers would be excited about migrating their apps to support native apple silicon if Apple wasn't so developer hostile at the moment. I am referring to stuff like Apple's Online Certificate Status Protocol ( htt…
Comment linking /en/post/apple-ocsp/
on “2020 Mac Mini – Putting Apple Silicon M1 To The Test”Apple is using an industry standard protocol to check and see if an application's developer certificate has been revoked. >To make sure the certificate hasn’t been revoked, macOS uses OCSP—short for the industry standard Online Certificate Status Protocol—to check its validity. https://arstechnica.com/gadgets/2020/11/mac-certificate-chec... There is no information tracking the application that is sent. The protocol…
Comment linking /en/post/apple-ocsp/
on “Suspended from Google Play for listing supported subtitle formats”HTTP is specified in the RFC. Only the developer certificate is checked. OCSP is also used by web browsers to check the revocation status of certificates used for HTTPS connections. Apple leveraged OCSP for its Gatekeeper functionality. This is not the same thing as notarization, which is checked over HTTPS. https://blog.jacopo.io/en/post/apple-ocsp/ Perhaps you should learn about OCSP before complaining about its u…
Comment linking /en/post/apple-ocsp/
on “macOS has checked app signatures online for over 2 years”I think it's smart to be concerned and smart to make your own decisions about what you're comfortable with. For what it's worth: Mac OS doesn't phone home on every app open. The result is cached on your computer for a few days[1]; this behavior was lightly confirmed by an independent researcher[2]. I don't think the caching really addresses the core concern. Apple has promised to provide an opt-out sometime in the n…
Comment linking /en/post/apple-ocsp/
on “Apple M1 vs. Ryzen 3900X vs. Intel I9 in Software Development”Government ID providers in Italy lock people to proprietary apps even when all they need is the most ordinary TOTP https://blog.jacopo.io/en/post/spid-google-authenticator/
Comment linking /en/post/spid-google-authenticator/
on “Dutch digital identity system crisis”As this article here: https://blog.jacopo.io/en/post/apple-ocsp/ showcases, Apple doesn't send "my data" on every app start. It sends a hash of the certificate in use to Apple, which happens to be an Apple certificate that is used to sign many applications running on your system. None of your data is being sent to Apple.
Comment linking /en/post/apple-ocsp/
on “Application trust is hard, but Apple does it well”> If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. Well, "unacceptable mess" are your words. It's totally acceptable to me that there could be issues on a feature / launch that need to be ironed out, unless we're talking about aviation software or pacemakers. If we deemed "unacceptable" any misstep or early issue, we wouldn't even have fire,…
Comment linking /en/post/apple-ocsp/
on “Application trust is hard, but Apple does it well”This article by Jacopo Jannone refutes the notion that macOS sends an application's hash to Apple "on every single app open": https://blog.jacopo.io/en/post/apple-ocsp/ Also in that article, the OCSP protocol is supposed to go over HTTP and not HTTPS: "If you used HTTPS for checking a certificate with OCSP then you would need to also check the certificate for the HTTPS connection using OCSP." Furthermore, the return…
Comment linking /en/post/apple-ocsp/
on “Safely open apps on your Mac”In November of 2020, Apple's OCSP responder became slow/unavailable for a bit. As a result, Mac apps were either not loading or taking a very long time to load because trustd was trying to connect on app launches and connecting but not getting a quick response. https://blog.jacopo.io/en/post/apple-ocsp/
Comment linking /en/post/apple-ocsp/
on “The Art of Mac Malware: Volume I: Analysis”https://sneak.berlin/20201112/your-computer-isnt-yours/ https://news.ycombinator.com/item?id=25078034 https://blog.jacopo.io/en/post/apple-ocsp/ https://news.ycombinator.com/item?id=25095438
Comment linking /en/post/apple-ocsp/
on ““Could you disable your Mac's password?” asked at an Apple store (2018)”This author appears to have a bit of an axe to grind, so take his article with a grain of salt. From a much better researched take: https://blog.jacopo.io/en/post/apple-ocsp/ > No, macOS does not send Apple a hash of your apps each time you run them. > You should be aware that macOS might transmit some opaque information about the developer certificate of the apps you run. This information is sent out in clear text…
Comment linking /en/post/apple-ocsp/
on “Macs Are a Privacy Nightmare”
