Thursday's OCSP service-related issues highlight the fact that macOS sends a hash of every app that users run, along with the users' unencrypted IP, to Apple
Security researcher Jeffrey Paul, writes in a blog post … Michael Potuck / 9to5Mac : Deeper look at Apple's recent server outage reveals potential Mac privacy concerns Filipe Espósito / 9to5Mac : iOS 14.3 beta code indicates Apple may suggest third-party apps to users during the iPhone or iPad setup process, likely to appease antitrust concerns Tweets: Longhorn / @never_released : Tim Millet, VP of Platform Architecture at Apple (silicon team): « now we have a place where people can tinker, and play, and really get access to the bare metal and do interesting things with the platform. » (part of the interview at https://www.youtube.com/... about arm64 macs) @llanga : I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when ‘trustd’ and ‘syspolicyd’ are unable to do so, the entire operating system grinds to a halt. I'm typing this from my phone since the Mac is effectively frozen. https://twitter.com/... Vinay Gupta / @leashless : Extremely concerning privacy situation with the new Apple operating system https://sneak.berlin/... this is extremely bad @dhh : “This means that Apple knows when you're at home. When you're at work. What apps you open there, and how often. They know when you open Premiere over at a friend's house on their Wi-Fi, and they know when you open Tor Browser in a hotel.” 😞 https://sneak.berlin/... Robin Berjon / @robinberjon : Privacy Is Apple. Unless, you know, you want some actual privacy, like, from Apple. You can't get that why would you want that? https://sneak.berlin/... Tim Bray / @timbray : @nelson Hmm Apple's privacy story has been... not terrible. Tim Bray / @timbray : Seriously, is this true?! https://twitter.com/... @aral : Dear @tim_cook, “It turns out that in the current version of the macOS, the OS sends to Apple a hash (unique identifier) of each and every program you run, when you run it.” Is this true? If so, how can you say you believe “privacy is a human right?” https://sneak.berlin/... Mitch Kapor / @mkapor : Cory @doctorow tried to warn us. They know every app we run, every time, and where we run it from. Ugh. https://sneak.berlin/... Alex Van de Sande / @avsa : Apple reporting every app you are using to their servers, unencrypted, and preventing you from stopping it. https://twitter.com/... @dhh : Anyway, here I go again, reading noble intentions into a bullying monopolistic conglomerate that also happens to be the most valuable company in the world. This is the residue of two decades of goodwill built. They're spending it at a ferocious rate though! Lucy / @pentothalic : TL;DR after the next macOS update, not even Little Snitch will be able to save us from Apple phoning home when, where, and what applications we use on our privately owned computers But don't worry, they insist they are the “privacy-focused” tech company https://sneak.berlin/... Paul Haddad / @tapbot_paul : @reneritchie Sensationalist article aside there's some serious issues going on there. Apple designed things with a single point of failure and broke every Mac out there. It's likely that a bad actor/state could take advantage of this and DDOS a large number of Macs in the future. @mehgcap : Well, this is... quite scary. And bad. And creepy. I didn't realize this was a thing, or that iOS/iPadOS (apparently) do the same thing. https://twitter.com/... Chris Blec / @chrisblec : Very important read for Mac users! h/t @lightcoin https://sneak.berlin/... @dhh : Shit like this is also just compounded when you embrace the notion of privacy as publicly as Apple has. Which is one of the things I really like about Apple! But you gotta stay congruent. These statements are not compatible with a phone-home scheme on every app launch. https://twitter.com/... @dhh : Apple is late to rendering its actions and intentions through the lens of a two-trillion dollar conglomerate with a proven record of using its systems and dominance for anti-competitive behavior. You can't simply go on good intentions any more! Don't think Apple employees realize @dhh : Worth noting the technical reason here. I don't think Apple is gathering this data because they want to sell it to advertisers (like a Google or Facebook would). Completely believe that the creators of this system thought they were doing right by users. But that's the conceit... Michael Herf / @herf : This seems right to me: by checking every binary launched on macOS with OCSP, Apple has implemented full surveillance of what's going on with your computer, and it lets them track popular apps/etc. Not at all consistent with their privacy guarantees. https://sneak.berlin/... Adewale Adetugbo / @aadetugbo : 👀 Even more interesting are the exceptions for system level processes which make firewalling/filtering this traffic difficult @charlesarthur @SteveBellovin @stevesi https://twitter.com/... Nick Craver / @nick_craver : This is what a global single point of failure looks like. Please avoid them when designing systems. https://twitter.com/...
Context & Ripple Effects
Jeffrey Paul's writeup turns a routine Apple server outage into a privacy story: because macOS checks every Developer ID-signed app against Apple's OCSP responder at launch, Thursday's OCSP disruption exposed that each check carries a hash of the app being run plus the user's IP address, unencrypted. A follow-up deep dive into the OCSP responder by Security Embedded framed the service as a critical, under-documented piece of macOS security.
The episode has a precedent in Apple's history — a Yosemite Spotlight glitch once leaked Mail users' IP addresses to spammers — but the difference now is that the exposure is architectural rather than a bug, which is what pushed Apple to answer publicly.
First-order effects
- Every launch of a Developer ID-signed Mac app was dependent on a single Apple service whose failure degraded app launches system-wide, while simultaneously transmitting per-app hashes alongside unencrypted user IPs to Apple.
- Security researchers gained a concrete artifact to audit, moving the debate from abstract platform-trust claims to inspectable protocol behavior.
Second-order effects
- Apple was compelled into a direct policy response: it ceased logging IP addresses from OCSP checks and committed to shipping an encrypted protocol in 2021, per its response to the backlash.
- Third-party macOS developers face heightened user scrutiny of Gatekeeper-era signing requirements, since the privacy cost of Apple's verification pipeline lands on their apps' launches.
Third-order effects
- If the pattern holds, OS vendors' security infrastructure will be judged by the same transparency standards as their consumer data practices — Apple's encrypted-protocol pledge effectively concedes that integrity checking must be privacy-preserving by design, not incidental.
- Single points of vendor-controlled verification become both a reliability risk and a regulatory talking point: one outage demonstrated that Apple can observe, and its servers can gate, every application run on macOS.
The trend: Platform-level security services are being reexamined as covert telemetry channels, pressuring Apple and peers to build privacy guarantees into verification protocols themselves.