That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. Even many CLI tools I use for development do update checks (and sometimes analytics) in the background.
> I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running.
What OS are you using? Purely off the top of my head, Linux programs I don't expect to be regularly connecting to the overall Internet in the background (at least unless I set an explicit opt-in setting or use a user-initiated action):
- Keepassxc
- Krita
- Blender
- Nearly all of my CLI tools
- digiKam
- VLC
- Audacity
- etc...
Programs I have that do check for updates or otherwise send activity to the Internet on boot:
- Firefox
- Calibre
- Emacs (Spacemacs)
- (Probably) something somewhere else that I'm forgetting?
Admittedly, I'm kind of cheating by using Linux instead of Windows/Mac. Those are OSes that don't have good update managers, so many apps manage updates themselves.
But even with those apps, there's a difference between an app itself initiating an Internet connection opportunistically in the background, and an app initiating an Internet connection that actually interrupts the app from launching. Very few of my native apps (side-eyes Emacs irritably) will stop working or freeze on boot if their update server is down or responding slowly.
Remember that the reason people found out about this in the first place is that they went to start launching apps on their Macs and found out none of them would start. That's the kind of behavior I would expect from a web browser if some global server was getting hammered (even if I would still be irritated to see it), but that I basically never expect for a native app.
> Admittedly, I'm kind of cheating by using Linux instead of Windows/Mac.
I don’t think that is cheating. I was primarily thinking of my own work development environment in macOS but comparing that to Linux is perfectly valid. Again though, I didn’t mean to say, “I bet you can’t name a single program that doesn’t use the Internet!” I just meant to point out that programs using the Internet are probably a fairly considerable majority for most regular users.
I use KeepassXC on macOS and it definitely does check for updates. Does it not do that on Linux?
Almost none of my programs on Linux do that by default, because they're handled by my package manager.
Programs like Spacemacs (updating ELPA repos on boot, which I actually kind of think is a mistake) and Calibre (just kind of doing its own thing) are the exception to that rule, but they're pretty rare in my personal experience. Even Firefox doesn't update itself on my Linux box.
That's kind of why I was thinking of Linux as cheating on some level. Windows/Mac programs basically can't do the same thing, since they don't have the same infrastructure.
> I just meant to point out that programs using the Internet are probably a fairly considerable majority for most regular users.
I would push back a tiny bit on this -- I don't think regular users would be surprised by a native program contacting the Internet, but I do think they would be surprised if that rest request failing meant that the program couldn't launch.
> I do think they would be surprised if that rest request failing meant that the program couldn't launch.
I fully agree. The only point I was aiming to make with my original comment was that the mere act of a program connecting to the Internet “unexpectedly” is by no means abnormal.
> That's kind of why I was thinking of Linux as cheating on some level. Windows/Mac programs basically can't do the same thing, since they don't have the same infrastructure.
MacOS, at least, is definitely headed in that direction with its App Store and the move to Apple silicon.
> That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running.
It is not.
Imagine that I don't have that great wifi coverage in all places around the house. But I take my laptop there.
You know what happens when you have poor wifi connection and you wake up laptop? Even the keyboard+mouse are unresponsive. I was wondering why on earth my keyboard stoppe working on a brand new laptop.
All suddenly started to work when I moved to a different room.
I don't have issues with notarization if and only if it does behave normally when the internet connection is spotty - it is a laptop for gods sake, not a desktop with ethernet.
The MacOS OCSP feature has been documented to be non-functional when there is no internet connection, it does not interrupt or slow down any functioning in that case.
Just like the sibling poster replied, it is not the issue of "no Internet".
You have three cases here:
1. Working internet connection
2. Slow internet connection
3. No internet connection
Everything works fine in 1 and 3, but breaks the OS when in 2 (and it is very common, just walk further from your router and you'll notice it - e.g. when waking up the mac from sleep).
What is strange to me is that I had an old Macbook Air with latest pre-BigSur macos, bought a new Macbook Air (early 2020) with the same OS and I saw the problem only on it - at first I thought it was broken.
That does sound like a bug, and if that's what's going on it makes me question Apple's technical excellence if they forget to put a reasonable timeout on a network call in such a high-impact place. This bug is not really about privacy though.
Slow Internet and no Internet are different things though. I have experienced this issue as well — sometimes after boot my regular apps will just bounce and bounce (in the macOS dock) and never start. Then when I plug in to ethernet and shut off my wifi everything all of a sudden fires up and starts working.
If there isn't a reasonable timeout set, that does sound like a bug. More than 2 seconds sounds pretty unreasonable to me (possibly should be even less), for a service that is willing to no-op give up when there is no network. Someone would have to do some reverse engineering/debugging maybe by observing/manipulating network traffic to be sure what is going on there, unless Apple wants to tell us but I suspect the suspicious wouldn't believe them.
Missing or too-high timeout should be fixed, but I don't think that'd be enough to to satisfy critics in this thread? Would it you?
[Not setting a timeout on a network request is a common bug in, say, web development. It does make me lose some confidence in Apple's technical abilities if they make that bug in a place with such high consequences. But that's different than ill-intent or a privacy violation]
People seem to object to the basic idea of OCSP, which I think means objecting to the basic idea of app signing.
App signing seems reasonable to me (although it is important to me there be a way for users to choose to launch un-signed apps; there still is in MacOS). And OCSP seems important part of a app signing implementation. Improvements to the particular OCSP implementation for both privacy and performance may be advisable though.
I absolutely agree with that. And I have experienced a similar issue with my laptop from time to time. It is pretty dumb and seems like poor implementation. I don’t think that is relevant to OPs argument though.
I didn’t mean to imply that one could not name programs that don’t communicate. Of course they exist. I’m not arguing for this type of behavior, just pointing out that it is pretty much the norm. On macOS I use Little Snitch to find and shutdown must of this extra traffic.
Others have already pointed out this is an exaggeration but still, there is truth to it.
I wonder how the field of software development has changed so radically that this is somehow considered acceptable and even perhaps normal?
Back in the 90s to mid 00s even, it was considered a clear violation of user expectations and not even remotely acceptable. Back then at Sun it was a big rule to never initiate such opaque network activity that wasn't directly related to user action and the purpose of the code. Requesting exceptions to that would have to be escalated pretty high up and generally rejected. It was something you Just Don't Do.
Even running half a dozen machines at home, my networks connection was entirely silent except for the occasional NTP packets, unless I was actively doing some user-initiated network activity.
These days, well, the outgoing pipe is always active even when no machine is doing anything. Most of that traffic is just variants of spyware, reporting back to HQ on what the user is doing at all times. This should not be considered normal and its on us as the software industry to try to claw back on this problem.
>I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running.
Ok but will those programs magically break if there is no internet? I would then argue nearly all applications work offline just fine. It's the exception that a program REQUIRES an internet connection..
All of that is of course bad. Ask around if people know their CLI tool is phoning home, most people aren't even aware. Let me control if I want to update something. Let me control what information goes out, and when.
There is just no way to defend an underhand tactic that you didn't know about. If it was so necessary and so good and so pure, why does it have to be revealed like that?
