← Back to context

Comment by submeta

4 years ago

Unbelievable. When I read the tweet (tried to post here as well), I suddenly realized why my Mac was unresponsive an hour ago.

Here is another tweet that describes the problem in more detail:

https://mobile.twitter.com/llanga/status/1326989724704268289

> I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when `trustd` and `syspolicyd` are unable to do so, the entire operating system grinds to a halt.

EDIT:

As others pointed out, I put this to my `/etc/hosts` file and refreshed it like so:

    sudo emacs /etc/hosts # add `0.0.0.0 ocsp.apple.com` 
    sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder # refresh hosts

413 comments

submeta

Reply
areoform  4 years ago

So yesterday I wrote about the blurring lines of ownership, and people came back with some fairly disparate responses. It's fair to say that I was mostly dismissed. https://youtu.be/Hg9F1Qjv3iU?t=3177 , timestamp 53:33) and they have no intention whatsoever of taking away our ability to do general compute on the machines we buy and own.

Except...

Apple can already decide what binaries you can execute. Should they choose to.

Apple is now restricting what other OSes you can boot into. As they've chosen to.

Apple can now make their machine reject a new, third-party repair part like a bad transplant. Should they choose to.

It's clear where they're going. And I'm jumping ship. It's painful to do so, given how invested I am in the ecosystem, but we're already beyond the threshold that many of us would have left earlier in the decade.

---

edit - It's also really hard as a designer + developer + would-be researcher in the making to find a good computer. Most non-Apple laptops don't have very good color accuracy. They also don't have good trackpads, and their keyboard + trackpad alignment is wonky (it's off-center in a lot of cases! How weird is that???)

I'm trying to find a laptop with good build quality, long battery life, a good display that I can design on, a good trackpad so that I don't have to carry around a mouse, good speakers would be a plus, and light enough that I don't feel like I'm lifting weights while working on my laptop. And this package should ideally come with 512GB of SSD storage and, at least, 16GB to 32GB of RAM.

Oh and it shouldn't be more expensive than a Mac as many of these laptops are!

Any suggestions?

  • nightowl_games  4 years ago

    Yeah so basically in the windows world, a lot of the good laptops are under the "business class" of the various manufacturers:

    Dell Precision, HP Elite Book, MSI Prestige

    In the consumer world the Dell XPS, Asus Zenbook, Asus Pro Art are the way to go for a designer.

    Dell Precision is probably the overall best laptop. MSI Prestige is targetted right at you though, with color accuracy and a good display. The only brand I can personally vouch for is Dell. I and my partner use XPS's, and a good friend of mine has a super nice Precision that I am jealous of (specifically the ports! I'm so over USB-C)

    • LeifCarrotson  4 years ago

      Lenovo Thinkpad is another popular line, seems conspicuously absent from your list. They're known to have good resale value, and to work well with Linux. If you're getting up to the Precision line, the Lenovo P series workstations are also worth considering, though given they're actually professional-grade machines with Xeon and Quadro parts they'll be more expensive than a Macbook Pro.

      There are also boutiques like System76, that white label, upgrade, and manage driver compatibility for Clevo laptops which may be worth considering, they just came out with a new Lemur Pro like yesterday.

      42 replies →

    • fn1  4 years ago

      > In the consumer world the Dell XPS [...] are the way to go for a designer

      I have to use a Dell XPS 9560 and had two issues with it, most people never realize:

      1. The Intel Thermal management driver is buggy so the device shuts off on very high-load tasks. You have to find the old driver on the internet and install it, and prevent windows from reverting to a new driver.

      2. Only after two years of hanging connections and dropped UDP-packets I ran a speedtest and realized that this is not my home-internet being weird, but a systemic problem of the Wifi-card, which others have reported on the internet as well. Switched cards - getting windows to recognize the new one was difficult - and now I have normal Wifi.

      Both of these issues are terrible for customers, and I still wish I wouldn't have ignored/overlooked the Wifi-issue for so long, as it interrupted work for a very long time.

      3 replies →

    • netflixandkill  4 years ago

      I use MSI laptops almost exclusively although they're definitely wiped and reinstalled to win10 ltsc or freebsd.

      In as much as I love the Mac touchpad for kanji/hanzi input the 2015 pro will probably be my last.

  • amatecha  4 years ago

    Wow, the way Craig is laughing at the question and so dismissive of it is really insulting. Maybe it's the more casual nature of the interview/discussion, but this really is the crappy icing on the cake of Mac users' continuously-declining control over the machines they spend their hard-earned money on. "Where do you even begin to come up with that theory"?? I mean, maybe we're seeing the gradual hampering of control over our computer with every OS X release in the past 5-10 years?

  • quantgenius  4 years ago

    Get a Thinkpad. I replaced a 2015 MacBook Pro with a Thinkpad P1 Gen2 and love it. The trackpad isn’t as nice. The keyboard is better. Running WSL2 you have a great Unixy development environment in Windows. Or just install Linux. As thin and light as a MacBook Pro. Much better thermals, though still not awesome. Other, somewhat larger Thinkpads have better thermals. You can upgrade your RAM, add 2 SSDs and other peripherals like a 4G card etc if you like. Thinkpads come with fantastic service. Next business day on-site repair including for accidental damage and they mean it. Looks: It’s the design Apple copied for their very first laptops and is IMO better looking. They got it right the first time and haven’t changed it materially. Built like a tank. Not quite a tough book but they will take some abuse.

    • sgerenser  4 years ago

      I have that exact laptop (work provided) and I’m not a fan. Trackpad is OK but not nearly as good as my Mac. 4K display sometimes looks amazing but the color accuracy is terrible and there’s a weird speckle texture that I assume comes from the touch overlay. I have a thunderbolt dock that supplies 85w of power but the machine refuses to charge from it and requires connecting the huge external power supply. But the worst part is I’ve gone through several incidents where some update occurred (never could narrow it down to one in particular) and I started getting multiple blue screens a day.

      Edit: forgot one more annoyance. The laptop seems to frequently power off completely overnight even though it should just be sleeping/hibernating.

      4 replies →

  • bangonkeyboard  4 years ago

    > they can simply toggle a switch for all users to "no unsigned binaries"

    That switch was toggled with Big Sur and Apple silicon: https://mjtsai.com/blog/2020/08/19/apple-silicon-macs-to-req...

    • jkaplowitz  4 years ago

      While true, that doesn't mean that an Apple-controlled key decides which apps will run:

      > There isn’t a specific identity requirement for this signature: a simple ad-hoc signature issued locally is sufficient, which includes signatures which are now generated automatically by the linker. This new behavior doesn’t change the long-established policy that our users and developers can run arbitrary code on their Macs, and is designed to simplify the execution policies on Apple silicon Mac computers and enable the system to better detect code modifications.

      (Source is the link you provided.)

  • lliamander  4 years ago

    NotebookCheck is a great website for laptop reviews. They even get into the nitty-gritty details of display calibration, input devices, power consumption, etc.

    Here's a list of the laptops with the best displays: https://www.notebookcheck.net/The-Best-Notebooks-with-the-Be...

    And here's a list of general multimedia laptops that would be roughly equivalent to a MacBook Pro: https://www.notebookcheck.net/Notebookcheck-s-Top-10-Multime...

    • fwipsy  4 years ago

      I find that their reviews are amazing but their "top 10" lists are lacking. Their search: https://www.notebookcheck.net/Search.8222.0.html is marginally better, but in general, they're for researching specific models, not finding models, imo.

      Edit to add: The other thing is that for their percentage laptop score, you should generally subtract 80 and multiply by 10. I've never seen them review a laptop below 60% or above 92%.

  • acomjean  4 years ago

    My partner bought a razer 13 inch to replace a MacBook Air. It wasn’t cheap, the build quality is excellent and it handles everything (she’s in an orchestra and records her parts on it, does graphic design and sometimes plays fortnite.). The screen is quite nice and the build quality is better than my system 76 (onyx pro) which I really like too.

    Dave2d on YouTube gives pretty short and decent laptop reviews. I think he has a discord channel discussing the machines too

    • sgtnoodle  4 years ago

      My 2017 razer stealth 13" has rather questionable build quality.

      * Once a month or so, the touchscreen flips out and starts registering dozens of random finger taps per second. There are tons of complaints on the internet, but Razer never acknowledged it as a known issue.

      * One of the long rubber pads on the bottom fell off after about a year and a half.

      * The USB-C power cord's insulation was frayed from day one.

      * When running Linux, the kernel continuously reports "correctable" pci-e errors, indicating a signal integrity issue. I had to turn down the verbosity of the messages to keep from spamming the journal.

      * When running Linux, a monitor connected via HDMI has random "snow" noise. When playing any sound through the builtin speakers, the monitor blacks out every 10 seconds or so. Plugging in headphones "fixes" it.

      * The bios' ACPI implementation is buggy and doesn't properly report whether the lid is open or closed. As a result, the laptop sometimes fails to go to sleep when I close it, and sometimes fails to wake up when I open it. It works most of the time but not always in windows, and linux got into a perpetual sleep-wakeup-sleep loop until I found the right workaround.

      * A plugable brand thunderbolt dock "glitches" every 10-20 seconds when typing on a USB3 keyboard. Plugable claims it's due to buggy Intel firmware in the laptop. To be fair, a different brand of dock works fine, though.

      3 replies →

  • PKop  4 years ago

    Manjaro GNOME on any of the Thinkpad models.

    I switched away from Macbook Pro about a year ago, after using Apple hardware for about a decade.

    It's working great, GNOME interface is solid and productive, Manjaro and AUR libraries just work. Highly recommend making the move, sooner the better as I'm sure you see the writing on the wall.

  • monocasa  4 years ago

    My Huawei Matebook Pro has been everything I wanted in a Mac, in a way I couldn't get from Apple.

    Pros that Macbooks don't have: USB-A (along with USB-C), no touch bar, 3:2 screen, can enable secure boot if I choose so feel like I'll be able to run whatever I want on it, replaceable SSD, etc.

    Pros that Macbooks also have: still has a great build quality, full day battery

    Cons that both have: Non replaceable RAM

    • UglyToad  4 years ago

      I can second this, I'm on the Matebook 14 2020 with the Ryzen 7 I think rather than the Pro. But after a dreadful run of luck with the XPS15, the Matebook (so far) is an amazing bit of kit for almost half the price.

      It feels like if they play the next iteration right Huawei could blow most of the top end out the water, there's so little choice at the top end and they all seem riddled with build quality, hardware or software issues.

      I'm glad I took the risk on the Huawei and I don't really regard the Chinese spying moral panic as an issue. If they want to spy on you I'm sure there's far easier ways online than trying to backdoor a highly scrutinised laptop.

    • silverpepsi  4 years ago

      My huawei matebook pro is the best laptop I've ever owned.

      The only downside is that I have Windows 10 on it, and considering Microsoft actively destorys user data and has for 15+ years as company policy...I won't use it for serious work, only entertainment. :(

      User state is also a time investment, so rebooting and destorying this is not ok even if all files by some stroke of luck were saved first

    • intricatedetail  4 years ago

      Are you not worried about your data going to China? Huawei looks indeed great, but I would never use it. Maybe if there was a way to replace components with ones from legitimate source like Mouser or digikey, to ensure there is no spying going on.

      1 reply →

  • kweks  4 years ago

    Over the generations, I have had three Macbooks, four Vaios, a ThinkPad, a HP, multiple ASUS and Huawei. Most of the devices I have killed by travel: dust infiltration, vibrated the BGA chips off the boards by motorbike vibrations..

    My requirements have all been fulfilled with the Huawei MateBook X Pro.

    You could say it's heavily inspired by the MacBook. Aluminum case. Chiclet keyboard with decent travel. 2000x3000 display (2:3 ratio!). Awesome trackpad. Good battery life. Portable. Solid. 2x USB-C and 1x USB-A. Sustained multiple drops.

    For context, I am able to pull solid 12-hour days on the device, without a mouse, without fatigue or frustration.

    Cheaper than a MacBook. Might be worth a look.

  • LockAndLol  4 years ago

    Assuming you were going for a Macbook Pro "15 for 2399$

    Recommendations for linux laptops (or checkout https://linuxpreloaded.com/ ):

    * Tuxedo https://www.tuxedocomputers.com

    ~1000$ 1.5kg, Their "15, 1080p flagship is configurable with AMD Ryzen 7 4700U, 32GB RAM, 500GB M.2

    They also have more expensive versions with 4k OLED displays if that's what you're into. Also "13.

    * KDE Slimbook https://slimbook.es/en/store/slimbook-kde/kde-slimbook-15-co...

    ~1200$ 1.5kg, "15, 1080p, AMD Ryzen 4800 H, 32GB RAM, 500GB NVMe

    * System76 https://system76.com/laptops/gaze15/configure

    ~1350$ 2.2kg, 15", 1080p, i7-10750H, 32GB DDR4, 500GB NVMe

    * Purism http://shop.puri.sm/shop/librem-15

    They're trying to become and opensource Apple --> high prices, own linux distro, trying to make their own ecosystem, etc.

    ~2000$ 1.8kg, "15, 4K, Core i7 7500U (Kabylake), 32GB RAM, 500GB NVMe

  • mastazi  4 years ago

    > keyboard + trackpad alignment is wonky (it's off-center in a lot of cases! How weird is that???)

    Those are laptops with numeric keypads, the trackpad is still centred relative to the "main area" of the keyboard (the home row and in particular the rest keys - the two keys with a little bump, F and J on a QWERTY) but it is off-centre relative to the body of the laptop due to the presence of the keypad.

    Macs don't have numpads so if you've always used Macs it's understandable that you're not familiar with this type of layout.

    In any case that type of placement makes no difference while you are using the laptop, because keys and touchpad are still where they are supposed to be relative to each other.

  • jonahbenton  4 years ago

    Get a Thinkpad, P-series, lots of options. Run Fedora on it. Great machines, great keyboard, 4k screens, good color, goot battery life, lightweight. Everything works. Mac-level price, and worth it.

  • jhoechtl  4 years ago

    > edit - It's also really hard as a designer + developer + would-be researcher in the making to find a good computer.

    I woukld agree on desginer.

    Absolutely not on developer or researcher.

    Actually MacOS is for the reasons you mentioned incredibly developer-unfriendly (unless you target is of course the iOS ecosystem).

    And for research there is no better platform but Linux. Unless you are in clicky-colorful frontend applications where I would doubt you are doing serious research.

  • ratbags  4 years ago

    Try metabox. (https://www.metabox.com.au/). They have a wide range of laptops at various specs and prices and form factors and whatever else. A lot of the guys at work have started to switch to them and they feel nice to hold and fondle.

    I'm currently in the same boat as you and my next machine will be from these guys when my (admittedly very new) Macbook Pro gives up or gets taken over by Apple.

  • intricatedetail  4 years ago

    It's hard to say who is now Apple's target audience. It seems like their products are ideal for people who don't know much about IT and just want to watch a video or edit their holiday photos and maybe create a CV and will probably never go beyond that. Other people still enjoy Macs from 2012, but things are moving on when you look at desktop PC and what you can do. Apple looks more and more dumbed down.

    • brobdingnagians  4 years ago

      It's like being trapped in a beautiful plastic cage. I used a MacBook Air (2012) for years as my primary development machine and really loved a lot about it, and it had some fantastic apps in the environment like QuickSilver, especially since it just worked compared to some of the Linux distros I had before that. But I'm glad I jumped ship when mine went obsolete.

      2 replies →

    • randomNumber7  4 years ago

      I understand people doing live music with it. Think about what would happen if Windows forces you to update during your performance^^

      Graphic designers because the nice display...

      Otherwise i don't get it. I think for most other people it's a status symbol ;)

      I especially don't understand why IT affine people buy it. Just buy DELL, HP, Lenovo, Alienware and install linux. Gives you more bang for the buck...

      1 reply →

  • calciphus  4 years ago

    I really like my surface book. They are priced like MacBook pros (and spec'd like them too). The track pad is great, the pen input and detachable screen come in handy more than I'd have guessed when I first switched.

    Apple has a pretty broad utility patent around their trackpads, which requires other manufacturers to work around what would seem like pretty obvious things.

    PDF: http://assets.sbnation.com/assets/2017767/USD674382S1.pdf

  • henry_bone  4 years ago

    Are there no other suggestions beyond the 2012 MBP?

    I use arch linux on a Lenova Thinkpad T580, and I'm really happy with it, but I'm not sure about the colour accuracy of the screen. I doubt it's as good as you find on an Apple.

    I, for one, am really interested in good, high quality alternative to apple laptop hardware, that meet the parent's criteria.

    • zapataband  4 years ago

      I just got an eluktronics. Basically barebones powered up systems. I got one running windows but that's only because I need the ableton software.

  • Thorrez  4 years ago

    I agree with you that Apple is doing way too much to restrict users. But I also agree with Craig in that I don't see how Apple silicon is useful for them in helping to restrict users.

    • mahkeiro  4 years ago

      It is useful as a justification. Not from a technical point of view, but just to support the pathway they have planned and the story around it.

      2 replies →

  • radicalbyte  4 years ago

    Dell XPS have an option for a fantastic 4K screen. After calibration it's better than the Retina screen on my 2013 MBP.

  • billylindeman  4 years ago

    X1 Yoga 4 is what I went with recently when my 2016 macbook pro died for the 4th time since owning it.

    Its very similar to the x1 carbon but converts to a tablet and it has an aluminum body.

    I can't say I'm out of the apple ecosystem entirely, but I decided to spend my money elsewhere given the abysmal quality of the macbook pro line these days.

  • xnyan  4 years ago

    Thinkpads. Lenovo is far from perfect, but they have been good stewards of the brand.

    • Frost1x  4 years ago

      I like Lenovo ThinkPads and even IdeaPads (I own one for personal use) but I do hesitate dealing with potential Chinese spyware from the factory for work uses.

  • cloudwalking  4 years ago

    I’d suggest using a Mac until it doesn’t actually work. Then you can find a new computer to compromise with.

  • MrSouth  4 years ago

    Owning a Lenovo X1 Carbon 7th gen, 2019, 4K screen, 16GB RAM. extremely impressed with the hardware, running Linux Mint and going to move to Manjaro. Initially i tried PopOS! but they removed from Gnome the intermediate scaling (1.5X) of the UI, just like in MacOS you have Display - Scaled options. I really like the per monitor setting which you don't have in Linux. (or i didn't research enough); e.g. More space on main display (external 4k monitor) and Larger Text on the macbook screen. I'm also jumping ship due to the worst experience i had in 25 years dealing with technology, 1 month to replace a swollen battery with a 3rd party repair service. Apple throws now all this "complex" hardware issues to 3rd parties since their employees are pressuring them not to execute hazardous repairs in their own "centers"

  • birdyrooster  4 years ago

    Their SSL certificate revocation server (the default for macOS) goes down an you try to tie it to Apple Silicon being created to lock-in users? I understand the feelings people have about this but today's failure seems orthogonal.

    • HideousKojima  4 years ago

      It's just one of many recent actions that they've taken that have made people wary. The changes to app signing in recent OS X versions was another example of this

  • virtualritz  4 years ago

    Huawei Matebook X Pro. A friend has one, 2019 model. Runs Ubuntu on it.

    Trackpad is as good as it gets outside Apple, I'd say.

    The display looks gorgeous. Can't say about color accuracy/fidelity though.

  • AtlasLion  4 years ago

    Re colour accuracy, checkout thinkpads, they even come with a colour calibration sensor so you can have them autocalibrate daily/weekly or whatever suits you.

  • fierarul  4 years ago

    > Oh and it shouldn't be more expensive than a Mac as many of these laptops are!

    Clearly there's no need to jump ship if it's more expensive on the other side.

  • pkulak  4 years ago

    Do you _really_ need a laptop? That's my solution to the problem of no good Linux laptops. I've got a desktop at home now, and when I go back to the office, I'll pick up a mini desktop. I'll keep an old MacBook in a drawer if I need to take it into a meeting. When I used laptops only, they were just plugged into a monitor/keyboard/mouse at all times anyway.

  • pmontra  4 years ago

    > their keyboard + trackpad alignment is wonky (it's off-center in a lot of cases! How weird is that???)

    Buy something without a number pad. Unfortunately most 15" laptops do have one.

    If anybody from HP is reading this, I'll pay an extra for a keyboard without number pad on your 15" ZBooks with 3 buttons on the touchpad. Space bar and touchpad aligned with the center of the screen please.

  • hitpointdrew  4 years ago

    >it's off-center in a lot of cases! How weird is that

    It is off center if they have a number pad to the right of the normal keyboard layout. At first glance it looks weird, but it is 100% what you would want if you were using the laptop. Otherwise the trackpad would end up being right over where your right wrist is.

  • e12e  4 years ago

    > I'm trying to find a laptop with good build quality, long battery life, a good display that I can design on, a good trackpad

    Sounds like you might want a Microsoft surface (or surface book).

    Not sure about the TouchPad - but at least there's a pen for drawing on the screen.

  • plufz  4 years ago

    I just gotta say that I don’t think it’s clear where they are going. You are of course free to do however you like. And if you are leaving because of what they already have done, that’s reasonable, but if you are leaving because of what you are guessing that they might do tomorrow, is that really wise? I mean even with the ARM switch won’t it be as easy to switch to win/linux intel after a year if you are not satisfied?

    I don’t like the boot thing either, and it’s a bit scary not being on intel as everyone else is right now, but I also think ARM feels really interesting and it might turn out to be a great new platform!

    Edit: i mean it is not like they never listen, they did take bake the mac pro, they did fix the keyboards, you have cli tools to make a lot of changes in how macos works, etc. Of course I would like hundreds of things to be different, but I believe that is true of all platforms.

  • tekstar  4 years ago

    2012 Macbook Pro. Get the highest-spec Magsafe laptop you can find.

    • nmg  4 years ago

      I second this. Catalina runs great on my 15" mid-2015 16GB/1TB, and it even runs shockingly well (bootstrapped) on my (unsupported) 13" mid-2009 8GB/512GB.

      The 2009-2015 era of Macbooks are, not were, truly phenomenal machines.

      2 replies →

  • girvo  4 years ago

    The Dell XPS line is my recommendation. But it’s not that much cheaper than the Mac equivalents

  • john_alan  4 years ago

    You can disable this behaviour by listing terminal under Dev tools, and launching from there.

  • MeatBro  4 years ago

    System76 may be good

    • acomjean  4 years ago

      I have one. It’s not the finest quality hardware (rebranded Clevo I’m told)but it’s lasted and the os has been trouble free. I’d get another.

      The onyx pro model, it’s not great on battery when using the nvidia graphics but it can play 3D games via steam.

      I do kinda like the pop! Os Linux distro.

  • xbar  4 years ago

    Buy an Intel Macbook Pro and boot Linux.

    • zelly  4 years ago

      Then you don't get to use what is probably the biggest selling point of MBPs, their patented touchpad and gestures.

  • nubero  4 years ago

    The only tool in that video you linked to is that dishonest cheerleader Gruber.

  • binarycodedhex  4 years ago

    I don't think there's a one-sized-fits-all solution without something custom and extremely expensive ($15k+). Maybe a Lenovo T480 for most purposes and a dedicated second screen for color correctness? I had a Dell Studio XPS 1645 with an RGBLED screen with an insane gamut. It begs the question: Why aren't such screens widely available?

    • Descensus  4 years ago

      What about getting a T480 and replacing the screen itself? You can find a decent one for ~$400 USD, and a 1080p or WQHD screen for another $100.

      As for screen availability, I think it's more to do with the fact that these are business computers. Lenovo only recently started blurring the line between their premium and business class devices.

      I think every post-Haswell ThinkPad comes with a 720p screen in it's default configuration. At least up until Tx90/5 series.

  • darthrupert  4 years ago

    I think you should stick to Apple, frankly. Every time Apple comes up with something new (or just a new software release), people come out of their sheds to warn about all the bad things that will happen.

    And then almost none of those bad things happen. I've witnessed this dozens of times now, so a safe interpretation would be to assume that this time none of those things happen.

    • toyg  4 years ago

      Except bad things did happen. Like their capricious application of Appstore “guidelines”; the increasing difficulty of running software on Mac where the developer won’t pay Apple a tithe; the drop in Linux support for the platform, as they locked it down more and more at hardware level; the imposition of their authentication and payment portals (and hence 30% taxes all around) on web apps... etc etc etc.

      We have been effectively boiled like obedient frogs.

      I love macOS but my next laptop won’t be a mac and my next phone won’t be an iPhone. Divesting from the ecosystem will be painful but we’re well past any grace period at this point.

      6 replies →

read_if_gay_  4 years ago

I started panicking mildly thinking my drive was failing or something.

And just before this, I finally managed to fix Spotlight pegging one core at 100% constantly. Next thing, I reboot into a laggy system. macOS is my favorite OS, but the shit I put up with... it's basically an abusive relationship at this point.

  • 27182818284  4 years ago

    Same. Panic attack. Thought the SSD was dying. I ran Disk Utility diagnostics and started coming up with plans to reformat and restore as a last resort.

    Apple folks in this thread, this was terrible

    • webvictim  4 years ago

      I genuinely thought the same thing. I opened my MBP and it was sluggish, felt like it was dead. Browser wouldn't load, Zoom wouldn't load, I rebooted and the same problems persisted. I honestly thought the hardware was giving out.

      I almost cannot believe the actual cause. Absolutely awful experience.

    • playcache  4 years ago

      Incredible I had the exact same thing. 2019 MB pro I bought for music production and ableton started to lag incredibly badly and the whole desktop was unresponsive. I started to search my email to see what warranty I had.

  • auslegung  4 years ago

    > macOS is my favorite OS, but the shit I put up with...

    Idk, the several Linux distros I’ve used recently, and Windows, have a much longer list of “shit _I_ put up with”

    • tomxor  4 years ago

      The thing you get with Linux is "more _predictable_ shit to deal with", not "less shit to deal with", no large capable desktop OS is perfect and never will be.

      Anxiety from what Apple's agenda will do to your computer next update? anxiety from if a 1hr windows update is awaiting you when you turn your pc on? ... Linux awaits.

      12 replies →

    • Yetanfou  4 years ago

      Well, you're using the wrong distributions then. Use something stodgy but solid like stable Debian or a recent but not bleeding edge version of Mint and you should not have all too many things on your shit list. It won't be empty - printing will still trip you up every now and then, just like it does everywhere else to give an example - but it will mostly ' just work' unless you're trying to install it on truly exotic (as in "released this week") hardware. The overall facepalm experience will be comparable to that on Mac OS, better than that on Windows. Add to that the fact that it is free in every sense of the word as well as the glaring and welcome absence of draconic "features" like the one discussed in this thread and those Linux distributions will start to look very tempting.

      6 replies →

    • morty_s  4 years ago

      > Windows, have a much longer list of “shit _I_ put up with”

      Yikes. This is painfully true. Maybe Apple knows they have a ton of breathing room here.

      I’ll jump through a few more hoops to continue using the machines they make. Then again all I do is edit text.

  • redisman  4 years ago

    > macOS is my favorite OS, but

    Ain't that the truth with every OS. I use Windows for gaming, PopOS for work on my desktop and MacOS for work on my laptop. The amount of weird issues is about constant.

    • barumi  4 years ago

      > The amount of weird issues is about constant.

      But linux is free both as in free beer and in free speech, windows required you to pay the Microsoft tax to use, and lastly macOS required you to pay a premium on hardware.

      23 replies →

  • echelon  4 years ago

    Just wait until you can only run signed binaries.

    As developers and engineers, we ought to be jumping off this platform like a sinking ship. It's clear that they want to lock it down like the iPhone. Why else would they be measuring which apps are in use if they didn't want to control it?

    If your argument is "compatibility research", you're missing the other warning signs.

  • knolan  4 years ago

    If I do any simple math calculation in Spotlight it pegs all cores at 100%. Its easily reproducible and really annoying because I've used spotlight as a calculator for years.

    • knolan  4 years ago

      I finally think I found a fix for this, toggle off and back on the Calculator service in System Prefs > Spotlight.

  • zapataband  4 years ago

    My music software became completely useless on catalina, and I was also running into issues with spotlight so I disabled it. I downgraded(painfully) to Mojave and my system is so much speedier. wish I could completely switch to linux.

    • abruzzi  4 years ago

      yeah, but in the end, choice of OS is secondary to choice of application. I'm staying on Mojave for the foreseeable future, but I'll stay with Mac because Logic Pro is not available on any other platform. Sometimes applications are fungible, or you're lucky and your critical application is available on multiple platforms, but sometimes there are only certain applications that can do what you want. I run a MacOS System 7 for software to edit my Yamaha VL-1. I run MacOS 9.2.8 due to hardware drivers for a Korg OasysPCI. I run MacOS 10.6.8 Snow Leopard because is is the last OS that runs rosetta and keeps numerous PowerPC apps that never made the jump to Intel. I'll keep Mojave running when eventually I have to jump to Arm because I'm sure a lot of the software I run won't make the jump to Arm. I'd LOVE to drop any of those systems, but each exists because there are applications that do not have replacement on modern OS'es.

      1 reply →

phkahler  4 years ago

> I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when `trustd` and `syspolicyd` are unable to do so, the entire operating system grinds to a halt.

That's another case of a product not doing its primary function - OS running apps - because company placed their own (data gathering) objective above it. See thermostats not turning on heat when the internet connection is down and other equally stupid examples...

jbergstroem  4 years ago

I discovered this by running unbound – a DNS server – locally (block some unwanted hosts and do dns over TLS). I guess the rest of the story is pretty obvious; having your default dns server not being able to resolve because you're trying to verify it – since you cannot resolve your verify hostname – is obviously Not Great. As you can imagine, there is no waiting in the world that fixes this. I couldn't kill (-9) the process either; had to reboot into safe mode, rename the binary and switch the default dns on the network.

neop1x  4 years ago

Currently the workaround seems to be /etc/hosts override or firewall-level blocking.

Just a small reminder that this can soon stop working: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur - https://news.ycombinator.com/item?id=24838816

  • submeta  4 years ago

    Will they prevent changing hosts file as well?

    • tl  4 years ago

      It's more likely that their will be an Apple-only private API that uses /private/etc/hosts which already exists, but is editable (for now) instead of /etc/hosts.

draebek  4 years ago

Note that it's ocsp.apple.com, not oSCp.apple.com.

antihero  4 years ago

The server is called OSCP which suggests to me that if we look at Apple in the most positive light - they sign and certify binaries as safe. If an app gets later reported as malicious, they need to revoke the certificate that has been used to sign said binary.

So when you open an app, how else are they going to check whether the certificate is still valid or whether it has been revoked?

Can anyone confirm whether this lookup applies to unsigned as well as signed binaries? As far as I know if I build a brand new binary with cargo, and run it, it doesn't do any checks.

  • jojobas  4 years ago

    Here's a wild idea: don't block executables from running.

    Or if you do, only do it for a set of known bad ones, as antivirus products do.

    Do not put a cloud service (or anything for that matter) between the users and their ability to run what they want.

    • antihero  4 years ago

      Sure but how does that work? If a cert-revoked app is allowed to run, the damage is already done.

      I think perhaps a better tradeoff would be if a revocation list could be synced hourly or so and the app could be checked sync locally and then asyncronously on open. And of course, always give the power user an option to ignore things.

  • habosa  4 years ago

    Here's an idea: log all opened binaries somewhere and then every hour or so check them against the list.

    Never block me from opening something, but warn me about bad stuff on a regular basis.

    • WhiteWestie  4 years ago

      They could also keep the current solution and just use a CRL as a backup to OCSP to check the revoked certificates and update it every other hour...

    • antihero  4 years ago

      Yes but with your solution if an app is malicious, and did malicious things, it now has a whole hour to fuck your shit up before being disabled.

Bondi_Blue  4 years ago

OCSP not OSCP

You can also run these commands to disable ocsp (and crl) since it can no longer be accomplished in Keychain Access → Preferences:

  defaults write /Library/Preferences/com.apple.security.revocation.plist CRLStyle None
  defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None
  defaults write com.apple.security.revocation.plist CRLStyle None
  defaults write com.apple.security.revocation.plist OCSPStyle None

sildur  4 years ago

That oscp server must be compiling a huge set of stats on application usage. That doesn't sound right, privacy-wise.

  • masklinn  4 years ago

    It probably just gets a fingerprint, or the cert’ information.

    But when the endpoint is dying and it gets called every time you try to run any binary…

vsskanth  4 years ago

Can apple not use security certificates to verify publishers ? why does it need to go to their servers ?

  • loeg  4 years ago

    The URL mentioned in sibling comments suggests this has to do with certificate revocation (OCSP): https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...

    I agree that breaking system availability when an OCSP server isn't available is user-hostile and unnecessary.

    • jrochkind1  4 years ago

      > I agree that breaking system availability when an OCSP server isn't available is user-hostile and unnecessary.

      Based on the OP tweet... depending on the way it is unavailable, the failure is indeed ignored in some cases. "Denying that connection fixes it, because OCSP is a soft failure (Disconnect internet also fixes.)"

      So it may be an actual unintended bug that a particular failure path results in a DoS instead?

    • LinusS1  4 years ago

      Normally if there's no internet Gatekeeper instead checks the "stapled" notarization ticket from the notarization process. But since there is internet, and the ocsp server is technically "up" gatekeeper isn't checking the tickets.

    • merb  4 years ago

      actually I think the problem is not that it is not available, heck /etc/hosts fixes wouldn't work than. it's that it is unresponsive as hell, and they have no system wide circuit breaker, if it is slow.

      2 replies →

  • burlesona  4 years ago

    It does go locally if you are not on wifi. I thought the issue was my slow internet so I turned off wifi and suddenly everything launched just fine.

SnowflakeOnIce  4 years ago

Right around this same time, I had 1 macBook hard reboot (watchdogd timeout) and shortly thereafter, a second macBook froze, fan maxed out, with the display not coming up. Then it rebooted into recovery mode.

Yeah, these _could_ be unrelated issues to what has been going on in Apple land today, but it's uncanny...

dylan604  4 years ago

I keep reading in the tweets how all Macs are unusable. Is this an OS bug that doesn't effect older OSes? I'm on Mojave on my 2017 MBP, and have had zero issues at all.

When was `trustd` introduced?

  • plorkyeran  4 years ago

    Checking for notarization on each launch was introduced in catalina. Older versions have trustd, but it was only used for the gatekeeper checks added in 10.8.

  • TMWNN  4 years ago

    `/usr/libexec/trustd` exists on Mojave, too. There's a (very unhelpful) manpage.

    I think you were just lucky to not open non-Apple applications during the outage.

  • ericd  4 years ago

    I ran into this on trying to load a new video file on VLC, with Mojave, so I guess it's not just apps, but maybe any new file load.

  • jwineinger  4 years ago

    My 2018 MPB on Mojave had some serious issues launching apps for a little while yesterday (3PM central) afternoon. It seemed to resolve within an hour though. Not sure how that lines up with the outage described here.

vishesh92  4 years ago

Found another reason for me to not get a Mac

LinuxBender  4 years ago

Why isn't apple doing OCSP stapling & caching? Reverse proxies have long since solved OCSP availability with stapling and caching.

rpastuszak  4 years ago

This might be a stupid question, but is there a downside to blocking this "feature"? I can't think of any.

I've been using Big Sur beta for some time and one of the things that annoyed me a bit was the sudden lack of responsiveness, which is a tad annoying given that I upgraded to a 16inch MBP earlier this year and everything felt so snappy.

jrochkind1  4 years ago

Huh apparently I win by still being on an old OS version?

  • pgt  4 years ago

    My policy is to never upgrade anything until everyone I know has upgraded to the next version and not downgraded after N weeks.

    • sjwright  4 years ago

      My policy is to upgrade my secondary/personal/low importance computer on day one and my primary computer a few weeks later.

passwordreset  4 years ago

ocsp.apple.com also has an IPv6 address. Firefox connects to it even with 0.0.0.0 in the hosts file and a flushed cache (you need to also clear firefox's internal cache if you're testing with it), so I'd assume that trustd could connect to the ocsp site as well. I don't think this will work without ensuring there is no IPv6 traffic on your network, or otherwise dumping both IPv4 and v6 packets to ocsp.apple.com.

Disable IPv6: sudo networksetup -setv6off Wi-Fi (where Wi-Fi is the name of the network service)

  • hxtk  4 years ago

    Can you not just add an IPv6 entry for it in your hosts file, e.g., ::1? That would work in Linux and seems like a much less nuclear option than disabling ipv6 all together, but admittedly I've never worked with ipv6 networking on Macs.

    Last time I played with a Mac they also had the BSD `ipfw` command for kernel packet filtering [1]. Could try something there if it still exists.

    [1]: https://www.unix.com/man-page/FreeBSD/8/ipfw/

mister_hn  4 years ago

and people was shocked at Windows 10 doing telemetry. MacOS isn't doing it better as I see

ummonk  4 years ago

I had both my personal and work laptop become unresponsive at the same time. I was wondering what kind of problem could cause that - was thinking EM interference or possibly something on my network. This explains it.

playcache  4 years ago

Ha! So that's what it was. Last night (I just woke up in the UK) my macbook pro started to crawl, I started to threat that it might be the SSD starting to fail.