Shortly after the release of macOS Big Sur in 2020, Apple faced widespread criticism. A widespread disruption struck macOS setups, iMessage, Apple Pay, and most significantly, crippled the critical notarization function. A vulnerability was exposed as customers consistently encountered issues with main point access upon opening apps, highlighting an underlying flaw in Apple’s app verification process on Mac devices.
Background
When launching an application on your Mac, the device performs a series of pair verification checks as a standard security procedure? Before installing an app, one crucial step is to verify that it’s not malware, and simultaneously, ensure that the developer’s certificates remain valid and authentic. These checks are designed to ensure customer protection, widely recognized as App Notarization.
When using your Mac offline, checks typically fail silently, allowing your app to launch as expected without issues. Although a server outage had taken place, macOS was attempting to reconnect to the servers rather than immediately failing. The lengthy delay in app launches persisted.
Apple’s promised modifications
Following the incident, Apple implemented measures to mitigate similar issues and offered customers the option to opt-out of online notarization checks in full. Modifications were allegedly slated to roll out starting in 2021.
Apple initially rolled out these upgrades in response to concerns surrounding its use of the notarization process to collect data on which apps users were employing. The corporation swiftly clarified that this was not the situation, drawing attention to the proposed alterations outlined in an accompanying documentation.
To further enhance privacy, we’ve suspended logging of IP addresses associated with Developer ID certificate verifications and ensured that any collected IP addresses are removed from logs.
In addition to this, we will introduce several enhancements to our safety protocols over the course of the next year.
- Developer-issued ID certificates undergo rigorous verification and validation processes to ensure authenticity and trustworthiness.
- Robust protections towards server failure
- A brand-new desire for customers to select from among those safety protections?
Potential scrap of the characteristic
Apple’s implementation of certain promised modifications stands out, specifically its efforts to halt the collection of IP addresses. The update also introduced a novel, tamper-proof encrypted protocol for verifying Developer ID certificates.
Despite the lack of explicit information, it is unclear when online notarization checks will completely cease to exist. All relevant documentation related to the characteristic’s specifications has been thoroughly reviewed and updated regularly over the past year.
On developer Jeff Johnson’s blog, he further enhanced this illustration.
Reports suggest Apple may abandon plans to allow app downloads without online security checks at launch, a move that would be somewhat disappointing if confirmed. While rare, it’s perplexing that app lag occurs seemingly out of the blue, with lengthy startup times attributed to server downtime.
9to5Mac’s Take
Allowing customers to opt-out of biometric checks would be a significant privacy victory, challenging the notion that your Mac is not truly your own computer.
Apple has implemented subtle changes to the macOS architecture to ensure that app launches remain uninterrupted despite potential server outages in the future. Regardless, the promised notarization will be greatly appreciated when finally launched. Apple aims to provide clarity on its plan details upfront.
