It’s also easy to set it and forget it, leaving certificate revocation disabled longer than you intend.īlocking HTTP connections to and HTTPS to should also be straightforward in most network firewalls/routers. This is readily reversed, but not the sort of thing that you’d want to perform every day.

You then need to put that into effect by clearing the DNS cache, traditionally performed using Putting a block into your Mac’s hosts file is quick and simple using Terminal, with the commands

in a local software firewall such as the popular Little Snitch.

This forces the user into choosing between normal revocation checks, or none at all. The great disadvantage is that blocking is all-or-none, and can’t be selective according to the app being launched. By blocking outgoing connections to and app launch should still proceed, usually more quickly too, without the check taking place. MacOS operates a fail-safe system on connections with Apple’s OCSP service: when a connection can’t be made to the service, attempts to check certificate revocation are abandoned. This article looks at two potential solutions: blocking all outgoing traffic to Apple’s OCSP service, which checks certificates against its list of revocations, and removing code signatures on selected apps. If you’re unfortunate enough to have to use your Mac in a part of the world where surveillance is performed, even knowing when you use certain apps could prove to your great disadvantage. Thankfully, that takes place using TLS, making any recovery of the payload far less likely.įor some users, these checks are potentially dangerous, and of serious concern. Since the introduction of notarization there’s also been a second type of online check, which both ascertains whether an app has been notarized and delivers Apple a cdhash to check for known malware. Those checks have been performed using HTTP, although recently Apple has switched to using HTTPS apparently. In the past, these have normally been confined to quarantined apps undergoing their first run, but by the release of Catalina in October 2019, they have been extended to the loading of all executable code even when no quarantine flag is set. These centred on certificate checks which are made when apps are launched. Late last year there was a lot of concern about macOS leaking information about user activities when launching apps.

127.0.0.1 mac os 10.12