Apple memory holed its broken promise for an OCSP opt-out

When you launch an app, macOS connects to Apple's OCSP service to check whether the app's Developer ID code signing certificate has been revoked by Apple. In November 2020, Apple's OCSP service experienced a mass outage, preventing Mac users worldwide from launching apps. In response and remedy to this outage, Apple made several explicit promises to Mac users in a support document, which can still be seen in a Wayback Machine archive from September 24, 2023.

To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.

The last item, "A new preference for users to opt out of these security protections", has never been implemented in macOS, and two years ago I wrote that Apple reneged on OCSP privacy.

Now I've discovered that on September 26, 2023, the day that macOS 14 Sonoma was released to the public, Apple erased its promise from the support document. This can also be seen with the Wayback Machine.

Leave a Comment