> don’t get a ping back in less than 500ms or whatever? Go ahead and open anyway

how do you do that without defeating the security? Now a malicious attacker just has to wait for a moment when you aren't connected before launching their payload.

Well it already just lets you launch the app if you’re not connected to the internet so my answer would be “no different to the situation we have now”?

Also, my understanding is that it’s a hash of the binary being checked so if it failed the verification the first time when you were connected you would have received a warning and the OS would block that executable on your system or given a warning or something? Not sure tbh.

The feature needs to be implemented using some kind of regularly updated local database, rather than requiring a phone home every time.

A program signature database, perhaps? We could even call it: antivirus! No, that’s a bad name...

In seriousness though, the problem with offline databases that are changed a lot is a problem antivirus programs always had: they need updating. You can’t have the “latest and greatest” protection if you don’t know about the newest threat. That’s probably what Apple is doing here: using a database on their end that they wouldn’t have to distribute to end users. It’s not the best way around it, but there isn’t really a “best” way.

I think it's an exaggeration to say that it's impossible to keep local AV databases up to date in a meaningful way.

Use compressed probabilistic data structures and ship minimal diffs to save bandwidth and storage; you can fall back to phoning home if there's a possibility of a collision with a known-bad hash. Apple's solved push messages at scale; it could piggyback an update mechanism on that, or use the techniques Dropbox uses to notify about file updates. It can do this at the OS level so there's no threat of a user process not being active to pull updates. And the check is already soft-failing (per the OP) so it won't break if the system is offline, so they're already not caring about threats that are so new, they were found while the computer was offline.

You need to solve a lot of timing diagrams and race conditions (and, if we're being snarky, maybe it's for the best that Apple isn't trying to do this!) but it should be doable.

A local database with a hash of every possible non-official Apple app in it? Sounds like something maybe only storage manufacturers will like.

The thing is, this is not a new security problem/challenge. It essentially can not be properly solved if you don't have a tightly controlled environment. If it's a general purpose environment, where you can't fully control what ends up running on it, this particular approach to "security" is pretty much doomed, no matter how you address it.

No, a database with the hash of every program you ever started on that computer. The Apple server should be contacted when a program is installed/run for the first time. And of course, the system software should handle network problems more gracefully. If everything "works" when offline, network problems should quicker lead to the offline behavior. There should be one daemon process which handles the signature checking which changes its behavior once requests to the server are not answered.

Pretty sure you just described how it already works. IIUC it only checks new hashes.

There are solutions for this like bloom filters etc. Google Safe Browsing system tackles a somewhat similar problem.

> I have no problem with checking binaries when I launch them for security. ... I doubt very much I’m leaky in any personal information.

You should. It's noones business when and how often you run a known tor browser binary.

I don’t run a tor browser so I’m good in that example.