In a Support Article, Apple Clarifies MacOS App Privacy Concerns ⇥ support.apple.com

In an update to the obliquely-titled “safely open apps on your Mac” support article,¹ Apple has added a new privacy-related section clarifying some of this week’s concerns about certificate validity checking [sic]:

These security checks have never included the user’s Apple ID or the identity of their device. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.

In addition, over the the next year we will introduce several changes to our security checks:

• A new encrypted protocol for Developer ID certificate revocation checks

• Strong protections against server failure

• A new preference for users to opt out of these security protections

The last item on this list is perhaps the most tantalizing. Does this mean the Gatekeeper system will have an off switch, as some more technically-literate users have been requesting? We will find out soon enough, I expect, but it is relieving to hear that changes are being made to prevent server problems from slowing down MacOS app launches.

This seems like another instance where Apple has failed to fully communicate changes — at all, or in a way most people can understand. When iOS 14 was released earlier this year with support for home screen widgets and compromised password notifications, among other features, some users conflated the two features and insinuated that popular customization apps were effectively keyloggers. Meanwhile, Apple’s developer documentation is, as Casey Liss put it this week, “piss poor”, and examples of miscommunication from its App Review team about rule changes or noncompliance are well-known.