系统与基础设施sigpipe.macromates.com
macOS Catalina：慢是设计使然？
MacOS Catalina: Slow by Design?
2020 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这篇文章讨论 macOS Catalina 中一个疑似被设计进系统的性能问题：用户首次运行新的可执行文件时，Gatekeeper/公证机制可能让执行等待与 Apple 服务器的网络校验，网络不佳或不可达时就表现为明显卡顿。文章围绕这一现象分析代码签名与公证检查对启动路径的影响。
为什么经久不衰：它揭示了一个至今仍 relevant 的张力：安全校验被放进 exec 等关键路径后，网络依赖会把本地操作变成不可控的等待，对 macOS 用户和系统设计者都有警示意义。
HN 评论精选
作者实测复现了运行时向 Apple 服务器发请求的行为。
为了验证文章所述行为，我用全新的随机可执行文件（甚至 echo 一个随机整数）和全新的文件名测试，并在抓包时对自己做了 MITM；确实看到向 ocsp.apple.com 发请求，URL 路径带哈希，响应体是二进制数据。后续尝试只看到对 api.apple-cloudkit.com 的请求，而且完全没有 headers，似乎只是在检查连通性。
usmannk查看英文原文
It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by: - Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script. - Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh I MITMd myself while recording the network traffic and, sure enough, there is a request to ocsp.apple.com with a hash in the URL path and a bunch of binary data in the response body. Unsure what it is yet but the URL suggests it is generating a cert for the binary and checking it. See: https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol Here's the URL I saw: http://ocsp.apple.com/ocsp-devid01/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFDOB0e%2FbaLCFIU0u76%2BMSmlkPCpsBBRXF%2B2iz9x8mKEQ4Py%2Bhy0s8uMXVAIIfYbtkeEKZsI%3D Edit2: Anyone know what this hash format is? It's not quite base64, nor is it multiple base64 strings separated with '+'s but it seems similar... Edit3: Here is the exact filename and file I used: https://gist.github.com/UsmannK/abb4b239c98ee45bdfcc5b284bf0029e Edit4 (final one probably...): On subsequent attempts I'm only seeing a request to https://api.apple-cloudkit.com and not the OCSP one anymore. Curiously, there's no headers at all. It is just checking for connectivity.
stapler staple 可预置票据，避免首次启动联网等待。
避免这种行为的办法是把公证票据 staple 到 bundle（或 dmg/pkg）上，即 /usr/bin/stapler staple <path>；否则 Gatekeeper 会在首次运行时去获取并替用户 staple 票据。（我是 xcnotary 作者，这个工具用于简化公证流程。）
davidvartan查看英文原文
> a degraded user experience, as the first time a user runs a new executable, Apple delays execution while waiting for a reply from their server. The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg), i.e. "/usr/bin/stapler staple <path>." Otherwise, Gatekeeper will fetch the ticket and staple it for the user on the first run. (I'm the author of xcnotary [1], a tool to make notarization way less painful, including uploading to Apple/polling for completion/stapling/troubleshooting various code signing issues.) [1] https://github.com/akeru-inc/xcnotary
批评在 exec 路径里做网络检查既危险又可被绕过。
在 exec() 这类系统调用里加入网络调用简直疯狂；这可能导致笔记本变砖，连修复命令都跑不了（比如代码没正确处理意外网络错误）。破解者也能通过覆写运行中指令文本绕过 exec() 检查。文章评论里有人复现是好事，但请再用 tcpdump 之类进一步调试，并做压力测试：循环生成带随机数的脚本并执行。
brendangregg查看英文原文
Adding network calls to syscalls like exec() is utterly insane. This road can lead to bricked laptops where you can't run anything to fix it (imagine an unexpected network error that the code doesn't handle properly). And crackers will just use ways to overwrite running instruction text to avoid the exec(). The comments on the article are annoying: it good that there's a mini way to reproduce, but please, use some further debugging like tcpdump (it still exists on osx, right?). Last time I summarized osx debugging was https://www.slideshare.net/brendangregg/analyzing-os-x-systems-performance-with-the-use-method/38 I'd also stress test it: generate scripts in a loop that include random numbers and execute them.
Ventura 把检查扩大到每次运行，并给出 pf 屏蔽思路。
好消息是 Ventura 在每次运行时都执行检查，而不只是文件变化时；想阻止检查的人可查看 Apple 列出的公证相关 IP 列表并用 pf 屏蔽，但每次系统更新后要重做，因为 pf.conf 会被覆盖。
sharikous查看英文原文
The wonderful news is that Ventura implements the checks at every run, not only when the file changes, see: https://eclecticlight.co/2022/06/17/app-security-changes-coming-in-ventura/ Those interested to block the check should look at this list : https://support.apple.com/en-us/HT210060 and block the IPs associated with notarization. It is possible to do that with pf, which is integrated in macOS but it should be done after every update since the pf.conf file will get overwritten.
历次讨论
同类还值得读
TTY 揭秘（2008）
The TTY demystified (2008)
经典文章深入剖析了 Unix/Linux 中 TTY 子系统的工作原理，包括线路规程、终端驱动、信号与控制字符等机制。
系统与基础设施上首页 11 次 · 2009–2025linusakesson.net编辑精选为什么 GNU grep 这么快
Why GNU grep is Fast
FreeBSD 邮件列表上一篇广为流传的帖子，解释 GNU grep 为什么快：核心在于 Boyer-Moore 字符串搜索算法配合精心优化的内部循环和 I/O，让程序在搜索时“…
系统与基础设施上首页 9 次 · 2010–2022lists.freebsd.orgXplain：为普通人讲解 X11
Xplain – Explaining X11 for the rest of us
《Xplain》是作者（HN 用户 Jasper_）写的一系列 X11 长文，用他在浏览器中重建的 X11 绘图模型做交互演示，讲解 X11 的绘图模型与窗口系统设计。
系统与基础设施上首页 6 次 · 2013–2020magcius.github.io编辑精选旋风教程：为 Linux 创建极小 ELF 可执行文件（1999）
A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (1999)
breadbox 写于 1999 年的经典教程，主题是如何为 Linux 手工构造并裁剪出体积极小的 ELF 可执行文件。
系统与基础设施上首页 6 次 · 2007–2025muppetlabs.comPostgreSQL 内部原理
The internals of PostgreSQL
《The Internals of PostgreSQL》是一本免费在线书籍，系统讲解 PostgreSQL 的内部实现，包括查询处理、并发控制、WAL、缓冲区管理等核心机制。
系统与基础设施上首页 5 次 · 2017–2025interdb.jp编辑精选