I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.
Wow. OSX ... it was nice knowing you.
“Two days ago the police came to me and wanted me to stop working on this”
31–40 of 559 posts
Re: “Two days ago the police came to me and wanted me to stop working on this”
#32While I understand what the gov is trying to do, who's to say somebody else that doesn't live in China maintains the project and puts it on GitHub for all the world to see?
Maybe they are going to block or attack GitHub again until GitHub takes down all clones of it.
Wouldn't be the first time https://en.wikipedia.org/wiki/Censorship_of_GitHub#China
Re: “Two days ago the police came to me and wanted me to stop working on this”
#33I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.
This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…
Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too?
(I have limited experience with OS X - only briefly played around with driver development and bootloaders in the 10.4 era with osx86 - and I did have to boot from the DVD a few times when I made the system unbootable.)
This raises the question, what good is root if it's not really root anymore?
Re: “Two days ago the police came to me and wanted me to stop working on this”
#34I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.
This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…
If you have some malware that actually needs to modify system files, that still significantly ups the ante. Sure, if you have a kernel exploit, you can do it, but currently malware does not need any exploits to take over a system if it can convince a user to download and type in their password to install - Gatekeeper is one mechanism to prevent this, but I've personally been served multiple ads offering malware with a valid Developer ID signature, so it's tricky... (though I don't know how aggressively Apple is working to revoke their certificates). The difference in skill required between just writing an installer disguised as legitimate software on one hand, and continuously coming up with working exploits on the other, is pretty huge. And in any case, the easiest-to-exploit OS X privilege escalation vulnerabilities are things like rootpipe that don't compromise the kernel.
However, this argument falls down a little if malware doesn't actually need to modify system files, which it doesn't for most typical evil stuff I can think of.
Re: “Two days ago the police came to me and wanted me to stop working on this”
#35Earlier quoted context omitted.
Not being facetious here - what country do you live in that you think the government can't/won't interfere with your code?
Perhaps I am misunderstanding your use of English, because it is difficult to see how this is not a facetious question. There are relatively few countries in which the government both could and would interfere with someone's publication of code, and I think only in China is there both widespread computer use and internet access, on the one hand, and state security actors (the civil police, actually) who have the soph…
The US does "interfere" with the publication of some code. I'm thinking of cryptography code. Quoting from https://en.wikipedia.org/wiki/Export_of_cryptography_from_th... .
> Since World War II, many governments, including the U.S. and its NATO allies, have regulated the export of cryptography for national security considerations, and, as late as 1992, cryptography was on the U.S. Munitions List as an Auxiliary Military Equipment. ...
> As of 2009, non-military cryptography exports from the U.S. are controlled by the Department of Commerce's Bureau of Industry and Security. Some restrictions still exist, even for mass market products, particularly with regard to export to "rogue states" and terrorist organizations. Militarized encryption equipment, TEMPEST-approved electronics, custom cryptographic software, and even cryptographic consulting services still require an export license
> ... Other countries, notably those participating in the Wassenaar Arrangement, have similar restrictions.
Re: “Two days ago the police came to me and wanted me to stop working on this”
#36Earlier quoted context omitted.
This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…
Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too? (I have limited experience with OS X - only briefly played around with driver development and bootloaders in the 10.4 era with osx86 - and I did have to boot from the DVD a few times when I made the system unbootable.) This raises the question, what good is root if it's not really root anymore?
There is a supported option to disable SIP from recovery mode, so there's no need to get around it per se. (Recovery mode because it would be hard to impossible to verify the user's intent when malware that already has root privileges is running...)
Re: “Two days ago the police came to me and wanted me to stop working on this”
#37I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.
This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…
How do SIP and dtrace interact?
Re: “Two days ago the police came to me and wanted me to stop working on this”
#38Earlier quoted context omitted.
This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…
Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too? (I have limited experience with OS X - only briefly played around with driver development and bootloaders in the 10.4 era with osx86 - and I did have to boot from the DVD a few times when I made the system unbootable.) This raises the question, what good is root if it's not really root anymore?
> Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too?
It's easier than that. It's just a kernel argument to disable it. Simply add "rootless=0" to your boot-args and you have control of your machine back.
I'm running the 10.11 beta and I've already had to disable rootless because I like to have /usr/local as a symlink to somewhere else and by default the rootless configuration prevents writes to /usr. :-/
Re: “Two days ago the police came to me and wanted me to stop working on this”
#39I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.
This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…
Not really surprising, though: Apple has been making OS X a little worse with every iteration.
Re: “Two days ago the police came to me and wanted me to stop working on this”
#40For people who are not aware of this: Shadowsocks is a popular and very simple tool to circumvent Great Fire Wall in China. It is written to reduce characteristics in network traffic so that GFW cannot easily block it by deep traffic analysis. clowwindy is the original author.
Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it?
I'd imagine most developers in China would just SSH tunnel their way out.