Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Two days ago the police came to me and wanted me to stop working on this”

github.com

Post reply on HN
Print view View original

41–50 of 559 posts

Re: “Two days ago the police came to me and wanted me to stop working on this”

#41

Post by brobinson »

__david__ wrote: post #38
userbinator wrote: post #33

Earlier quoted context omitted.

Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too? (I have limited experience with OS X - only briefly played around with driver development and bootloaders in the 10.4 era with osx86 - and I did have to boot from the DVD a few times when I made the system unbootable.) This raises the question, what good is root if it's not really root anymore?

> Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too? It's easier than that. It's just a kernel argument to disable it. Simply add "rootless=0" to your boot-args and you have control of your machine back. I'm running the 10.11 beta and I've already had to disable rootless because I like to have /usr/local as a symlink to somewhere else and by defau…

Does this break homebrew? Or does it only block writes to entries in /usr and not subdirectories like /usr/local ?

Re: “Two days ago the police came to me and wanted me to stop working on this”

#43

Post by alexchen »

brobinson wrote: post #9
teej wrote: post #3

Earlier quoted context omitted.

Not being facetious here - what country do you live in that you think the government can't/won't interfere with your code?

Maybe China? There's a bit of Chinese in the author's other repos: https://github.com/clowwindy?tab=repositories

Yes it's china, because chinese government fears that the citizens who lived in china know about the truth of government's corruption.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#44

Post by speeder »

beedogs wrote: post #39
conradev wrote: post #28

Earlier quoted context omitted.

This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…

Not really surprising, though: Apple has been making OS X a little worse with every iteration.

I am doing my best to NOT update my OSX, every time I update it, the thing get slower, it is really annoying.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#45

Post by eridius »

conradev wrote: post #28
babuskov wrote: post #23

I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.

This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…

But that's the thing, you can't disable SIP from userland. It can only be disabled when booted into recovery mode. So yes, it absolutely does verify integrity, because it makes it so malware cannot embed itself into the system. Your last sentence there is 100% pure grade A FUD. You may as well just say "every security measure is bullshit, because if malware were to figure a way around it, then it wouldn't work". It's a meaningless statement.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#46

Post by hipaulshi »

verroq wrote: post #40
hipaulshi wrote: post #27

For people who are not aware of this: Shadowsocks is a popular and very simple tool to circumvent Great Fire Wall in China. It is written to reduce characteristics in network traffic so that GFW cannot easily block it by deep traffic analysis. clowwindy is the original author.

Who is the target audience of this software and how does it work? Do non technical users set this up on a VPS provider and then connect to it? I'd imagine most developers in China would just SSH tunnel their way out.

SSH dynamic port forwarding is no longer working for years. It is so easily picked up by GFW and minutes later it is gone together with the whole SSH connection. So does PPTP and L2TP VPN. GFW has been upgraded so many times for the past few years. The target audience is developers. The install is super simple via one line of `pip install`, the start code for daemon is also one line with the configuration inline or through <10 lines of json. On the client side the author and other contributors developed native clients that allow connection by supplying just 1 password and 1 server address. Super simple and highly reliable to this day.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#47

Post by x0 »

comex wrote: post #34
conradev wrote: post #28

Earlier quoted context omitted.

This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…

If you have some malware that actually needs to modify system files, that still significantly ups the ante. Sure, if you have a kernel exploit, you can do it, but currently malware does not need any exploits to take over a system if it can convince a user to download and type in their password to install - Gatekeeper is one mechanism to prevent this, but I've personally been served multiple ads offering malware with…

what if some os x malware finds a way past the limitations on editing system files? the malware would become undeletable

Re: “Two days ago the police came to me and wanted me to stop working on this”

#48

Post by __david__ »

brobinson wrote: post #41
__david__ wrote: post #38

Earlier quoted context omitted.

> Does booting an alternate OS still work to get around it, or have Apple thought of that route and somehow blocked it too? It's easier than that. It's just a kernel argument to disable it. Simply add "rootless=0" to your boot-args and you have control of your machine back. I'm running the 10.11 beta and I've already had to disable rootless because I like to have /usr/local as a symlink to somewhere else and by defau…

Does this break homebrew? Or does it only block writes to entries in /usr and not subdirectories like /usr/local ?

You are allowed to write to /usr/local. But making /usr/local itself into a symlink requires writing to /usr which is prohibited. So I was screwed but for the normal case it should work fine.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#49

Post by eridius »

babuskov wrote: post #23

I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.

This is an iOS app, not a Mac app.

Re: “Two days ago the police came to me and wanted me to stop working on this”

#50

Post by superuser2 »

conradev wrote: post #28
babuskov wrote: post #23

I find this comment amazing: https://github.com/shadowsocks/shadowsocks-iOS/issues/124#is... Even with root account, you are not in full control of your Mac - you are sandboxed by Apple.

This is the result of a recent change in OS X 10.11, called System Integrity Protection. It's a big step in the wrong direction [opinion], especially because it does nothing to verify "integrity". It prevents changes to the System directory by conventional means (and injection into system processes). If malware were to figure out a way to disable SIP from userland, it could install itself in such a way that nothing s…

>nothing short of disabling SIP could uninstall it

At the very least, the OS needs to be reinstalled from an off-disk source, and that's assuming you haven't been hit by something sophisticated enough to put itself in firmware. We're fast approaching an era where you need to trash the hardware. You should never trust an OS install that was ever compromised, and making it more difficult to do so is a good thing in my book.

Post reply on HN