Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS Catalina: Slow by Design?

sigpipe.macromates.com

Post reply on HN
Print view View original

661–670 of 1001 posts

Re: MacOS Catalina: Slow by Design?

#661

Post by lioeters »

saagarjha wrote: post #635
lioeters wrote: post #606

Earlier quoted context omitted.

In the Apple Sandbox Guide v1.0 [1], it mentions Dionysus Blazakis' paper [2] presented at Blackhat DC 2011. In the latter, Apple's sandbox rule set (custom profiles) is called SBPL - Sandbox Profile Language - and is described as a "Scheme embedded domain specific language". It's evaluated by libSandbox, which contains TinyScheme! [3] From what I could understand, the Scheme interpreter generates a blob suitable for…

That sounds about right. I was doing some work in this area very recently, which found a couple of methods to bypass sandboxing entirely, but somewhat humorously the issues did not require me to have any understanding of how the lower levels of this worked ;)

Blazakis' paper is a fascinating investigative/exploratory work, delving deep into the sandbox mechanism. I learned more than I wanted to know!

Re: MacOS Catalina: Slow by Design?

#662

Post by ignoranceprior »

usmannk wrote: post #484

It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by: - Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script. - Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh I MITMd myself while rec…

Does this mean you can't run a custom shell script without an internet connection?

Re: MacOS Catalina: Slow by Design?

#663

Post by xvector »

vbsteven wrote: post #281

With Apple degrading the developer experience with each release and Microsoft working hard on things like WSL(2) and the new "package manager" I think within a year or 2 lots of developers will go back to Windows-based machines.

As a security engineer myself, what Apple is doing here is completely fucking insane. I honestly cannot believe that anyone thought it was a good idea.

Re: MacOS Catalina: Slow by Design?

#664

Post by eximius »

prewett wrote: post #421
eximius wrote: post #367

Earlier quoted context omitted.

What is special about /nix that would make it better suited elsewhere? Aesthetic? Clutter? I don't think there are any technical reasons why the root of the filesystem is important. The /nix folder is just another folder with some ACLs/Permissions (however OSX works, idk)

Historically / has been reserved for the use of the Unix system (the distribution that packaged it, not the computer you're running on). Local programs were installed to /usr/local. Packages installing themselves in /packagename are making your root directory like Windows' Start Menu. Furthermore, if your, say, Physics department has 20 machines, your sysadmin would install everything on an NFS share, which probably…

You're not _wrong_, but I'm not sure that those reasons really mean anything. They were all new and arbitrary at some point and we're a long way from Unix.

> it is completely flaunting established Unix norms.

Also, _nix_ is completely flaunting established Unix norms in more ways than one. /nix is where all of the nix stores go, the immutable bundles that get pieced together to form all of the stuff you install. It could go in /var/nix or wherever, it doesn't really matter.

But putting it in /nix is kind of nice in that it's so different from the purposes of the rest of the filesystem. /nix doesn't behave like the rest of a normal Linux system, so it is separate. You can still symlink from /usr/local/bin/foo -> /nix/store/abcdef-1.1.0/bin/foo so the rest of your system has the same expectations.

Re: MacOS Catalina: Slow by Design?

#665

Post by moyix »

usmannk wrote: post #484

It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by: - Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script. - Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh I MITMd myself while rec…

Were you able to MITM the api.apple-cloudkit.com connection? I tried with MITMProxy but ran into a client error, which made me think they were doing cert pinning.

If you did get it to work could you paste the logs somewhere?

Re: MacOS Catalina: Slow by Design?

#666

Post by mindfulhack »

gfxgirl wrote: post #195
lol768 wrote: post #9

Earlier quoted context omitted.

The set of possible operating systems to consider does not contain two items.

It does depending on what software you want to run. There is no actually good alternative to Photoshop. gIMP is not remotely in the same league. Pixelmator and Affinity Photo are brought up but they're also like nano vs emacs. Photoshop doesn't run on Linux AFAIK. I'm sure for a graphic designer the same is true for Illustrator. The cheaper alternative exist and you can maybe get by but there's missing so many featur…

I wonder how viable just running PhotoShop in a VM is these days, if you have the extra RAM and are OK with the extra minute to boot up the VM each time to use the program?

VirtualBox has a 'seamless mode' as well, I wonder how well it works on a Linux host and a macOS/Windows guest.

Re: MacOS Catalina: Slow by Design?

#667

Post by gowld »

ccmcarey wrote: post #69
nromiun wrote: post #2

> This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay! > Apple’s most recent OS where it appears that low-level system API such as exec and getxattr now do synchronous network activity before returning to the caller. Can anyone confirm this? Because hones…

How could this possibly not be absolutely awful on projects that run hundreds of executables during their execution (e.g. some shell wrappers like oh-my-zsh call out to a large amount of different scripts every time they run).

If you don’t trust Apple, don’t run a multi Gigabyte closed source OS they provide.

Re: MacOS Catalina: Slow by Design?

#668

Post by usmannk »

moyix wrote: post #665
usmannk wrote: post #484

It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by: - Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script. - Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh I MITMd myself while rec…

Were you able to MITM the api.apple-cloudkit.com connection? I tried with MITMProxy but ran into a client error, which made me think they were doing cert pinning. If you did get it to work could you paste the logs somewhere?

Yes but it looks like there is no actual session, at least for shell scripts that don't have an app bundle ID. There is just an HTTP CONNECT, TLS negotiation, then nothing.

Re: MacOS Catalina: Slow by Design?

#669

Post by hrktb »

the_af wrote: post #594
hrktb wrote: post #444

Earlier quoted context omitted.

I only tried Ubuntu, a few month ago. For the day or two spent with it: - multi-language support requires a lot of work to get to the same point as macos. In particular I use third party shortcut mappers to get language switching on left and right command keys (mimicking the JIS keyboards, but with an english international layout). That looks like something I’d have to give up on code myself. - printer support is not…

Fair enough. I'm not a Mac OS X user so I don't know how it would compare. I can only compare it with my past experience with Windows, and I think it's superior (for me) to Windows circa 7 -- I stopped using Windows entirely at that point, so I wouldn't know how later versions of Windows fare. Portability is also a fair issue to raise, but it's simply not a problem for me. When I say Linux "on the desktop", I literal…

Thanks for the additional details.

For the printers, you are right in that it’s far from being a solved problem on macos. I had an EPSON all in one before, and it was also a pain to get everything working. If I remember correctly the generic driver could print, but we didn’t get “advanced” options without going through the EPSON pkg installer and all the garbage coming with it. I’d totally imagine the linux driver being done cleaner than that.

For the record I’ve worked with a decent number of devs using linux workstations, so I totally vouch for your use case. I’d just temper the niche nature of multi-language support; that’s an everyday need for basically all Asia. Granted my use of shortcuts is niche (I wouldn’t need them if I had enough keys), but looking at maintenance projects annual reports there seem to be a sizeable amount of quality of life fixes still on the way.

Re: MacOS Catalina: Slow by Design?

#670

Post by Myrmornis »

torstenvl wrote: post #629
usmannk wrote: post #484

It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by: - Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script. - Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh I MITMd myself while rec…

What happens if you edit /private/etc/hosts to point ocsp.apple.com to 0.0.0.0 and flush the DNS cache?

This seems like an interesting line of inquiry.

AIUI doing what you said would permit the network request to proceed, and it would fail because nothing is listening on port 80 [1] We already know that the phone-home bails out when there's no network connection, so perhaps that code also bails out on connection failure?

Alternatively, is there some way to make DNS lookup itself fail for ocsp.apple.com?

Last resort, if we know how to fake the response, running a dummy server listening on localhost would be faster than allowing the request to go over the internet.

[1] Empirically, `curl http://0.0.0.0` yields a connection failure. I think I know that 0.0.0.0 is used in a listening context to mean "listen on all interfaces" but tbh I don't really know what it means in a sending context. Maybe someone can educate me?

Post reply on HN