Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS Catalina: Slow by Design?

sigpipe.macromates.com

Post reply on HN
Print view View original

831–840 of 1001 posts

Re: MacOS Catalina: Slow by Design?

#831

Post by comex »

derefr wrote: post #231
jfkebwjsbx wrote: post #200

Earlier quoted context omitted.

Why would sandboxing be slower? They are definitely doing something way too slow.

Apple replaced the very simple (i.e. function fits in a cache line; inputs fit in a single dword) BSD user/group/other filesystem privileges system, with a Lisp interpreter (or maybe compiler? not sure) executing some security DSL[1][2]. [1] https://wiki.mozilla.org/Sandbox/OS_X_Rule_Set [2] https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sand... This capabilities-ruleset interpreter is what Apple uses the te…

The Scheme interpreter only runs when compiling a sandbox. It's compiled into a simple non-Turing-complete bytecode, and that's what's consulted on every syscall. This has been the case since… 10.5 or something. It's always been on the path for BSD code. And Cocoa operations lower to BSD syscalls anyway. There's no system for them to get a "capability" for a directory tree; on the contrary, file descriptors ought to be able to serve as capabilities, but the Sandbox kext stupidly computes the full path for every file that's accessed before matching it against a bunch of regexes. This too has been the case as long as Sandbox has existed.

There is a bunch of new stuff in 10.15, mostly involving binary execs (and I don't understand all of it), but I'm pretty sure it doesn't match what you're describing.

Re: MacOS Catalina: Slow by Design?

#832

Post by pinopinopino »

pjmlp wrote: post #813
Wowfunhappy wrote: post #720

Earlier quoted context omitted.

Of course it's relevant! Software is a form of expression. Apple controls what types of expression are allowed on your phone. A developer made a game depicting bad practices at FoxConn. Apple removed it for "Objectionable Content"[1]. How is this inherently different from Apple saying you can't use your iPhone to read a certain book? Apple's restrictions also make it easy for authoritarian governments to ban software…

Not at all, you are always free to buy computers, phones and tablets from other vendor. Don't go buy Apple and then cry in the corner that you aren't getting the right set of toys to play with. I use Apple devices and fully support don't having random app uploading my stuff into the world.

Sure, you can buy whatever you want, you aren't living in a dictatorial country. Sadly enough, most people can't say this. Therefore it is important for you to fight decisions like this. If something doesn't exist, it cannot be abused by some regime.

I am going to say something very cynical now, if the reader doesn't like that, he should tune out now. But I guess Apple can't wait to have that special China deal. ^_^

Re: MacOS Catalina: Slow by Design?

#835

Post by saagarjha »

pjmlp wrote: post #820
drvdevd wrote: post #760

Earlier quoted context omitted.

Sure. But as Brendan Gregg pointed out in his comment - doing this at the level of exec() on a UNIX-like OS is ... a questionable technical choice to say the least. What’s the Linux equivalent of “notarization”? I’m not sure. Of course there’s probably more than one answer to that - let’s just taking signing packages as an example. In theory Apple could put their weight behind vetting some of the popular open source…

Apple OSes never were about CLI, pre-OS X you didn't have a CLI as standard OS feature. Selling UNIX underpinning was just a marketing move for willing to betray GNU/Linux and BSD in name of a better laptop experience, instead of helping OEMs selling their stuff. Something that NeXT also did against the Sun workstations market. On Linux side of the this kind of security measures never work, because the moment someone…

I'm not sure I particularly appreciate your use of the word "betray" for the BSDs. Sure, macOS is not really a great adherent to the GNU philosophy, but for the BSDs it actually did fairly well for a while. (It's still true UNIX, if barely.)

Re: MacOS Catalina: Slow by Design?

#836

Post by saagarjha »

john_alan wrote: post #817
drvdevd wrote: post #760

Earlier quoted context omitted.

Sure. But as Brendan Gregg pointed out in his comment - doing this at the level of exec() on a UNIX-like OS is ... a questionable technical choice to say the least. What’s the Linux equivalent of “notarization”? I’m not sure. Of course there’s probably more than one answer to that - let’s just taking signing packages as an example. In theory Apple could put their weight behind vetting some of the popular open source…

Watching the notarization video from WWDC last year they explicitly said it wouldn’t affect command line apps.

I believe that some of the problems here have actually started affecting command line apps in Catalina.

Re: MacOS Catalina: Slow by Design?

#837

Post by ComodoHacker »

rurban wrote: post #757
usmannk wrote: post #484

It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by: - Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script. - Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh I MITMd myself while rec…

It's called lockdown for a reason. Apple was just the very first to implement centralized binary blacklisting, revocation. They call it notarization. Problem is, that they did it unannounced. There must be really some weird stuff going on in those managers heads. How can they possibly think to go away with that?

>Apple was just the very first to implement centralized binary blacklisting

No, AV vendors did it for decades. In a more efficient way though.

Re: MacOS Catalina: Slow by Design?

#838

Post by pinopinopino »

jerryzh wrote: post #804
ibeckermayer wrote: post #694

Earlier quoted context omitted.

Why can’t they have their walled garden App Store and also allow me to install other app stores? It’s an authoritarian usurpation of the spirit of property rights. I should be able to decide for myself what software to run on my hardware, Apple HQ’s opinion should be irrelevant.

Why would any developer even want to release their app in walled garden when they can do whatever they want by releasing elsewhere?

Analogue question in the linux world: Why would anyone get something in the debian package repository, when they can just release their package on their website? Because it gets added support, a bigger reach and a safer and easier installation for users?

Re: MacOS Catalina: Slow by Design?

#839

Post by pjmlp »

saagarjha wrote: post #835
pjmlp wrote: post #820

Earlier quoted context omitted.

Apple OSes never were about CLI, pre-OS X you didn't have a CLI as standard OS feature. Selling UNIX underpinning was just a marketing move for willing to betray GNU/Linux and BSD in name of a better laptop experience, instead of helping OEMs selling their stuff. Something that NeXT also did against the Sun workstations market. On Linux side of the this kind of security measures never work, because the moment someone…

I'm not sure I particularly appreciate your use of the word "betray" for the BSDs. Sure, macOS is not really a great adherent to the GNU philosophy, but for the BSDs it actually did fairly well for a while. (It's still true UNIX, if barely.)

Take as you wish, if those users were actually supportive of the BSDs, they would be giving their hard earned cash directly to OEMs selling proper FreeBSD, OpenBSD, NetBSD, DragonFly based devices.

One cannot give the money instead to Apple and then come back complain that they were mislead.

NeXTSTEP was also a true UNIX, that wasn't why most business bought it, rather Renderman and other graphical based tooling.

I have used Apple platforms on and off since the LC II days, their commercial view was always quite clear to me.

Post reply on HN