Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Some Differences Between macOS and Common Unix Systems

dyx.name

Post reply on HN
Print view View original

51–60 of 82 posts

Re: Some Differences Between macOS and Common Unix Systems

#51

Post by pram »

Brian_K_White wrote: post #18
Hackbraten wrote: post #14

I keep hearing that `sudo` insecurity argument everywhere. I think that argument is fundamentally wrong. In practice, a package manager that eschews `sudo` does not protect you any less than a package manager that works with `sudo`. If malware has obtained file system access, it’s already game over. The malicious code can now mess with your shell profile and fake the `sudo` command.

The main problem isn't really that it doesn't require sudo. If it installed as a user into your home dir, that would be fine. Changing a shared system-wide path or installing shared system-wide files owned by a user is so fundamentally borked that you should immediately reject anything offered by anyone who suggested to do that. But the masses of users who made it popular didn't know that and there were/are a lot of…

That is exactly how installing an application in MacOS always works. When you run an installer for a native app, and it goes into /Applications, it's owned by the user who installed it. What Homebrew is doing isn't functionally different, other than /usr/local is in your PATH I guess?

Re: Some Differences Between macOS and Common Unix Systems

#52

Post by smoldesu »

aborsy wrote: post #11

Not quite on this topic, but I have always felt Linux security seems lagging behind macOS. Linux seems lacking on sufficient sandboxing. I am also increasingly uncomfortable with so many repositories, FOOS on GitHub and users sudoing left and right. I am not sure if I am correct though.

MacOS is it's own security nightmare, it's just mangled and unrecognizable through so many layers of abstraction. Apple's understanding of security and privacy is fundamentally broken: they protect you against a boogyman, the idea of someone who wants to take your data for exploitative gain. In reality, the paradigm of computer security has completely changed. Apple had been leaking unencrypted user data to third party firms for years, and refused to yield when researchers warned them of the implications. Thunderbolt is rife with security vulnerabilities, some exploits being so advanced that they can give the attacker a raw dump of whatever was in memory (which is ironically even more dangerous thanks to MacOS' lackluster memory management).

At the end of the day, securing MacOS is a losing game. Big Sur introduced new, untraceable telemetry at the lowest levels of the system, basically forcing me out of the Mac game. Linux it a breath of fresh air by comparison: not only does my system never phone home, it gets security updates as a first-class citizen in the software world (one of the many perks of being the backbone of most computer infrastructure).

Security on Linux is entirely dependent on the user. One of the core Unix philosophies is that a true Unix system won't stop a dumb user from doing something dumb, because that impedes clever people trying to do something clever. The weakest link in the security chain is always the end user, which is why most "hacks" these days are just massive phishing campaigns: it's just an easier attack vector. It doesn't matter if you're on Windows, MacOS, Linux or TempleOS - if you put your credentials into a browser, someone's gonna pwn it.

P.S. - If sandboxing is your interest, you should check out Flatpak. I think it should clear up your repo concerns too ;)

Re: Some Differences Between macOS and Common Unix Systems

#53

Post by skissane »

loeg wrote: post #30
Someone wrote: post #13

Earlier quoted context omitted.

It’s a no-brainer Mac OS has more Unix heritage than Linux, but I don’t think using certification by the company that happens to own the name is the way to show that. I would think the BSDs have at least as much Unix heritage as macOS, but they aren’t certified (“Certified Unix” is a rare breed. https://www.opengroup.org/openbrand/register/ lists only 13 products) (Nitpick: it isn’t Unix™ , it’s UNIX® )

Certified Unix just means you've paid SCO enough money. There are Linux-based Certified UNIX products: EulerOS and Inspur K-UX.

> Certified Unix just means you've paid SCO enough money

Not SCO, the Open Group. The Open Group is a not-for-profit industry consortium that maintains various standards and conformance programs for those standards, among which POSIX and UNIX are probably the most widely-known.

Novell gave the UNIX trademark and test suites to The Open Group; all SCO actually got was the right to sublicense the copyright to the AT&T UNIX software (but not the actual copyright itself). The former is much more important than the later because there are operating systems which pass the test suite (and hence are allowed to use the UNIX trademark) but which aren't based on AT&T-derived code (e.g. macOS, z/OS, EulerOS)

Note that Inspur K-UX you mentioned is no longer a certified UNIX because the vendor failed to pay the renewal fees. The same is true of Solaris.

Re: Some Differences Between macOS and Common Unix Systems

#54

Post by skissane »

Someone wrote: post #38
loeg wrote: post #30

Earlier quoted context omitted.

Certified Unix just means you've paid SCO enough money. There are Linux-based Certified UNIX products: EulerOS and Inspur K-UX.

Thanks. Google gave me https://www.opengroup.org/openbrand/register/brand3596.htm , which links to both http://www.opengroup.org/csq/search/t=XY1.html (Nice layout, BTW. Reminds me of the ‘90) and https://www.opengroup.org/openbrand/register/xy.htm . Apparently, “conformance statements” are different from “registered products”. I guess one is self-reported and the other is externally verified?

> Apparently, “conformance statements” are different from “registered products”. I guess one is self-reported and the other is externally verified?

Products get dropped from the register if the vendor fails to pay renewal fees. The product no longer appears on the register page, but the page on the product is not taken down and can still be directly accessed. This is what has happened to both Inspur K-UX and Oracle Solaris (and I'm pretty sure a few more over the years).

Re: Some Differences Between macOS and Common Unix Systems

#55

Post by __turbobrew__ »

IshKebab wrote: post #43
Hackbraten wrote: post #14

I keep hearing that `sudo` insecurity argument everywhere. I think that argument is fundamentally wrong. In practice, a package manager that eschews `sudo` does not protect you any less than a package manager that works with `sudo`. If malware has obtained file system access, it’s already game over. The malicious code can now mess with your shell profile and fake the `sudo` command.

Yes the only way around that is to have sudo activate a Secure Attention Key. Windows has had that for many many years ("press ctrl-alt-del to continue") though they seem to have ditched it in Windows 10. Presumably users didn't know what it meant or why it was there and just did it when asked by anyone. I don't think it's really possible to make sudo use a SAK on Linux though because it requires tight integration of…

The magic sysrq key combination works, I don’t see why you couldn’t do something similar for a SAK?

Re: Some Differences Between macOS and Common Unix Systems

#56

Post by skissane »

icedchai wrote: post #24
kergonath wrote: post #12

Earlier quoted context omitted.

Both, I would say, particularly with the GNU’s Not UNIX userland. I don’t think it matters much, though, as you can have a great non-UNIX OS, which Linux definitely is. Also, we might forget it now, but in the past there were a lot of UNIX that were quite different in small and large ways. The differences between Linux and Darwin might be as great as the differences between SunOS and Xenix, or indeed NeXTSTEP, back i…

Outside of macOS, commercial Unix is basically dead. In the old days I used to see all sorts of systems. One company had Solaris 2.x, SunOS 4.x, Digital Unix, HPUX, AIX. Now you rarely see anything other than Linux, though I still know a couple of AIX shops that went all in on IBM hardware and still swear by it. Like it or not, right or wrong, when people say "Unix" today, they mean Linux with GNU userland.

The IBM mainframe operating system z/OS (formerly known as MVS) is a certified UNIX 95. (That's an older UNIX standard, but still valid.)

There are still a lot of IBM mainframes out there. Far less than there used to be, but IBM mainframes remain (even in 2020) a sector with many billions of dollars of annual revenue (if you add up hardware and software and services across both IBM and the ISV ecosystem). And the vast majority of those mainframes run z/OS. (They also run other operating systems – z/Linux, z/VM, z/VSE and z/TPF – but many of the sites running one of those other operating systems run z/OS as well.)

The UNIX component of z/OS is not merely a compatibility layer, a lot of operating system components and applications now rely on it. For example, the REST-based z/OS management console Zowe that IBM is now promoting runs under z/OS UNIX. My understanding is that IBM prefers (where possible) to develop new OS components and applications to run under z/OS UNIX rather than the traditional z/OS APIs. Anything written in Java (or other newer languages, such as node.js) is running on z/OS UNIX. So even if a z/OS site isn't doing anything directly on UNIX, they are almost certainly using OS components and applications which directly rely on it to function.

Obviously z/OS is absolutely dwarfed by Linux and macOS, but it is probably the healthiest of all the commercial Unixes – Oracle has put Solaris in maintenance mode, same for HPE and HP/UX, HPE killed Digital Unix years ago; AIX is healthier than Solaris or HP/UX, but I think z/OS is even healthier than AIX. z/OS licensing fees are a lot higher than AIX licensing fees, and the non-UNIX parts of z/OS (JCL, VSAM, CICS, IMS, etc) make it far harder to migrate off than AIX is.

Re: Some Differences Between macOS and Common Unix Systems

#57

Post by jeffbee »

kitsunesoba wrote: post #40
jeffbee wrote: post #25

Earlier quoted context omitted.

You can install the toolchain with `xcode-select` which does not require an Apple ID.

And if I'm not mistaken, until clang is installed commands like "clang" and "gcc" redirect to xcode-select, so if the user tries to compile something the system will offer to install the toolchain for you.

Yep. That's how I setup a new Mac. I open a terminal and type `make` and it installs the world.

Re: Some Differences Between macOS and Common Unix Systems

#58

Post by 1vuio0pswjnm7 »

yjftsjthsd-h wrote: post #3

> Some Differences between macOS and Common Unix Systems ...by which is meant, "Some differences between macOS, a certified Unix™, and systemd/Linux". Which is fine and valuable! But macOS is the most common Unix™, so the title as written is... entertaining.

macOS claims to be UNIX yet "XNU", the macOS kernel, is an abbreviation for "X is not UNIX". "Linux" refers to a kernel, inspired by Minix, which is an abbreviation for "mini-UNIX".

Re: Some Differences Between macOS and Common Unix Systems

#59

Post by zamalek »

kergonath wrote: post #41
zamalek wrote: post #35

Earlier quoted context omitted.

> UNIX I don't understand why UNIX is such a big deal in 2020. Linux has won, and at least one BSD has binary compatability with Linux. If anything, we should be taking about Linux compliance. Having no strong package manager story, yet being UNIX compliant, seems like an extremely bizarre priority choice.

There is some value in standards such as UNIX and POSIX compared to whatever the maintainers of a GNU project decided this morning. As for your second point, it just means that package management is irrelevant to UNIX (or POSIX) compliance. It did not prevent different package managers to appear over the years, because all the expected infrastructure was in place.

> It did not prevent different package managers

But did these UNIX package managers actually materialize? I guess my point is: is UNIX at all relevant? It had some really good ideas that were worth copying, but the world has moved on to greater ideas.

Re: Some Differences Between macOS and Common Unix Systems

#60

Post by icedchai »

skissane wrote: post #56
icedchai wrote: post #24

Earlier quoted context omitted.

Outside of macOS, commercial Unix is basically dead. In the old days I used to see all sorts of systems. One company had Solaris 2.x, SunOS 4.x, Digital Unix, HPUX, AIX. Now you rarely see anything other than Linux, though I still know a couple of AIX shops that went all in on IBM hardware and still swear by it. Like it or not, right or wrong, when people say "Unix" today, they mean Linux with GNU userland.

The IBM mainframe operating system z/OS (formerly known as MVS) is a certified UNIX 95. (That's an older UNIX standard, but still valid.) There are still a lot of IBM mainframes out there. Far less than there used to be, but IBM mainframes remain (even in 2020) a sector with many billions of dollars of annual revenue (if you add up hardware and software and services across both IBM and the ISV ecosystem). And the vas…

Interesting. I had forgotten about z/OS. I don't know much about the mainframe world. Several years back, I did get it booted on the "Hercules" emulator, but making much real use of it was beyond my capabilities.
Post reply on HN