macOS 11’s hidden security improvements • Hacker News Board

Re: macOS 11’s hidden security improvements

#31

Post by GekkePrutser » Fri, Aug 20, 2021, 10:02 PM UTC

azinman2 wrote: post #13

GekkePrutser wrote: post #11

Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…

You can always disable CSR/SIP generally. macOS is unlike iOS in that many security mitigations can be disabled. The fact that new M1 Macs let you side load a diff non-Apple in iOS should be the ultimate proof you need of this motivation to allow user control on Macs.

Yes you can disable it, but then you disable it completely and totally. There is no middle ground. Most of the time these things are totally great ideas. Apple is doing really great work on the security front for sure. It's just what they lack is a way to customise them. Most security improvements they make involve giving Apple the keys and them alone. It doesn't have to be that way.

For example I would want to be able to just make an exception for some of the files I want to change.

Re: macOS 11’s hidden security improvements

#32

Post by ChuckNorris89 » Fri, Aug 20, 2021, 10:03 PM UTC

jchw wrote: post #19

azinman2 wrote: post #13

Earlier quoted context omitted.

You can always disable CSR/SIP generally. macOS is unlike iOS in that many security mitigations can be disabled. The fact that new M1 Macs let you side load a diff non-Apple in iOS should be the ultimate proof you need of this motivation to allow user control on Macs.

If one mentions Android’s “openness” as a plus, people (rightly) point out that sure, it is technically open source and you can often sideload, but that doesn’t mean it is friendly towards those things necessarily. A lot of downsides come with rooting and bootloader unlocking after all. That is when comparing to iOS, which is more restrictive than macOS, as you point out. I mention this because I think that it’s good…

>A lot of downsides come with rooting and bootloader unlocking after all.

I think you might be confused. You don't need to root or unlock the bootloader on an Android device to side load apps. Just download desired APK and accept the security prompt of installing from unknown sources. It's literally that easy.

Re: macOS 11’s hidden security improvements

#33

Post by goodpoint » Fri, Aug 20, 2021, 10:04 PM UTC

GekkePrutser wrote: post #11

Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…

> its security features listen only to Apple and not to the user

That's the definition of backdoors.

Re: macOS 11’s hidden security improvements

#34

Post by Klonoar » Fri, Aug 20, 2021, 10:11 PM UTC

GekkePrutser wrote: post #31

azinman2 wrote: post #13

Earlier quoted context omitted.

You can always disable CSR/SIP generally. macOS is unlike iOS in that many security mitigations can be disabled. The fact that new M1 Macs let you side load a diff non-Apple in iOS should be the ultimate proof you need of this motivation to allow user control on Macs.

Yes you can disable it, but then you disable it completely and totally. There is no middle ground. Most of the time these things are totally great ideas. Apple is doing really great work on the security front for sure. It's just what they lack is a way to customise them. Most security improvements they make involve giving Apple the keys and them alone. It doesn't have to be that way. For example I would want to be ab…

There actually is a middle ground, in some cases - csrutil can, for instance, allow you to disable unsigned kext blocking but keep the rest of SIP enabled.

Re: macOS 11’s hidden security improvements

#35

Post by GekkePrutser » Fri, Aug 20, 2021, 10:12 PM UTC

azinman2 wrote: post #14

darwingr wrote: post #5

But can it ignore your firewall settings?

My understanding is if you change firewall settings using PF let's you have total control, unlike network extensions.

Correct, though both layers remain active. The application-level firewall in the macOS GUI and the packet-based pf layer work on top of each other (I believe pf is on top of the application layer one but not 100% sure).

So if you have the application firewall on, opening ports in pf won't help.

I'm kinda surprised pf is still in there to be honest. I know some security solutions like McAfee Firewall use it under the hood. But they could do similar things with network extensions. I have expected them to drop it for years now.

Re: macOS 11’s hidden security improvements

#36

Post by tyre » Fri, Aug 20, 2021, 10:13 PM UTC

goodpoint wrote: post #33

GekkePrutser wrote: post #11

Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…

> its security features listen only to Apple and not to the user That's the definition of backdoors.

No, it isn’t.

The password hint bug, for example, was “only listening to Apple” in the narrow sense that the OS wouldn’t let you run your own implementation of password hints or login. But it’s not a backdoor.

There are plenty of built-in features that aren’t configurable, which is fine and good. Because most people have no idea what those things do, most of the rest shouldn’t touch them, and leaving them as configurable or editable opens up a whole class of malware.

Re: macOS 11’s hidden security improvements

#37

Post by eropple » Fri, Aug 20, 2021, 10:13 PM UTC

ChuckNorris89 wrote: post #32

jchw wrote: post #19

Earlier quoted context omitted.

If one mentions Android’s “openness” as a plus, people (rightly) point out that sure, it is technically open source and you can often sideload, but that doesn’t mean it is friendly towards those things necessarily. A lot of downsides come with rooting and bootloader unlocking after all. That is when comparing to iOS, which is more restrictive than macOS, as you point out. I mention this because I think that it’s good…

> A lot of downsides come with rooting and bootloader unlocking after all. I think you might be confused. You don't need to root or unlock the bootloader on an Android device to side load apps. Just download desired APK and accept the security prompt of installing from unknown sources. It's literally that easy.

Those applications can't get root, though, and that does limit user control of the device.

(I used to root Android phones in the 4.x days, and then stopped, and then went back to iOS as I found myself doing progressively less and less with my phone.)

Re: macOS 11’s hidden security improvements

#38

Post by GekkePrutser » Fri, Aug 20, 2021, 10:17 PM UTC

Klonoar wrote: post #34

GekkePrutser wrote: post #31

Earlier quoted context omitted.

Yes you can disable it, but then you disable it completely and totally. There is no middle ground. Most of the time these things are totally great ideas. Apple is doing really great work on the security front for sure. It's just what they lack is a way to customise them. Most security improvements they make involve giving Apple the keys and them alone. It doesn't have to be that way. For example I would want to be ab…

There actually is a middle ground, in some cases - csrutil can, for instance, allow you to disable unsigned kext blocking but keep the rest of SIP enabled.

I thought those were entirely separate things? There's now a GUI option for the unsigned kernel extension block (in the startup security utility). I don't think that's part of SIP per se. It's also the one you need to run any other OS. Whereas SIP is a thing within the OS itself as far as I know. But I have to admit this is where my knowledge gets fuzzy :)

The kind of control I'd want is allowing to add a signator for approved kernel extensions. So that I could add my own key and sign kernel extensions myself. Or trust another party to do this. Just like you can add your own keys to Secure Boot on a PC. The same with the app notarisation. Another feature that's essentially great, but fully under the control of Apple. For example, as a corporate admin it'd be great to be able to notarise which apps I'd allow our employees to use.

These security tools would be super powerful and useful if we would be allowed to configure them more.

Re: macOS 11’s hidden security improvements

#39

Post by smoldesu » Fri, Aug 20, 2021, 10:32 PM UTC

hdjjhhvvhga wrote: post #21

GekkePrutser wrote: post #11

Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…

On the other hand, Linux is getting better and better. And with the prevalence of web apps, the main obstacle to running non (MS | Apple) systems is getting smaller. With Linux, you can adjust the level of security you need and you keep the key. Security improvements appear also in BSDs, especially OpenBSD, but honestly I wouldn't recommend people used to macOS to switch to OpenBSD (yet).

This, a million times. Now that Mojave is starting to get dropped, Linux is exactly what the doctor ordered for me. I feel a lot safer in a system where I can check the locks instead of being told "the door's closed, you're fine."

Re: macOS 11’s hidden security improvements

#40

Post by cma » Fri, Aug 20, 2021, 10:41 PM UTC

azinman2 wrote: post #13

GekkePrutser wrote: post #11

Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…

You can always disable CSR/SIP generally. macOS is unlike iOS in that many security mitigations can be disabled. The fact that new M1 Macs let you side load a diff non-Apple in iOS should be the ultimate proof you need of this motivation to allow user control on Macs.

Won't the next update still wipe out your system changes, putting you back to insecure openssh password auth, etc., or do they have a system to merge your changes over now?