51–60 of 152 posts
Earlier quoted context omitted.
It always is! (in a good and bad way)
That's the joke. It's been the 'Year of The Linux Desktop!' at least since my senior year of high school, which was all the way back in 2002.
I'd be interested to hear from someone with deep security knowledge: Some people have dismissed OpenBSD's mitigations as overhyped (i.e. - things like W^X are not the main problem, linux has long caught up, etc). But now we see Apple adding precisely some of these mitigations. Where does this leave such architectural countermeasures? Are there real gains from investing in such low-level things? Are they irrelevant in…
W^X is a good mitigation to prevent attackers from just spraying shellcode into a RWX heap. This is how most JIT engines used to be attacked, and many exploits continue to include WebAssembly just because Chrome will create a RWX arena for this. Many of the OpenBSD mitigations are actually a good idea, but some are fanciful junk. The posture that the team has towards pushing those latter ones is what generally makes…
Well, pledge and unveil work fine.
Earlier quoted context omitted.
W^X is a good mitigation to prevent attackers from just spraying shellcode into a RWX heap. This is how most JIT engines used to be attacked, and many exploits continue to include WebAssembly just because Chrome will create a RWX arena for this. Many of the OpenBSD mitigations are actually a good idea, but some are fanciful junk. The posture that the team has towards pushing those latter ones is what generally makes…
>The posture that the team has towards pushing those latter ones is what generally makes people unhappy. Well, pledge and unveil work fine.
The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.
Can those daemons be deleted/renamed?
Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…
On the other hand, Linux is getting better and better. And with the prevalence of web apps, the main obstacle to running non (MS | Apple) systems is getting smaller. With Linux, you can adjust the level of security you need and you keep the key. Security improvements appear also in BSDs, especially OpenBSD, but honestly I wouldn't recommend people used to macOS to switch to OpenBSD (yet).
Edit: To those downvoting. If you genueinly think running linux isn't a UIUX downgrade on macOS you are totally deluded. Its more open. Cool. It's also a UX nightmare.
Earlier quoted context omitted.
On the other hand, Linux is getting better and better. And with the prevalence of web apps, the main obstacle to running non (MS | Apple) systems is getting smaller. With Linux, you can adjust the level of security you need and you keep the key. Security improvements appear also in BSDs, especially OpenBSD, but honestly I wouldn't recommend people used to macOS to switch to OpenBSD (yet).
You get that. And about a million tradeoffs in terms of usability. No thanks. Edit: To those downvoting. If you genueinly think running linux isn't a UIUX downgrade on macOS you are totally deluded. Its more open. Cool. It's also a UX nightmare.
Earlier quoted context omitted.
You get that. And about a million tradeoffs in terms of usability. No thanks. Edit: To those downvoting. If you genueinly think running linux isn't a UIUX downgrade on macOS you are totally deluded. Its more open. Cool. It's also a UX nightmare.
For a new job I've switched to 100% Ubuntu from Windows and I'm not missing much.. What would you be giving up?
The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.
This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the asso…
Does anyone else wonder what exactly it is analysing now, after the whole CSAM thing came to light?