Kinda sad to think future generations of Mac users won’t be able to write self modifying assembly. I feel like that’s a fun learning experience
macOS 11’s hidden security improvements
81–90 of 152 posts
Re: macOS 11’s hidden security improvements
#82Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).
I am an iOS and MacOS developer and have gotten my updates rejected for my release notes not being descriptive enough of what it changes. Yet Apple regularly gives exceptions to the big guys like Facebook, Uber etc apps and now themselves. Apple’s developer guidelines specifically warn developers to not put vague release notes but the rules often get partially applied.
Youtube’s release notes: “Fixed bugs, improved performance, took the afternoon off”.
Re: macOS 11’s hidden security improvements
#83Kinda sad to think future generations of Mac users won’t be able to write self modifying assembly. I feel like that’s a fun learning experience
On the other hand it prevents companies from using BS like vmprotect.
Re: macOS 11’s hidden security improvements
#84Earlier quoted context omitted.
You don't think, with all the resources available to them, the intelligence community would spend just about whatever it took to sneak a vulnerability or two into the most-run piece of code on the planet? The core devs don't even have to be corrupted--there are 28 million lines of code in the kernel, you don't think a motivated adversary could sneak something past the gate keepers?
It's well known that they've already tried to insert back doors many times. On the other side is a huge amount of resources auditing and reviewing the kernel. Many reviewers, auditors, security analysts.
Details about a few known attempts:
https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_t...
Re: macOS 11’s hidden security improvements
#85Earlier quoted context omitted.
On the other hand, Linux is getting better and better. And with the prevalence of web apps, the main obstacle to running non (MS | Apple) systems is getting smaller. With Linux, you can adjust the level of security you need and you keep the key. Security improvements appear also in BSDs, especially OpenBSD, but honestly I wouldn't recommend people used to macOS to switch to OpenBSD (yet).
You get that. And about a million tradeoffs in terms of usability. No thanks. Edit: To those downvoting. If you genueinly think running linux isn't a UIUX downgrade on macOS you are totally deluded. Its more open. Cool. It's also a UX nightmare.
I don't think anyone should downvote expressing an opinion, at least when it's done without toxicity like you did. Ok, that "delusion" remark was a bit toxic. But anyway.
Here's my opinion: i3 is vastly superior to anything macos is offering in the desktop space in terms of usability. Sure, wrestling with minutae like proper font rendering and DPI settings is a huge pain, but a) some distros do those things for you and b) if you're not a serial distro hopper / manic reinstaller, those things don't have to be done too often.
I genuinely think it's an UX upgrade. And I've been using macs almost exclusively for 5 years now.
The bad things of Linux are still bad: subsystems get replaced all the time (often with just minimal technical justification), and the replacements are usually (if you compare them to Macs) alpha quality for a long time. And the integration is lacking. Notable contemporary examples: oss/alsa/pulseaudio/jack/pipewire and x11/wayland. This is something I truly don't miss when using macs. Almost everything else I do miss.
Re: macOS 11’s hidden security improvements
#86Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).
Both Microsoft and Apple are treating users like they don't care now. And probably 99.99999% of the users don't.
Today you have to run Linux to control your computer yourself.
Re: macOS 11’s hidden security improvements
#87Earlier quoted context omitted.
This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the asso…
photoanalysisd Does anyone else wonder what exactly it is analysing now, after the whole CSAM thing came to light?
It boils down to using Linux if you want privacy.
Re: macOS 11’s hidden security improvements
#88Sounds good but a problem with Apple's latest releases are that a lot of its security features listen only to Apple and not to the user. This doesn't concern most of the improvements mentioned in the article, those are purely technical improvements at a very low level. But the signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. I'm not very…
> signed system volume for example (also mentioned), while a good idea, lacks a convenient way for the user to make changes to it. MacOS has no convenient way to know if changes are made by the user or malware. It is a feature, not a bug, for most users. Why would you need to change system volume anyway?
I’d imagine no os has a way to see if changes are made by the user or by malware, otherwise you’d just prevent the changes.
Re: macOS 11’s hidden security improvements
#89The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.
This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the asso…
Does anyone know for a way to disable this scanning by photoanalysisd? (Other than not having any photos.) my old laptop keeps chugging away at that process for tens of minutes after each wake.
Re: macOS 11’s hidden security improvements
#90The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.
Can those daemons be deleted/renamed?
LaunchControl’s ui looks like it could disable them, but I haven’t tried.