Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS 11’s hidden security improvements

blog.malwarebytes.com

Post reply on HN
Print view View original

91–100 of 152 posts

Re: macOS 11’s hidden security improvements

#91

Post by duskwuff »

userbinator wrote: post #60
musicale wrote: post #44

Earlier quoted context omitted.

This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the asso…

photoanalysisd Does anyone else wonder what exactly it is analysing now, after the whole CSAM thing came to light?

Apple's Photos app can search photos based on their contents (e.g. try typing "cat" into the Photos search box). It can also identify individual faces, and group photos based on who's in them.

All of this is local-only. (Which is why it has to run an expensive indexing process locally.)

Re: macOS 11’s hidden security improvements

#93

Post by yehaaa »

xgbi wrote: post #92
yehaaa wrote: post #69

Earlier quoted context omitted.

Why is it not possible to disable SIP, make the desired changes, compute a new seal, then enable SIP again?

Because if you can do it, any rootkit will be able to do it too.

But you disable SIP while booted in recover mode. Somehow Apple needs to do this anytime the system is updated.

Re: macOS 11’s hidden security improvements

#94

Post by omginternets »

peakaboo wrote: post #86
bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

Both Microsoft and Apple are treating users like they don't care now. And probably 99.99999% of the users don't. Today you have to run Linux to control your computer yourself.

What's the state of running Linux on Mac hardware these days?

Re: macOS 11’s hidden security improvements

#95

Post by Razengan »

peakaboo wrote: post #86
bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

Both Microsoft and Apple are treating users like they don't care now. And probably 99.99999% of the users don't. Today you have to run Linux to control your computer yourself.

> Today you have to run Linux to control your computer yourself.

To control your operating system. Your hardware will still have shit like IME and whatnot.

Re: macOS 11’s hidden security improvements

#96

Post by hulitu »

peakaboo wrote: post #86
bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

Both Microsoft and Apple are treating users like they don't care now. And probably 99.99999% of the users don't. Today you have to run Linux to control your computer yourself.

In soviet russia the computer controls you. It's funny to see Apple with 1984 ad and Microsoft which said that GPL is communistic apply the same tactics as the KGB and Soviet politburo. I think that people never learn because they are so happy to embrace the future.

Re: macOS 11’s hidden security improvements

#97

Post by hulitu »

laurent92 wrote: post #82
busymom0 wrote: post #50

Earlier quoted context omitted.

I am an iOS and MacOS developer and have gotten my updates rejected for my release notes not being descriptive enough of what it changes. Yet Apple regularly gives exceptions to the big guys like Facebook, Uber etc apps and now themselves. Apple’s developer guidelines specifically warn developers to not put vague release notes but the rules often get partially applied.

Youtube’s release notes: “Fixed bugs, improved performance, took the afternoon off”.

This is valid for all google aps.

Re: macOS 11’s hidden security improvements

#98

Post by hdjjhhvvhga »

breakfastduck wrote: post #56
hdjjhhvvhga wrote: post #21

Earlier quoted context omitted.

On the other hand, Linux is getting better and better. And with the prevalence of web apps, the main obstacle to running non (MS | Apple) systems is getting smaller. With Linux, you can adjust the level of security you need and you keep the key. Security improvements appear also in BSDs, especially OpenBSD, but honestly I wouldn't recommend people used to macOS to switch to OpenBSD (yet).

You get that. And about a million tradeoffs in terms of usability. No thanks. Edit: To those downvoting. If you genueinly think running linux isn't a UIUX downgrade on macOS you are totally deluded. Its more open. Cool. It's also a UX nightmare.

There are many differences between Linux in general and macOS, but I wouldn't name UX as the first advantage of the latter. One of the first things I do on a fresh macOS device is to install Rectangle (previously Spectacle).

I have many gripes with Linux, but not about UX. I use preemptive kernels on the desktop for example, because the vanilla kernel is geared towards more general usage, which practically speaking means servers. Sometimes I need to spend more time when installing some new piece of hardware (and sometimes I don't, it works automatically).

One of the biggest advantages for me personally is that I can diagnose occasional problem myself, down to a single character in the source code if I want/need. I know what is running on my system and why, and if I want, I can remove it. (Or, I can make it very hard to remove.) I know what is getting in and out, and I can block it if I want, without any built-in exceptions for the vendor. When you come to think of it, this should be the default for all systems, but we're heading in the opposite direction.

Re: macOS 11’s hidden security improvements

#99

Post by microtonal »

peakaboo wrote: post #86
bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

Both Microsoft and Apple are treating users like they don't care now. And probably 99.99999% of the users don't. Today you have to run Linux to control your computer yourself.

Apple does typically have release notes and an overview of fixed vulnerabilities for releases.

I think it is likely that 11.5.2 fixes a large vulnerability and they will only disclose more information once most people have updated to 11.5.2. And/or they are still preparing updates for Mojave/Catalina.

Re: macOS 11’s hidden security improvements

#100

Post by anthk »

spockz wrote: post #89
musicale wrote: post #44

Earlier quoted context omitted.

This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all. On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the asso…

Does anyone know for a way to disable this scanning by photoanalysisd? (Other than not having any photos.) my old laptop keeps chugging away at that process for tens of minutes after each wake.

Find the binary of the service and chmod -x it as root.
Post reply on HN