Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS 11’s hidden security improvements

blog.malwarebytes.com

Post reply on HN
Print view View original

111–120 of 152 posts

Re: macOS 11’s hidden security improvements

#111

Post by beermonster »

easton wrote: post #49
GekkePrutser wrote: post #38

Earlier quoted context omitted.

I thought those were entirely separate things? There's now a GUI option for the unsigned kernel extension block (in the startup security utility). I don't think that's part of SIP per se. It's also the one you need to run any other OS. Whereas SIP is a thing within the OS itself as far as I know. But I have to admit this is where my knowledge gets fuzzy :) The kind of control I'd want is allowing to add a signator fo…

If you’re a corporate admin you can whitelist kernel extensions via MDM, maybe that would help? https://support.apple.com/guide/mdm/kernel-extension-policy-...

Many years ago, when it wasn’t possible to set a strong iPhone password, I worked out I could construct an Exchange ActiveSync profile enabling a strong password policy instead of a four digit number. I didn’t have a corporate Exchange server so I pushed it to the device using the fantastic and open source z-push. A strange length to have to go to mind. I also used this method to force full device encryption and wiping device after 10 failed attempts.

All of these are now possible to configure in settings now and device encryption is on by default.

Re: macOS 11’s hidden security improvements

#112

Post by beermonster »

This is a great write-up. Are Apple getting more secretive as I had heard they were trying to become more open regarding their security. This and not providing release notes [1]for 11.5.2 make me think otherwise

https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus

Re: macOS 11’s hidden security improvements

#113

Post by pram »

IncRnd wrote: post #66
pram wrote: post #51

Earlier quoted context omitted.

Although you could literally buy a desktop with Linux at Walmart in 2001 so, maybe that actually was the year.

Except, those quickly disappeared. That's the essence of the joke that was mentioned. Each year was called the year of the Linux Desktop, but it never happened.

I meant the 'year' had come and gone, 20 years ago.

Re: macOS 11’s hidden security improvements

#115

Post by ziml77 »

livinginfear wrote: post #103
breakfastduck wrote: post #56

Earlier quoted context omitted.

You get that. And about a million tradeoffs in terms of usability. No thanks. Edit: To those downvoting. If you genueinly think running linux isn't a UIUX downgrade on macOS you are totally deluded. Its more open. Cool. It's also a UX nightmare.

> If you genueinly think running linux isn't a UIUX downgrade.... You've betrayed yourself with this statement. There isn't one Linux . I know this might just seem like more of the complexity non-Linux users want to avoid, however users are free to install whatever desktop environment or window manager they like. You could even opt for a desktop environment that resembles MacOS in most ways. I use MacOS in my profess…

But that's part of the problem. There isn't a single DE which means that any applications that aren't specific to a DE will provide a UX that is inconsistent.

Re: macOS 11’s hidden security improvements

#116

Post by hdjjhhvvhga »

bdamm wrote: post #61
smoldesu wrote: post #39

Earlier quoted context omitted.

This, a million times. Now that Mojave is starting to get dropped, Linux is exactly what the doctor ordered for me. I feel a lot safer in a system where I can check the locks instead of being told "the door's closed, you're fine."

Make no mistake, there are back doors into Linux as well.

When you think about the utility of such backdoors, the ones in Windows like in Bitlocker are much more useful to intelligence agencies than a similar thing in Linux. As Linux is mainly installed on a server, we are talking about a backdoor that allows defined or arbitrary code execution based on a given signal such as specific connection data. What happens next is also important (a connection is established, a hidden process is created and so on). When you take all this into consideration, hiding a backdoor in the Linux kernel is not the most efficient way to proceed, especially when you normally deal with specific targets. So instead of a full backdoor you would prefer introducing a feature that would play nicely with a zero day you already developed.

Re: macOS 11’s hidden security improvements

#117

Post by livinginfear »

ziml77 wrote: post #115
livinginfear wrote: post #103

Earlier quoted context omitted.

> If you genueinly think running linux isn't a UIUX downgrade.... You've betrayed yourself with this statement. There isn't one Linux . I know this might just seem like more of the complexity non-Linux users want to avoid, however users are free to install whatever desktop environment or window manager they like. You could even opt for a desktop environment that resembles MacOS in most ways. I use MacOS in my profess…

But that's part of the problem. There isn't a single DE which means that any applications that aren't specific to a DE will provide a UX that is inconsistent.

That's not really true. Outside of tiling window managers, pretty much everything is designed around the same, familiar model of minimise/maximise/close buttons in the corner of the window. Just about every mainstream OS supports different UI toolkits, and for the most part everyone lives with this.

Even tiling window managers don't really have any problems. They provide a very niche UX, which is almost entirely keyboard driven. There's not a single general application I can think of designed for use with this kind of window manager. Still, you get a pretty consistent user experience for the most part.

Re: macOS 11’s hidden security improvements

#118

Post by nbzso »

peakaboo wrote: post #86
bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

Both Microsoft and Apple are treating users like they don't care now. And probably 99.99999% of the users don't. Today you have to run Linux to control your computer yourself.

No way. Ask HN "new generation" to tell you, Apple and Microsoft are taking care of you to feel safe and protecting the children at the same time. Linux desktop sucks. It is broken. I found out that this "brokenness" is what I expect to have. To modify and optimize my UX.

Re: macOS 11’s hidden security improvements

#119

Post by PhantomGremlin »

anthk wrote: post #101
taylorfinley wrote: post #74

Earlier quoted context omitted.

You don't think, with all the resources available to them, the intelligence community would spend just about whatever it took to sneak a vulnerability or two into the most-run piece of code on the planet? The core devs don't even have to be corrupted--there are 28 million lines of code in the kernel, you don't think a motivated adversary could sneak something past the gate keepers?

Any middleware Linux/BSD router could detect suspicious traffic.

I don't think this is realistic any more. There's just too much noise, too many chatty processes, too much traffic.

A while ago I tried to track the start of a single application, a new install of Firefox. IIRC the first start generated traffic to about a dozen endpoints.

Also, macOS and Windows generate enormous amounts of traffic (others here have noted that).

The amount of background traffic is simply overwhelming. Perhaps security companies can make sense of it all, but it's far too much for most technical people.

I run my own OpenBSD firewall and I've long since given up trying to understand what my Macbooks are doing.

The beauty of OpenBSD itself is that it starts very few daemons, and all source code is available. So it's easy for me to understand what my firewall is doing.

   user@catalina ~ % ps aux |wc -l
        542
vs

   openbsd_user$ ps aux |wc -l                                                                    
         42

Re: macOS 11’s hidden security improvements

#120

Post by Tijdreiziger »

Hackbraten wrote: post #84
h4x0r12345 wrote: post #80

Earlier quoted context omitted.

It's well known that they've already tried to insert back doors many times. On the other side is a huge amount of resources auditing and reviewing the kernel. Many reviewers, auditors, security analysts.

Details about a few known attempts: https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_t...

TIL Linus Torvalds' father is a Member of European Parliament.
Post reply on HN