Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s macOS Ventura – New Security Changes

sentinelone.com

Post reply on HN
Print view View original

131–140 of 193 posts

Re: Apple’s macOS Ventura – New Security Changes

#131

Post by tptacek »

captn3m0 wrote: post #80

Do the new DNSSEC changes imply anything for local DNS overrides? Would Apple refuse to block a site if DNSSEC is enabled and PiHole returns a blocking response?

Probably not. I haven't been able to dig into what they're doing, but I watched the presentation about the feature, and it's an opt-in API for applications. I'm not clear on this but I have to assume that the macOS/iOS resolver code is still leaning on your external recursor to do the DNSSEC validation stuff (otherwise, it's going to generate _a lot_ of extra lookup traffic), which means it's going to trust whatever your PiHole tells it anyways.

Re: Apple’s macOS Ventura – New Security Changes

#132

Post by Lammy »

kccqzy wrote: post #95
Lammy wrote: post #84

> Gatekeeper’s role is to ensure that when users execute some code, that code meets the local system policy. The policy includes checks such as whether the code is validly signed and whether it has been tampered with in certain ways. Weasel-word alert. I never thought I’d see the day when technologists would applaud the gradual death of general-purpose computing, but here we are. A decade from now Apple probably won’…

Gatekeeper was introduced in 2011 in Lion. It has already been a decade. I didn't see that transformation happening.

The existence of Gatekeeper already causes a huge privacy violation by “requiring” my computer to phone home to verify the signature the first time it launches an application. Everyone should have realized this when Apple’s OCSP responder went down in November 2020 and nobody could launch anything that wasn’t built in to the OS.

According to TFA this kind of verification will now occur every time an application is launched to deter post-verification “tampering” by you, the user. How big of a privacy violation would it have to become to bother you, out of curiosity? If we let this continue we will end up in a future where full “Remote Attestation” of every hardware and software component is required to participate in the Internet. This isn’t hypothetical doom-saying, either: game consoles already work like this. I remember my XBOX360 could detect modified DVD drive firmware, launches of individual pieces of software (e.g. Halo 3 Delta leak), and other types of system modifications, then it would permanently ban that machine from XBOX LIVE. And that was all 15+ years ago.

Just imagine what a gift this will be to law enforcement, for example, once they can go to Apple all like “Hey, Siri, show me all users of Tor Browser around the time of ${BITCOIN_TRANSACTION_ID}”.

Re: Apple’s macOS Ventura – New Security Changes

#133

Post by [deleted] »

forgotmypw17 wrote: post #118

Somewhere between Mountain Lion and High Sierra, it became impossible to delete or even mark non-executable various annoying built-in applications which I never use, e.g. iTunes.app and Safari.app, which often open without me asking them to. Does anyone know how to re-enable this functionality?

[deleted]

Re: Apple’s macOS Ventura – New Security Changes

#134

Post by rodric »

djxfade wrote: post #120
thewebcount wrote: post #114

Earlier quoted context omitted.

I wonder if it’s worse this year than usual because of the switchover to AppleSilicon? I have a 2013 Mac Pro that I use daily and it’s gotten all updates until this one. 9 years is pretty good. But I can understand wanting to end support for as many Intel machines as quickly as possible.

When Apple announced the transition from PPC to Intel, the PPC Macs only got two major updates before being EOLed. Even the Power Mac G5 (2005) only got two major updates before being cut off from support.

It should be noted, however, that those major updates had longer lifespans then. Snow Leopard, the first Intel-only version of Mac OS, came out in 2009.

Re: Apple’s macOS Ventura – New Security Changes

#135

Post by threeseed »

kybernetyk wrote: post #78
jmull wrote: post #2

> However, the Gatekeeper check here is overridable by users. This is presented as a flaw, but I'm not sure they are thinking through the alternatives. It's hard to give too much credence to security experts who are't thinking holistically. Perhaps there is a flaw, but I'm curious to know what it is.

Security folks tend to have a very myopic view on things. Ever wondered why your computer got less and less useable? Security people pushing their agenda.

> Ever wondered why your computer got less and less useable

Would disagree.

I think the security changes have made the OS more usable since I now get visibility into what apps are doing.

And I love the idea that security people pushing their agenda of making devices more secure and more private is painted as a bad thing.

Re: Apple’s macOS Ventura – New Security Changes

#136

Post by corrral »

Lammy wrote: post #84

> Gatekeeper’s role is to ensure that when users execute some code, that code meets the local system policy. The policy includes checks such as whether the code is validly signed and whether it has been tampered with in certain ways. Weasel-word alert. I never thought I’d see the day when technologists would applaud the gradual death of general-purpose computing, but here we are. A decade from now Apple probably won’…

> A decade from now Apple probably won’t even ship a local version of Xcode, and the transformation will be complete as all new development happens in Xcode Cloud where no line of code goes unscrutinized by the watchful eye of the mother ship.

Any young folks wondering: yes, this exact same thing was being posted ten years ago, all the time.

"Apple's gonna totally lock down macOS without any way around it, they hate general purpose computing" and the related "Apple's gonna merge iOS and macOS" are the apocalypse cult of computer geek forums. They might be right eventually, but only after being wrong a hundred times. And they never get the timeline right.

Re: Apple’s macOS Ventura – New Security Changes

#137

Post by zenlf »

solarkraft wrote: post #108
PartiallyTyped wrote: post #55

Earlier quoted context omitted.

> In collaboration with Google, Microsoft and other industry players, Apple has been working on a new logon technology for web and other remote services called ‘passkeys’. I don't think it will be Apple only. However, I am wondering what will happen to services like bitwarden [1] if it is available on other OSes as well. [1] https://bitwarden.com/

What's your concern regarding Bitwarden?

Not the original poster, but I think the worry is that how can a password manager survive in a passwordless future.

Will major players be too powerful that no competing solutions will realistically exist.

Re: Apple’s macOS Ventura – New Security Changes

#138

Post by zmmmmm »

Most concerning is Gatekeeper, as I do still routinely run into scenarios where it harassess me about applications I am trying to run and on the odd occasion I have to manually codesign things.

It will be super annoying if this now starts making developer's life hell because it is nannying binaries they are building, sharing or working with as part of their development work.

Re: Apple’s macOS Ventura – New Security Changes

#139

Post by zmmmmm »

jcelerier wrote: post #109
guessmyname wrote: post #101

Earlier quoted context omitted.

It is funny to me to read this because I recently joined the Xcode Cloud team to precisely work on this, thinking that I could help Apple make developer’s life easier in the near future, but according to your comment, there are people out there who will consider my team’s work a regression.

> It is funny to me to read this because I recently joined the Xcode Cloud team to precisely work on this, thinking that I could help Apple make developer’s life easier in the near future, but according to your comment, there are people out there who will consider my team’s work a regression. how exactly will it be easier than my current workflow of: - Boot computer - Press win-key + d - type the letters "qtc" - hit…

Not having to download 10g to edit 1 line of code on a computer where you haven't set up XCode should be a win?

Having said that, I agree, the biggest problem here is that even if it doesn't seem obvious now, once the cloud offering is there the control it offers will make it very appealing for Apple to expand its use and eventually offer features there that aren't in the real XCode. It can fast be a slippery slope to the non-cloud app being deprecated.

Re: Apple’s macOS Ventura – New Security Changes

#140

Post by Wowfunhappy »

zmmmmm wrote: post #138

Most concerning is Gatekeeper, as I do still routinely run into scenarios where it harassess me about applications I am trying to run and on the odd occasion I have to manually codesign things. It will be super annoying if this now starts making developer's life hell because it is nannying binaries they are building, sharing or working with as part of their development work.

You can completely disable Gatekeeper if it annoys you:

$ sudo spctl --master-disable

Post reply on HN