Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why macOS anti-malware scans can behave oddly

eclecticlight.co

Post reply on HN
Print view View original

11–20 of 46 posts

Re: Why macOS anti-malware scans can behave oddly

#11

Post by mschuster91 »

MaxikCZ wrote: post #8
mschuster91 wrote: post #6

Earlier quoted context omitted.

> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from…

In this case its the execution that was bad. If the MacOS would wake silently knowing the purpose is to scan and do nothing else, all the useless stuff for it could (and should) be kept off. Then such thing could not happen.

No OS supports just waking up "specific" processes only after a resume from standby. IIRC Apple does but in a fake way - they just wake up the T2 chip and its dedicated OS, which is a ton of work to get right (as state of hardware must be coordinated between macOS and bridgeOS), and only Apple can do this because (other than servers with iLO/equivalent) no x86 machine has a similarly capable coprocessor.

Edit: never mind, I must have gotten something wrong, T2 is not capable of that.

Re: Why macOS anti-malware scans can behave oddly

#12

Post by dotty- »

hunters_laptop wrote: post #4

"Instead it records those events in the log, and in Ventura and later makes them available to third-party software through Endpoint Security events." Sounds like what malware did for decades

What are you trying to say by this comment? Odd comparison.

Re: Why macOS anti-malware scans can behave oddly

#13

Post by giuliomagnifico »

mschuster91 wrote: post #6
giuliomagnifico wrote: post #2

I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) but know that macOS keep itself a bit more secure is a good thing.

> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from…

macOS already wake up itself lots of time but keeping the display and other services off, it’s called PowerNap. It downloads mails and updates, so the same for the malware protection would not be a bad idea.

Re: Why macOS anti-malware scans can behave oddly

#14

Post by arghwhat »

mschuster91 wrote: post #11
MaxikCZ wrote: post #8

Earlier quoted context omitted.

In this case its the execution that was bad. If the MacOS would wake silently knowing the purpose is to scan and do nothing else, all the useless stuff for it could (and should) be kept off. Then such thing could not happen.

No OS supports just waking up "specific" processes only after a resume from standby. IIRC Apple does but in a fake way - they just wake up the T2 chip and its dedicated OS, which is a ton of work to get right (as state of hardware must be coordinated between macOS and bridgeOS), and only Apple can do this because (other than servers with iLO/equivalent) no x86 machine has a similarly capable coprocessor. Edit: never…

There is no technical limitation, the kernel is free to schedule whatever it wants. The appearance that everything never stopped running is an illusion the kernel does active work to implement - heck, in the case of hibernation it is even after a normal cold boot like any other.

Resuming to only run specific processes - or resuming to run an entirely different, temporary userspace - is trivial from a kernel perspective.

Re: Why macOS anti-malware scans can behave oddly

#16

Post by tedunangst »

MaxikCZ wrote: post #8
mschuster91 wrote: post #6

Earlier quoted context omitted.

> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from…

In this case its the execution that was bad. If the MacOS would wake silently knowing the purpose is to scan and do nothing else, all the useless stuff for it could (and should) be kept off. Then such thing could not happen.

Why don't they write the rest of the OS in this guaranteed bugfree way too?

Re: Why macOS anti-malware scans can behave oddly

#17

Post by tinus_hn »

giuliomagnifico wrote: post #13
mschuster91 wrote: post #6

Earlier quoted context omitted.

> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from…

macOS already wake up itself lots of time but keeping the display and other services off, it’s called PowerNap. It downloads mails and updates, so the same for the malware protection would not be a bad idea.

In addition to this, this feature is optional, there is a clearly labeled switch in the settings to turn this on or off if for some reason people have strong feelings against it.

Re: Why macOS anti-malware scans can behave oddly

#18

Post by Kognito »

I've always found it interesting that XProtect is completely invisible to the average user, whereas MS Defender is very much in your face (at least it was last time I used Windows). I suppose it's to quietly reinforce the narrative that Macs "don't get malware".

If they do, but you never know about it before its dealt with, to the average user it's as good as it never having happened. Unless of course, damage has been done/data stolen/etc - in which case I suppose the user never finds out?

I really wouldn't mind a UI for XProtect buried somewhere deep in the settings.

Re: Why macOS anti-malware scans can behave oddly

#19

Post by paradox460 »

jasoneckert wrote: post #5
hunters_laptop wrote: post #4

"Instead it records those events in the log, and in Ventura and later makes them available to third-party software through Endpoint Security events." Sounds like what malware did for decades

In this case, it's for enterprise MDM and MDR software agents that have device-level trust after the device has been enrolled (e.g., Apple Business Manager, Microsoft Intune, Kandji, Jamf).

I would say the line between malware and most mdm packages is up for debate

Re: Why macOS anti-malware scans can behave oddly

#20

Post by nickpeterson »

tinus_hn wrote: post #17
giuliomagnifico wrote: post #13

Earlier quoted context omitted.

macOS already wake up itself lots of time but keeping the display and other services off, it’s called PowerNap. It downloads mails and updates, so the same for the malware protection would not be a bad idea.

In addition to this, this feature is optional, there is a clearly labeled switch in the settings to turn this on or off if for some reason people have strong feelings against it.

People are used to the old days when a computer would come on in a bag and overheat itself.
Post reply on HN