Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why macOS anti-malware scans can behave oddly

eclecticlight.co

Post reply on HN
Print view View original

31–40 of 46 posts

Re: Why macOS anti-malware scans can behave oddly

#31

Post by easton »

TillE wrote: post #28
Kognito wrote: post #18

I've always found it interesting that XProtect is completely invisible to the average user, whereas MS Defender is very much in your face (at least it was last time I used Windows). I suppose it's to quietly reinforce the narrative that Macs "don't get malware". If they do, but you never know about it before its dealt with, to the average user it's as good as it never having happened. Unless of course, damage has bee…

I think maybe this was changed quite recently, but for a long time Windows 10/11 would send you periodic notifications that Defender had done a scan and found no threats. Pointless and briefly alarming; I do not expect to get AV notifications unless there's a problem. I'm glad there's a GUI though, which lets you do a deep scan on boot and other stuff.

I’m on 11 Insider Preview on my work machine and about once a week I get a notification that says something to the effect of Defender not finding anything after scanning five times.

Re: Why macOS anti-malware scans can behave oddly

#32

Post by wila »

giuliomagnifico wrote: post #13
mschuster91 wrote: post #6

Earlier quoted context omitted.

> I would have preferred if the scan was also performed when in sleep (I mean by wake up the system silently) Bad, bad idea. It's really bad if the system decides to wake up for any reason on its own - my AirPods used to be really bad for a while, despite setting them to "connect with last device" they'd connect to my work MacBook spontaneously instead of my tablet, wake up the laptop, something would prevent it from…

macOS already wake up itself lots of time but keeping the display and other services off, it’s called PowerNap. It downloads mails and updates, so the same for the malware protection would not be a bad idea.

On top of this the default for PowerNap is to not run when on battery, only when plugged in.

Re: Why macOS anti-malware scans can behave oddly

#33

Post by arghwhat »

jonhohle wrote: post #21
arghwhat wrote: post #14

Earlier quoted context omitted.

There is no technical limitation, the kernel is free to schedule whatever it wants. The appearance that everything never stopped running is an illusion the kernel does active work to implement - heck, in the case of hibernation it is even after a normal cold boot like any other. Resuming to only run specific processes - or resuming to run an entirely different, temporary userspace - is trivial from a kernel perspecti…

In a sleep state there is no kernel running, it’s a hardware feature that stops CPU execution and possibly more depending on the sleep state.

Sleep states are not a switch you just flick - that be equivalent to you pulling the power cord.

Even in the highest, most power hungry sleep states the kernel has to pause everything first, power down all the other hardware (otherwise you'd still have you WiFi card and GPU running full tilt), configure what will interrupt the CPU sleep and finally start it. On the other end it has to set everything back up, reinitialize all the other hardware to be in the same state as before, and finally start running user space again - pretending nothing happened even though the foundation was removed and rebuilt.

The only real difference to full hibernation - where the machine is powered off entirely and the kernel restores system state from a snapshot it wrote to disk - is that the RAM state sticks around and that the CPU executes the kernel again on wake instead of dropping to the firmware boot sequence.

Without that boot sequence, hibernate would basically be indistinguishable from suspend - an Phoronix article some years back talked about how Intel tuned the kernel to get from cold boot to full interactive UI in 300ms for automotive usecases.

Re: Why macOS anti-malware scans can behave oddly

#34

Post by intelVISA »

FirmwareBurner wrote: post #27
Kognito wrote: post #18

I've always found it interesting that XProtect is completely invisible to the average user, whereas MS Defender is very much in your face (at least it was last time I used Windows). I suppose it's to quietly reinforce the narrative that Macs "don't get malware". If they do, but you never know about it before its dealt with, to the average user it's as good as it never having happened. Unless of course, damage has bee…

"Malware on Macs does not exist" - 'waving Jedi hand'

Well, technically the kernel is the malware (non-free) in this case...

Re: Why macOS anti-malware scans can behave oddly

#35

Post by JadeNB »

MBCook wrote: post #22
Kognito wrote: post #18

I've always found it interesting that XProtect is completely invisible to the average user, whereas MS Defender is very much in your face (at least it was last time I used Windows). I suppose it's to quietly reinforce the narrative that Macs "don't get malware". If they do, but you never know about it before its dealt with, to the average user it's as good as it never having happened. Unless of course, damage has bee…

I would put it more towards Apple’s general philosophy of “the user shouldn’t have to care about that” than trying to uphold an image from a (extremely popular) 15 year old ad campaign. That said I agree it’s great that it’s there and I like that it doesn’t bother if I don’t need to be involved.

> I would put it more towards Apple’s general philosophy of “the user shouldn’t have to care about that” than trying to uphold an image from a (extremely popular) 15 year old ad campaign.

Apple's general philosophy has always been "the user shouldn't have to care about that", but they've moved more and more recently to "the user shouldn't even be able to do anything about that" (I feel betraying their BSD roots along the way), and this seems to be an instance of that.

Re: Why macOS anti-malware scans can behave oddly

#36

Post by Terretta »

JadeNB wrote: post #35
MBCook wrote: post #22

Earlier quoted context omitted.

I would put it more towards Apple’s general philosophy of “the user shouldn’t have to care about that” than trying to uphold an image from a (extremely popular) 15 year old ad campaign. That said I agree it’s great that it’s there and I like that it doesn’t bother if I don’t need to be involved.

> I would put it more towards Apple’s general philosophy of “the user shouldn’t have to care about that” than trying to uphold an image from a (extremely popular) 15 year old ad campaign. Apple's general philosophy has always been "the user shouldn't have to care about that", but they've moved more and more recently to "the user shouldn't even be able to do anything about that" (I feel betraying their BSD roots along…

> I feel betraying their BSD roots along the way

As a BSD 4.3, BSDi, FreeBSD, and now MacOS user, I'm not finding MacOS shell environment to be crippled in recent releases. If anything, even the ecosystem available to me through brew keeps getting broader as more and more tools add support.

What do you feel Apple has taken away from you at the CLI?

Re: Why macOS anti-malware scans can behave oddly

#37

Post by ryandrake »

Terretta wrote: post #36
JadeNB wrote: post #35

Earlier quoted context omitted.

> I would put it more towards Apple’s general philosophy of “the user shouldn’t have to care about that” than trying to uphold an image from a (extremely popular) 15 year old ad campaign. Apple's general philosophy has always been "the user shouldn't have to care about that", but they've moved more and more recently to "the user shouldn't even be able to do anything about that" (I feel betraying their BSD roots along…

> I feel betraying their BSD roots along the way As a BSD 4.3, BSDi, FreeBSD, and now MacOS user, I'm not finding MacOS shell environment to be crippled in recent releases. If anything, even the ecosystem available to me through brew keeps getting broader as more and more tools add support. What do you feel Apple has taken away from you at the CLI?

Not CLI related but here is a petty example of Apple taking something that worked for years and just dropping it. 1080i (interlaced) display support. My home theater tv supports 1080i but not 1080p, and I’ve been happily powering it with a Mac Mini running Kodi. A few years ago I “upgraded” macOS and lo and behold Apple just -decided- that I don’t need 1080i anymore and dropped support. No good reason, just “Fuck you, user. You don’t need this.”

Apple’s recent history is full of these “we know better and you don’t need this” decisions.

Re: Why macOS anti-malware scans can behave oddly

#38

Post by NoPicklez »

TillE wrote: post #28
Kognito wrote: post #18

I've always found it interesting that XProtect is completely invisible to the average user, whereas MS Defender is very much in your face (at least it was last time I used Windows). I suppose it's to quietly reinforce the narrative that Macs "don't get malware". If they do, but you never know about it before its dealt with, to the average user it's as good as it never having happened. Unless of course, damage has bee…

I think maybe this was changed quite recently, but for a long time Windows 10/11 would send you periodic notifications that Defender had done a scan and found no threats. Pointless and briefly alarming; I do not expect to get AV notifications unless there's a problem. I'm glad there's a GUI though, which lets you do a deep scan on boot and other stuff.

I tend to agree, in Windows 10 I've found I get less Defender notifications than I ever did.

I can't remember the last time I saw the Defender UI

Re: Why macOS anti-malware scans can behave oddly

#39

Post by astrange »

wila wrote: post #32
giuliomagnifico wrote: post #13

Earlier quoted context omitted.

macOS already wake up itself lots of time but keeping the display and other services off, it’s called PowerNap. It downloads mails and updates, so the same for the malware protection would not be a bad idea.

On top of this the default for PowerNap is to not run when on battery, only when plugged in.

AS Macs will wake on battery too.

Re: Why macOS anti-malware scans can behave oddly

#40

Post by astrange »

arghwhat wrote: post #14
mschuster91 wrote: post #11

Earlier quoted context omitted.

No OS supports just waking up "specific" processes only after a resume from standby. IIRC Apple does but in a fake way - they just wake up the T2 chip and its dedicated OS, which is a ton of work to get right (as state of hardware must be coordinated between macOS and bridgeOS), and only Apple can do this because (other than servers with iLO/equivalent) no x86 machine has a similarly capable coprocessor. Edit: never…

There is no technical limitation, the kernel is free to schedule whatever it wants. The appearance that everything never stopped running is an illusion the kernel does active work to implement - heck, in the case of hibernation it is even after a normal cold boot like any other. Resuming to only run specific processes - or resuming to run an entirely different, temporary userspace - is trivial from a kernel perspecti…

> Resuming to only run specific processes - or resuming to run an entirely different, temporary userspace - is trivial from a kernel perspective.

The first is rather difficult from a system perspective, because if you suspend anything you'll get deadlocks if anything else calls it, or memory growth if anything else sends IPC to it that gets buffered.

You can throttle them instead, but actually suspending is hard.

Post reply on HN