Apple Exclaves

Post by hedora » Mon, Mar 10, 2025, 1:10 AM UTC

vermilingua wrote: post #12

kazinator wrote: post #10

If most of the stuff the user cares about is inside the "Insecure World" bubble of the diagram, then this whole business is, like, for shit. It serves only the platform provider, who can decide which programs may or may not be installed based on whether they are aligned with or against their competitive interests.

This is just plainly false. Passkeys, biometrics, app permissions, and a suite of other user-centric privacy features have clear benefit from strong isolation from an "insecure world" kernel.

Post by thrdbndndn » Mon, Mar 10, 2025, 1:17 AM UTC

metadat wrote: post #19

gnabgib wrote: post #17

Earlier quoted context omitted.

That is underwhelming! (But also.. that's *this* discussion.. and the other discussion is already linked by GP.. so I'm not really sure what you're aiming for here)

Only attempting to share information. Is there an unstated next step (or next-next step) given Apple's moves? A gentle suggestion for a more interesting / entertaining article currently on the front page with a glance: https://news.ycombinator.com/item?id=43311696 Hatching a Conspiracy: A BIG Investigation into Egg Prices https://www.thebignewsletter.com/p/hatching-a-conspiracy-a-b... P.s. @gnabgib thanks for all you…

Post by neom » Mon, Mar 10, 2025, 1:23 AM UTC

musicale wrote: post #16

neom wrote: post #9

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA

It is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad. Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the origina…

Post by markus_zhang » Mon, Mar 10, 2025, 1:31 AM UTC

saagarjha wrote: post #7

markus_zhang wrote: post #4

I'm not familiar with that level of knowledge, but from the look of it you can attack the enclave itself to escalate privilege higher than the kernel enjoys? Is this piece of hardware something like a co-processor?

An exclave isn’t hardware, it’s an isolated piece of software that deals with a certain sensitive operation that you don’t want the kernel to have access to. So if you exploit it, then yes you have access to something that the kernel doesn’t–but that’s the point, because the goal is if you exploit the kernel you shouldn’t get access to that.

Post by timewizard » Mon, Mar 10, 2025, 1:47 AM UTC

hedora wrote: post #21

vermilingua wrote: post #12

Earlier quoted context omitted.

This is just plainly false. Passkeys, biometrics, app permissions, and a suite of other user-centric privacy features have clear benefit from strong isolation from an "insecure world" kernel.

How so? Isn’t this just the xkcd authorization model? https://xkcd.com/1200/ I tried to read the article, and know what all the words mean (sel4, enclaves, virtualization primitives, etc.). It all seems very complicated and error prone, but I couldn’t figure out what the attack model is, or what the security objectives are. Eg, what sorts of things run in exclaves, and under what circumstances will a persistent kerne…