Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Exclaves

randomaugustine.medium.com

Post reply on HN
Print view View original

41–50 of 233 posts

Re: Apple Exclaves

#41

Post by colechristensen »

6stringmerc wrote: post #35
neom wrote: post #25

Earlier quoted context omitted.

Now that I'm becoming an old man, I've taken the time to go back and listen to him properly, to analize his thoughts and words a bit more contextually, and I've come to believe that Steve Jobs was quite misunderstood, both by us, and by himself. When I miss him I think: his thoughts were so very refined for his time, it is quite incredible and I wish he was around to hear more of them. I guess I'm a fan? Oh well...wo…

I still think about how he tried to cure cancer with crystals and then when that didn’t work he used his wealth to get residency in a different state to jump in line for a transplant and still died before his yacht got completed. I don’t misunderstand him at all. Especially the parking in handicap spaces part. Very easy to understand what kind of person he was through his actions. Perhaps we will never see eye to eye…

Ok, but more or less everyone is going to have a few things about them that you’re not going to like. When your whole life is up for scrutiny and you have unlimited resources, that’s how it is. If you had a billion dollars there’d be plenty of things people would criticize about you. And anybody else who did too.

Re: Apple Exclaves

#42

Post by joseppudev »

neom wrote: post #25
musicale wrote: post #16

Earlier quoted context omitted.

It is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad. Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the origina…

Now that I'm becoming an old man, I've taken the time to go back and listen to him properly, to analize his thoughts and words a bit more contextually, and I've come to believe that Steve Jobs was quite misunderstood, both by us, and by himself. When I miss him I think: his thoughts were so very refined for his time, it is quite incredible and I wish he was around to hear more of them. I guess I'm a fan? Oh well...wo…

[dead]

Re: Apple Exclaves

#43

Post by alfiedotwtf »

saagarjha wrote: post #7
markus_zhang wrote: post #4

I'm not familiar with that level of knowledge, but from the look of it you can attack the enclave itself to escalate privilege higher than the kernel enjoys? Is this piece of hardware something like a co-processor?

An exclave isn’t hardware, it’s an isolated piece of software that deals with a certain sensitive operation that you don’t want the kernel to have access to. So if you exploit it, then yes you have access to something that the kernel doesn’t–but that’s the point, because the goal is if you exploit the kernel you shouldn’t get access to that.

If it’s all in software but the kernel has lower privileges, I’m curious how they’ll be able to update it? And if there is an API to update via the kernel, what’s stopping a push via a malicious source pretending to be Apple?

Re: Apple Exclaves

#44

Post by saagarjha »

transpute wrote: post #18
tptacek wrote: post #14

Earlier quoted context omitted.

For what it's worth, this article is much better.

For more detail, there's a 3-part series on iOS SPTM and TXM: Aug 2023, https://www.df-f.com/blog/ios17 Nov 2023, https://www.df-f.com/blog/ios-17round2 Feb 2025, https://www.df-f.com/blog/sptm3

Somewhat less detail, actually.

Re: Apple Exclaves

#45

Post by saagarjha »

wtallis wrote: post #38
akyuu wrote: post #11

I wonder how this will affect macOS security, since SPTM is not used according to Apple documentation: https://support.apple.com/guide/security/operating-system-in... For now, I think existing exclaves such as the one that displays the camera indicator do not really apply to macOS (since MacBooks have dedicated hardware for that), but in the future there might be exclaves that do.

> since SPTM is not used according to Apple documentation: Try reading that footnote again: > Note 2: Page Protection Layer (PPL) and Secure Page Table Monitor (SPTM) enforce the execution of signed and trusted code on all platforms with the exception of macOS (because macOS is designed to run any code). All of the other security properties, including the protection of page tables, are present across all supported pl…

That document is wrong and has been wrong for years (FB13803014)

Re: Apple Exclaves

#46

Post by saagarjha »

alfiedotwtf wrote: post #43
saagarjha wrote: post #7

Earlier quoted context omitted.

An exclave isn’t hardware, it’s an isolated piece of software that deals with a certain sensitive operation that you don’t want the kernel to have access to. So if you exploit it, then yes you have access to something that the kernel doesn’t–but that’s the point, because the goal is if you exploit the kernel you shouldn’t get access to that.

If it’s all in software but the kernel has lower privileges, I’m curious how they’ll be able to update it? And if there is an API to update via the kernel, what’s stopping a push via a malicious source pretending to be Apple?

I don't think it is accurate to say that the kernel has lower privileges. It's just something the kernel isn't allowed to do, while the exclave has a list of things it isn't allowed to do. Also exclaves are shipped with normal software updates (verified by the boot chain, not the kernel).

Re: Apple Exclaves

#47

Post by saagarjha »

seventh12 wrote: post #8
saagarjha wrote: post #6

> Apple may use SPTM to manage transitions between the secure and insecure worlds This, because they don’t have TrustZone

Why Apple doesn't use TrustZone?

You'd have to ask them. My general guess is they design their own stuff first and then try to get it standardized.

Re: Apple Exclaves

#49

Post by pstuart »

6stringmerc wrote: post #35
neom wrote: post #25

Earlier quoted context omitted.

Now that I'm becoming an old man, I've taken the time to go back and listen to him properly, to analize his thoughts and words a bit more contextually, and I've come to believe that Steve Jobs was quite misunderstood, both by us, and by himself. When I miss him I think: his thoughts were so very refined for his time, it is quite incredible and I wish he was around to hear more of them. I guess I'm a fan? Oh well...wo…

I still think about how he tried to cure cancer with crystals and then when that didn’t work he used his wealth to get residency in a different state to jump in line for a transplant and still died before his yacht got completed. I don’t misunderstand him at all. Especially the parking in handicap spaces part. Very easy to understand what kind of person he was through his actions. Perhaps we will never see eye to eye…

There's plenty to not like about Jobs as a person, but Apple exists because of him (twice).

Re: Apple Exclaves

#50

Post by yalogin »

neom wrote: post #9

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA

Sorry I am sure the article about enclaves triggered this thought about Steve for you. I cannot how one led to the other, can you may be tell us?
Post reply on HN