Live data from Hacker News

Apple Exclaves

randomaugustine.medium.com

81–90 of 233 posts

Re: Apple Exclaves

#81
post #68
post #64

Earlier quoted context omitted.

If we lose a bastion of being able to speak quite freely in front of other intelligent humans, that will be a shame.

Don’t worry, the more reasonable of us on HN helped to flag that troll comment into oblivion. Thanks for sharing your story.

[flagged]

Re: Apple Exclaves

#82
post #51

Who is this author? It’s a very elaborately, well written post. Great job. Having followed exclaves myself this is well done

This was an incredibly well-researched and well-written deep dive. It's rare to see such a thorough breakdown of something as technical as exclaves while still making it engaging to read.

Re: Apple Exclaves

#83
post #72

Earlier quoted context omitted.

Sure. On the one hand, everything adhered to the letter of the law. On the other, he used his money to get served before other people in an otherwise similar position would have been able to do. I personally view that as more of a failing in the system itself (why are there multiple lines to begin with when organ transport is a solved problem?), but it's not unreasonable to look at somebody exploiting that broken sys…

I know very few people who would't use their wealth to try to save their lifes, or that of their loved ones. It's kind of what wealth is for.

You know that's still bad right?

Re: Apple Exclaves

#84
I wonder if it's possible for app devs to use Exclaves. The thing that irks me about Apple is that they invent this new amazing internal stuff but then completely wall it off from devs, leaving everyone else (banking apps, wallets, secure messaging, etc.) to continue running in unsecured user space.

Re: Apple Exclaves

#85

Earlier quoted context omitted.

DF blog series source reference, https://randomaugustine.medium.com/on-apple-exclaves-d683a2c... I would particularly like to highlight the work of Dataflow Forensics and their much more advanced work dissecting SPTM without the benefit of source code. I enthusiastically await their promised blog post about exclaves and hope they will answer many of the remaining questions, provide gory disassembly explanations, and…

They are being polite. The Dataflow blog post barely goes beyond running strings.

> They are being polite.

Are they? The article's closing paragraph advertises a _future_ Dataflow blog post to the reader. Their follow-up March correction is consistent with the Dataflow Feb summary, https://randomaugustine.medium.com/more-speculation-on-excla...

Re: Apple Exclaves

#86

> SK runs on the same high speed application processors as XNU/iOS. To make this possible, additional processor privilege levels are required — likely supported by virtualization extensions Recent Apple phone and laptop SoCs include hardware support for nested virtualization, including the M4 iPad Pro where an exclave is used for the camera LED. Hopefully the next revision of the Apple Platform Security guide will co…

The author published a follow-up post and revised diagram, https://randomaugustine.medium.com/more-speculation-on-excla...

> While I speculated that TrustZone was being used, exclaves may well use the existing SPTM and GXF (Guarded Execution) privilege levels after all. One implication may be that there is no hard reason they couldn't be supported on iPhone 13 and higher, aside from RAM requirements and development effort. Make no mistake these are huge undertakings even for Apple.

Re: Apple Exclaves

#87

Earlier quoted context omitted.

They are being polite. The Dataflow blog post barely goes beyond running strings.

> They are being polite. Are they? The article's closing paragraph advertises a _future_ Dataflow blog post to the reader. Their follow-up March correction is consistent with the Dataflow Feb summary, https://randomaugustine.medium.com/more-speculation-on-excla...

Yes, they're saying that there's some stuff they didn't cover, and they hope the Dataflow people will. But the first couple didn't really answer much so I'm not particularly hopeful.

Re: Apple Exclaves

#88
post #54
post #50

Earlier quoted context omitted.

Sorry I am sure the article about enclaves triggered this thought about Steve for you. I cannot how one led to the other, can you may be tell us?

hehe, it's a good question. When you get to scale, you realize you got there because a lot of humans put you there. It's part of why scaling is hard, business is an art and science that juggles the value exchange between us in society. People still here on hackernews are angry at me personally for decisions at digitalocean, in retrospect, I wish I'd handled the wipe disk thing that happened better, for example. It's…

Thanks for the Steve Jobs clip and this valiant comment on complex subjects.

Re: Apple Exclaves

#89

Related thread, "Apple rearranged its XNU kernel with exclaves" , https://news.ycombinator.com/item?id=43314171

An overview from that piece: > exclaves refer to specific resources that are separated from the main kernel (XNU) and cannot be accessed by it, even if the kernel is compromise Also interesting: > It’s not uncommon for mid-cycle releases of macOS to gain new features in preparation for the next major version. Perhaps the most fundamental and significant added to Sonoma 14.4, together with iOS 17.4, iPadOS 17.4 and wa…

> In macOS 15 and later, creation of a VM running macOS 15 or later can configure an identity derived from the host Secure Enclave, enabling access to resources requiring Apple ID including iCloud. This is accomplished using an exclave of the Secure Enclave.

This is not correct

Re: Apple Exclaves

#90
post #77

Earlier quoted context omitted.

> He also believed very strongly in good marketing, and he jumped on privacy marketing very quickly after the Facebook - Google privacy spat that coincided with the failure of iTunes Ping. I have two thoughts about this. One, if you tell yourself a story strongly enough, it becomes real. Especially when you can structure the company to force it to become real. Two, "marketing" is usually used disparagingly to mean so…

> "knowing what people are going to want by the time it's ready to ship" Isn't that Product rather than Marketing?

Same function at Apple. There isn't a separate "product" division and there aren't "PMs" with power (though there are some job site postings for them… in the marketing division.) That doesn't make sense at a functionally organized company where the execs and designers decide everything - Jobs and Ive were the "product" people.

IIRC the advertising people are called Marcom or "marketing communications".

Post reply on HN