Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple Exclaves

randomaugustine.medium.com

Post reply on HN
Print view View original

221–230 of 233 posts

Re: Apple Exclaves

#221

Post by spyke112 »

rollcat wrote: post #220
spyke112 wrote: post #219

Earlier quoted context omitted.

I don’t know, it’s my workstation so everything is in Dropbox/Onedrive/Github/Gitlab, making the machine itself ephemeral… Come to think of it I should probably get a NAS and mirror Dropbox/Onedrive onto, just in case.

Does Dropbox or Onedrive keep hourly+daily+weekly+monthly deduplicated snapshots of everything that's happened on your machine, that work without any network connection? It's no substitute for backups (I use Borg), and syncing is good (I use Syncthing, I guess iCloud also counts). But snapshots should be ubiquitous at this point, just like having a "trash bin" was mainstream in 1995.

Well, I may be an oddball, but I never really find myself having the need for snapshots, I have a tendency to not really delete files. Once upon a time i recall Dropbox having versions?

Re: Apple Exclaves

#222

Post by musicale »

musicale wrote: post #16
neom wrote: post #9

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA

It is weird. Jobs was divisive and (not infrequently) abrasive, and why would you miss a tech billionaire anyway? Yet I also feel indebted to him and to the folks at Apple who helped to produce some of my favorite products like the Mac, the iPod, and the iPad. Jobs also said a lot of things that still resonate with me. Recently Apple introduced a "classic Mac" screensaver that shows how carefully designed the origina…

And I need to be more obsessive about proofreading before HN's editing timeout expires.

Re: Apple Exclaves

#223

Post by kennysoona »

amelius wrote: post #107
neom wrote: post #9

I think Steve truly believed at his core, very simply: your laptop is your diary, and they have a responsibility to that. I don't think Tim would be CEO if he didn't believe what Steve did. It's so weird, but I really miss Steve. https://www.youtube.com/watch?v=Ij-jlF98SzA

As someone who builds industrial/scientific machines, the consumer oriented devices that Apple makes are completely unusable for me. Locking down completely capable computing devices seems like such a waste. I'm also not a fan of how Apple controls devices and the market of software after the device has changed owner. I'm staying the hell away from this ecosystem. Not sure why many so-called "hackers" are so enthusia…

> Not sure why many so-called "hackers" are so enthusiastic about these "hood-welded-shut" systems.

I think the term 'hackers' has become diluted to the point it just means 'enthusiastic coder' - it hasn't seemed tied to creative thinking or pushing boundaries in some time. That probably stopped around the time the LifeHacks site became popular.

They prefer Apple because most are young and grew up with iPhones and Apple being cool due, all while MS starting continually shooting themselves in the photo with Win 10 and 11. They probably approve of Apple standing up to the FBI also.

Re: Apple Exclaves

#224

Post by kennysoona »

adamtaylor_13 wrote: post #205
saagarjha wrote: post #199

Earlier quoted context omitted.

There are processes on macOS you can’t signal without disabling SIP.

This is true, but those tend to be “mission critical” and, as you pointed out, CAN be affected with enough motivation. Windows blocks me from doing things like permanently uninstalling Microsoft Edge. It’s like the operating system itself is viral in nature.

You can permanently uninstall Microsoft Edge, it just takes some tinkering.

Last time I was playing with a Mac, even the root account was a problem to try and access. Apple are just way too nannying with their devices, but people like that.

Re: Apple Exclaves

#225

Post by kennysoona »

rollcat wrote: post #129
amelius wrote: post #107

Earlier quoted context omitted.

As someone who builds industrial/scientific machines, the consumer oriented devices that Apple makes are completely unusable for me. Locking down completely capable computing devices seems like such a waste. I'm also not a fan of how Apple controls devices and the market of software after the device has changed owner. I'm staying the hell away from this ecosystem. Not sure why many so-called "hackers" are so enthusia…

I'm a self-branded hacker so I'll share my motivation: Shit. Works. This is critical. I can focus on my actual task at hand, rather than fiddling with the system. Some perspective: I've been on Debian for 15 years, and I still hold it in very high regard for servers. I'm also an occasional Alpine & OpenBSD user; and Windows for games. I've tried Ubuntu, couldn't stop it from getting in my way. Before you suggest Fedo…

Shit works just as well without issue on my Alpine main install. On a mac, I have to fiddle with it to stay out of my way.

What exactly does not work for you on other systems, that works on a mac?

Re: Apple Exclaves

#227

Post by kennysoona »

MBCook wrote: post #207
brookst wrote: post #196

Earlier quoted context omitted.

No, because that way a rogue kernel could overwrite the exclave itself and the next reboot would be insecure. You can’t trust a low-trust environment to update a high-trust environment.

Is that why everything is cryptographically secured in the boot chain? To ensure only trusted code is loaded?

Exactly.

Re: Apple Exclaves

#228

Post by kennysoona »

saagarjha wrote: post #89
GeekyBear wrote: post #20

Earlier quoted context omitted.

An overview from that piece: > exclaves refer to specific resources that are separated from the main kernel (XNU) and cannot be accessed by it, even if the kernel is compromise Also interesting: > It’s not uncommon for mid-cycle releases of macOS to gain new features in preparation for the next major version. Perhaps the most fundamental and significant added to Sonoma 14.4, together with iOS 17.4, iPadOS 17.4 and wa…

> In macOS 15 and later, creation of a VM running macOS 15 or later can configure an identity derived from the host Secure Enclave, enabling access to resources requiring Apple ID including iCloud. This is accomplished using an exclave of the Secure Enclave. This is not correct

How is it incorrect?

Re: Apple Exclaves

#229

Post by adamtaylor_13 »

kennysoona wrote: post #224
adamtaylor_13 wrote: post #205

Earlier quoted context omitted.

This is true, but those tend to be “mission critical” and, as you pointed out, CAN be affected with enough motivation. Windows blocks me from doing things like permanently uninstalling Microsoft Edge. It’s like the operating system itself is viral in nature.

You can permanently uninstall Microsoft Edge, it just takes some tinkering. Last time I was playing with a Mac, even the root account was a problem to try and access. Apple are just way too nannying with their devices, but people like that.

I’ve literally never experienced that. If you’re the admin account, you can sudo su no problem.

Unless your company has something locked down. If it’s a consumer Mac, it requires nothing more than a login password.

Re: Apple Exclaves

#230

Post by kennysoona »

adamtaylor_13 wrote: post #229
kennysoona wrote: post #224

Earlier quoted context omitted.

You can permanently uninstall Microsoft Edge, it just takes some tinkering. Last time I was playing with a Mac, even the root account was a problem to try and access. Apple are just way too nannying with their devices, but people like that.

I’ve literally never experienced that. If you’re the admin account, you can sudo su no problem. Unless your company has something locked down. If it’s a consumer Mac, it requires nothing more than a login password.

I'm not talking about sudo su, but actually accessing the root account directly. I remember back in the day I put a file on someones desktop to prove a point, and they couldn't delete it because logging on as root was harder than it should be and they didn't know how.
Post reply on HN