Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS 11’s hidden security improvements

blog.malwarebytes.com

Post reply on HN
Print view View original

41–50 of 152 posts

Re: macOS 11’s hidden security improvements

#41

Post by [deleted] »

ChuckNorris89 wrote: post #32
jchw wrote: post #19

Earlier quoted context omitted.

If one mentions Android’s “openness” as a plus, people (rightly) point out that sure, it is technically open source and you can often sideload, but that doesn’t mean it is friendly towards those things necessarily. A lot of downsides come with rooting and bootloader unlocking after all. That is when comparing to iOS, which is more restrictive than macOS, as you point out. I mention this because I think that it’s good…

> A lot of downsides come with rooting and bootloader unlocking after all. I think you might be confused. You don't need to root or unlock the bootloader on an Android device to side load apps. Just download desired APK and accept the security prompt of installing from unknown sources. It's literally that easy.

[deleted]

Re: macOS 11’s hidden security improvements

#42

Post by user3939382 »

The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.

Re: macOS 11’s hidden security improvements

#43

Post by walterbell »

user3939382 wrote: post #42

The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.

Can those daemons be deleted/renamed?

Re: macOS 11’s hidden security improvements

#44

Post by musicale »

user3939382 wrote: post #42

The security improvement I want is that when I run ‘ps ax’ on a fresh install, I have reduced attack surface instead of dozens of random daemons hardwired into launchd like the one for classrooms(??), iCloud and photo sharing even when those features are disabled, etc.

This is a big issue - on Windows you can set services to not start up unless they are needed, and you can turn them off so they don't run at all.

On macOS, the launchd configuration seems to be hard-wired and protected by SIP; there's no easy way to disable random daemons for features like remote student device management - something that most users would not need or want. And as you note even if you disable the associated feature (e.g. in Preferences) its daemon can still run.

It's always annoying when you're not doing anything but your laptop heats up and turns on the fans because some stupid daemon has woken up and decided to re-scan the same files (such as game updates) for the 100th time.

Not to mention photoanalysisd, which burns large amounts of CPU for days/weeks and runs even if you disable the intrusive and obnoxious holiday events/memories features in Photos.

Re: macOS 11’s hidden security improvements

#45

Post by tgsovlerkhgsel »

bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

IIRC it didn't just have no release notes, it explicitly claimed not to contain security patches.

Although I may be misremembering or may have been misled by an ambiguous message. https://support.apple.com/en-us/HT201222 lists it as being a security update but "This update has no published CVE entries." (emphasis mine) implying some nasty but embargoed security issue.

Re: macOS 11’s hidden security improvements

#46

Post by motoboi »

robbyking wrote: post #25
hdjjhhvvhga wrote: post #21

Earlier quoted context omitted.

On the other hand, Linux is getting better and better. And with the prevalence of web apps, the main obstacle to running non (MS | Apple) systems is getting smaller. With Linux, you can adjust the level of security you need and you keep the key. Security improvements appear also in BSDs, especially OpenBSD, but honestly I wouldn't recommend people used to macOS to switch to OpenBSD (yet).

It's the year of the Linux desktop!

It has been Linux desktop year for at least 15 years now.

The state of Linux Desktop has actually being getting worse, not better.

From a top with Ubuntu in the first 5 years, to the sad state we see now.

Re: macOS 11’s hidden security improvements

#47

Post by taylorfinley »

marricks wrote: post #27
robbyking wrote: post #25

Earlier quoted context omitted.

It's the year of the Linux desktop!

It always is! (in a good and bad way)

That's the joke. It's been the 'Year of The Linux Desktop!' at least since my senior year of high school, which was all the way back in 2002.

Re: macOS 11’s hidden security improvements

#48

Post by GekkePrutser »

cma wrote: post #40
azinman2 wrote: post #13

Earlier quoted context omitted.

You can always disable CSR/SIP generally. macOS is unlike iOS in that many security mitigations can be disabled. The fact that new M1 Macs let you side load a diff non-Apple in iOS should be the ultimate proof you need of this motivation to allow user control on Macs.

Won't the next update still wipe out your system changes, putting you back to insecure openssh password auth, etc., or do they have a system to merge your changes over now?

Exactly. This is the #1 problem I have with the implementation: I want to set up public-key authentication as the only option on openssh ("Remote Login").

Re: macOS 11’s hidden security improvements

#49

Post by easton »

GekkePrutser wrote: post #38
Klonoar wrote: post #34

Earlier quoted context omitted.

There actually is a middle ground, in some cases - csrutil can, for instance, allow you to disable unsigned kext blocking but keep the rest of SIP enabled.

I thought those were entirely separate things? There's now a GUI option for the unsigned kernel extension block (in the startup security utility). I don't think that's part of SIP per se. It's also the one you need to run any other OS. Whereas SIP is a thing within the OS itself as far as I know. But I have to admit this is where my knowledge gets fuzzy :) The kind of control I'd want is allowing to add a signator fo…

If you’re a corporate admin you can whitelist kernel extensions via MDM, maybe that would help?

https://support.apple.com/guide/mdm/kernel-extension-policy-...

Re: macOS 11’s hidden security improvements

#50

Post by busymom0 »

bangonkeyboard wrote: post #10

Very hidden. The 11.5.2 patch from last week had no release notes ( https://eclecticlight.co/2021/08/15/last-week-on-my-mac-trus... ), and Apple replied to inquiries with "No further details on the Big Sur 11.5.2 update will be released" ( https://twitter.com/ClassicII_MrMac/status/14256327792624312... ).

I am an iOS and MacOS developer and have gotten my updates rejected for my release notes not being descriptive enough of what it changes. Yet Apple regularly gives exceptions to the big guys like Facebook, Uber etc apps and now themselves. Apple’s developer guidelines specifically warn developers to not put vague release notes but the rules often get partially applied.
Post reply on HN