3 ms·

I assume you are talking about System Integrity Protection. You can turn this off, so do you consider the fact that Ubuntu doesn't have a root user by default (

I assume you are talking about System Integrity Protection. You can turn this off, so do you consider the fact that Ubuntu doesn't have a root user by default (and requires you to run everything through sudo) an imposition on your freedom as well? Or is it only barriers which require a restart to disable? In addition, no Intel Macs have any means of operating system lock-in. You can run Windows, Linux, or anything else that can handle standard x86 hardware. So you seem to have full control over the hardware at least (except maybe the SMC, which is not easily modifiable on standard PC hardware either). And given the fact that the Darwin kernel is open source[1], you are free to patch out SIP entirely and run that instead. [1]: https://github.com/opensource-apple/xnu https://github.com/opensource-apple/xnu

CamperBob2 11y ago
Or is it only barriers which require a restart to disable? Yes, that's what I meant by "nonstandard." Apple has invented a brand-new access control mechanism to keep people from tinkering with files that reside on their own computers. For now you can work around this feature. Once they close that particular gap, I'm guessing we'll still be able to use a debugger to get the job done... and I'm guessing you'll move the goalpost accordingly.
- TeMPOraL 11y ago
  This is actually a battle that will soon merge with the primary frontline of the War Against General-Purpose Computing[0]. Windows 8 already has some things that you can't do without restarting and going through scary recovery screen with additional layers of security - in particular, installing unsigned device drivers. I predict the gap will close from both software and hardware side as Trusted Computing starts getting popular, finally sealing your fate as a leaser of computing device, not the owner. [0] - It's not really "coming" anymore.
  - CamperBob2 11y ago
    Agreed, it's not really fair of me to single out Apple for criticism. I was just reaching for a recent example of something that can't possibly be justified on any grounds other than the usual "For the children" and "For the OS vendor."
    - TeMPOraL 11y ago
      I didn't read it as singling out Apple, just wanted to share another example that you may not have heard of and that I remember vividly, after losing some time and patience trying to program a TI Stellaris LM4F120 using a Windows 8 laptop.
  - johncolanduoni 11y ago
    > installing unsigned device drivers So, probably one of the most dangerous things you can do (opening the door to rootkits and an infected BIOS) doesn't take just a click and an undistinguished warning dialog? Also, this has been around since at least Windows 7, its not evidence of us sliding down a slope.
    - TeMPOraL 11y ago
      I didn't have to reboot Windows 7 machine and go through recovery interface to find obscure option that needs to be toggled and authorized in order to do so. Yes, rebooting Windows one time to do it isn't that bad, but it's a start. I won't be surprised if the next version of Windows (next after Win10) removed that feature completely. Forcing users to run only signed drivers is a problem because only Trusted Vendors can get proper certification (after paying proper amount of $$ to Trusted Certification Providers). Such restriction will basically kill hardware tinkering, which is one of the goals of the War on General-Purpose Computing.
- userbinator 11y ago
  Once they close that particular gap, I'm guessing we'll still be able to use a debugger to get the job done... Not if the Trusted Computing Group has their way; it's already happening with things like Secure Boot. Hopefully things will change for the better, before we get to outlawing debuggers[1]... [1] http://www.gnu.org/philosophy/right-to-read.en.html http://www.gnu.org/philosophy/right-to-read.en.html
- johncolanduoni 11y ago
  > Yes, that's what I meant by "nonstandard." It's slightly more difficult than turning of UAC on Windows. In addition, they didn't even try to hide the ability to turn it off; it's available in the documentation [1]. The only way they could seal the more difficult workaround I detailed above would be to either: 1. Rewrite their kernel so they don't have to open source it. In this case, I have no doubt the Hackinitosh community will have a patched version within a week. Goalposts moved I guess. Note you can still edit those files by restarting in another OS, which shouldn't be a problem for anyone who knows enough that they should be messing with such things. 2. Modify the hardware so it can only boot signed OS X. At this point, SIP is pretty irrelevant to the issue, and there doesn't seem to be any strategic advantage in even having it. Also, I'm not sure what the motive is here. I can still install and run whatever binaries I want, signed or otherwise. I have El Capitan and I'm even using a custom shell. If Apple planned to require signatures for even command line programs to further their evil anti-Turing plan, SIP would again become irrelevant. So what slippery slope are we sliding down? [1]: https://developer.apple.com/library/watchos/documentation/Security/Conceptual/System_Integrity_Protection_Guide/System_Integrity_Protection_Guide.pdf https://developer.apple.com/library/watchos/documentation/Se...

CamperBob2 11y ago

Or is it only barriers which require a restart to disable? Yes, that's what I meant by "nonstandard." Apple has invented a brand-new access control mechanism to keep people from tinkering with files that reside on their own computers. For now you can work around this feature. Once they close that particular gap, I'm guessing we'll still be able to use a debugger to get the job done... and I'm guessing you'll move the goalpost accordingly.

TeMPOraL 11y ago
This is actually a battle that will soon merge with the primary frontline of the War Against General-Purpose Computing[0]. Windows 8 already has some things that you can't do without restarting and going through scary recovery screen with additional layers of security - in particular, installing unsigned device drivers. I predict the gap will close from both software and hardware side as Trusted Computing starts getting popular, finally sealing your fate as a leaser of computing device, not the owner. [0] - It's not really "coming" anymore.
- CamperBob2 11y ago
  Agreed, it's not really fair of me to single out Apple for criticism. I was just reaching for a recent example of something that can't possibly be justified on any grounds other than the usual "For the children" and "For the OS vendor."
  - TeMPOraL 11y ago
    I didn't read it as singling out Apple, just wanted to share another example that you may not have heard of and that I remember vividly, after losing some time and patience trying to program a TI Stellaris LM4F120 using a Windows 8 laptop.
- johncolanduoni 11y ago
  > installing unsigned device drivers So, probably one of the most dangerous things you can do (opening the door to rootkits and an infected BIOS) doesn't take just a click and an undistinguished warning dialog? Also, this has been around since at least Windows 7, its not evidence of us sliding down a slope.
  - TeMPOraL 11y ago
    I didn't have to reboot Windows 7 machine and go through recovery interface to find obscure option that needs to be toggled and authorized in order to do so. Yes, rebooting Windows one time to do it isn't that bad, but it's a start. I won't be surprised if the next version of Windows (next after Win10) removed that feature completely. Forcing users to run only signed drivers is a problem because only Trusted Vendors can get proper certification (after paying proper amount of $$ to Trusted Certification Providers). Such restriction will basically kill hardware tinkering, which is one of the goals of the War on General-Purpose Computing.
userbinator 11y ago
Once they close that particular gap, I'm guessing we'll still be able to use a debugger to get the job done... Not if the Trusted Computing Group has their way; it's already happening with things like Secure Boot. Hopefully things will change for the better, before we get to outlawing debuggers[1]... [1] http://www.gnu.org/philosophy/right-to-read.en.html http://www.gnu.org/philosophy/right-to-read.en.html
johncolanduoni 11y ago
> Yes, that's what I meant by "nonstandard." It's slightly more difficult than turning of UAC on Windows. In addition, they didn't even try to hide the ability to turn it off; it's available in the documentation [1]. The only way they could seal the more difficult workaround I detailed above would be to either: 1. Rewrite their kernel so they don't have to open source it. In this case, I have no doubt the Hackinitosh community will have a patched version within a week. Goalposts moved I guess. Note you can still edit those files by restarting in another OS, which shouldn't be a problem for anyone who knows enough that they should be messing with such things. 2. Modify the hardware so it can only boot signed OS X. At this point, SIP is pretty irrelevant to the issue, and there doesn't seem to be any strategic advantage in even having it. Also, I'm not sure what the motive is here. I can still install and run whatever binaries I want, signed or otherwise. I have El Capitan and I'm even using a custom shell. If Apple planned to require signatures for even command line programs to further their evil anti-Turing plan, SIP would again become irrelevant. So what slippery slope are we sliding down? [1]: https://developer.apple.com/library/watchos/documentation/Security/Conceptual/System_Integrity_Protection_Guide/System_Integrity_Protection_Guide.pdf https://developer.apple.com/library/watchos/documentation/Se...