4 ms·

This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Assumptions you're making: * T

by pdkl95 11y ago

This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Assumptions you're making: * That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. (see previous [5]) * That SIP will continue, forever into the future, to protect only those hidden directories. * That Apple always knows what is better for the user, and won't exploit that power. > turned off Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. As an analogy, you might say that I'm warning you that someone seems to be placing some gas cans around your property, and you might want to stop them before they decide to light a match. Meanwhile, you (and quite a few other people) are saying it's no big deal because you can just step over those gas cans - they aren't blocking the walkway much. Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. > Also what war on general computing? I'm somewhat shocked. All I can say is you have quite a bit of catching up to do. For the answer to that question, see my previous [1] and [2]. For [1], I linked to Doctorow's essay, but he links to his original lecture at 28C3 if you prefer. That lecture introduces the War, while [2] continues with a discussion of why we need to solve this problem now, as the ramifications extend much further than Apple and the ability to gain root. Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple.

AlphaSite 11y ago
They don't assert ownership, they set a default setting to prohibit a potential security hole. This is the same principal as a master key, if there is a hole you can exploit, there exists a hole which someone else may exploit.
2trill2spill 11y ago
> This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Dtrace is one of the features that is limited by SIP so yes this has something to do with dtrace. > That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. Yes apple could get rid of the ability to turn off SIP, I don't believe they will. Doing so would anger developers and technical users, these people have a huge amount of say on what technology get used in their organization. > That SIP will continue, forever into the future, to protect only those hidden directories. I don't assume that it will only protect those hidden directories, because it protects other system resources as well. I also hope apple keeps adding to the list of protected resources, to continue securing Mac OSX and IOS. > Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. This is not a power grab, this is a company securing their products for their users. Even if this somehow is a power grab by apple, so what. No one is forced to buy apple's products, and if apple wants to do things that make there products less desirable, again so what, people might start switching to a competitor. It's not like apple is the government, nor is it a monopoly. > Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. Apple has not taken root access from me, I can still do whatever I want on my Mac Pro. > Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple. Again I still have root on my laptop, yes I had to boot into recovery mode first, but afterwards I can sudo away. To me it seems like you haven't heard of Mandatory Access Controls, Operating systems have had the ability to reduce the privileges of root for a long time. Thats all SIP is a application of Mandatory Access Controls, SIP is built on top of the TrustedBSD MAC framework that FreeBSD, IOS, and MAC OSX all share. The MAC framework has been in IOS and Mac for a decade and apple have been slowly using it to hardened there operating systems and SIP is just a progression of this. You would think you would be happy that apple is trying to improve the security of their products.
coldtea 11y ago
>That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. (see previous [5]) That SIP will continue, forever into the future, to protect only those hidden directories. * That Apple always knows what is better for the user, and won't exploit that power.* All the assumptions he's making are about what ACTUALLY happens, today. All your assumptions are about uncertain future events and "what ifs". Who do you think makes make sense?
- pdkl95 11y ago
  So you're saying we should inductively reason that Apple will never change their behavior even though they already restrict the iphone? This is a large claim. Do you want a warning about the possible arsonist who seems to be stacking gas cans near your house? Do you want to insist that he isn't a problem because he hasn't burned your house down yet? Both of those are claims about the future. I'm basing mine of Apple's history with the iphone and the direction their actions have taken over the last decade. The claim you describe as being "about what ACTUALLY happens today" is really a claim about Apple's behavior into the future. I see no contract guaranteeing they won't change SIP. What I do see is a lot of people seeing what they want to see.
  - coldtea 11y ago
    >So you're saying we should inductively reason that Apple will never change their behavior even though they already restrict the iphone? This is a large claim. No, I'm saying that what IS has more substance than the myriads of things that we're worried that CAN BE. And, for this specific question mentioning the iPhone, I'm also saying that restricted, special purpose devices, which were ALWAYS sold as such (like mobile phones ever since the early nineties) are not the same as PCs which have other uses cases and history. >Do you want a warning about the possible arsonist who seems to be stacking gas cans near your house? Not when the only reason to think of them as "arsonist" is for stacking gas cans, when that also has another very logical explanation (e.g. he's building a gas station). In the case of Apple, they're improving the security of OS releases, the same way Microsoft and other do. Sandboxes, secure modes, signed apps, are all standard things security researchers have been advising for years. In all those years since they introduced signed and sandboxes apps, they never removed the ability to run non sandboxed and/or non-signed apps. So I also doubt they'll remove the ability to turn off SIP, as it's still needed for various use cases. But even if they do change the SIP, no big deal for 99% of their customers. The rest can always use another platform, unless they value the (then) convenience, virus-tolerance etc of OS X more than they value the "do everything with them" openness of other platforms. Just because some people started with a 'assemble yourself' kit PC in the 80s, it doesn't mean that the essence of having a PC is all about custom rigging it. And even more so, that was never the allure of Apple PCs (neither implicit or advertised). It was "it just works".

by pdkl95 11y ago

AlphaSite 11y ago

They don't assert ownership, they set a default setting to prohibit a potential security hole. This is the same principal as a master key, if there is a hole you can exploit, there exists a hole which someone else may exploit.

2trill2spill 11y ago

> This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Dtrace is one of the features that is limited by SIP so yes this has something to do with dtrace. > That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. Yes apple could get rid of the ability to turn off SIP, I don't believe they will. Doing so would anger developers and technical users, these people have a huge amount of say on what technology get used in their organization. > That SIP will continue, forever into the future, to protect only those hidden directories. I don't assume that it will only protect those hidden directories, because it protects other system resources as well. I also hope apple keeps adding to the list of protected resources, to continue securing Mac OSX and IOS. > Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. This is not a power grab, this is a company securing their products for their users. Even if this somehow is a power grab by apple, so what. No one is forced to buy apple's products, and if apple wants to do things that make there products less desirable, again so what, people might start switching to a competitor. It's not like apple is the government, nor is it a monopoly. > Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. Apple has not taken root access from me, I can still do whatever I want on my Mac Pro. > Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple. Again I still have root on my laptop, yes I had to boot into recovery mode first, but afterwards I can sudo away. To me it seems like you haven't heard of Mandatory Access Controls, Operating systems have had the ability to reduce the privileges of root for a long time. Thats all SIP is a application of Mandatory Access Controls, SIP is built on top of the TrustedBSD MAC framework that FreeBSD, IOS, and MAC OSX all share. The MAC framework has been in IOS and Mac for a decade and apple have been slowly using it to hardened there operating systems and SIP is just a progression of this. You would think you would be happy that apple is trying to improve the security of their products.

coldtea 11y ago

>That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. (see previous [5]) That SIP will continue, forever into the future, to protect only those hidden directories. * That Apple always knows what is better for the user, and won't exploit that power.* All the assumptions he's making are about what ACTUALLY happens, today. All your assumptions are about uncertain future events and "what ifs". Who do you think makes make sense?

pdkl95 11y ago
So you're saying we should inductively reason that Apple will never change their behavior even though they already restrict the iphone? This is a large claim. Do you want a warning about the possible arsonist who seems to be stacking gas cans near your house? Do you want to insist that he isn't a problem because he hasn't burned your house down yet? Both of those are claims about the future. I'm basing mine of Apple's history with the iphone and the direction their actions have taken over the last decade. The claim you describe as being "about what ACTUALLY happens today" is really a claim about Apple's behavior into the future. I see no contract guaranteeing they won't change SIP. What I do see is a lot of people seeing what they want to see.
- coldtea 11y ago
  >So you're saying we should inductively reason that Apple will never change their behavior even though they already restrict the iphone? This is a large claim. No, I'm saying that what IS has more substance than the myriads of things that we're worried that CAN BE. And, for this specific question mentioning the iPhone, I'm also saying that restricted, special purpose devices, which were ALWAYS sold as such (like mobile phones ever since the early nineties) are not the same as PCs which have other uses cases and history. >Do you want a warning about the possible arsonist who seems to be stacking gas cans near your house? Not when the only reason to think of them as "arsonist" is for stacking gas cans, when that also has another very logical explanation (e.g. he's building a gas station). In the case of Apple, they're improving the security of OS releases, the same way Microsoft and other do. Sandboxes, secure modes, signed apps, are all standard things security researchers have been advising for years. In all those years since they introduced signed and sandboxes apps, they never removed the ability to run non sandboxed and/or non-signed apps. So I also doubt they'll remove the ability to turn off SIP, as it's still needed for various use cases. But even if they do change the SIP, no big deal for 99% of their customers. The rest can always use another platform, unless they value the (then) convenience, virus-tolerance etc of OS X more than they value the "do everything with them" openness of other platforms. Just because some people started with a 'assemble yourself' kit PC in the 80s, it doesn't mean that the essence of having a PC is all about custom rigging it. And even more so, that was never the allure of Apple PCs (neither implicit or advertised). It was "it just works".