6 ms·

M(DM)acOS

82 points by bangonkeyboard 10y ago

brazzledazzle 10y ago
If Apple does this they'll throw away so much good will from the developer community. Kind of makes me wonder if laying off the macOS automation guy is related.
Sophistifunk 10y ago
This would be a lot more sensible if there was an explanation of what MDM stands for.
- lloeki 10y ago
  For the record: Mobile Device Management
  - deleted 10y ago
    [deleted]
- agumonkey 10y ago
  I read the whole thing thinking it was related to device mapper ..
- thegeomaster 10y ago
  My best guess after seeing the title was something related to MDMA...
dantiberian 10y ago
This article makes an acrobatic leap from 1. iOS devices are locked down. 2. Current iOS devices have security features in HFS+ that aren't present in macOS HFS+ (such as?). 3. APFS has more security (encryption?) features that bring macOS in line with iOS. 4. macOS is going to become locked down. This may be true, but I don't see it from the evidence provided. I may be wrong, but I don't think that the file system on iOS is the reason that it is locked down and the file system on macOS is why it is open? Disk encryption has very little to do with cryptographically signing and protecting the OS. Apple has been taking the good bits from iOS and moving them to macOS. Deprecating software update in favour of the App Store and changing how the OS is downloaded seems to be one of these cases. Apple has repeatedly said that they aren't going to merge iOS and macOS. They're two different systems with different contexts. Walling macOS off makes little more sense than opening up iOS completely.
- lloeki 10y ago
  > Disclaimer: This blog post is only a personal, ficticious thought experiment.
  - matt4077 10y ago
    Back in Einstein's days, thought experiments had meaning. This guy uses it as an easy cop-out of a transparent attempt to get attention with a sort of Hacker-News-SM-fanfic exploiting the current narrative on Apple. But it works, so all the best to him.
    - sacrilicious 10y ago
      I'm sure the author appreciates your comparisons to Einstein! It's apt. Oh, and look at the publish date before you decide the 'zeitgeist-headline-grabbing' factor.
- soneil 10y ago
  Personally, I can see them going a slightly different path. Two things caught my attention in apfs - 'space sharing', where two volumes can take the same extents on disk, rather than having non-overlapping bounds (in practice, if not implementation, this so far acts as if its one volume, where members are tagged with which filesystem they belong to) - and linked clones for copies. It doesn't seem inconceivable to me that the 'recovery volume' holds a copy of the OS, and the installed OS is just linked clones to the recovery volume. On the surface this is a lot like how we treat unixy hardlinks, but a) linked clones can diverge from each other on a block-by-block basis, rather than "you're a link or you're not". and b) because two filesystems can take the same physical location on disk, a linked clone _could_ (and this doesn't appear to be possible in the current developer previews) act as a hardlink across volumes. I realise this seems like a lot of effort with little gain, but the 'how' seems to be all in place - and with SSDs setting us back a step to 256GB volumes at the entry tiers, the space-savings wouldn't be unwelcome. .. or this could all be hand-wavy nonsense. But there does seem to be some interesting features in apfs, and I really an curious to see where they go with them - apple rarely do nuts'n'bolts changes this big unless they have a use-case waiting for them (like spotlight & the fs_usage API).
matt4077 10y ago
This is a restatement of a conspiracy theory that was bullshit when it first appeared three or four years ago, and it hasn't improved. The convoluted way he uses to get there should one day make him President. Basically it's "they're unifying file systems across iOS and macOS" -> "they must be unifying something else" -> "They must be getting rid of root". Never mind that they could effectively do that today, without a filesystem switch, with System Integrity Protection. Yes, you can boot into the rescue system and deactivate it but nobody does, and those that do don't make a difference. Because (assuming Apple's goal is revenue), SIP in /Applications would be enough to destroy the market for independently distributed applications. "For some, this will feel like a bleak story. Or even a scary one. In the name of security." Or maybe... In the name of love. Or strangely important(ish) sounding short paragraphs. Encryption in this context is about native support for full-disk encryption. It's completely removed from the iOS mechanisms that stop you from accessing the file system, which is based on signatures.
i336_ 10y ago
> Apple had an entire session on APFS (which you can watch without a Developer ID). https://developer.apple.com/videos/play/wwdc2016/701/ https://developer.apple.com/videos/play/wwdc2016/701/ That page: Streaming is available in Safari, and through the WWDC app. Me: "Right." FFmpeg handles .m3u8 files just fine now, as does VLC and mplayer. Here's the playlist hiding in the HTML of the above page: http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/hls_vod_mvp.m3u8 http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietc... That master playlist further references sub-playlist URLs for each resolution, so you can pick the resolution you want manually if you like. - 1080p: http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/1920/1920.m3u8 http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietc... - 960x540 (the one I grabbed; 718MB): http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/0960/0960.m3u8 http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietc... I downloaded it with ffmpeg -i <URL> -c copy apfs.ts
- draw_down 10y ago
  Congratulations!
_pmf_ 10y ago
I don't think Apple still cares enough about MacBooks to go to such lengths.
zalmoxes 10y ago
A few of us are working on a open source alternative to Mobile Device Management vendors. https://github.com/micromdm https://github.com/micromdm https://micromdm.io/community/ https://micromdm.io/community/ Also, Apple has finally released the protocol, which previously was behind the Enterprise Developer portal. https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html https://developer.apple.com/library/content/documentation/Mi...
- walterbell 10y ago
  Great news about the release of MDM docs. Will this also support iOS, e.g. per-app VPN profiles, VPN certs?
  - zalmoxes 10y ago
    Not all, but most MDM Commands in the spec are already supported. You can see all the supported commands you can issue to devices here https://github.com/micromdm/mdm/blob/master/command.go#L233 https://github.com/micromdm/mdm/blob/master/command.go#L233 There's a lot of work that needs to be done for micromdm to be a usable replacement in the enterprise though. Right now it's still a experiment -- the focus(at least for me) is to try to create a tool which is extensible(API driven) and one that will be acceptable in environments where people today use configuration management everyday.
    - walterbell 10y ago
      Since that list can deliver profiles, could Apple Configurator be used to create the profile, then deliver them with the MDM tool? I recall that registration was needed for Apple's servers to push profiles to managed devices. How would that work with an OSS MDM? Does the MDM need a certificate from Apple?
      - zalmoxes 10y ago
        You need to be an enterprise Dev and get a special APNS cert from apple. (It only costs $300/year, which any company should afford). MDM certs are still a pain, and it's hard to get involved with the project if you don't have one. Luckily, if you install Server.app from the App store and enables Device management, Apple issues you a push cert you can use. You just have to export it from Keychain access as a .p12 file.
iainmerrick 10y ago
What would the impact of this be on the average power user? i.e. not someone managing a fleet of devices, but someone who needs to install and use a bunch of low-level tools to get stuff done. If there comes a time when I can't just "brew install" the stuff I need, the Mac becomes useless (to me) as a development platform. If I were simply forced to install stuff in my home directory, I guess that would be okay. I wonder what the story would be for things that (currently) need root or kernel access, though, like FUSE or VMware. I agree with other comments that this particular article seems a bit speculative and overblown, but the Mac has been increasingly locked down for several years now so it's worth thinking about.
TazeTSchnitzel 10y ago
MDM doesn't interest me, but storing the OS and user data separately? That is interesting. OS X and now macOS already has System Integrity Protection, where a large portion of the filesystem cannot be touched even by root. Maybe they'll eventually move that to its own partition?
pier25 10y ago
Apple has denied merging macOS and iOS, but IMO a universal OS that works on all your devices is inevitable. Mobile devices are now powerful enough that they could connect to a screen and display a desktop environment to perform everyday tasks. I'm almost certain Apple isn't doing this because it would canibalise its products. If the rumoured Andromeda OS by Google is what I'm describing, macOS and Windows will become the trucks of desktop OSs.
marssaxman 10y ago
What is "MDM"? I'm not familiar with such an acronym, and the author of this piece never defines it.

If Apple does this they'll throw away so much good will from the developer community. Kind of makes me wonder if laying off the macOS automation guy is related.

Sophistifunk 10y ago

This would be a lot more sensible if there was an explanation of what MDM stands for.

lloeki 10y ago
For the record: Mobile Device Management
- deleted 10y ago
  [deleted]
agumonkey 10y ago
I read the whole thing thinking it was related to device mapper ..
thegeomaster 10y ago
My best guess after seeing the title was something related to MDMA...

dantiberian 10y ago

This article makes an acrobatic leap from 1. iOS devices are locked down. 2. Current iOS devices have security features in HFS+ that aren't present in macOS HFS+ (such as?). 3. APFS has more security (encryption?) features that bring macOS in line with iOS. 4. macOS is going to become locked down. This may be true, but I don't see it from the evidence provided. I may be wrong, but I don't think that the file system on iOS is the reason that it is locked down and the file system on macOS is why it is open? Disk encryption has very little to do with cryptographically signing and protecting the OS. Apple has been taking the good bits from iOS and moving them to macOS. Deprecating software update in favour of the App Store and changing how the OS is downloaded seems to be one of these cases. Apple has repeatedly said that they aren't going to merge iOS and macOS. They're two different systems with different contexts. Walling macOS off makes little more sense than opening up iOS completely.

lloeki 10y ago
> Disclaimer: This blog post is only a personal, ficticious thought experiment.
- matt4077 10y ago
  Back in Einstein's days, thought experiments had meaning. This guy uses it as an easy cop-out of a transparent attempt to get attention with a sort of Hacker-News-SM-fanfic exploiting the current narrative on Apple. But it works, so all the best to him.
  - sacrilicious 10y ago
    I'm sure the author appreciates your comparisons to Einstein! It's apt. Oh, and look at the publish date before you decide the 'zeitgeist-headline-grabbing' factor.
soneil 10y ago
Personally, I can see them going a slightly different path. Two things caught my attention in apfs - 'space sharing', where two volumes can take the same extents on disk, rather than having non-overlapping bounds (in practice, if not implementation, this so far acts as if its one volume, where members are tagged with which filesystem they belong to) - and linked clones for copies. It doesn't seem inconceivable to me that the 'recovery volume' holds a copy of the OS, and the installed OS is just linked clones to the recovery volume. On the surface this is a lot like how we treat unixy hardlinks, but a) linked clones can diverge from each other on a block-by-block basis, rather than "you're a link or you're not". and b) because two filesystems can take the same physical location on disk, a linked clone _could_ (and this doesn't appear to be possible in the current developer previews) act as a hardlink across volumes. I realise this seems like a lot of effort with little gain, but the 'how' seems to be all in place - and with SSDs setting us back a step to 256GB volumes at the entry tiers, the space-savings wouldn't be unwelcome. .. or this could all be hand-wavy nonsense. But there does seem to be some interesting features in apfs, and I really an curious to see where they go with them - apple rarely do nuts'n'bolts changes this big unless they have a use-case waiting for them (like spotlight & the fs_usage API).

matt4077 10y ago

This is a restatement of a conspiracy theory that was bullshit when it first appeared three or four years ago, and it hasn't improved. The convoluted way he uses to get there should one day make him President. Basically it's "they're unifying file systems across iOS and macOS" -> "they must be unifying something else" -> "They must be getting rid of root". Never mind that they could effectively do that today, without a filesystem switch, with System Integrity Protection. Yes, you can boot into the rescue system and deactivate it but nobody does, and those that do don't make a difference. Because (assuming Apple's goal is revenue), SIP in /Applications would be enough to destroy the market for independently distributed applications. "For some, this will feel like a bleak story. Or even a scary one. In the name of security." Or maybe... In the name of love. Or strangely important(ish) sounding short paragraphs. Encryption in this context is about native support for full-disk encryption. It's completely removed from the iOS mechanisms that stop you from accessing the file system, which is based on signatures.

i336_ 10y ago

> Apple had an entire session on APFS (which you can watch without a Developer ID). https://developer.apple.com/videos/play/wwdc2016/701/ https://developer.apple.com/videos/play/wwdc2016/701/ That page: Streaming is available in Safari, and through the WWDC app. Me: "Right." FFmpeg handles .m3u8 files just fine now, as does VLC and mplayer. Here's the playlist hiding in the HTML of the above page: http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/hls_vod_mvp.m3u8 http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietc... That master playlist further references sub-playlist URLs for each resolution, so you can pick the resolution you want manually if you like. - 1080p: http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/1920/1920.m3u8 http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietc... - 960x540 (the one I grabbed; 718MB): http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/0960/0960.m3u8 http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietc... I downloaded it with ffmpeg -i <URL> -c copy apfs.ts

draw_down 10y ago
Congratulations!

_pmf_ 10y ago

I don't think Apple still cares enough about MacBooks to go to such lengths.

zalmoxes 10y ago

A few of us are working on a open source alternative to Mobile Device Management vendors. https://github.com/micromdm https://github.com/micromdm https://micromdm.io/community/ https://micromdm.io/community/ Also, Apple has finally released the protocol, which previously was behind the Enterprise Developer portal. https://developer.apple.com/library/content/documentation/Miscellaneous/Reference/MobileDeviceManagementProtocolRef/3-MDM_Protocol/MDM_Protocol.html https://developer.apple.com/library/content/documentation/Mi...

walterbell 10y ago
Great news about the release of MDM docs. Will this also support iOS, e.g. per-app VPN profiles, VPN certs?
- zalmoxes 10y ago
  Not all, but most MDM Commands in the spec are already supported. You can see all the supported commands you can issue to devices here https://github.com/micromdm/mdm/blob/master/command.go#L233 https://github.com/micromdm/mdm/blob/master/command.go#L233 There's a lot of work that needs to be done for micromdm to be a usable replacement in the enterprise though. Right now it's still a experiment -- the focus(at least for me) is to try to create a tool which is extensible(API driven) and one that will be acceptable in environments where people today use configuration management everyday.
  - walterbell 10y ago
    Since that list can deliver profiles, could Apple Configurator be used to create the profile, then deliver them with the MDM tool? I recall that registration was needed for Apple's servers to push profiles to managed devices. How would that work with an OSS MDM? Does the MDM need a certificate from Apple?
    - zalmoxes 10y ago
      You need to be an enterprise Dev and get a special APNS cert from apple. (It only costs $300/year, which any company should afford). MDM certs are still a pain, and it's hard to get involved with the project if you don't have one. Luckily, if you install Server.app from the App store and enables Device management, Apple issues you a push cert you can use. You just have to export it from Keychain access as a .p12 file.

iainmerrick 10y ago

What would the impact of this be on the average power user? i.e. not someone managing a fleet of devices, but someone who needs to install and use a bunch of low-level tools to get stuff done. If there comes a time when I can't just "brew install" the stuff I need, the Mac becomes useless (to me) as a development platform. If I were simply forced to install stuff in my home directory, I guess that would be okay. I wonder what the story would be for things that (currently) need root or kernel access, though, like FUSE or VMware. I agree with other comments that this particular article seems a bit speculative and overblown, but the Mac has been increasingly locked down for several years now so it's worth thinking about.

TazeTSchnitzel 10y ago

MDM doesn't interest me, but storing the OS and user data separately? That is interesting. OS X and now macOS already has System Integrity Protection, where a large portion of the filesystem cannot be touched even by root. Maybe they'll eventually move that to its own partition?

pier25 10y ago

Apple has denied merging macOS and iOS, but IMO a universal OS that works on all your devices is inevitable. Mobile devices are now powerful enough that they could connect to a screen and display a desktop environment to perform everyday tasks. I'm almost certain Apple isn't doing this because it would canibalise its products. If the rumoured Andromeda OS by Google is what I'm describing, macOS and Windows will become the trucks of desktop OSs.

marssaxman 10y ago

What is "MDM"? I'm not familiar with such an acronym, and the author of this piece never defines it.