4 ms·

I'm glad I didn't upgrade. Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC et

I'm glad I didn't upgrade. Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC etc.

otterley 9y ago
It took Linux/BSD years to get it right, too. It often takes a long time for the user-facing interface to catch up to the kernel functionality.
- ShabbosGoy 9y ago
  > It often takes a long time for the user-facing interface to catch up to the kernel functionality. A long time to catch up for a company that revolutionized UX?
  - otterley 9y ago
    Revolutions in user interfaces rarely occur overnight. The current Mac is the culmination of over 25 years of continuous development, and it's still imperfect.
acdha 9y ago
> Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC etc. Same reason why you still so commonly find Linux and BSD systems where those are disabled: the improved security model breaks assumptions people have about what their code can do and it takes time to redesign code and retrain people.
- ShabbosGoy 9y ago
  What does "improved security model" mean to you? One where the user cannot access ring0? My thoughts are: It's my fucking machine, I bought it with my hard earned money, so I should be allowed to do with it whatever I please.
  - acdha 9y ago
    Improved security model means not having it be incredibly brittle where the first time there's a zero day or the user gives the wrong response to a prompt they lose all of their data and need to completely wipe their system or buy a new one to recover (note that without full, bug-free firmware signing it's impossible to trust the system after a compromise). Yes, you may think that you're going to make that call correctly 100% of the time day in and day out but even if that does happen to be true, it's not true for most people. Since Apple's the vendor and they consider trust/privacy a selling point, they're making decisions which are good for the other 99.999% of people using computers.

I'm glad I didn't upgrade. Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC etc.

otterley 9y ago

It took Linux/BSD years to get it right, too. It often takes a long time for the user-facing interface to catch up to the kernel functionality.

ShabbosGoy 9y ago
> It often takes a long time for the user-facing interface to catch up to the kernel functionality. A long time to catch up for a company that revolutionized UX?
- otterley 9y ago
  Revolutions in user interfaces rarely occur overnight. The current Mac is the culmination of over 25 years of continuous development, and it's still imperfect.

acdha 9y ago

> Why is it so hard for Apple to get System Integrity Protection right? Linux/BSD were hardened years ago with SELinux/AppArmor/MAC etc. Same reason why you still so commonly find Linux and BSD systems where those are disabled: the improved security model breaks assumptions people have about what their code can do and it takes time to redesign code and retrain people.

ShabbosGoy 9y ago
What does "improved security model" mean to you? One where the user cannot access ring0? My thoughts are: It's my fucking machine, I bought it with my hard earned money, so I should be allowed to do with it whatever I please.
- acdha 9y ago
  Improved security model means not having it be incredibly brittle where the first time there's a zero day or the user gives the wrong response to a prompt they lose all of their data and need to completely wipe their system or buy a new one to recover (note that without full, bug-free firmware signing it's impossible to trust the system after a compromise). Yes, you may think that you're going to make that call correctly 100% of the time day in and day out but even if that does happen to be true, it's not true for most people. Since Apple's the vendor and they consider trust/privacy a selling point, they're making decisions which are good for the other 99.999% of people using computers.