4 ms·
Nitpick: > Now this may come as a shock to some of you, but Apple really doesn’t seem to like it when third party developers change just about anything about t
by pilif 7y ago
Nitpick:
> Now this may come as a shock to some of you, but Apple really doesn’t seem to like it when third party developers change just about anything about their UX
> Deploying a kext requires it be signed using a special Kernel Extension Signing Certificate, which can only be acquired from Apple
this restriction has nothing to do with them not liking people doing stuff about their UX and everything to do about the fact that kernel extensions bypass all security boundaries between users and processes.
Kernel extensions are bloody dangerous and I'm happy with Apple putting additional scrutiny on them.
- adrianN 7y agoForbidding users from doing dangerous stuff with the machines they own is not good imho.
- tinus_hn 7y agoBut is it allowed for users to choose a machine that forbids this?
- diffeomorphism 7y agoThis clothing is made with slave labor. "But is it allowed for customers to choose to buy this?". "allowed" is irrelevant here.
- adrianN 7y agoThat's a difficult question because it might limit supply of open machines for users who want the freedom to hack their own stuff. I think it's okay to offer computers that are basically Facebook appliances, but there should always be a toggle somewhere that allows people who know what they're doing to do whatever they please.
- dkdkdjdj 7y agoWhat do you think of the counterargument that, as soon as you put a switch like that in, people will get manipulated into flipping it?
- adrianN 7y agoI think the risk of that can be made sufficiently low so that it won't be a serious problem in practice.
- pilif 7y agoMacs do have such a toggle. You can boot from the recovery partition, launch the terminal and issue the `csrutil disable` command. This will turn off all the security features that have been added over the years, including the “Catalina Vista” prompts people were complaining about in September. The reason this requires booting from the recovery partition is to make it impossible for malware to flip the switch and to make it convoluted enough that even the most gullible of users will question their actions when pushed to do these steps by malware. (Apple has stated publicly and in very clear language that they fully intend for the Mac to continue to be able to run unsigned code, so I believe this toggle isn’t temporary)
- saagarjha 7y ago> This will turn off all the security features that have been added over the years, including the “Catalina Vista” prompts people were complaining about in September. I installed it back in June, so my memory might be a bit hazy, but as far as I’m aware SIP doesn’t control TCC.
- pilif 7y agoYou can disable all of those checks by booting from the recovery partition, opening the Terminal and use `csrutil disable`. Then you can do with your machine whatever you want.
- djsumdog 7y agoYep. Same with Windows; you get a big red screen and warning message when checks are disabled. You have to be able to do this in order to develop custom drivers and kernel extensions. One the one hand, it makes it difficult for regular users to install malicious root-kits, but it also limits all wide scale adoption of FOSS tech like this at the pure whims and discretion of Apple.