5 ms·

I really hope that this is the final nail in the coffin for third party Anti Virus vendors. It's been really worrying to see large enterprises that have moved

I really hope that this is the final nail in the coffin for third party Anti Virus vendors. It's been really worrying to see large enterprises that have moved from Windows to macOS and carry their thinking that the need to install a third party AV product (which in turn often acts as a near-unrestricted way into the kernel).

r00fus 7y ago
Does this also doom the corporate spyware that's in almost every large enterprise Mac deployment, or does that install without KE?
- jedieaston 7y ago
  Define "spyware". JAMF uses the MDM APIs that Apple provides. It also can't access personal data via those APIs. Your anti-virus may use kernel extensions, in which case it will stop working.
  - floatingatoll 7y ago
    JAMF additionally permits the provisioning server to run arbitrary scripts on the endpoints, using an installed daemon that implements functionality beyond what MDM offers.
- yoz-y 7y ago
  What would be the ideal solution to manage fleets of computers though? Afaik Apple does not have a full featured first party solution, or do they?
0az 7y ago
I can't wait until I can uninstall University-mandated AV. I'm still waiting for Jumpshot to respond to my CCPA inquiry.
- jedieaston 7y ago
  You don't have to worry about that anymore... https://www.jumpshot.com/ https://www.jumpshot.com/
  - yjftsjthsd-h 7y ago
    That is ironically one of the nicest, cleanest, most to-the-point pages I've ever seen on the web. ...I'm not sure what to do with this.
- kyleee 7y ago
  What was jumpshot?
highlandinfo 7y ago
Not sure how you'll feel about the EndpointSecurity user-space framework, specifically designed to provide replacement functionality for anti-malware vendors (https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity)...
- floatingatoll 7y ago
  That sounds a lot less fragile than patching the kernel directly.
  - anaisbetts 7y ago
    Sending every I/O operation through userspace and back again is going to be _glacially_ slow, good luck macOS
    - duskwuff 7y ago
      A lot of existing antivirus software was already doing that -- and yes, it was glacially slow. But at least doing this through a first-party interface means it probably won't block the rest of the system quite as badly.
self_awareness 7y ago
So what's the alternative for third party AV vendors? Do you have any suggestion for my parents?
- yjftsjthsd-h 7y ago
  > So what's the alternative for third party AV vendors Probably, "die." I'm not sure we'll miss them; that whole market is sketchy, and more obsolete every year as the OS gets more secure on its own.
  - self_awareness 7y ago
    How does that answer my question? I would like to know what is the alternative today, not 10 years from now.
    - yjftsjthsd-h 7y ago
      In seriousness: Why do you need a third party AV today?
      - self_awareness 7y ago
        Several reasons. 1. My parents lost money in the Internet. They treat scam messages ("you've been hacked, we have discriminating stuff against you, give us bitcoins and we don't tell anyone") seriously. They wanted to buy some wonder drug that didn't even exist. Now they contact me in every case that involves money on the Internet, and since several years there were a few other cases where I had to say "don't do it, this is a scam". So I'm effectively performing the role of a human thirdparty AV. 2. My girlfriend has been hit with a clickjacking compaign. She was crushed; I want to lessen the chance of this happening ever again. I've also educated her about it and how it works, so she will probably not do it anymore, but in the scale of whole humanity, the "let's teach them how to defend" is not a good strategy for trying to eliminate some harmful event, there will always be people that will resist learning. 3. I want to help with limiting spreading malware. If I'm using AV, this means that I influence the environment I live in so that everyone sees lower malware spread. This means people like you can wonder what is the point in AV tools, since you probably don't know even 1 person that had been hit with malware attack. Similar to vaccines I guess.

r00fus 7y ago

Does this also doom the corporate spyware that's in almost every large enterprise Mac deployment, or does that install without KE?

jedieaston 7y ago
Define "spyware". JAMF uses the MDM APIs that Apple provides. It also can't access personal data via those APIs. Your anti-virus may use kernel extensions, in which case it will stop working.
- floatingatoll 7y ago
  JAMF additionally permits the provisioning server to run arbitrary scripts on the endpoints, using an installed daemon that implements functionality beyond what MDM offers.
yoz-y 7y ago
What would be the ideal solution to manage fleets of computers though? Afaik Apple does not have a full featured first party solution, or do they?

0az 7y ago

I can't wait until I can uninstall University-mandated AV. I'm still waiting for Jumpshot to respond to my CCPA inquiry.

jedieaston 7y ago
You don't have to worry about that anymore... https://www.jumpshot.com/ https://www.jumpshot.com/
- yjftsjthsd-h 7y ago
  That is ironically one of the nicest, cleanest, most to-the-point pages I've ever seen on the web. ...I'm not sure what to do with this.
kyleee 7y ago
What was jumpshot?

highlandinfo 7y ago

Not sure how you'll feel about the EndpointSecurity user-space framework, specifically designed to provide replacement functionality for anti-malware vendors (https://developer.apple.com/documentation/endpointsecurity https://developer.apple.com/documentation/endpointsecurity)...

floatingatoll 7y ago
That sounds a lot less fragile than patching the kernel directly.
- anaisbetts 7y ago
  Sending every I/O operation through userspace and back again is going to be _glacially_ slow, good luck macOS
  - duskwuff 7y ago
    A lot of existing antivirus software was already doing that -- and yes, it was glacially slow. But at least doing this through a first-party interface means it probably won't block the rest of the system quite as badly.

self_awareness 7y ago

So what's the alternative for third party AV vendors? Do you have any suggestion for my parents?

yjftsjthsd-h 7y ago
> So what's the alternative for third party AV vendors Probably, "die." I'm not sure we'll miss them; that whole market is sketchy, and more obsolete every year as the OS gets more secure on its own.
- self_awareness 7y ago
  How does that answer my question? I would like to know what is the alternative today, not 10 years from now.
  - yjftsjthsd-h 7y ago
    In seriousness: Why do you need a third party AV today?
    - self_awareness 7y ago
      Several reasons. 1. My parents lost money in the Internet. They treat scam messages ("you've been hacked, we have discriminating stuff against you, give us bitcoins and we don't tell anyone") seriously. They wanted to buy some wonder drug that didn't even exist. Now they contact me in every case that involves money on the Internet, and since several years there were a few other cases where I had to say "don't do it, this is a scam". So I'm effectively performing the role of a human thirdparty AV. 2. My girlfriend has been hit with a clickjacking compaign. She was crushed; I want to lessen the chance of this happening ever again. I've also educated her about it and how it works, so she will probably not do it anymore, but in the scale of whole humanity, the "let's teach them how to defend" is not a good strategy for trying to eliminate some harmful event, there will always be people that will resist learning. 3. I want to help with limiting spreading malware. If I'm using AV, this means that I influence the environment I live in so that everyone sees lower malware spread. This means people like you can wonder what is the point in AV tools, since you probably don't know even 1 person that had been hit with malware attack. Similar to vaccines I guess.