10 ms·

"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!" ...and now Apple has altered the deal and we m

"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!" ...and now Apple has altered the deal and we must pray they do not alter it further. Disgusting. Predictable, expected, unsurprising -- but still disgusting.

Skunkleton 6y ago
You understand that Apple could bypass kexts too? This is an issue of trust, not a technical issue.
- CountSessine 6y ago
  Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes. Pushing these guys out of the kernel lets Apple cheat them and Mac users clean and easy.
  - gruez 6y ago
    >Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes why would that be the case? All you'd need to do is provide some sort of private network api, and only allow apple signed code to use it.
    - throwaway2048 6y ago
      that is not how kexts work(ed), they can do completely arbitrary things to the kernel, including removing any theoretical code signing requirement.
      - gruez 6y ago
        any access? On Windows, you can write a driver that would run in kernel mode, but critical sections can't be modified[1]. I'd imagine there's something similar for mac. [1] https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection
        SCHiM 6y ago
        KPP is not considered a security boundary. That means, in Windows security jargon, that it's a feature that helps security. But not something that you or anyone else should consider a fail proof solution, or even something that would result in a patch if breached.
        gruez 6y ago
        If patching the kernel to intercept network requests is sufficiently hard enough that you're forced to use their "approved" way of intercepting network requests, then it's very easy for them to sneak requests through. Even if patching the kernel wasn't an issue, it still turns into a game of whack a mole because apple can sneak as many changes as they want with each macos release. It heavily favors apple, not the developers of such firewalls.
        CountSessine 6y ago
        Even if patching the kernel wasn't an issue, it still turns into a game of whack a mole Exactly - but the game itself is the problem. Firewall vendors will go hunting through kernel code for jump targets and structs to plug into hidden interfaces, and Apple will remove and change them, causing crashes and instability. Apple has some leverage if they have a program like WHQL, but even then driver writers will commit shenanigans. Push them out of the kernel altogether and now only Apple can engage in shenanigans and break user trust. Which they already have.
        comex 6y ago
        There hasn’t been anything like that on macOS. macOS on Apple Silicon will have a form of kernel patch protection, like on iOS, but it’s designed to guard against exploits from userland, not approved kexts. It’s definitely possible for third party kexts to bypass that somehow, but possibly only by disabling Secure Boot; I haven’t looked into it.
- Wowfunhappy 6y ago
  It's worth noting the Apple does release the source code to XNU (albeit on a ~6 month delay), and unlike some of their other source releases, there's actually enough tooling for you to build your own kernel. So while there are still gaps, it is overall more open to review.
nix23 6y ago
Dont pray, just dont buy Apple Products
- Skunkleton 6y ago
  It's a frustrating road we are headed down. Tech companies have gotten so big that they don't really have to work together using standardization anymore. Options are limited, and most are anti-consumer in one way or another.
  - nix23 6y ago
    >Options are limited No not really, but limited is the mindset of peoples.
    - gabereiser 6y ago
      >No not really, but limited is the mindset of peoples. I'd argue options really are limited. Your counter argument assumes one can just roll their own OS with the same features and functionality as current-gen OS's. That's quite a leap. Options today are Windows, Mac, or some flavor of Linux if you can get it to work. Linux aside, Windows and Mac both are making it so you no longer own the OS but are "subscribed" to it. Making it easy for them to implement anti-consumer strategies to lock you in.
      - fsflover 6y ago
        > or some flavor of Linux if you can get it to work Do not try to get anything work. Just buy preinstalled.
        a1369209993 6y ago
        Buy preinstalled from where, exactly? (And no, chromebooks are not linux for any practical purpose, although they probably would be easier to install a real linux system on.)
caiob 6y ago
Apple have never made such claim. In fact, if you read their ToS, it discloses all the information you're classifying as "disgusting".
josteink 6y ago
> and now Apple has altered the deal and we must pray they do not alter it further And the slippery slope of MacOS lockdown slips just a little further.
gabereiser 6y ago
Tim Cook's Apple Inc is really a nightmare. Sure we have sleek shiny laptops and devices that are amazingly powerful but at what cost? I still haven't found a trackpad as good as MagicTrackpad sadly otherwise I'd ditch the MacBook Pro. To be fair to Apple though, it's their OS, they can do what they want and we agree every time we update MacOS or iOS. It's crazy to me that we basically only have 3 phone device choices, 2.15 environment choices (OS wise... Linux Desktop is crap, but getting better), and only 2 choices in GPU's, CPU's, etc... What can we do about this?
- ProAm 6y ago
  Would you use a good trackpad that connects via USB or bluetooth? Its a real question because I see a lot of comments about people not leaving the Macbook because of the trackpad even though they dislike the rest of the laptop? Seems like something that could be a product?
  - kccqzy 6y ago
    No you wouldn't. It's not about the trackpad hardware (Apple sells a separate Bluetooth trackpad after all), but it's about the software.
    - ProAm 6y ago
      What about the software makes it good? Ive never used a macbook so have zero experience with it.
      - daniel-thompson 6y ago
        For me, two things combine to make it feel super responsive: 1. The latency between you moving your finger(s) and seeing movement on the screen feels imperceptible. 2. There isn't any "lost" movement - if you scribble your finger around really quickly and come back to where you start, the cursor or window scroll position will be back to where it started too.
      - fsflover 6y ago
hilbert42 6y ago
Don't bother to look to Microsoft Windows for a solution! For don't forget MS Windows has a 'dial-home-to-Microsoft' link that's hard coded within Windows itself. It bypasses the hosts file altogether, and if I recall correctly, it's been in Windows since XP. The only solution stop the 'talk-home' connection would be to find the destination IPs numbers and then key them into your external router for blocking.
- WarOnPrivacy 6y ago
  Windows doesn't bypass 3rd party firewalls.
  - hilbert42 6y ago
    'Windows doesn't bypass 3rd party firewalls.' Sorry WarOnPrivacy, Windows does bypass 3rd-party firewalls and has done so since at least XP onwards (however, I am uncertain if this was the case with Windows 2000). Microsoft has programmed into Windows dozens of addresses that 'dial home' to Microsoft's servers. As you will be aware, many of these addresses change with the various versions of Windows. Normal program switches can block some of these addresses whilst others are hidden from normal view, but with a little judicious snooping, we can find most of hidden ones and successfully block them with the hosts file. However, we cannot block all of them, and this has been the case since Windows XP. From my understanding, which I learned from various security experts around 15 or more years ago at the time when the Microsoft 'exploit' was first discovered, Microsoft hard-coded certain dial-home links for the specific purpose of determining which and how many copies of Windows were pirated. (This seemed to have been the consequence of the widespread pirating of certain corporate copies of Windows 2000.) Whilst the user many have thought he'd secured every talk-home to Microsoft loophole and was safe, nevertheless MS still knew that his O/S was a pirate version. Unlike other activation links that announced an 'illegal copy' status to the user, these links only advised Microsoft of the fact—if you like, there're part of Microsoft's secret surveillance system. Essentially, Microsoft has deliberately sabotaged the DNS client's hosts table lookup functionality by bypassing it with hard coding. It seems that in recent years, Microsoft has developed this secret system to an even finer art, as these days it gathers much more information other than whether the O/S has been pirated or not. With having the handle WarOnPrivacy, I gather you're more than just interested in securing your Windows in the usual ways. If I were you, I'd do what I'm doing here and that's to research the details further and then publicize the fact. As will now be obvious, this is not something that Microsoft wants broadcast to the world. Below are a few links about the matter with a few comments from some of the sites: https://slashdot.org/story/06/04/16/1351217/Microsoft-Bypasses-HOSTS-File https://slashdot.org/story/06/04/16/1351217/Microsoft-Bypass... https://bugtraq.securityfocus.narkive.com/a2fZWlAb/microsoft-dns-resolver-deliberately-sabotaged-hosts-file-lookup https://bugtraq.securityfocus.narkive.com/a2fZWlAb/microsoft... " Hey, guess what I just found out: Microsoft have deliberately sabotaged their DNS client's hosts table lookup functionality. Normally you can override DNS lookup by specifying a hostname and IP directly in the hosts file, which is searched before any query is issued to your dns server; this technique is often used to block ads, spyware and phone-homes by aliasing the host to be blocked to 127.0.0.1 in your hosts file." https://www.theregister.com/2015/09/01/microsoft_backports_data_slurp_to_windows_78_via_patches/ https://www.theregister.com/2015/09/01/microsoft_backports_d... "All the updates can be removed post-installation – but all ensure the OS reports data to Microsoft even when asked not to, bypassing the hosts file and (hence) third-party privacy tools. This data can include how long you use apps, and which features you use the most, snapshots of memory to investigate crashes, and so on."

Skunkleton 6y ago

You understand that Apple could bypass kexts too? This is an issue of trust, not a technical issue.

CountSessine 6y ago
Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes. Pushing these guys out of the kernel lets Apple cheat them and Mac users clean and easy.
- gruez 6y ago
  >Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes why would that be the case? All you'd need to do is provide some sort of private network api, and only allow apple signed code to use it.
  - throwaway2048 6y ago
    that is not how kexts work(ed), they can do completely arbitrary things to the kernel, including removing any theoretical code signing requirement.
    - gruez 6y ago
      any access? On Windows, you can write a driver that would run in kernel mode, but critical sections can't be modified[1]. I'd imagine there's something similar for mac. [1] https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection
      - SCHiM 6y ago
        KPP is not considered a security boundary. That means, in Windows security jargon, that it's a feature that helps security. But not something that you or anyone else should consider a fail proof solution, or even something that would result in a patch if breached.
        gruez 6y ago
        If patching the kernel to intercept network requests is sufficiently hard enough that you're forced to use their "approved" way of intercepting network requests, then it's very easy for them to sneak requests through. Even if patching the kernel wasn't an issue, it still turns into a game of whack a mole because apple can sneak as many changes as they want with each macos release. It heavily favors apple, not the developers of such firewalls.
        CountSessine 6y ago
        Even if patching the kernel wasn't an issue, it still turns into a game of whack a mole Exactly - but the game itself is the problem. Firewall vendors will go hunting through kernel code for jump targets and structs to plug into hidden interfaces, and Apple will remove and change them, causing crashes and instability. Apple has some leverage if they have a program like WHQL, but even then driver writers will commit shenanigans. Push them out of the kernel altogether and now only Apple can engage in shenanigans and break user trust. Which they already have.
      - comex 6y ago
        There hasn’t been anything like that on macOS. macOS on Apple Silicon will have a form of kernel patch protection, like on iOS, but it’s designed to guard against exploits from userland, not approved kexts. It’s definitely possible for third party kexts to bypass that somehow, but possibly only by disabling Secure Boot; I haven’t looked into it.
Wowfunhappy 6y ago
It's worth noting the Apple does release the source code to XNU (albeit on a ~6 month delay), and unlike some of their other source releases, there's actually enough tooling for you to build your own kernel. So while there are still gaps, it is overall more open to review.

nix23 6y ago

Dont pray, just dont buy Apple Products

Skunkleton 6y ago
It's a frustrating road we are headed down. Tech companies have gotten so big that they don't really have to work together using standardization anymore. Options are limited, and most are anti-consumer in one way or another.
- nix23 6y ago
  >Options are limited No not really, but limited is the mindset of peoples.
  - gabereiser 6y ago
    >No not really, but limited is the mindset of peoples. I'd argue options really are limited. Your counter argument assumes one can just roll their own OS with the same features and functionality as current-gen OS's. That's quite a leap. Options today are Windows, Mac, or some flavor of Linux if you can get it to work. Linux aside, Windows and Mac both are making it so you no longer own the OS but are "subscribed" to it. Making it easy for them to implement anti-consumer strategies to lock you in.
    - fsflover 6y ago
      > or some flavor of Linux if you can get it to work Do not try to get anything work. Just buy preinstalled.
      - a1369209993 6y ago
        Buy preinstalled from where, exactly? (And no, chromebooks are not linux for any practical purpose, although they probably would be easier to install a real linux system on.)

caiob 6y ago

Apple have never made such claim. In fact, if you read their ToS, it discloses all the information you're classifying as "disgusting".

josteink 6y ago

> and now Apple has altered the deal and we must pray they do not alter it further And the slippery slope of MacOS lockdown slips just a little further.

gabereiser 6y ago

Tim Cook's Apple Inc is really a nightmare. Sure we have sleek shiny laptops and devices that are amazingly powerful but at what cost? I still haven't found a trackpad as good as MagicTrackpad sadly otherwise I'd ditch the MacBook Pro. To be fair to Apple though, it's their OS, they can do what they want and we agree every time we update MacOS or iOS. It's crazy to me that we basically only have 3 phone device choices, 2.15 environment choices (OS wise... Linux Desktop is crap, but getting better), and only 2 choices in GPU's, CPU's, etc... What can we do about this?

ProAm 6y ago
Would you use a good trackpad that connects via USB or bluetooth? Its a real question because I see a lot of comments about people not leaving the Macbook because of the trackpad even though they dislike the rest of the laptop? Seems like something that could be a product?
- kccqzy 6y ago
  No you wouldn't. It's not about the trackpad hardware (Apple sells a separate Bluetooth trackpad after all), but it's about the software.
  - ProAm 6y ago
    What about the software makes it good? Ive never used a macbook so have zero experience with it.
    - daniel-thompson 6y ago
      For me, two things combine to make it feel super responsive: 1. The latency between you moving your finger(s) and seeing movement on the screen feels imperceptible. 2. There isn't any "lost" movement - if you scribble your finger around really quickly and come back to where you start, the cursor or window scroll position will be back to where it started too.
    - fsflover 6y ago

hilbert42 6y ago

Don't bother to look to Microsoft Windows for a solution! For don't forget MS Windows has a 'dial-home-to-Microsoft' link that's hard coded within Windows itself. It bypasses the hosts file altogether, and if I recall correctly, it's been in Windows since XP. The only solution stop the 'talk-home' connection would be to find the destination IPs numbers and then key them into your external router for blocking.

WarOnPrivacy 6y ago
Windows doesn't bypass 3rd party firewalls.
- hilbert42 6y ago
  'Windows doesn't bypass 3rd party firewalls.' Sorry WarOnPrivacy, Windows does bypass 3rd-party firewalls and has done so since at least XP onwards (however, I am uncertain if this was the case with Windows 2000). Microsoft has programmed into Windows dozens of addresses that 'dial home' to Microsoft's servers. As you will be aware, many of these addresses change with the various versions of Windows. Normal program switches can block some of these addresses whilst others are hidden from normal view, but with a little judicious snooping, we can find most of hidden ones and successfully block them with the hosts file. However, we cannot block all of them, and this has been the case since Windows XP. From my understanding, which I learned from various security experts around 15 or more years ago at the time when the Microsoft 'exploit' was first discovered, Microsoft hard-coded certain dial-home links for the specific purpose of determining which and how many copies of Windows were pirated. (This seemed to have been the consequence of the widespread pirating of certain corporate copies of Windows 2000.) Whilst the user many have thought he'd secured every talk-home to Microsoft loophole and was safe, nevertheless MS still knew that his O/S was a pirate version. Unlike other activation links that announced an 'illegal copy' status to the user, these links only advised Microsoft of the fact—if you like, there're part of Microsoft's secret surveillance system. Essentially, Microsoft has deliberately sabotaged the DNS client's hosts table lookup functionality by bypassing it with hard coding. It seems that in recent years, Microsoft has developed this secret system to an even finer art, as these days it gathers much more information other than whether the O/S has been pirated or not. With having the handle WarOnPrivacy, I gather you're more than just interested in securing your Windows in the usual ways. If I were you, I'd do what I'm doing here and that's to research the details further and then publicize the fact. As will now be obvious, this is not something that Microsoft wants broadcast to the world. Below are a few links about the matter with a few comments from some of the sites: https://slashdot.org/story/06/04/16/1351217/Microsoft-Bypasses-HOSTS-File https://slashdot.org/story/06/04/16/1351217/Microsoft-Bypass... https://bugtraq.securityfocus.narkive.com/a2fZWlAb/microsoft-dns-resolver-deliberately-sabotaged-hosts-file-lookup https://bugtraq.securityfocus.narkive.com/a2fZWlAb/microsoft... " Hey, guess what I just found out: Microsoft have deliberately sabotaged their DNS client's hosts table lookup functionality. Normally you can override DNS lookup by specifying a hostname and IP directly in the hosts file, which is searched before any query is issued to your dns server; this technique is often used to block ads, spyware and phone-homes by aliasing the host to be blocked to 127.0.0.1 in your hosts file." https://www.theregister.com/2015/09/01/microsoft_backports_data_slurp_to_windows_78_via_patches/ https://www.theregister.com/2015/09/01/microsoft_backports_d... "All the updates can be removed post-installation – but all ensure the OS reports data to Microsoft even when asked not to, bypassing the hosts file and (hence) third-party privacy tools. This data can include how long you use apps, and which features you use the most, snapshots of memory to investigate crashes, and so on."