14 ms·

How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....

How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it.... And a humorous guide on disabling protections like code signing and notarization: https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-liberate-macos/ https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-li...

centimeter 6y ago
I’m not sure it’s sensible to call these “protections” - they’re closer to security theater.
- xenocratus 6y ago
  Can you give an example of what you consider proper protections?
  - Craighead 6y ago
    Ever heard of crowdstrike?
  - jhardy54 6y ago
    Full disk encryption?
    - spullara 6y ago
      Doesn't everyone have at enabled at this point?
      - jhardy54 6y ago
        No. There are tons of platforms that don't come with FDE by default (e.g. Raspberry Pi).
  - heavyset_go 6y ago
    You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.
    - johncolanduoni 6y ago
      How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for it. X11 probably being the most egregious limiter, followed by no standard trusted file access UI. On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile.
      - danieldk 6y ago
        followed by no standard trusted file access UI. If an application uses Gtk+3 or Qt5 then portals will be used automatically for Open/Save dialogs: https://docs.flatpak.org/en/latest/sandbox-permissions.html#portals https://docs.flatpak.org/en/latest/sandbox-permissions.html#... I agree with the thrust of you comment though, outside the webbrowser, proper sandboxing a barely used outside web browsers. However, I think the problem is as much social as technical. Every time Flatpak comes up, it mostly gets hostile reactions. The situation is rather unfortunate. A lot of people believe that Linux is more secure than other operating systems, but in practice the Linux desktop is far less secure than e.g. macOS, iOS/iPadOS, or Android. And no, you aren't safe because it is open source software. Sandboxing also protects against unknown vulnerabilities in open source software.
      - merb 6y ago
        > On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile. actually firecracker is not a sandbox. it's basically qemu/libvirt and a minimal implementation of devices. it's qemu-kvm with a http interface and way less devices. the reason why they rewritten qemu-kvm is because qemu-kvm contains a lot of code that is not needed and is way more bug prone. and also loading a kernel is way faster in firecracker since they optimized the kernel loading code.
keyle 6y ago
Why _should_ you have to disable this feature? Sigh. My point: opting out should be much, much easier.
- bangonkeyboard 6y ago
  All you need to do is to know about the linked page and have it open on another computer, disable some initial disk protections, reboot into recovery while holding down some unmentioned key combinations, disable further restrictions by typing in cryptic Terminal commands that don't match the public names of the features they affect, reboot again, type in more cryptic commands as root to modify deeply nested system files and perform filesystem voodoo, and then reboot yet again with an optional prayer. Repeat for every OS update. What could be easier?
  - josteink 6y ago
    It just works!
  - 867-5309 6y ago
    sounds like a feature
- sjwright 6y ago
  The easier it is to opt out, the more likely it is for sketchy developers to guide tech-novice users through that process, the more likely it is for malicious actors to take advantage of those who opted out.
- pfortuny 6y ago
  First boot: “Do you wish Apple to receive ... for your security?” Most users will say yes. Technical ones at least can say no. Easier than setting up bluetoooth.
  - tinus_hn 6y ago
    Actually the OS asks these questions already.
LeoPanthera 6y ago
Although possible to disable the feature, those steps are crazy complicated, and probably impossible for anyone who isn't a developer. (Apart from anything else, regular users should never be advised to disable SIP.)
- saagarjha 6y ago
  I am sure the complexity is intentional.
- grishka 6y ago
  Why should they not? Linux for example doesn't have any such features and somehow is okay to use like that.
  - andy_ppp 6y ago
    What stops a Linux program altering the system? I guess you need root access to change things outside of /usr/local this could easily be done on macOS too but the wheel had to be reinvented by Apple in a way that is probably less trustworthy.
    - grishka 6y ago
      You actually need root on macOS to modify anything under /System, and this was the case even before SIP. This is why some installers ask for the root password.
    - angry_octet 6y ago
      With SIP you can't change some things even as root. SIP has definitely made macos a harder target, though it is still lagging Windows in some areas. Linux is almost comically unprotected. @grishka Edit because I'm rate limited: I've not seen anything that does executable validation for linux and actually works. Needs lots of kernel support. See the response from the old DigSig author: https://stackoverflow.com/questions/1732927/signed-executables-under-linux/ https://stackoverflow.com/questions/1732927/signed-executabl... You can check binary signatures on disk (tripwire) but that is extremely tiresome to maintain and does not prevent straight loading of shellcode into memory. More recently: https://lwn.net/Articles/733431/ https://lwn.net/Articles/733431/ Signed kernel modules is on its way though: https://www.kernel.org/doc/html/latest/admin-guide/module-signing.html https://www.kernel.org/doc/html/latest/admin-guide/module-si... I guess that would be a place to start for implementing SIP...
1vuio0pswjnm7 6y ago
The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iOS and MacOS by default generate a considerable amount of network traffic to Apple servers as soon as they are powered on. When I power on a computer running NetBSD, there is by default no traffic to a corporate mothership. Given the choice between (a) a corporate OS that requires me to perform some amount of work to "turn off" some "features" the corporation has enabled and (b) a non-corporate OS that requires me to perform some amount of work to "turn on" the "features" that I want to use, I prefer (b).
- Lucasoato 6y ago
  The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer. Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry...
  - unicornporn 6y ago
    > The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer. Came here to say that. > Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry... I do, I truly do care. So much that I'm looking at open-source/Linux options, at least for my home projects. Doesn't look very bright on the video side, but DaVinci Resolve is at least available for Linux. Rawtherapee is getting there with local adjustments as we speak. Darktable has lots of power but terrible UX.
  - 1vuio0pswjnm7 6y ago
    I have a G4 I bought for use as a DAW. It still has OS9; I never installed OSX as I knew it would probably slow things down. I never needed to connect the Mac to the internet. If I needed to send/receive files via internet I moved them via crossover cable to a laptop or PC that was connected to the internet. People today, even more so than in the 2000's, have multiple computers. Would it still be feasible to have a Mac used for {music, cinema, graphics} that is not connected to the internet. Certainly one would have other computers that were connected to the internet and moving files between computers on the local network, preferably via Ethernet, is much faster. But the point of me telling personal stories is not to suggest anyone could/should do the same things; on the contrary, it is to illustrate that "one size does not fit all". Today's Apple chooses for the user, rather than letting the user choose.
jackjeff 6y ago
I’m not sure I want to turn off SIP and SSV to get a firewall that works.

centimeter 6y ago

I’m not sure it’s sensible to call these “protections” - they’re closer to security theater.

xenocratus 6y ago
Can you give an example of what you consider proper protections?
- Craighead 6y ago
  Ever heard of crowdstrike?
- jhardy54 6y ago
  Full disk encryption?
  - spullara 6y ago
    Doesn't everyone have at enabled at this point?
    - jhardy54 6y ago
      No. There are tons of platforms that don't come with FDE by default (e.g. Raspberry Pi).
- heavyset_go 6y ago
  You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.
  - johncolanduoni 6y ago
    How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for it. X11 probably being the most egregious limiter, followed by no standard trusted file access UI. On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile.
    - danieldk 6y ago
      followed by no standard trusted file access UI. If an application uses Gtk+3 or Qt5 then portals will be used automatically for Open/Save dialogs: https://docs.flatpak.org/en/latest/sandbox-permissions.html#portals https://docs.flatpak.org/en/latest/sandbox-permissions.html#... I agree with the thrust of you comment though, outside the webbrowser, proper sandboxing a barely used outside web browsers. However, I think the problem is as much social as technical. Every time Flatpak comes up, it mostly gets hostile reactions. The situation is rather unfortunate. A lot of people believe that Linux is more secure than other operating systems, but in practice the Linux desktop is far less secure than e.g. macOS, iOS/iPadOS, or Android. And no, you aren't safe because it is open source software. Sandboxing also protects against unknown vulnerabilities in open source software.
    - merb 6y ago
      > On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile. actually firecracker is not a sandbox. it's basically qemu/libvirt and a minimal implementation of devices. it's qemu-kvm with a http interface and way less devices. the reason why they rewritten qemu-kvm is because qemu-kvm contains a lot of code that is not needed and is way more bug prone. and also loading a kernel is way faster in firecracker since they optimized the kernel loading code.

keyle 6y ago

Why _should_ you have to disable this feature? Sigh. My point: opting out should be much, much easier.

bangonkeyboard 6y ago
All you need to do is to know about the linked page and have it open on another computer, disable some initial disk protections, reboot into recovery while holding down some unmentioned key combinations, disable further restrictions by typing in cryptic Terminal commands that don't match the public names of the features they affect, reboot again, type in more cryptic commands as root to modify deeply nested system files and perform filesystem voodoo, and then reboot yet again with an optional prayer. Repeat for every OS update. What could be easier?
- josteink 6y ago
  It just works!
- 867-5309 6y ago
  sounds like a feature
sjwright 6y ago
The easier it is to opt out, the more likely it is for sketchy developers to guide tech-novice users through that process, the more likely it is for malicious actors to take advantage of those who opted out.
pfortuny 6y ago
First boot: “Do you wish Apple to receive ... for your security?” Most users will say yes. Technical ones at least can say no. Easier than setting up bluetoooth.
- tinus_hn 6y ago
  Actually the OS asks these questions already.

LeoPanthera 6y ago

Although possible to disable the feature, those steps are crazy complicated, and probably impossible for anyone who isn't a developer. (Apart from anything else, regular users should never be advised to disable SIP.)

saagarjha 6y ago
I am sure the complexity is intentional.
grishka 6y ago
Why should they not? Linux for example doesn't have any such features and somehow is okay to use like that.
- andy_ppp 6y ago
  What stops a Linux program altering the system? I guess you need root access to change things outside of /usr/local this could easily be done on macOS too but the wheel had to be reinvented by Apple in a way that is probably less trustworthy.
  - grishka 6y ago
    You actually need root on macOS to modify anything under /System, and this was the case even before SIP. This is why some installers ask for the root password.
  - angry_octet 6y ago
    With SIP you can't change some things even as root. SIP has definitely made macos a harder target, though it is still lagging Windows in some areas. Linux is almost comically unprotected. @grishka Edit because I'm rate limited: I've not seen anything that does executable validation for linux and actually works. Needs lots of kernel support. See the response from the old DigSig author: https://stackoverflow.com/questions/1732927/signed-executables-under-linux/ https://stackoverflow.com/questions/1732927/signed-executabl... You can check binary signatures on disk (tripwire) but that is extremely tiresome to maintain and does not prevent straight loading of shellcode into memory. More recently: https://lwn.net/Articles/733431/ https://lwn.net/Articles/733431/ Signed kernel modules is on its way though: https://www.kernel.org/doc/html/latest/admin-guide/module-signing.html https://www.kernel.org/doc/html/latest/admin-guide/module-si... I guess that would be a place to start for implementing SIP...

1vuio0pswjnm7 6y ago

The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iOS and MacOS by default generate a considerable amount of network traffic to Apple servers as soon as they are powered on. When I power on a computer running NetBSD, there is by default no traffic to a corporate mothership. Given the choice between (a) a corporate OS that requires me to perform some amount of work to "turn off" some "features" the corporation has enabled and (b) a non-corporate OS that requires me to perform some amount of work to "turn on" the "features" that I want to use, I prefer (b).

Lucasoato 6y ago
The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer. Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry...
- unicornporn 6y ago
  > The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer. Came here to say that. > Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry... I do, I truly do care. So much that I'm looking at open-source/Linux options, at least for my home projects. Doesn't look very bright on the video side, but DaVinci Resolve is at least available for Linux. Rawtherapee is getting there with local adjustments as we speak. Darktable has lots of power but terrible UX.
- 1vuio0pswjnm7 6y ago
  I have a G4 I bought for use as a DAW. It still has OS9; I never installed OSX as I knew it would probably slow things down. I never needed to connect the Mac to the internet. If I needed to send/receive files via internet I moved them via crossover cable to a laptop or PC that was connected to the internet. People today, even more so than in the 2000's, have multiple computers. Would it still be feasible to have a Mac used for {music, cinema, graphics} that is not connected to the internet. Certainly one would have other computers that were connected to the internet and moving files between computers on the local network, preferably via Ethernet, is much faster. But the point of me telling personal stories is not to suggest anyone could/should do the same things; on the contrary, it is to illustrate that "one size does not fit all". Today's Apple chooses for the user, rather than letting the user choose.

jackjeff 6y ago

I’m not sure I want to turn off SIP and SSV to get a firewall that works.