5 ms·

Seems unfortunate that to boot something unsigned you have to disable SIP, e.g. once we have a working linux port (I'm sure it won't be long) to enable booting

Seems unfortunate that to boot something unsigned you have to disable SIP, e.g. once we have a working linux port (I'm sure it won't be long) to enable booting it will reduce my OSX security at runtime [and not just from the boot chain].

sedatk 6y ago
Booting something unsigned would remove the security anyway, wouldn't it?
- pabs3 6y ago
  Some of the Linux distros have signed bootloaders/kernels for SecureBoot on PCs, so it would be good if that same model could be allowed on macs.
  - judge2020 6y ago
    Given the state of signed firmware, I think Apple is in the right - https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-secure-boot-but-theres-no-reason-to-panic-heres-why/ https://arstechnica.com/information-technology/2020/07/new-f...
    - silly-silly 6y ago
      I think that the two are at best tangentially related.
- lathiat 6y ago
  It removes some specific types of security, but System Integrity Protection is a "runtime" protection on OSX. It disables access to various files/etc even as root unless in the right context. So it seems unfortunate to have to lower the level of runtime security for OSX, in order to enable booting unsigned software. As they shouldn't be strictly related.
  - sedatk 6y ago
    My understanding is that if boot security cannot be established, it's impossible to assert runtime security either. Otherwise, a compromised code in the boot process can also alter how SIP behaves, essentially invalidating its security function.
zabardasth 6y ago
I was paranoid for a long time about things like SIP and SecureBoot but think of it this way. What is the likelihood that you are infected by a bootkit versus some 0day that affects your browser? My main beef w/ rootless/SIP/Gatekeeper and these types of technology is that you no longer own your hardware, you are a slave to the HW manufacturer.
- gjsman-1000 6y ago
  You know you can disable SIP and Gatekeeper, right? It's just two terminal commands.
- jbverschoor 6y ago
  Yet at the same time you get roasted on here if you run things as root. It’s pure bs.. Apple has top notch engineering and architecture. Others always follow.. in terms of hardware, but also software

sedatk 6y ago

Booting something unsigned would remove the security anyway, wouldn't it?

pabs3 6y ago
Some of the Linux distros have signed bootloaders/kernels for SecureBoot on PCs, so it would be good if that same model could be allowed on macs.
- judge2020 6y ago
  Given the state of signed firmware, I think Apple is in the right - https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-secure-boot-but-theres-no-reason-to-panic-heres-why/ https://arstechnica.com/information-technology/2020/07/new-f...
  - silly-silly 6y ago
    I think that the two are at best tangentially related.
lathiat 6y ago
It removes some specific types of security, but System Integrity Protection is a "runtime" protection on OSX. It disables access to various files/etc even as root unless in the right context. So it seems unfortunate to have to lower the level of runtime security for OSX, in order to enable booting unsigned software. As they shouldn't be strictly related.
- sedatk 6y ago
  My understanding is that if boot security cannot be established, it's impossible to assert runtime security either. Otherwise, a compromised code in the boot process can also alter how SIP behaves, essentially invalidating its security function.

zabardasth 6y ago

I was paranoid for a long time about things like SIP and SecureBoot but think of it this way. What is the likelihood that you are infected by a bootkit versus some 0day that affects your browser? My main beef w/ rootless/SIP/Gatekeeper and these types of technology is that you no longer own your hardware, you are a slave to the HW manufacturer.

gjsman-1000 6y ago
You know you can disable SIP and Gatekeeper, right? It's just two terminal commands.
jbverschoor 6y ago
Yet at the same time you get roasted on here if you run things as root. It’s pure bs.. Apple has top notch engineering and architecture. Others always follow.. in terms of hardware, but also software