32 ms·
Booting something unsigned would remove the security anyway, wouldn't it?
by sedatk 6y ago
Booting something unsigned would remove the security anyway, wouldn't it?
- pabs3 6y agoSome of the Linux distros have signed bootloaders/kernels for SecureBoot on PCs, so it would be good if that same model could be allowed on macs.
- judge2020 6y agoGiven the state of signed firmware, I think Apple is in the right - https://arstechnica.com/information-technology/2020/07/new-flaw-neuters-secure-boot-but-theres-no-reason-to-panic-heres-why/ https://arstechnica.com/information-technology/2020/07/new-f...
- silly-silly 6y agoI think that the two are at best tangentially related.
- lathiat 6y agoIt removes some specific types of security, but System Integrity Protection is a "runtime" protection on OSX. It disables access to various files/etc even as root unless in the right context. So it seems unfortunate to have to lower the level of runtime security for OSX, in order to enable booting unsigned software. As they shouldn't be strictly related.
- sedatk 6y agoMy understanding is that if boot security cannot be established, it's impossible to assert runtime security either. Otherwise, a compromised code in the boot process can also alter how SIP behaves, essentially invalidating its security function.