3 ms·
If your threat model is this extreme you likely should be airgapped and not downloading OTA updates.
by stevenhubertron 5y ago
If your threat model is this extreme you likely should be airgapped and not downloading OTA updates.
- sneak 5y agoThere are no non-OTA updates available for macOS any longer, AFAIK. You can download full installers, and do a full reinstall on each point release, but that is prohibitively time-consuming (and still requires internet access to reactivate the device following a drive wipe, which transmits your ECID and other information to Apple at albert.apple.com). I understand that it may also optionally drop executables on your system at reinstallation time (based on device serial) for devices enrolled in Apple's DEP, which allows for no-click MDM enrollment for serials registered with Apple to an organization, so who knows if Apple can also be compelled at that point to target specific devices with police malware. There is no good way to set up a new Apple system in a really trustworthy way, as it absolutely requires phone-home during wipe/reinstall (to check to make sure your serial isn't marked as stolen in someone else's iCloud account, among other reasons). I have written about this before. https://sneak.berlin/20201204/on-trusting-macintosh-hardware/ https://sneak.berlin/20201204/on-trusting-macintosh-hardware...