7 ms·

Yeah I was one of them. Unfortunately the Unix part seems to be very underappreciated by Apple recently so I've already moved on again. I was an early adopter

Yeah I was one of them. Unfortunately the Unix part seems to be very underappreciated by Apple recently so I've already moved on again. I was an early adopter of macOS and have 'converted' many more mainstream users that still use it. But for me it's become too locked down.

midislack 5y ago
I stopped using Apple products when they started spying on everything I did. Do I really want Apple recording the name and hash of every program I run? Why ask permission and click "agree" to write code for my own use? Checked right out of that ecosystem and I won't be going back.
llllllllllll9 5y ago
windows11 with wsl2. sometimes i forget i'm not in kde.
p1mrx 5y ago
Which OS/distro did you move onto?
- GekkePrutser 5y ago
  FreeBSD with KDE
- rch 5y ago
  Nixpkgs on Fedora w/ i3wm
- withinboredom 5y ago
  Windows + WSL for open source stuff and PopOS for work.
  - p1mrx 5y ago
    Isn't WSL2 still IPv4-only? That's why I uninstalled it years ago.
    - withinboredom 5y ago
      Yeah, but you can use a custom kernel and WireGuard to get around that. https://withinboredom.info/blog/2022/04/02/finally-getting-ipv6-in-wsl2/ https://withinboredom.info/blog/2022/04/02/finally-getting-i...
smoldesu 5y ago
Amen to that. At work one of my responsibilities includes maintaining bootstrapping scripts for MacOS so we can reliably develop on the platform. Getting things to "just work" the way they do on our deploy servers is an actual nightmare, especially once you toss Apple Silicon into the mix. Not only are we running different kernels, but different architectures; it's simply impossible to guarantee that something that runs locally will work fine on production, or vice-versa. I definitely do my development on Linux where possible.
azinman2 5y ago
What is it too locked down to accomplish? There are many knobs to unlock it.
- GekkePrutser 5y ago
  Changing the sshd_config to only accept key authentication for example. Since the recent locking down of significant parts of the OS this keeps getting reverted to default. But there's many more issues, I've gone into them before (I used to be a Mac admin) but I don't want to bring it all up again
  - WesolyKubeczek 5y ago
    You sort of can sidestep the issue by supplying your own launchd plist for openssh, and disabling Apple's one, but it's a thorn in the side anyway — the fact that you even need to bother to sidestep the issue in the first place, while there are systems which go to great lengths to respect your changes to the configuration.
    - withinboredom 5y ago
      System level environment variables would be nice. It’s a pita to use a yubikey (arguably more secure than a plaintext key in .ssh) for ssh key storage. I remember having to start certain UI programs from a shell just to run them because they needed SSH abilities.
  - VogonPoetry 5y ago
    There has been a very nice trend for a number of projects to support a <config_file>.d directory to which local modifications can be added. Current macOS (and Debian >=11) has a non-standard sshd_config modification that does "Include /etc/ssh/sshd_config.d/*". Although placement early in the config file means some things cannot be overridden. Current "sudo" on macOS also supports this via "#includedir /private/etc/sudoers.d". (the # has been swapped for @ in upstream sudo). This neatly sidesteps the need to diff / re-apply changes on a SW update.
7speter 5y ago
Theres also a lot of commercial service overhead, like apple music starting up on boot (and even being installed) and asking if you’d like to subscribe or whatever. 15 years ago apple had people on stage bragging how there was only one version of OS X while Microsoft had countless versions of Windows (Vista Home, Vista Pro, Server, etc). I wonder if there should be a standard MacOS and a MacOS Pro that would be a relatively stripped down unix environment without all of the bloat thats been added on to MacOS recently…
- the_other 5y ago
  Absolutely not. There should just be easy switches.
kergonath 5y ago
Out of curiosity, what do you mean by “too locked down”? What could you do on, say OS X 10.8 that you cannot do now? I am still running and compiling the same open source software as I did 10 years ago and more besides. There have been a couple of rough transitions with the new security things, SIP, and whatnot. I disabled it for a couple of releases but now that’s not really a problem.
- WesolyKubeczek 5y ago
  You have an increased number of hoops to jump through if you want your computer to be programmable. At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. Custom kernel extensions? No way. It's like slowly boiling the water in which you sit. Little things, but one by one they accumulate into quite a lump of red tape, and Apple seems to drive home the point that a developer is a different caste than the user is, and there's some sacred knowledge that you should be in possession of, and update it every year for $99, so that you can program your computer. All the while the user is supposed to be clueless and in awe from this technological marvel the caste of engineers is bestowing unto them. Oh, and Apple wants to be a bottleneck in each and every process connected to programming their computers. They also remind you that the machines you pay mad bucks for, you don't really own. I like the pure Unix approach more, when the line between using the computer and programming it doesn't really exist, and where the system is basically your IDE too, and where you're going from being a user to being a programmer and back without really noticing. Mind you, it doesn't mean you have to go from one to the other, but when you want/need to, it's damn frictionless, and the system is as malleable as you want it to be.
  - inkyoto 5y ago
    > You have an increased number of hoops to jump through if you want your computer to be programmable. > At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. You are confusing the local software development with the global software distribution. Anyone is free to install development tools, compilers and toolchains, compile and run anything locally on an OS X, just like on any other UNIX system, including Linux. Gatekeeper and the notarisation enforcement, which are a default but can be neutered, address a common use case of «my mom/little sister/grandfather/etc has downloaded and installed a seemingly useful app from a dodgy website that has excreted a ransomware that now demands a payment to give their data back, or leaked all of their contacts/personal data, or slowed their computing device 100 fold down». OS X does give lay users a way to turn checks off, including the system integrity protection, and shoot themselves in the foot if that is what they want. In fact, I would like to be able to selectively apply an even more, higher, restrictive security profile to any app, including to the ones available through Apple's own app store. Who can tell what potential spyware / trackware a 500+ Mb WhatsApp download from the official Apple app store contains within? WhatsApp desktop client is a mediocre (feature wise) messenger that is not even as feature rich as the 85Mb Telegram desktop download is. And I, for one, don't have the capacity to reverse engineer and manually inspect every single WhatsApp download/update for my own peace of mind and sanity, and I would also presume that very few people even from around here can. Anything coming out of FaceBook nowadays should be considered trackware and needs to be airgapped with the utmost diligence. Even the business/enterprise software is ridden with all sorts of trackers. Citrix Workspace client, for example, installs three "telemetry" helper processes that phone home non-stop. > Custom kernel extensions? No way. Yes way. They just have to be signed for same reasons as third party apps. See https://support.apple.com/en-au/guide/security/sec8e454101b/web https://support.apple.com/en-au/guide/security/sec8e454101b/... for details. I was recently scrubbing the file system off some legacy components and noticed, with a lot bewilderment, what extra 'useful' USB drivers a 4G MiFi device I had purchased over a decade ago installed at the 1st connection attempt. I, for one, don't need those 'niceties' to sneakily creep into any of my file systems or lurk around. In fact, OS X has become more GNU Hurd since 10.15 like by pushing kernel extensions into the user space instead, which reduces chances of the kernel crashing due to a bug in a random extension. More kernel stability and security? I say yes to both, albeit your mileage may vary.
pjmlp 5y ago
For NeXT the UNIX compatibility was a means to compete in the workstation market, nothing more. "Why We Have to Make UNIX Invisible." https://www.usenix.org/blog/vault-steve-jobs-keynotes-1987-usenix-atc https://www.usenix.org/blog/vault-steve-jobs-keynotes-1987-u...

midislack 5y ago

I stopped using Apple products when they started spying on everything I did. Do I really want Apple recording the name and hash of every program I run? Why ask permission and click "agree" to write code for my own use? Checked right out of that ecosystem and I won't be going back.

llllllllllll9 5y ago

windows11 with wsl2. sometimes i forget i'm not in kde.

p1mrx 5y ago

Which OS/distro did you move onto?

GekkePrutser 5y ago
FreeBSD with KDE
rch 5y ago
Nixpkgs on Fedora w/ i3wm
withinboredom 5y ago
Windows + WSL for open source stuff and PopOS for work.
- p1mrx 5y ago
  Isn't WSL2 still IPv4-only? That's why I uninstalled it years ago.
  - withinboredom 5y ago
    Yeah, but you can use a custom kernel and WireGuard to get around that. https://withinboredom.info/blog/2022/04/02/finally-getting-ipv6-in-wsl2/ https://withinboredom.info/blog/2022/04/02/finally-getting-i...

smoldesu 5y ago

Amen to that. At work one of my responsibilities includes maintaining bootstrapping scripts for MacOS so we can reliably develop on the platform. Getting things to "just work" the way they do on our deploy servers is an actual nightmare, especially once you toss Apple Silicon into the mix. Not only are we running different kernels, but different architectures; it's simply impossible to guarantee that something that runs locally will work fine on production, or vice-versa. I definitely do my development on Linux where possible.

azinman2 5y ago

What is it too locked down to accomplish? There are many knobs to unlock it.

GekkePrutser 5y ago
Changing the sshd_config to only accept key authentication for example. Since the recent locking down of significant parts of the OS this keeps getting reverted to default. But there's many more issues, I've gone into them before (I used to be a Mac admin) but I don't want to bring it all up again
- WesolyKubeczek 5y ago
  You sort of can sidestep the issue by supplying your own launchd plist for openssh, and disabling Apple's one, but it's a thorn in the side anyway — the fact that you even need to bother to sidestep the issue in the first place, while there are systems which go to great lengths to respect your changes to the configuration.
  - withinboredom 5y ago
    System level environment variables would be nice. It’s a pita to use a yubikey (arguably more secure than a plaintext key in .ssh) for ssh key storage. I remember having to start certain UI programs from a shell just to run them because they needed SSH abilities.
- VogonPoetry 5y ago
  There has been a very nice trend for a number of projects to support a <config_file>.d directory to which local modifications can be added. Current macOS (and Debian >=11) has a non-standard sshd_config modification that does "Include /etc/ssh/sshd_config.d/*". Although placement early in the config file means some things cannot be overridden. Current "sudo" on macOS also supports this via "#includedir /private/etc/sudoers.d". (the # has been swapped for @ in upstream sudo). This neatly sidesteps the need to diff / re-apply changes on a SW update.

7speter 5y ago

Theres also a lot of commercial service overhead, like apple music starting up on boot (and even being installed) and asking if you’d like to subscribe or whatever. 15 years ago apple had people on stage bragging how there was only one version of OS X while Microsoft had countless versions of Windows (Vista Home, Vista Pro, Server, etc). I wonder if there should be a standard MacOS and a MacOS Pro that would be a relatively stripped down unix environment without all of the bloat thats been added on to MacOS recently…

the_other 5y ago
Absolutely not. There should just be easy switches.

kergonath 5y ago

Out of curiosity, what do you mean by “too locked down”? What could you do on, say OS X 10.8 that you cannot do now? I am still running and compiling the same open source software as I did 10 years ago and more besides. There have been a couple of rough transitions with the new security things, SIP, and whatnot. I disabled it for a couple of releases but now that’s not really a problem.

WesolyKubeczek 5y ago
You have an increased number of hoops to jump through if you want your computer to be programmable. At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. Custom kernel extensions? No way. It's like slowly boiling the water in which you sit. Little things, but one by one they accumulate into quite a lump of red tape, and Apple seems to drive home the point that a developer is a different caste than the user is, and there's some sacred knowledge that you should be in possession of, and update it every year for $99, so that you can program your computer. All the while the user is supposed to be clueless and in awe from this technological marvel the caste of engineers is bestowing unto them. Oh, and Apple wants to be a bottleneck in each and every process connected to programming their computers. They also remind you that the machines you pay mad bucks for, you don't really own. I like the pure Unix approach more, when the line between using the computer and programming it doesn't really exist, and where the system is basically your IDE too, and where you're going from being a user to being a programmer and back without really noticing. Mind you, it doesn't mean you have to go from one to the other, but when you want/need to, it's damn frictionless, and the system is as malleable as you want it to be.
- inkyoto 5y ago
  > You have an increased number of hoops to jump through if you want your computer to be programmable. > At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. You are confusing the local software development with the global software distribution. Anyone is free to install development tools, compilers and toolchains, compile and run anything locally on an OS X, just like on any other UNIX system, including Linux. Gatekeeper and the notarisation enforcement, which are a default but can be neutered, address a common use case of «my mom/little sister/grandfather/etc has downloaded and installed a seemingly useful app from a dodgy website that has excreted a ransomware that now demands a payment to give their data back, or leaked all of their contacts/personal data, or slowed their computing device 100 fold down». OS X does give lay users a way to turn checks off, including the system integrity protection, and shoot themselves in the foot if that is what they want. In fact, I would like to be able to selectively apply an even more, higher, restrictive security profile to any app, including to the ones available through Apple's own app store. Who can tell what potential spyware / trackware a 500+ Mb WhatsApp download from the official Apple app store contains within? WhatsApp desktop client is a mediocre (feature wise) messenger that is not even as feature rich as the 85Mb Telegram desktop download is. And I, for one, don't have the capacity to reverse engineer and manually inspect every single WhatsApp download/update for my own peace of mind and sanity, and I would also presume that very few people even from around here can. Anything coming out of FaceBook nowadays should be considered trackware and needs to be airgapped with the utmost diligence. Even the business/enterprise software is ridden with all sorts of trackers. Citrix Workspace client, for example, installs three "telemetry" helper processes that phone home non-stop. > Custom kernel extensions? No way. Yes way. They just have to be signed for same reasons as third party apps. See https://support.apple.com/en-au/guide/security/sec8e454101b/web https://support.apple.com/en-au/guide/security/sec8e454101b/... for details. I was recently scrubbing the file system off some legacy components and noticed, with a lot bewilderment, what extra 'useful' USB drivers a 4G MiFi device I had purchased over a decade ago installed at the 1st connection attempt. I, for one, don't need those 'niceties' to sneakily creep into any of my file systems or lurk around. In fact, OS X has become more GNU Hurd since 10.15 like by pushing kernel extensions into the user space instead, which reduces chances of the kernel crashing due to a bug in a random extension. More kernel stability and security? I say yes to both, albeit your mileage may vary.

pjmlp 5y ago

For NeXT the UNIX compatibility was a means to compete in the workstation market, nothing more. "Why We Have to Make UNIX Invisible." https://www.usenix.org/blog/vault-steve-jobs-keynotes-1987-usenix-atc https://www.usenix.org/blog/vault-steve-jobs-keynotes-1987-u...