6 ms·

You have an increased number of hoops to jump through if you want your computer to be programmable. At first, it was Gatekeeper. Yeah, appeared in 10.8. Then n

You have an increased number of hoops to jump through if you want your computer to be programmable. At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. Custom kernel extensions? No way. It's like slowly boiling the water in which you sit. Little things, but one by one they accumulate into quite a lump of red tape, and Apple seems to drive home the point that a developer is a different caste than the user is, and there's some sacred knowledge that you should be in possession of, and update it every year for $99, so that you can program your computer. All the while the user is supposed to be clueless and in awe from this technological marvel the caste of engineers is bestowing unto them. Oh, and Apple wants to be a bottleneck in each and every process connected to programming their computers. They also remind you that the machines you pay mad bucks for, you don't really own. I like the pure Unix approach more, when the line between using the computer and programming it doesn't really exist, and where the system is basically your IDE too, and where you're going from being a user to being a programmer and back without really noticing. Mind you, it doesn't mean you have to go from one to the other, but when you want/need to, it's damn frictionless, and the system is as malleable as you want it to be.

inkyoto 5y ago
> You have an increased number of hoops to jump through if you want your computer to be programmable. > At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. You are confusing the local software development with the global software distribution. Anyone is free to install development tools, compilers and toolchains, compile and run anything locally on an OS X, just like on any other UNIX system, including Linux. Gatekeeper and the notarisation enforcement, which are a default but can be neutered, address a common use case of «my mom/little sister/grandfather/etc has downloaded and installed a seemingly useful app from a dodgy website that has excreted a ransomware that now demands a payment to give their data back, or leaked all of their contacts/personal data, or slowed their computing device 100 fold down». OS X does give lay users a way to turn checks off, including the system integrity protection, and shoot themselves in the foot if that is what they want. In fact, I would like to be able to selectively apply an even more, higher, restrictive security profile to any app, including to the ones available through Apple's own app store. Who can tell what potential spyware / trackware a 500+ Mb WhatsApp download from the official Apple app store contains within? WhatsApp desktop client is a mediocre (feature wise) messenger that is not even as feature rich as the 85Mb Telegram desktop download is. And I, for one, don't have the capacity to reverse engineer and manually inspect every single WhatsApp download/update for my own peace of mind and sanity, and I would also presume that very few people even from around here can. Anything coming out of FaceBook nowadays should be considered trackware and needs to be airgapped with the utmost diligence. Even the business/enterprise software is ridden with all sorts of trackers. Citrix Workspace client, for example, installs three "telemetry" helper processes that phone home non-stop. > Custom kernel extensions? No way. Yes way. They just have to be signed for same reasons as third party apps. See https://support.apple.com/en-au/guide/security/sec8e454101b/web https://support.apple.com/en-au/guide/security/sec8e454101b/... for details. I was recently scrubbing the file system off some legacy components and noticed, with a lot bewilderment, what extra 'useful' USB drivers a 4G MiFi device I had purchased over a decade ago installed at the 1st connection attempt. I, for one, don't need those 'niceties' to sneakily creep into any of my file systems or lurk around. In fact, OS X has become more GNU Hurd since 10.15 like by pushing kernel extensions into the user space instead, which reduces chances of the kernel crashing due to a bug in a random extension. More kernel stability and security? I say yes to both, albeit your mileage may vary.
- WesolyKubeczek 5y ago
  The thing is, you cannot harden it even more. If Apple Almighty hasn’t thought about your use case, it may as well not exist. There are two modes: either Apple nannying your systems like the overly attached yiddishe mame, or a mad ex breaking up with you, but also ripping out the locks from your doors before they go. Which is my freaking point exactly: you are being constantly reminded that despite having paid mad bucks for the hardware, Apple still owns it, snooping over your shoulder, giving you slaps on the hand if you dare „misuse” what they gave you.
  - GekkePrutser 5y ago
    This is the point, yes. You can turn most of it off, but then even regular software upgrades break before you even do any modifications. Running an outdated system is not viable in this day and age. Part of the reasons for locking down is 'security' (though a lot of it is so easy to bypass through Apple's own backdoors that it seems to be more form than function). Which makes some sense from the user's point of view. Part of the reasons is DRM for Apple's services. Apple TV, Music, App store, iOS apps. I don't care about that but there is not much I can do about it on their hardware. Soon we'll have a new category Apple will want to lock down the system for: the CSAM detection. Of course Apple will be hell-bent on preventing people trying to tamper with that. It will come with its own host of protections, which I bet will even be active when SIP is off. Right now there are already a bunch of folders which the root user can't even read. Try running a "find / 1>/dev/null" as root and you'll get a nice list of folders Apple considers too sensitive for the user even to look at. The problem is not security. The problem is Apple enforces security without the user being able to override their choices. There is no way to make modifications to system files and "bless" them so it will still boot after the next update. You have to do it every time. There's no UI for such features at all. Apple forgets that I'm the owner and admin of my system and doesn't give me the keys to manage it. It's fine for their new targeted audience which is mainstream users with a large disposable income. It's not great for power users with a unix background like myself. I lament that macOS has moved away from supporting my usecase because I did enjoy it for many years. But now I'm happier with FreeBSD with KDE. I really enjoy being able to trace a problem right down to its cause again. I love all the customisation options again.
astrange 5y ago
There's no overhead to ad-hoc signing. The linker does it by default and it's "ad-hoc" - it's literally a checksum, not a secure signature. You might complain about MAP_JIT but that's pretty important for security.
scarface74 5y ago
Everything you list makes the Mac more secure and more stable. For instance, with system integrity protection, a bad browser installer can’t wreck your entire computer. https://arstechnica.com/information-technology/2019/09/no-it-wasnt-a-virus-it-was-chrome-that-stopped-macs-from-booting/ https://arstechnica.com/information-technology/2019/09/no-it...
- WesolyKubeczek 5y ago
  I like to be in control precisely over how hardened I'd like my system to be. If I wreck it, I know how to reinstall it and restore my backups, thank you very much.
  - breakfastduck 5y ago
    And you can do that. Just turn it off. I honestly thing the 'lock down' is so overblown. Yes there's 'more hoops' - but you go through the hoop once. Seriously, if you're running a dev machine turning off 3, maybe 4, things once and never touching them again is hardly the biggest hurdle.
  - astrange 5y ago
    It's near-impossible to brick an M1 machine. You can always reinstall from a second machine using Apple Configurator. This is actually an experimental advantage over PCs, which you can brick if eg you erase the BIOS and backup BIOS.
    - GekkePrutser 5y ago
      The problem is, not everyone has a second machine. Not being able to install from USB or internet is really annoying from a support point of view.
      - scarface74 5y ago
        https://support.apple.com/en-us/HT204904 https://support.apple.com/en-us/HT204904
nine_k 5y ago
I hazard yo ask: have you tried Linux recently? Apple wants to produce customer appliances, not entirely but mostly locked down in the name of security and smooth customer experience, and there seems to be a large market for these.
- GekkePrutser 5y ago
  That was exactly my point above. They've moved on to a new market and the Unix power user market I'm part of is no longer in focus with Apple.
epistasis 5y ago
As somebody who writes code most days, and is constantly downloading and compiling others' code, your comment doesn't sound like we are in the same platform, even though I also use macOS. I wonder why our experiences are so different. For example, I don't have a $99 developer certificate, and am not sure why I would want or need one.
- deleted 5y ago
  [deleted]
- armitron 5y ago
  Try and distribute binaries (not source) that other people can run (not compile) and you'll quickly find out why.
kmeisthax 5y ago
The developer/user caste split is not unique to Apple. That's just how every computer has been used ever since we stopped booting (micro)computers straight into ROM BASIC. The moment you have people using software they did not develop, you create the opportunity for malware; and once you have malware you have OS vendors trying to lock it away from you. FWIW the biggest hoop an ordinary user would ever have to jump through on macOS is right-clicking an unsigned app bundle on first use to authorize it; which I've had to do on plenty of FOSS apps. This is not a problem, IMO - it is reasonable for the system to say "hey wait a second this app is new or different" and give you the opportunity to check twice before you jump. Code signing and notarization are things you only ever need to worry about if you want to distribute apps and not make your users right-click. Windows has similar problems with SmartScreen, except you can't even buy a code signing certificate to reliably make the problem go away, and Microsoft does an arguably better job at hiding the "no seriously this is just a FOSS app that hasn't jumped through all your hoops yet" option than macOS does.
- WesolyKubeczek 5y ago
  The problem with how Apple is treating FOSS apps is in that it’s using scary messages like „this could be a dangerous malware!” every time, all the time, if you want to distribute your software without paying Apple for what amounts to protection racket. Which leads to two outcomes: either you learn to right click everything and one day it’s going to be malware, too, or you „spctl --master-disable” and make the system turn a blind eye, and a drive-by zero-click kind of malware finds its way in. Or, if you are not really familiar with intricacies of software distribution in Apple’s ecosystem, there’s a third outcome: you believe Apple and for you, all FOSS is dangerous malware. Mind you, UAC nagging on Windows has the same problem, and sudo conditions you into just giving your computer password away left and right. I don’t know if a good solution exists, except maybe that you have to learn to not let your guard down in certain situations.
kergonath 5y ago
> At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. Custom kernel extensions? No way. I don’t know, from my experience just building and running works fine. As hoc signing is something the tool chain does. I don’t write kernel extensions so I cannot really comment on those (though I have a couple of them installed as a user and there was no significant hassle). The worst annoyance I’ve seen is having to authenticate every now and then to attach a debugger to a process. > there's some sacred knowledge that you should be in possession of, and update it every year for $99, so that you can program your computer. Programming your own computer has no red tape, the difficulties start when you want to distribute binaries, if you don’t want your users to have to right-click once. You can get compilers and things from xCode, Homebrew or MacPorts and they work without you having to pay anything. > I like the pure Unix approach more, when the line between using the computer and programming it doesn't really exist, and where the system is basically your IDE too, and where you're going from being a user to being a programmer and back without really noticing. Mind you, it doesn't mean you have to go from one to the other, but when you want/need to, it's damn frictionless, and the system is as malleable as you want it to be. Yes, it’s nice. But my ose of MacOS and Linux are not very different in that regard (true, I spent quite a bit of time customising xfce, which was fun). Also, to be a bit realistic it does not really work with end users in general. For a mass market OS, the fewer footguns the better.

inkyoto 5y ago

> You have an increased number of hoops to jump through if you want your computer to be programmable. > At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. You are confusing the local software development with the global software distribution. Anyone is free to install development tools, compilers and toolchains, compile and run anything locally on an OS X, just like on any other UNIX system, including Linux. Gatekeeper and the notarisation enforcement, which are a default but can be neutered, address a common use case of «my mom/little sister/grandfather/etc has downloaded and installed a seemingly useful app from a dodgy website that has excreted a ransomware that now demands a payment to give their data back, or leaked all of their contacts/personal data, or slowed their computing device 100 fold down». OS X does give lay users a way to turn checks off, including the system integrity protection, and shoot themselves in the foot if that is what they want. In fact, I would like to be able to selectively apply an even more, higher, restrictive security profile to any app, including to the ones available through Apple's own app store. Who can tell what potential spyware / trackware a 500+ Mb WhatsApp download from the official Apple app store contains within? WhatsApp desktop client is a mediocre (feature wise) messenger that is not even as feature rich as the 85Mb Telegram desktop download is. And I, for one, don't have the capacity to reverse engineer and manually inspect every single WhatsApp download/update for my own peace of mind and sanity, and I would also presume that very few people even from around here can. Anything coming out of FaceBook nowadays should be considered trackware and needs to be airgapped with the utmost diligence. Even the business/enterprise software is ridden with all sorts of trackers. Citrix Workspace client, for example, installs three "telemetry" helper processes that phone home non-stop. > Custom kernel extensions? No way. Yes way. They just have to be signed for same reasons as third party apps. See https://support.apple.com/en-au/guide/security/sec8e454101b/web https://support.apple.com/en-au/guide/security/sec8e454101b/... for details. I was recently scrubbing the file system off some legacy components and noticed, with a lot bewilderment, what extra 'useful' USB drivers a 4G MiFi device I had purchased over a decade ago installed at the 1st connection attempt. I, for one, don't need those 'niceties' to sneakily creep into any of my file systems or lurk around. In fact, OS X has become more GNU Hurd since 10.15 like by pushing kernel extensions into the user space instead, which reduces chances of the kernel crashing due to a bug in a random extension. More kernel stability and security? I say yes to both, albeit your mileage may vary.

WesolyKubeczek 5y ago
The thing is, you cannot harden it even more. If Apple Almighty hasn’t thought about your use case, it may as well not exist. There are two modes: either Apple nannying your systems like the overly attached yiddishe mame, or a mad ex breaking up with you, but also ripping out the locks from your doors before they go. Which is my freaking point exactly: you are being constantly reminded that despite having paid mad bucks for the hardware, Apple still owns it, snooping over your shoulder, giving you slaps on the hand if you dare „misuse” what they gave you.
- GekkePrutser 5y ago
  This is the point, yes. You can turn most of it off, but then even regular software upgrades break before you even do any modifications. Running an outdated system is not viable in this day and age. Part of the reasons for locking down is 'security' (though a lot of it is so easy to bypass through Apple's own backdoors that it seems to be more form than function). Which makes some sense from the user's point of view. Part of the reasons is DRM for Apple's services. Apple TV, Music, App store, iOS apps. I don't care about that but there is not much I can do about it on their hardware. Soon we'll have a new category Apple will want to lock down the system for: the CSAM detection. Of course Apple will be hell-bent on preventing people trying to tamper with that. It will come with its own host of protections, which I bet will even be active when SIP is off. Right now there are already a bunch of folders which the root user can't even read. Try running a "find / 1>/dev/null" as root and you'll get a nice list of folders Apple considers too sensitive for the user even to look at. The problem is not security. The problem is Apple enforces security without the user being able to override their choices. There is no way to make modifications to system files and "bless" them so it will still boot after the next update. You have to do it every time. There's no UI for such features at all. Apple forgets that I'm the owner and admin of my system and doesn't give me the keys to manage it. It's fine for their new targeted audience which is mainstream users with a large disposable income. It's not great for power users with a unix background like myself. I lament that macOS has moved away from supporting my usecase because I did enjoy it for many years. But now I'm happier with FreeBSD with KDE. I really enjoy being able to trace a problem right down to its cause again. I love all the customisation options again.

astrange 5y ago

There's no overhead to ad-hoc signing. The linker does it by default and it's "ad-hoc" - it's literally a checksum, not a secure signature. You might complain about MAP_JIT but that's pretty important for security.

scarface74 5y ago

Everything you list makes the Mac more secure and more stable. For instance, with system integrity protection, a bad browser installer can’t wreck your entire computer. https://arstechnica.com/information-technology/2019/09/no-it-wasnt-a-virus-it-was-chrome-that-stopped-macs-from-booting/ https://arstechnica.com/information-technology/2019/09/no-it...

WesolyKubeczek 5y ago
I like to be in control precisely over how hardened I'd like my system to be. If I wreck it, I know how to reinstall it and restore my backups, thank you very much.
- breakfastduck 5y ago
  And you can do that. Just turn it off. I honestly thing the 'lock down' is so overblown. Yes there's 'more hoops' - but you go through the hoop once. Seriously, if you're running a dev machine turning off 3, maybe 4, things once and never touching them again is hardly the biggest hurdle.
- astrange 5y ago
  It's near-impossible to brick an M1 machine. You can always reinstall from a second machine using Apple Configurator. This is actually an experimental advantage over PCs, which you can brick if eg you erase the BIOS and backup BIOS.
  - GekkePrutser 5y ago
    The problem is, not everyone has a second machine. Not being able to install from USB or internet is really annoying from a support point of view.
    - scarface74 5y ago
      https://support.apple.com/en-us/HT204904 https://support.apple.com/en-us/HT204904

nine_k 5y ago

I hazard yo ask: have you tried Linux recently? Apple wants to produce customer appliances, not entirely but mostly locked down in the name of security and smooth customer experience, and there seems to be a large market for these.

GekkePrutser 5y ago
That was exactly my point above. They've moved on to a new market and the Unix power user market I'm part of is no longer in focus with Apple.

epistasis 5y ago

As somebody who writes code most days, and is constantly downloading and compiling others' code, your comment doesn't sound like we are in the same platform, even though I also use macOS. I wonder why our experiences are so different. For example, I don't have a $99 developer certificate, and am not sure why I would want or need one.

deleted 5y ago
[deleted]
armitron 5y ago
Try and distribute binaries (not source) that other people can run (not compile) and you'll quickly find out why.

kmeisthax 5y ago

The developer/user caste split is not unique to Apple. That's just how every computer has been used ever since we stopped booting (micro)computers straight into ROM BASIC. The moment you have people using software they did not develop, you create the opportunity for malware; and once you have malware you have OS vendors trying to lock it away from you. FWIW the biggest hoop an ordinary user would ever have to jump through on macOS is right-clicking an unsigned app bundle on first use to authorize it; which I've had to do on plenty of FOSS apps. This is not a problem, IMO - it is reasonable for the system to say "hey wait a second this app is new or different" and give you the opportunity to check twice before you jump. Code signing and notarization are things you only ever need to worry about if you want to distribute apps and not make your users right-click. Windows has similar problems with SmartScreen, except you can't even buy a code signing certificate to reliably make the problem go away, and Microsoft does an arguably better job at hiding the "no seriously this is just a FOSS app that hasn't jumped through all your hoops yet" option than macOS does.

WesolyKubeczek 5y ago
The problem with how Apple is treating FOSS apps is in that it’s using scary messages like „this could be a dangerous malware!” every time, all the time, if you want to distribute your software without paying Apple for what amounts to protection racket. Which leads to two outcomes: either you learn to right click everything and one day it’s going to be malware, too, or you „spctl --master-disable” and make the system turn a blind eye, and a drive-by zero-click kind of malware finds its way in. Or, if you are not really familiar with intricacies of software distribution in Apple’s ecosystem, there’s a third outcome: you believe Apple and for you, all FOSS is dangerous malware. Mind you, UAC nagging on Windows has the same problem, and sudo conditions you into just giving your computer password away left and right. I don’t know if a good solution exists, except maybe that you have to learn to not let your guard down in certain situations.

kergonath 5y ago

> At first, it was Gatekeeper. Yeah, appeared in 10.8. Then notarization. Now, on M1 you need to sign your binaries ad-hoc or they won't run. Custom kernel extensions? No way. I don’t know, from my experience just building and running works fine. As hoc signing is something the tool chain does. I don’t write kernel extensions so I cannot really comment on those (though I have a couple of them installed as a user and there was no significant hassle). The worst annoyance I’ve seen is having to authenticate every now and then to attach a debugger to a process. > there's some sacred knowledge that you should be in possession of, and update it every year for $99, so that you can program your computer. Programming your own computer has no red tape, the difficulties start when you want to distribute binaries, if you don’t want your users to have to right-click once. You can get compilers and things from xCode, Homebrew or MacPorts and they work without you having to pay anything. > I like the pure Unix approach more, when the line between using the computer and programming it doesn't really exist, and where the system is basically your IDE too, and where you're going from being a user to being a programmer and back without really noticing. Mind you, it doesn't mean you have to go from one to the other, but when you want/need to, it's damn frictionless, and the system is as malleable as you want it to be. Yes, it’s nice. But my ose of MacOS and Linux are not very different in that regard (true, I spent quite a bit of time customising xfce, which was fun). Also, to be a bit realistic it does not really work with end users in general. For a mass market OS, the fewer footguns the better.