14 ms·

Apple’s macOS Ventura – New Security Changes

176 points by alwillis 4y ago

jmull 4y ago
> However, the Gatekeeper check here is overridable by users. This is presented as a flaw, but I'm not sure they are thinking through the alternatives. It's hard to give too much credence to security experts who are't thinking holistically. Perhaps there is a flaw, but I'm curious to know what it is.
- etchalon 4y ago
  Things the user can override are things social engineers can convince users to override.
  - cmg 4y ago
    Exactly. Technical measures are important, but if someone wants to play a game or do something that's been banned on Apple's stores and finds a site that claims to have an installer (which is actually malware) with instructions to disable Gatekeeper or SIP or what not, social engineering can work. Their goal is to do the thing they wanted to do, probably not thinking of security in the meanwhile. Popup alerts are going to be interpreted as something to get rid of so they can do the thing. It's a difficult balance. Power users, engineers, developers - we can (usually) tell when warnings need to be heeded. People who use their devices to achieve a goal without really understanding or caring about what's happening usually won't.
    - macintux 4y ago
      I still recall when that viral elf bowling game was showing up on everyone's computers, and it struck me that we were all quite fortunate it wasn't secretly malware.
    - GekkePrutser 4y ago
      It's not a balance. There must be a way to override it. I really don't want Apple to decide what I can have on my computer like they do with iOS. It'll be more secure but also a lot less free and functional.
  - KerrAvon 4y ago
    Yes. Note that thus is the technical argument for disallowing sideloading.
    - josephcsible 4y ago
      Let's also ban antifreeze because someone could kill you by socially engineering you into drinking it.
  - grishka 4y ago
    To which my answer is — being alive is risky, get over it and stop treating all people like idiots that need constant oversight lest they do something potentially dangerous.
    - etchalon 4y ago
      "... and that's why I don't wear a helmet."
  - r00fus 4y ago
    This is overboard. Defaults matter a LOT. Requiring users to override defaults to deliver ad/malware is a losing proposition and ad/malware creators know this.
- dagmx 4y ago
  They explain their reasoning right after that statement. Their concern is social engineering is still a way to convince people to override this.
  - GekkePrutser 4y ago
    It is but there needs to be a way for the user to keep full control of the system they own of they choose to have it. And enterprises already have a way to turn this override off so I don't really understand their beef here.
- kybernetyk 4y ago
  Security folks tend to have a very myopic view on things. Ever wondered why your computer got less and less useable? Security people pushing their agenda.
  - pjmlp 4y ago
    Yeah, because we get many sad users when their hard drive gets encrypted by ransomware, and even more so if it is a shared drive. So the less toys to play, the better.
  - threeseed 4y ago
    > Ever wondered why your computer got less and less useable Would disagree. I think the security changes have made the OS more usable since I now get visibility into what apps are doing. And I love the idea that security people pushing their agenda of making devices more secure and more private is painted as a bad thing.
  - m463 4y ago
    I've always learned: security = 1/convenience
ramesh31 4y ago
Am I the only one increasingly frustrated with macOS's naming scheme? I have no idea what the latest version is. Ubuntu versioning gets this right; you can parse their codenames alphabetically to derive the semantic version. But Apple's heuristic here seems to be "throw a dart at a map of California".
- Ruq 4y ago
  I just miss the Big Cat names.
- ubercore 4y ago
  Hasn't it been this way the whole time? Why is your frustration increasing?
  - itg 4y ago
    I imagine as the number of versions increase, there is more tracking you have to do when someone doesn't explicitly mention the version number.
    - saurik 4y ago
      That's definitely my issue: over the years, we have accumulated more and more and more of these names. When someone talks about iOS 4 or iOS 7 in some article I am reading, I know what they are talking about and the extent to which the version matters; but, when someone talks about macOS Gaviota, I have to think "wait, was that the one that just came out, or was that one of the ones I haven't had to think about in a decade? oh shit... maybe it's the one that got announced today and I just haven't heard the name yet?!". (That said, I will also note that frustration is not inherently constant even when something is truly static: sometimes you get used to something over time and it stops bothering you, while other times it slowly drives you mad.)
  - guerrilla 4y ago
    Haven't you not been getting food this whole time? Why is your frustration increasing?
pram 4y ago
The login items panel is such a good change, and also like 20 years overdue.
- jessriedel 4y ago
  Yes, I have been baffled that it was always so difficult for the user to manage what’s auto-launched on start-up. So many apps try to bury into start-up so they can keep collecting data and lightly spamming the user. Can anyone shed light on why it took so long? I had always figured the non-existence of a login items panel was a purposeful choice.
  - nvrspyx 4y ago
    It's actually been there for a long time. It's a separate tab in "Users & Groups" pre-Ventura.
    - yurishimo 4y ago
      Apps aren’t required to use that screen though. Some of them will, but a lot of apps not in the App Store can and do register themselves with launchd on their own. Apple should be proactive and extract those items automatically, but in practice, they don’t.
      - GekkePrutser 4y ago
        Launch agents and daemons didn't even show up there. It was more for the user themselves to register programs they wanted to auto open. However that feature became a bit stale since macOS started reopening all apps anyway.
    - mrtesthah 4y ago
      No, the “Login Items” panel that was previously under Users & Groups did not include Launch Agents or Launch Daemons. Launch Daemons in particular are managed directly by launchd and can have more sophisticated triggers including periodic execution.
Ensorceled 4y ago
5-6 year support for hardware is just too short. I have a Mid 2015 Macbook Pro as a "backup" and that computer is still quite decent.
- Kerrick 4y ago
  MacOS versions tend to receive security updates for 2 additional years after they’re supplanted, so it’s more like 7-8 years. Plus, all of the Macs that aren’t eligible for Ventura can use Bootcamp to install Windows or dual boot into Linux if you’re not happy with MacOS anymore.
  - michaelmrose 4y ago
    The newest machine that can't run the new version would be a Mac Pro purchased a scant 4 years ago. Potentially for several thousand dollars. Meanwhile there are 10 year old ~$1000 Thinkpads running Windows 11 or Linux. If they just wanted to run Linux on it they could have saved themselves some money. 8 years of updates to current version and 10 years of security updates should be the absolute minimum for every expensive hardware.
    - unix_fan 4y ago
      I question anyone purchasing a machine with generations old hardware in 2018. Especially considering the Mac pro had been supplanted by newer macs at that point.
      - lostmsu 4y ago
        In 2018 CPUs were still stagnating, so a 2013 CPU would likely be almost as performant as the latest one.
        nicky0 4y ago
        It's not really about the CPU power, more that by 2018 it was well known that the Trashcan Mac Pro was a dead-end design and a soon to have radical refresh.
sharikous 4y ago
At least two other security changes: - userspace filesystems: the nail on the coffin for kernel extensions. Now we won't need to run in "reduced security" to use FUSE and that was the last kernel extension that remained popular. Probably kexts will be deprecated shortly - rapid security response - it seems also to include changes in Xprotect and mrt
- dagmx 4y ago
  Do you have any links on the userspace filesystems? There's a few things I'd like to develop in that regard without getting into kexts
  - sharikous 4y ago
    There is that: https://threedots.ovh/blog/2022/06/quick-look-at-user-mode-file-systems-on-macos-ventura/ https://threedots.ovh/blog/2022/06/quick-look-at-user-mode-f... But userspace filesystems are already present in iOS so you can find some reverse engineered info on that (e.g. in Jonathan Levin's books)
    - dagmx 4y ago
      Thanks
      - my123 4y ago
        Note that UVFS is currently not exposed to third parties. For your own 3rd-party file systems, you'll still have to use a kernel extension for now. (or local NFS mount).
- dochtman 4y ago
  Very curious about userspace filesystems, would be awesome if there's finally a fast solution for this that's well-supported in the OS.
- pxc 4y ago
  > the nail on the coffin for kernel extensions The OpenZFS implementation on macOS also requires kernel extensions, and I don't suppose it can easily be ported to FUSE or that that would have desirable performance characteristics. Special kernel extensions are also required to get some basic functionality working on macOS these days, like disabling pointer acceleration.
jessriedel 4y ago
Mostly off-topic: have Apple and Microsoft completely given up on non-trivial changes to desktop operating systems? Will MacOS look basically the same in 40 years? Or is the idea that everything will be AR/VR by then and there is no use innovating in this domain?
- dagmx 4y ago
  I guess you'd need to set a goal post of what counts as trivial? Many of the things mentioned in the article aren't trivial. They may be smaller in scope, but size (large / small) are different than complexity. You can take a look at what's new in Ventura https://www.apple.com/macos/macos-ventura-preview/features/ https://www.apple.com/macos/macos-ventura-preview/features/ but that's not even getting into the under pinnings. Similarly Microsoft made fairly significant changes to Windows between 10 and 11, and several times to 10 within its life cycle. Unless you're talking purely visual design, in which case what kind of changes would you expect without upending people's workflow?
  - jessriedel 4y ago
    We have gotten so use to these trivial changes that our expectations have renormalized. Desktop OSs are asymptotically approaching a fixed point. Examples of modest but non-trivial changes: - eliminate the folder-file system (or at least make it completely invisible to the user) - remove UI distinction (but not necessarily the sandbox distinction) between web apps and normal apps. - seamless mobile-desktop integration, so the user views them as just different form factors for accessing the same resources. (There are of course much more radical changes than these that one could imagine.)
    - dagmx 4y ago
      I'm curious as to your background if you consider any of the things mentioned in the articles as "trivial" changes. Have you worked in systems development before? I similarly question your definition of "modest". The first one alone is incredibly radical, and has been tried several times in the past but people keep asking for hierarchical file systems. It's far from modest. 1. How do you propose users organize things? 2. Already exists today with electron and webview. What would you propose an OS provide here? Many apps you use today on macOS are web apps within a native context. 3. This is already growing on macOS with features like continuity handofd, universal control, being able to run mobile apps on desktop, iCloud sync of projects etc.. Each year they've clearly moved towards unifying things. If these are what you consider modest though, I fear what you consider radical without throwing out decades of learned user interaction in the process
kappuchino 4y ago
Lets hope the open core project, namely the Open Core Legacy Patcher[1] will revive some older models to run Ventura. Personally, I'm running a 2014/15 Macbook Air 11" for 7 years now[2] and with "Open Core Legacy" on Monterrey with no issues at all. [1] https://dortania.github.io/OpenCore-Legacy-Patcher/MODELS.html https://dortania.github.io/OpenCore-Legacy-Patcher/MODELS.ht... [2] Except the mainboard, display and shell everything else thats modular (wifi card, ssd, battery and keyboard) was replaced/repaired at some point.
- Synaesthesia 4y ago
  In pretty confident it will, the OCLP project has improved a lot and is now very capable and stable. My MacBook Pro 2012 runs Monterey, and it's really fast and stable. Better than any previous Mac OS in fact. You can look on the Macrumors forum and Reddit to see if they're already getting the betas to work. https://forums.macrumors.com/threads/macos-13-ventura-on-unsupported-macs-thread.2346881/ https://forums.macrumors.com/threads/macos-13-ventura-on-uns... https://www.reddit.com/r/venturapatcher/ https://www.reddit.com/r/venturapatcher/ Edit: the OCLP team released an official statement, looks like they're having quite a few challenges. https://github.com/dortania/OpenCore-Legacy-Patcher/issues/998 https://github.com/dortania/OpenCore-Legacy-Patcher/issues/9...
  - alexd111 4y ago
    Interesting that you say that it's faster and more stable. My 2013 Air is on Monterey and it's "good enough" for my needs still, but slipping towards not quite good enough. Very tempted to give OCLP a try if it extends the life of the machine a bit more.
- ksec 4y ago
  May be off topic but this had me thinking. Will Safari 16 be available on older macOS? Assuming Apple doesn't break their tradition it should support two prior OS release, Monterey and Big Sur. While I could do without an OS update on my MacBook Pro 2015. ( I cant record a single useful feature from all the previous OS update other than Universal Clipboard ) That means for MacBook Pro 2015 Model users they will only have two more Safari Update.
prpl 4y ago
I’m sure quite a few MBP 2015 users are going to be a little sad the end is near. I loved that machine. I was able to skip the 2017 MBP and go to 2019, but honestly I miss the smaller trackpad.
- brundolf 4y ago
  Will non-Ventura devices still get vulnerabilities patched, or are they dead in the water?
  - crest 4y ago
    Apple has established a pattern of haphazardly offering partial and late security updates for the two more releases (e.g. Big Sur, Monterey, Ventura).
    - philistine 4y ago
      Looking from the outside, it sure does look like every security patch is assessed on its difficulty to port to older OSes, its severity, and its reach. It can be maddening.
  - samcat116 4y ago
    Security updates are N-2 I believe (so current OS and last two major versions).
- MrBuddyCasino 4y ago
  Still using the 2013 and 2015 MBPs here, had no reason to upgrade. Love them to death, still no hardware issues whatsoever except a new battery. I also prefer the smaller trackpad. Guess its time to gift them to my parents. Luckily, the M1/M2 is finally a worthy upgrade, after years of keyboard issues and unwanted features.
  - soylentgraham 4y ago
    My 2013 mbp is being retired for a mac studio as I accidentally updated ios to a version that needs xcode13, which i cannot install. It had a good run! (My 2011 imac died last year)
DavideNL 4y ago
> "Passkeys aim to solve the problems with passwords" So are you locked in with Apple if you use this, or can you switch all your existing passwords to another "passkey provider/service" ? > "Wave Goodbye to CAPTCHAS" I assume that's Safari only... so this is bad news for Firefox?
- anaisbetts 4y ago
  Assumedly any service that implements this will let you reset your password away from Passkeys, but it's still the soft lockin of "Ughhhh I don't want to reset everything". Sites will never go full Passkeys because that obviously falls over if you want to access it from any other device or computer, support request costs would go through the ceiling
  - philistine 4y ago
    I wouldn’t be surprised if banks go passkeys only.
    - skoskie 4y ago
      By 2040.
- gernb 4y ago
  curious too as someone that uses 7 computers running 3 OSes, are my passkeys accessable, syncable, across OSes?
  - alwillis 4y ago
    One obvious solution is to use a cross-platform password manager that supports Passkeys [1]. [1]: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
- PartiallyTyped 4y ago
  > In collaboration with Google, Microsoft and other industry players, Apple has been working on a new logon technology for web and other remote services called ‘passkeys’. I don't think it will be Apple only. However, I am wondering what will happen to services like bitwarden [1] if it is available on other OSes as well. [1] https://bitwarden.com/ https://bitwarden.com/
kemayo 4y ago
Nothing terribly major here, it sounds like. Making login items visible is a long-overdue change... but none of these are going to have any particular impact on average users or average apps. On a pettier note, can we get a better source than a website that's using JS to change its title when it doesn't have focus to try to gain attention? (It toggles about every second between "macOS Ventura | 7 New Security Changes to Be Aware Of" and "Message from SentinelOne". https://imgur.com/ynPqpvK https://imgur.com/ynPqpvK - it's pretty awful.) I don't normally complain about scummy websites on here, but this is just annoying. Interestingly, I went looking for alternative sources for the content, and found that identical content is on other sites [1] which are also doing the same title-flicker technique. So presumably this is part of some content network... [1]: https://phxtechsol.com/2022/06/13/apples-macos-ventura-7-new-security-changes-to-be-aware-of/ https://phxtechsol.com/2022/06/13/apples-macos-ventura-7-new...
- deleted 4y ago
  [deleted]
- joshgachnang 4y ago
  I'm not surprised they're using scummy tactics. Their actual software runs like crap, so gotta do whatever they can to get users. I had a work MBP and personal MBP with exactly the same specs, main difference being the Sentinel One agent. The work one was constantly spinning up the fans, S1 was gobbling up memory, and support was completely useless in diagnosing. Their Linux agent isn't much better with constant memory leaks.
- sys_64738 4y ago
  I noticed it even did that in Reader Mode in Safari. Really annoying.
- saagarjha 4y ago
  There’s a lot of changes under the hood that this post doesn’t mention.
deleted 4y ago
[deleted]
captn3m0 4y ago
Do the new DNSSEC changes imply anything for local DNS overrides? Would Apple refuse to block a site if DNSSEC is enabled and PiHole returns a blocking response?
- tptacek 4y ago
  Probably not. I haven't been able to dig into what they're doing, but I watched the presentation about the feature, and it's an opt-in API for applications. I'm not clear on this but I have to assume that the macOS/iOS resolver code is still leaning on your external recursor to do the DNSSEC validation stuff (otherwise, it's going to generate _a lot_ of extra lookup traffic), which means it's going to trust whatever your PiHole tells it anyways.
Lammy 4y ago
> Gatekeeper’s role is to ensure that when users execute some code, that code meets the local system policy. The policy includes checks such as whether the code is validly signed and whether it has been tampered with in certain ways. Weasel-word alert. I never thought I’d see the day when technologists would applaud the gradual death of general-purpose computing, but here we are. A decade from now Apple probably won’t even ship a local version of Xcode, and the transformation will be complete as all new development happens in Xcode Cloud where no line of code goes unscrutinized by the watchful eye of the mother ship. At least we’ll be Safe™.
- RONROC 4y ago
  There is no more prescient of a take on this news as this one. Once the singularity is nearly complete you'll know: macOS and iOS will merge into one monolithic OS.
- kccqzy 4y ago
  Gatekeeper was introduced in 2011 in Lion. It has already been a decade. I didn't see that transformation happening.
  - Lammy 4y ago
    The existence of Gatekeeper already causes a huge privacy violation by “requiring” my computer to phone home to verify the signature the first time it launches an application. Everyone should have realized this when Apple’s OCSP responder went down in November 2020 and nobody could launch anything that wasn’t built in to the OS. According to TFA this kind of verification will now occur every time an application is launched to deter post-verification “tampering” by you, the user. How big of a privacy violation would it have to become to bother you, out of curiosity? If we let this continue we will end up in a future where full “Remote Attestation” of every hardware and software component is required to participate in the Internet. This isn’t hypothetical doom-saying, either: game consoles already work like this. I remember my XBOX360 could detect modified DVD drive firmware, launches of individual pieces of software (e.g. Halo 3 Delta leak), and other types of system modifications, then it would permanently ban that machine from XBOX LIVE. And that was all 15+ years ago. Just imagine what a gift this will be to law enforcement, for example, once they can go to Apple all like “Hey, Siri, show me all users of Tor Browser around the time of ${BITCOIN_TRANSACTION_ID}”.
deleted 4y ago
[deleted]
forgotmypw17 4y ago
Somewhere between Mountain Lion and High Sierra, it became impossible to delete or even mark non-executable various annoying built-in applications which I never use, e.g. iTunes.app and Safari.app, which often open without me asking them to. Does anyone know how to re-enable this functionality?
- deleted 4y ago
  [deleted]
- plorkyeran 4y ago
  As of Big Sur it's impossible. The entire OS is now a single cryptographically signed image that's verified on boot, which is great for security but it includes some things that don't particularly need to be locked down.
zmmmmm 4y ago
Most concerning is Gatekeeper, as I do still routinely run into scenarios where it harassess me about applications I am trying to run and on the odd occasion I have to manually codesign things. It will be super annoying if this now starts making developer's life hell because it is nannying binaries they are building, sharing or working with as part of their development work.
- Wowfunhappy 4y ago
  You can completely disable Gatekeeper if it annoys you: $ sudo spctl --master-disable
  - idle_zealot 4y ago
    I’ve done this a few times but still get nagged when launching unsigned apps for the first time. Is that part of a different security mechanism?
    - Wowfunhappy 4y ago
      Probably, I would need to see the message to be sure what you're referring to. But LaunchServices will for example still warn you the first time you open a downloaded application. You used to be able to get rid of that with `defaults write com.apple.LaunchServices LSQuarantine -bool false` but I don't know if the syntax has changed.
- deleted 4y ago
  [deleted]
- dagmx 4y ago
  If you're building, you can designate something as a developer tool and gatekeeper will ignore it.
sydthrowaway 4y ago
The security engineering division at Apple intends to destroy this product.
GekkePrutser 4y ago
I don't think number 2 (specifically the complaint that the user can override gatekeeper) in their list is really an issue for enterprises. If they want they can already turn off the gatekeeper user override through a profile. I do exactly that on our Macs. And for consumers I don't think it's a good idea to remove this option altogether. The owner should have full control if they desire it. The constant check for modifications is great though. I'm surprised that wasn't the case before.
post_break 4y ago
So is Rogue Amoeba essentially screwed then?

176 points by alwillis 4y ago

> However, the Gatekeeper check here is overridable by users. This is presented as a flaw, but I'm not sure they are thinking through the alternatives. It's hard to give too much credence to security experts who are't thinking holistically. Perhaps there is a flaw, but I'm curious to know what it is.

etchalon 4y ago
Things the user can override are things social engineers can convince users to override.
- cmg 4y ago
  Exactly. Technical measures are important, but if someone wants to play a game or do something that's been banned on Apple's stores and finds a site that claims to have an installer (which is actually malware) with instructions to disable Gatekeeper or SIP or what not, social engineering can work. Their goal is to do the thing they wanted to do, probably not thinking of security in the meanwhile. Popup alerts are going to be interpreted as something to get rid of so they can do the thing. It's a difficult balance. Power users, engineers, developers - we can (usually) tell when warnings need to be heeded. People who use their devices to achieve a goal without really understanding or caring about what's happening usually won't.
  - macintux 4y ago
    I still recall when that viral elf bowling game was showing up on everyone's computers, and it struck me that we were all quite fortunate it wasn't secretly malware.
  - GekkePrutser 4y ago
    It's not a balance. There must be a way to override it. I really don't want Apple to decide what I can have on my computer like they do with iOS. It'll be more secure but also a lot less free and functional.
- KerrAvon 4y ago
  Yes. Note that thus is the technical argument for disallowing sideloading.
  - josephcsible 4y ago
    Let's also ban antifreeze because someone could kill you by socially engineering you into drinking it.
- grishka 4y ago
  To which my answer is — being alive is risky, get over it and stop treating all people like idiots that need constant oversight lest they do something potentially dangerous.
  - etchalon 4y ago
    "... and that's why I don't wear a helmet."
- r00fus 4y ago
  This is overboard. Defaults matter a LOT. Requiring users to override defaults to deliver ad/malware is a losing proposition and ad/malware creators know this.
dagmx 4y ago
They explain their reasoning right after that statement. Their concern is social engineering is still a way to convince people to override this.
- GekkePrutser 4y ago
  It is but there needs to be a way for the user to keep full control of the system they own of they choose to have it. And enterprises already have a way to turn this override off so I don't really understand their beef here.
kybernetyk 4y ago
Security folks tend to have a very myopic view on things. Ever wondered why your computer got less and less useable? Security people pushing their agenda.
- pjmlp 4y ago
  Yeah, because we get many sad users when their hard drive gets encrypted by ransomware, and even more so if it is a shared drive. So the less toys to play, the better.
- threeseed 4y ago
  > Ever wondered why your computer got less and less useable Would disagree. I think the security changes have made the OS more usable since I now get visibility into what apps are doing. And I love the idea that security people pushing their agenda of making devices more secure and more private is painted as a bad thing.
- m463 4y ago
  I've always learned: security = 1/convenience

ramesh31 4y ago

Am I the only one increasingly frustrated with macOS's naming scheme? I have no idea what the latest version is. Ubuntu versioning gets this right; you can parse their codenames alphabetically to derive the semantic version. But Apple's heuristic here seems to be "throw a dart at a map of California".

Ruq 4y ago
I just miss the Big Cat names.
ubercore 4y ago
Hasn't it been this way the whole time? Why is your frustration increasing?
- itg 4y ago
  I imagine as the number of versions increase, there is more tracking you have to do when someone doesn't explicitly mention the version number.
  - saurik 4y ago
    That's definitely my issue: over the years, we have accumulated more and more and more of these names. When someone talks about iOS 4 or iOS 7 in some article I am reading, I know what they are talking about and the extent to which the version matters; but, when someone talks about macOS Gaviota, I have to think "wait, was that the one that just came out, or was that one of the ones I haven't had to think about in a decade? oh shit... maybe it's the one that got announced today and I just haven't heard the name yet?!". (That said, I will also note that frustration is not inherently constant even when something is truly static: sometimes you get used to something over time and it stops bothering you, while other times it slowly drives you mad.)
- guerrilla 4y ago
  Haven't you not been getting food this whole time? Why is your frustration increasing?

pram 4y ago

The login items panel is such a good change, and also like 20 years overdue.

jessriedel 4y ago
Yes, I have been baffled that it was always so difficult for the user to manage what’s auto-launched on start-up. So many apps try to bury into start-up so they can keep collecting data and lightly spamming the user. Can anyone shed light on why it took so long? I had always figured the non-existence of a login items panel was a purposeful choice.
- nvrspyx 4y ago
  It's actually been there for a long time. It's a separate tab in "Users & Groups" pre-Ventura.
  - yurishimo 4y ago
    Apps aren’t required to use that screen though. Some of them will, but a lot of apps not in the App Store can and do register themselves with launchd on their own. Apple should be proactive and extract those items automatically, but in practice, they don’t.
    - GekkePrutser 4y ago
      Launch agents and daemons didn't even show up there. It was more for the user themselves to register programs they wanted to auto open. However that feature became a bit stale since macOS started reopening all apps anyway.
  - mrtesthah 4y ago
    No, the “Login Items” panel that was previously under Users & Groups did not include Launch Agents or Launch Daemons. Launch Daemons in particular are managed directly by launchd and can have more sophisticated triggers including periodic execution.

Ensorceled 4y ago

5-6 year support for hardware is just too short. I have a Mid 2015 Macbook Pro as a "backup" and that computer is still quite decent.

Kerrick 4y ago
MacOS versions tend to receive security updates for 2 additional years after they’re supplanted, so it’s more like 7-8 years. Plus, all of the Macs that aren’t eligible for Ventura can use Bootcamp to install Windows or dual boot into Linux if you’re not happy with MacOS anymore.
- michaelmrose 4y ago
  The newest machine that can't run the new version would be a Mac Pro purchased a scant 4 years ago. Potentially for several thousand dollars. Meanwhile there are 10 year old ~$1000 Thinkpads running Windows 11 or Linux. If they just wanted to run Linux on it they could have saved themselves some money. 8 years of updates to current version and 10 years of security updates should be the absolute minimum for every expensive hardware.
  - unix_fan 4y ago
    I question anyone purchasing a machine with generations old hardware in 2018. Especially considering the Mac pro had been supplanted by newer macs at that point.
    - lostmsu 4y ago
      In 2018 CPUs were still stagnating, so a 2013 CPU would likely be almost as performant as the latest one.
      - nicky0 4y ago
        It's not really about the CPU power, more that by 2018 it was well known that the Trashcan Mac Pro was a dead-end design and a soon to have radical refresh.

sharikous 4y ago

At least two other security changes: - userspace filesystems: the nail on the coffin for kernel extensions. Now we won't need to run in "reduced security" to use FUSE and that was the last kernel extension that remained popular. Probably kexts will be deprecated shortly - rapid security response - it seems also to include changes in Xprotect and mrt

dagmx 4y ago
Do you have any links on the userspace filesystems? There's a few things I'd like to develop in that regard without getting into kexts
- sharikous 4y ago
  There is that: https://threedots.ovh/blog/2022/06/quick-look-at-user-mode-file-systems-on-macos-ventura/ https://threedots.ovh/blog/2022/06/quick-look-at-user-mode-f... But userspace filesystems are already present in iOS so you can find some reverse engineered info on that (e.g. in Jonathan Levin's books)
  - dagmx 4y ago
    Thanks
    - my123 4y ago
      Note that UVFS is currently not exposed to third parties. For your own 3rd-party file systems, you'll still have to use a kernel extension for now. (or local NFS mount).
dochtman 4y ago
Very curious about userspace filesystems, would be awesome if there's finally a fast solution for this that's well-supported in the OS.
pxc 4y ago
> the nail on the coffin for kernel extensions The OpenZFS implementation on macOS also requires kernel extensions, and I don't suppose it can easily be ported to FUSE or that that would have desirable performance characteristics. Special kernel extensions are also required to get some basic functionality working on macOS these days, like disabling pointer acceleration.

jessriedel 4y ago

Mostly off-topic: have Apple and Microsoft completely given up on non-trivial changes to desktop operating systems? Will MacOS look basically the same in 40 years? Or is the idea that everything will be AR/VR by then and there is no use innovating in this domain?

dagmx 4y ago
I guess you'd need to set a goal post of what counts as trivial? Many of the things mentioned in the article aren't trivial. They may be smaller in scope, but size (large / small) are different than complexity. You can take a look at what's new in Ventura https://www.apple.com/macos/macos-ventura-preview/features/ https://www.apple.com/macos/macos-ventura-preview/features/ but that's not even getting into the under pinnings. Similarly Microsoft made fairly significant changes to Windows between 10 and 11, and several times to 10 within its life cycle. Unless you're talking purely visual design, in which case what kind of changes would you expect without upending people's workflow?
- jessriedel 4y ago
  We have gotten so use to these trivial changes that our expectations have renormalized. Desktop OSs are asymptotically approaching a fixed point. Examples of modest but non-trivial changes: - eliminate the folder-file system (or at least make it completely invisible to the user) - remove UI distinction (but not necessarily the sandbox distinction) between web apps and normal apps. - seamless mobile-desktop integration, so the user views them as just different form factors for accessing the same resources. (There are of course much more radical changes than these that one could imagine.)
  - dagmx 4y ago
    I'm curious as to your background if you consider any of the things mentioned in the articles as "trivial" changes. Have you worked in systems development before? I similarly question your definition of "modest". The first one alone is incredibly radical, and has been tried several times in the past but people keep asking for hierarchical file systems. It's far from modest. 1. How do you propose users organize things? 2. Already exists today with electron and webview. What would you propose an OS provide here? Many apps you use today on macOS are web apps within a native context. 3. This is already growing on macOS with features like continuity handofd, universal control, being able to run mobile apps on desktop, iCloud sync of projects etc.. Each year they've clearly moved towards unifying things. If these are what you consider modest though, I fear what you consider radical without throwing out decades of learned user interaction in the process

kappuchino 4y ago

Lets hope the open core project, namely the Open Core Legacy Patcher[1] will revive some older models to run Ventura. Personally, I'm running a 2014/15 Macbook Air 11" for 7 years now[2] and with "Open Core Legacy" on Monterrey with no issues at all. [1] https://dortania.github.io/OpenCore-Legacy-Patcher/MODELS.html https://dortania.github.io/OpenCore-Legacy-Patcher/MODELS.ht... [2] Except the mainboard, display and shell everything else thats modular (wifi card, ssd, battery and keyboard) was replaced/repaired at some point.

Synaesthesia 4y ago
In pretty confident it will, the OCLP project has improved a lot and is now very capable and stable. My MacBook Pro 2012 runs Monterey, and it's really fast and stable. Better than any previous Mac OS in fact. You can look on the Macrumors forum and Reddit to see if they're already getting the betas to work. https://forums.macrumors.com/threads/macos-13-ventura-on-unsupported-macs-thread.2346881/ https://forums.macrumors.com/threads/macos-13-ventura-on-uns... https://www.reddit.com/r/venturapatcher/ https://www.reddit.com/r/venturapatcher/ Edit: the OCLP team released an official statement, looks like they're having quite a few challenges. https://github.com/dortania/OpenCore-Legacy-Patcher/issues/998 https://github.com/dortania/OpenCore-Legacy-Patcher/issues/9...
- alexd111 4y ago
  Interesting that you say that it's faster and more stable. My 2013 Air is on Monterey and it's "good enough" for my needs still, but slipping towards not quite good enough. Very tempted to give OCLP a try if it extends the life of the machine a bit more.
ksec 4y ago
May be off topic but this had me thinking. Will Safari 16 be available on older macOS? Assuming Apple doesn't break their tradition it should support two prior OS release, Monterey and Big Sur. While I could do without an OS update on my MacBook Pro 2015. ( I cant record a single useful feature from all the previous OS update other than Universal Clipboard ) That means for MacBook Pro 2015 Model users they will only have two more Safari Update.

prpl 4y ago

I’m sure quite a few MBP 2015 users are going to be a little sad the end is near. I loved that machine. I was able to skip the 2017 MBP and go to 2019, but honestly I miss the smaller trackpad.

brundolf 4y ago
Will non-Ventura devices still get vulnerabilities patched, or are they dead in the water?
- crest 4y ago
  Apple has established a pattern of haphazardly offering partial and late security updates for the two more releases (e.g. Big Sur, Monterey, Ventura).
  - philistine 4y ago
    Looking from the outside, it sure does look like every security patch is assessed on its difficulty to port to older OSes, its severity, and its reach. It can be maddening.
- samcat116 4y ago
  Security updates are N-2 I believe (so current OS and last two major versions).
MrBuddyCasino 4y ago
Still using the 2013 and 2015 MBPs here, had no reason to upgrade. Love them to death, still no hardware issues whatsoever except a new battery. I also prefer the smaller trackpad. Guess its time to gift them to my parents. Luckily, the M1/M2 is finally a worthy upgrade, after years of keyboard issues and unwanted features.
- soylentgraham 4y ago
  My 2013 mbp is being retired for a mac studio as I accidentally updated ios to a version that needs xcode13, which i cannot install. It had a good run! (My 2011 imac died last year)

DavideNL 4y ago

> "Passkeys aim to solve the problems with passwords" So are you locked in with Apple if you use this, or can you switch all your existing passwords to another "passkey provider/service" ? > "Wave Goodbye to CAPTCHAS" I assume that's Safari only... so this is bad news for Firefox?

anaisbetts 4y ago
Assumedly any service that implements this will let you reset your password away from Passkeys, but it's still the soft lockin of "Ughhhh I don't want to reset everything". Sites will never go full Passkeys because that obviously falls over if you want to access it from any other device or computer, support request costs would go through the ceiling
- philistine 4y ago
  I wouldn’t be surprised if banks go passkeys only.
  - skoskie 4y ago
    By 2040.
gernb 4y ago
curious too as someone that uses 7 computers running 3 OSes, are my passkeys accessable, syncable, across OSes?
- alwillis 4y ago
  One obvious solution is to use a cross-platform password manager that supports Passkeys [1]. [1]: https://blog.1password.com/1password-is-joining-the-fido-alliance/ https://blog.1password.com/1password-is-joining-the-fido-all...
PartiallyTyped 4y ago
> In collaboration with Google, Microsoft and other industry players, Apple has been working on a new logon technology for web and other remote services called ‘passkeys’. I don't think it will be Apple only. However, I am wondering what will happen to services like bitwarden [1] if it is available on other OSes as well. [1] https://bitwarden.com/ https://bitwarden.com/

kemayo 4y ago

Nothing terribly major here, it sounds like. Making login items visible is a long-overdue change... but none of these are going to have any particular impact on average users or average apps. On a pettier note, can we get a better source than a website that's using JS to change its title when it doesn't have focus to try to gain attention? (It toggles about every second between "macOS Ventura | 7 New Security Changes to Be Aware Of" and "Message from SentinelOne". https://imgur.com/ynPqpvK https://imgur.com/ynPqpvK - it's pretty awful.) I don't normally complain about scummy websites on here, but this is just annoying. Interestingly, I went looking for alternative sources for the content, and found that identical content is on other sites [1] which are also doing the same title-flicker technique. So presumably this is part of some content network... [1]: https://phxtechsol.com/2022/06/13/apples-macos-ventura-7-new-security-changes-to-be-aware-of/ https://phxtechsol.com/2022/06/13/apples-macos-ventura-7-new...

deleted 4y ago
[deleted]
joshgachnang 4y ago
I'm not surprised they're using scummy tactics. Their actual software runs like crap, so gotta do whatever they can to get users. I had a work MBP and personal MBP with exactly the same specs, main difference being the Sentinel One agent. The work one was constantly spinning up the fans, S1 was gobbling up memory, and support was completely useless in diagnosing. Their Linux agent isn't much better with constant memory leaks.
sys_64738 4y ago
I noticed it even did that in Reader Mode in Safari. Really annoying.
saagarjha 4y ago
There’s a lot of changes under the hood that this post doesn’t mention.

deleted 4y ago

[deleted]

captn3m0 4y ago

Do the new DNSSEC changes imply anything for local DNS overrides? Would Apple refuse to block a site if DNSSEC is enabled and PiHole returns a blocking response?

tptacek 4y ago
Probably not. I haven't been able to dig into what they're doing, but I watched the presentation about the feature, and it's an opt-in API for applications. I'm not clear on this but I have to assume that the macOS/iOS resolver code is still leaning on your external recursor to do the DNSSEC validation stuff (otherwise, it's going to generate _a lot_ of extra lookup traffic), which means it's going to trust whatever your PiHole tells it anyways.

Lammy 4y ago

> Gatekeeper’s role is to ensure that when users execute some code, that code meets the local system policy. The policy includes checks such as whether the code is validly signed and whether it has been tampered with in certain ways. Weasel-word alert. I never thought I’d see the day when technologists would applaud the gradual death of general-purpose computing, but here we are. A decade from now Apple probably won’t even ship a local version of Xcode, and the transformation will be complete as all new development happens in Xcode Cloud where no line of code goes unscrutinized by the watchful eye of the mother ship. At least we’ll be Safe™.

RONROC 4y ago
There is no more prescient of a take on this news as this one. Once the singularity is nearly complete you'll know: macOS and iOS will merge into one monolithic OS.
kccqzy 4y ago
Gatekeeper was introduced in 2011 in Lion. It has already been a decade. I didn't see that transformation happening.
- Lammy 4y ago
  The existence of Gatekeeper already causes a huge privacy violation by “requiring” my computer to phone home to verify the signature the first time it launches an application. Everyone should have realized this when Apple’s OCSP responder went down in November 2020 and nobody could launch anything that wasn’t built in to the OS. According to TFA this kind of verification will now occur every time an application is launched to deter post-verification “tampering” by you, the user. How big of a privacy violation would it have to become to bother you, out of curiosity? If we let this continue we will end up in a future where full “Remote Attestation” of every hardware and software component is required to participate in the Internet. This isn’t hypothetical doom-saying, either: game consoles already work like this. I remember my XBOX360 could detect modified DVD drive firmware, launches of individual pieces of software (e.g. Halo 3 Delta leak), and other types of system modifications, then it would permanently ban that machine from XBOX LIVE. And that was all 15+ years ago. Just imagine what a gift this will be to law enforcement, for example, once they can go to Apple all like “Hey, Siri, show me all users of Tor Browser around the time of ${BITCOIN_TRANSACTION_ID}”.

deleted 4y ago

[deleted]

forgotmypw17 4y ago

Somewhere between Mountain Lion and High Sierra, it became impossible to delete or even mark non-executable various annoying built-in applications which I never use, e.g. iTunes.app and Safari.app, which often open without me asking them to. Does anyone know how to re-enable this functionality?

deleted 4y ago
[deleted]
plorkyeran 4y ago
As of Big Sur it's impossible. The entire OS is now a single cryptographically signed image that's verified on boot, which is great for security but it includes some things that don't particularly need to be locked down.

zmmmmm 4y ago

Most concerning is Gatekeeper, as I do still routinely run into scenarios where it harassess me about applications I am trying to run and on the odd occasion I have to manually codesign things. It will be super annoying if this now starts making developer's life hell because it is nannying binaries they are building, sharing or working with as part of their development work.

Wowfunhappy 4y ago
You can completely disable Gatekeeper if it annoys you: $ sudo spctl --master-disable
- idle_zealot 4y ago
  I’ve done this a few times but still get nagged when launching unsigned apps for the first time. Is that part of a different security mechanism?
  - Wowfunhappy 4y ago
    Probably, I would need to see the message to be sure what you're referring to. But LaunchServices will for example still warn you the first time you open a downloaded application. You used to be able to get rid of that with `defaults write com.apple.LaunchServices LSQuarantine -bool false` but I don't know if the syntax has changed.
deleted 4y ago
[deleted]
dagmx 4y ago
If you're building, you can designate something as a developer tool and gatekeeper will ignore it.

sydthrowaway 4y ago

The security engineering division at Apple intends to destroy this product.

GekkePrutser 4y ago

I don't think number 2 (specifically the complaint that the user can override gatekeeper) in their list is really an issue for enterprises. If they want they can already turn off the gatekeeper user override through a profile. I do exactly that on our Macs. And for consumers I don't think it's a good idea to remove this option altogether. The owner should have full control if they desire it. The constant check for modifications is great though. I'm surprised that wasn't the case before.

post_break 4y ago

So is Rogue Amoeba essentially screwed then?