5 ms·

"Apple's approach to third-party OSes is essentially "have fun". We do not have any expectations of direct support, documentation, or additional development eff

"Apple's approach to third-party OSes is essentially "have fun". We do not have any expectations of direct support, documentation, or additional development effort from them, nor do we expect them to attempt to hinder third-party OSes in any deliberate way. They have explicitly developed the ability to securely run third-party OSes and bootloaders on these machines, and left the rest to us." Under the list at https://github.com/AsahiLinux/docs/wiki/Introduction-to-Apple-Silicon#design-goals https://github.com/AsahiLinux/docs/wiki/Introduction-to-Appl...

AceJohnny2 4y ago
That still sounds like an assumption from the community. Perhaps the "third party OSes and bootloaders" is just a side-effect of Apple's own development requirements. On the other hand: "Apple gives users explicit permission to run their own OS in their EULA." I guess I haven't read their EULA!
- smoldesu 4y ago
  It's definitely a bit of a reach. Apple has always given users explicit permission to run their own OS, as far as I understand it. Bootcamp has existed for years, and before that there was nothing stopping you from putting Linux on a Macbook (besides the loathesome touch bar). The closest Apple has come to acknowledging third-party OSes on Apple Silicon was their statement that Microsoft is welcome to try porting Windows to it, if they want. I think Asahi sideliners (and Apple fans at large) are quick to attribute mysterious coincidences as benevolence, but I reckon they're making the same mistake that happened when they trusted Microsoft as bedfellows with the open source community. Apple is not your friend, they just make more money if it seems that way.
  - MBCook 4y ago
    There is absolutely no reason Apple couldn’t have locked things down quite a bit further. The other OS functionality is totally unnecessary for MacOS or probably even Apple tools their store/repair techs use. They don’t allow any of this on iOS devices, and M1/2 Macs are basically iOS devices at a hardware level with more ports/power. Surely allowing the other OS functionality is at least a tiny security weakness because it makes it easier to get a foothold to attack from. Apple takes security really seriously, and has only been getting stricter. I just have a hard time seeing any reason any of this exists unless they purposefully chose to allow it. It’s can’t be happenstance.
    - smoldesu 4y ago
      > The other OS functionality is totally unnecessary for MacOS or probably even Apple tools their store/repair techs use. Both of those statements are probably true, but it's not the same for hardware calibration/testing from the factory. It totally makes sense that Apple would add this as a convenient way to use a single testing image for multiple Macs, or as an entrypoint for Microsoft to start supporting Bootcamp. Hell, maybe it was a mistake and they're too embarassed to admit. Apple doesn't have that kind of dialogue with their community though, so we don't know. Until they release a statement acknowledging that they made this change for Asahi, nobody can say they're "helping" with any certainty. > Surely allowing the other OS functionality is at least a tiny security weakness because it makes it easier to get a foothold to attack from. Not really? You should go check out the boot flow on the link in this thread, I can't really conceive of any way that an attacker could abuse that process. Sure you might be able to boot malicious software, but you're not going to get it to persist (certainly not in MacOS), and it can't really read any sensitive information since your APFS volume is still encrypted. There's effectively no security tradeoff to their implementation, particularly for MacOS users. > I just have a hard time seeing any reason any of this exists unless they purposefully chose to allow it. It’s can’t be happenstance. I agree. I just don't think it was done for Asahi, and it certainly doesn't seem like deliberate help.
      - MBCook 4y ago
        Yeah I’ve read how the boot works, and in theory if it all works perfectly then they should be 100% irrelevant. What we know software has bugs. And it seems like if you can execute kernel level code on the machine, you’re more likely to be able to find one of those bugs somehow from the other 0S then you would if you were having to attack from a macOS process. Total 100% assumption on my part. Apple knows what happens. No matter what they do someone was going to try and put Linux or BSD on the machine. That plus the way things are setup makes me suspect Apple is purposely allowing this in the closest to a wink-wink-nudge-nudge approval they’ll ever give us.
    - philistine 4y ago
      Look at their decision to remove all the scripting languages from macOS as another example. At first glance, this could mean a terrible step back for openness but the reality is sunnier. Apple has widely seen that everybody’s using Homebrew and no one is calling their old and crusty language versions anymore. So they wisely decided to count on the open-source community, who’s doing a better job at this than them, and to leave space for Homebrew to finally put references in your path to the languages you install. Everybody wins by Apple giving a bit more space to others.

AceJohnny2 4y ago

That still sounds like an assumption from the community. Perhaps the "third party OSes and bootloaders" is just a side-effect of Apple's own development requirements. On the other hand: "Apple gives users explicit permission to run their own OS in their EULA." I guess I haven't read their EULA!

smoldesu 4y ago
It's definitely a bit of a reach. Apple has always given users explicit permission to run their own OS, as far as I understand it. Bootcamp has existed for years, and before that there was nothing stopping you from putting Linux on a Macbook (besides the loathesome touch bar). The closest Apple has come to acknowledging third-party OSes on Apple Silicon was their statement that Microsoft is welcome to try porting Windows to it, if they want. I think Asahi sideliners (and Apple fans at large) are quick to attribute mysterious coincidences as benevolence, but I reckon they're making the same mistake that happened when they trusted Microsoft as bedfellows with the open source community. Apple is not your friend, they just make more money if it seems that way.
- MBCook 4y ago
  There is absolutely no reason Apple couldn’t have locked things down quite a bit further. The other OS functionality is totally unnecessary for MacOS or probably even Apple tools their store/repair techs use. They don’t allow any of this on iOS devices, and M1/2 Macs are basically iOS devices at a hardware level with more ports/power. Surely allowing the other OS functionality is at least a tiny security weakness because it makes it easier to get a foothold to attack from. Apple takes security really seriously, and has only been getting stricter. I just have a hard time seeing any reason any of this exists unless they purposefully chose to allow it. It’s can’t be happenstance.
  - smoldesu 4y ago
    > The other OS functionality is totally unnecessary for MacOS or probably even Apple tools their store/repair techs use. Both of those statements are probably true, but it's not the same for hardware calibration/testing from the factory. It totally makes sense that Apple would add this as a convenient way to use a single testing image for multiple Macs, or as an entrypoint for Microsoft to start supporting Bootcamp. Hell, maybe it was a mistake and they're too embarassed to admit. Apple doesn't have that kind of dialogue with their community though, so we don't know. Until they release a statement acknowledging that they made this change for Asahi, nobody can say they're "helping" with any certainty. > Surely allowing the other OS functionality is at least a tiny security weakness because it makes it easier to get a foothold to attack from. Not really? You should go check out the boot flow on the link in this thread, I can't really conceive of any way that an attacker could abuse that process. Sure you might be able to boot malicious software, but you're not going to get it to persist (certainly not in MacOS), and it can't really read any sensitive information since your APFS volume is still encrypted. There's effectively no security tradeoff to their implementation, particularly for MacOS users. > I just have a hard time seeing any reason any of this exists unless they purposefully chose to allow it. It’s can’t be happenstance. I agree. I just don't think it was done for Asahi, and it certainly doesn't seem like deliberate help.
    - MBCook 4y ago
      Yeah I’ve read how the boot works, and in theory if it all works perfectly then they should be 100% irrelevant. What we know software has bugs. And it seems like if you can execute kernel level code on the machine, you’re more likely to be able to find one of those bugs somehow from the other 0S then you would if you were having to attack from a macOS process. Total 100% assumption on my part. Apple knows what happens. No matter what they do someone was going to try and put Linux or BSD on the machine. That plus the way things are setup makes me suspect Apple is purposely allowing this in the closest to a wink-wink-nudge-nudge approval they’ll ever give us.
  - philistine 4y ago
    Look at their decision to remove all the scripting languages from macOS as another example. At first glance, this could mean a terrible step back for openness but the reality is sunnier. Apple has widely seen that everybody’s using Homebrew and no one is calling their old and crusty language versions anymore. So they wisely decided to count on the open-source community, who’s doing a better job at this than them, and to leave space for Homebrew to finally put references in your path to the languages you install. Everybody wins by Apple giving a bit more space to others.