12 ms·

Bringing free antivirus to Mac is a good thing IMO, especially since Microsoft has been doing the same for years. I'd like to see much more behavioral analysis

Bringing free antivirus to Mac is a good thing IMO, especially since Microsoft has been doing the same for years. I'd like to see much more behavioral analysis like the leading AV companies do, rather than just fingerprinting but it's a good start. One thing I don't like about Apple's approach to security is locking the user out, making the OS like a black box. For me the user should always retain the last word. Until now most of their work has been in this direction (and the direction of iOS) but I'm pleased to see they're looking more into mitigation rather than just prevention now.

m463 4y ago
> locking the user out I wish ios would allow me to firewall my phone, even from apple.
- kylehotchkiss 4y ago
  Me too, little snitch for iOS would be fantastic at preventing so many apps from phoning home to analytics
  - blacksmith_tb 4y ago
    For that can't you use Private DNS / Encrypted DNS pointing to a PiHole or nextdns etc? My memory is that iOS you have to change the DNS settings for each network which is sort of a headache, but one-time at least.
    - clairity 4y ago
      that only works for network requests that use dns. some (including a number of apple & google services) go directly to an ip address, which is why a firewall like little snitch is still valuable beyond dns-based blockers like pihole, nextdns, and adguard (this is what i use on ios). you used to be able to install an application firewall on jailbroken iphones, but i don't think that's an option any more. on macos, i used to use hands off! from one periodic (and before that, metakine), but they've since disappeared. i now use lulu with pf firewall via murus lite as a backup, but may switch to little snitch again (used to have a license but was unable to upgrade it so switched to hands off! via a promo) for the better UX.
      - heinternets 4y ago
        What Apple and Google services go directly to an IP address?
        Godel_unicode 4y ago
        Mostly just their DNS service.
  - behnamoh 4y ago
    I tried Mullvad VPN and chose "Block Ad URLS", but then iCloud sync stopped working!
- inopinatus 4y ago
  There are apps performing packet filtering by presenting as a VPN client. Can’t stop Apple bypassing that when it wants to, however.
- dp-hackernews 4y ago
  Isn't there something similar to NetGuard or TrackerControl able to be implemented on iOS? <https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard> <https://github.com/TrackerControl/tracker-control-android https://github.com/TrackerControl/tracker-control-android>
green_on_black 4y ago
The issue is most users would be better served with a black box. If there's a way in, malice will get there, regardless of user and developer intent.
- noasaservice 4y ago
  And this arrogant "we know better than you, plebes" is why I don't buy apple shit. My money, my hardware, my control. Not negotiable. (Edit: this applies to all their offerings. Iphone is already anti-user and effectively a rented device. Mac laptops are heading that way. Do not want.)
  - yamtaddle 4y ago
    You can turn off most of the stuff that's keeping it out of "your control". I write "most" only to hedge—I'm not aware of any that you can't (though there may be some).
  - gffrd 4y ago
    … and that's your choice! In their defense—both Apple's, and the public's—the general populace is, like, 99.99% OK with outsourcing those choices to a company that's way more interested/invested/capable in knowing better than they would be on their own. Is it arrogant if the public continues to reward/reaffirm it?
    - mhh__ 4y ago
      I agree it's mostly between the customer and apple but just remember that most people don't know anything about computers at all. Even people who have heard of Linux for example's opinions will have mostly been set by people shilling for Windows and so on
    - noasaservice 4y ago
      - 4y ago
yamtaddle 4y ago
> One thing I don't like about Apple's approach to security is locking the user out, making the OS like a black box. You can still turn off an awful lot of the security features in macOS. Some require a reboot, but still, the option's there for developers and power-users, if they prefer or require riskier operation.
- GekkePrutser 4y ago
  Yes but that's all or nothing then. And you lose out on some functionality. There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. This is not OK, there should be a way for me to sign files so they are marked as valid. I don't think the read-only OS partition or the SIP is a bad idea. The bad part is that Apple is the only one who controls it.
  - jen20 4y ago
    What about editing `/private/etc/ssh/sshd_config` does not persist for you?
    - yamtaddle 4y ago
      That file is overwritten on OS updates. At least, it used to be.
      - GekkePrutser 4y ago
        This yes. It even used to put it on the desktop in a passive aggressive way of saying "keep your shit to yourself" :)
  - yamtaddle 4y ago
    > There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. Does putting your custom options in something like: /etc/ssh/sshd_config.d/disable-passwords.conf no longer allow custom sshd config to survive updates? It's like if you're configuring daemons on, say, Ubuntu the "right way" so you don't get a ton of those prompts during apt-updates asking you if you want to accept the maintainer's config file or roll the dice and keep your own.
bayindirh 4y ago
> One thing I don't like about Apple's approach to security is locking the user out, making the OS like a black box. If we're talking about prevention of execution of unknown applications, that's not existent. Right click any application, click open, and it'll show you the same warning with "Open" added. So, you can always override Apple's warning. I like how macOS makes you read the warning box before making a decision, tbh. Yes, it's no Linux in terms of flexibility, and freedom, but I like the OS nevertheless.
- behnamoh 4y ago
  People have been talking bs about Windows for a long time, but I think Apple will do even worse than what MS did to Windows. As something gets more popular (in this case, macOS), unfortunately it falls victim to corporate greed (telemetry, forced updates, etc.)
  - xenospn 4y ago
    to be fair, microsoft has been awful at this from the very beginning and got progressively worse.
  - dlivingston 4y ago
    It depends on the profit motivators. Windows fell victim to telemetry and forced updates because Microsoft’s business model might not be what you think it is. Apple has a simple business model for macOS. It exists solely as a vehicle for selling Macs - premium computers with (most importantly) a fat profit margin. Keeping the customer wanting to buy new Macs (and maybe that new iPhone…and that Apple TV+ subscription…) is what drives their OS to be, generally, much less user-hostile than Windows. The user is the customer; whether through direct hardware sales or through the subscription purchases those hardware sales lead into. Microsoft, in turn, sells Windows to OEMs and the business world via bulk licensing. You, the consumer, buying a Windows 11 license is not what’s funding Satya Nadella’s new private island. It’s Initech Corp. buying 5,000 PCs with Windows because “no one ever got fired for buying IBM.” Disclaimer: this is largely all speculation, and if I am off the mark, do let me know.
NayamAmarshe 4y ago
Making tech accessible and safe for people who don't know any better should always be welcomed. But when you do that yet hide things from people who do know better, you're not making tech accessible, you're making tech worse. I really don't like how these companies behave sometimes, their utopia involves people with 0% knowledge and 100% obsession.
lowdose 4y ago
Don’t forget many bad faith actors are financially not able to cough up the $200 fee.
DeepYogurt 4y ago
> Bringing free antivirus to Mac is a good thing IMO, especially since Microsoft has been doing the same for years. Apple's been doing it for over a decade https://www.justinrummel.com/apples-built-in-anti-virus-xprotect/ https://www.justinrummel.com/apples-built-in-anti-virus-xpro...
grishka 4y ago
No, the main issue is Apple considering themselves an unquestionably trusted party. Notarization and all other shit. I want to build a macOS app at some point because every single one of modern instant messaging clients sucks, but I won't be paying $100/year to be able to "notarize" it. I had gatekeeper completely disabled, yet somehow it has recently reset to its asinine default and I got this "this app isn't from an identified developer, you should delete it" error. I hated it. If you must do code signing for whatever reason, at least let me install my own roots of trust for developers I personally consider trustworthy.

m463 4y ago

> locking the user out I wish ios would allow me to firewall my phone, even from apple.

kylehotchkiss 4y ago
Me too, little snitch for iOS would be fantastic at preventing so many apps from phoning home to analytics
- blacksmith_tb 4y ago
  For that can't you use Private DNS / Encrypted DNS pointing to a PiHole or nextdns etc? My memory is that iOS you have to change the DNS settings for each network which is sort of a headache, but one-time at least.
  - clairity 4y ago
    that only works for network requests that use dns. some (including a number of apple & google services) go directly to an ip address, which is why a firewall like little snitch is still valuable beyond dns-based blockers like pihole, nextdns, and adguard (this is what i use on ios). you used to be able to install an application firewall on jailbroken iphones, but i don't think that's an option any more. on macos, i used to use hands off! from one periodic (and before that, metakine), but they've since disappeared. i now use lulu with pf firewall via murus lite as a backup, but may switch to little snitch again (used to have a license but was unable to upgrade it so switched to hands off! via a promo) for the better UX.
    - heinternets 4y ago
      What Apple and Google services go directly to an IP address?
      - Godel_unicode 4y ago
        Mostly just their DNS service.
- behnamoh 4y ago
  I tried Mullvad VPN and chose "Block Ad URLS", but then iCloud sync stopped working!
inopinatus 4y ago
There are apps performing packet filtering by presenting as a VPN client. Can’t stop Apple bypassing that when it wants to, however.
dp-hackernews 4y ago
Isn't there something similar to NetGuard or TrackerControl able to be implemented on iOS? <https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard> <https://github.com/TrackerControl/tracker-control-android https://github.com/TrackerControl/tracker-control-android>

green_on_black 4y ago

The issue is most users would be better served with a black box. If there's a way in, malice will get there, regardless of user and developer intent.

noasaservice 4y ago
And this arrogant "we know better than you, plebes" is why I don't buy apple shit. My money, my hardware, my control. Not negotiable. (Edit: this applies to all their offerings. Iphone is already anti-user and effectively a rented device. Mac laptops are heading that way. Do not want.)
- yamtaddle 4y ago
  You can turn off most of the stuff that's keeping it out of "your control". I write "most" only to hedge—I'm not aware of any that you can't (though there may be some).
- gffrd 4y ago
  … and that's your choice! In their defense—both Apple's, and the public's—the general populace is, like, 99.99% OK with outsourcing those choices to a company that's way more interested/invested/capable in knowing better than they would be on their own. Is it arrogant if the public continues to reward/reaffirm it?
  - mhh__ 4y ago
    I agree it's mostly between the customer and apple but just remember that most people don't know anything about computers at all. Even people who have heard of Linux for example's opinions will have mostly been set by people shilling for Windows and so on
  - noasaservice 4y ago
    - 4y ago

yamtaddle 4y ago

> One thing I don't like about Apple's approach to security is locking the user out, making the OS like a black box. You can still turn off an awful lot of the security features in macOS. Some require a reboot, but still, the option's there for developers and power-users, if they prefer or require riskier operation.

GekkePrutser 4y ago
Yes but that's all or nothing then. And you lose out on some functionality. There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. This is not OK, there should be a way for me to sign files so they are marked as valid. I don't think the read-only OS partition or the SIP is a bad idea. The bad part is that Apple is the only one who controls it.
- jen20 4y ago
  What about editing `/private/etc/ssh/sshd_config` does not persist for you?
  - yamtaddle 4y ago
    That file is overwritten on OS updates. At least, it used to be.
    - GekkePrutser 4y ago
      This yes. It even used to put it on the desktop in a passive aggressive way of saying "keep your shit to yourself" :)
- yamtaddle 4y ago
  > There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. Does putting your custom options in something like: /etc/ssh/sshd_config.d/disable-passwords.conf no longer allow custom sshd config to survive updates? It's like if you're configuring daemons on, say, Ubuntu the "right way" so you don't get a ton of those prompts during apt-updates asking you if you want to accept the maintainer's config file or roll the dice and keep your own.

bayindirh 4y ago

> One thing I don't like about Apple's approach to security is locking the user out, making the OS like a black box. If we're talking about prevention of execution of unknown applications, that's not existent. Right click any application, click open, and it'll show you the same warning with "Open" added. So, you can always override Apple's warning. I like how macOS makes you read the warning box before making a decision, tbh. Yes, it's no Linux in terms of flexibility, and freedom, but I like the OS nevertheless.

behnamoh 4y ago
People have been talking bs about Windows for a long time, but I think Apple will do even worse than what MS did to Windows. As something gets more popular (in this case, macOS), unfortunately it falls victim to corporate greed (telemetry, forced updates, etc.)
- xenospn 4y ago
  to be fair, microsoft has been awful at this from the very beginning and got progressively worse.
- dlivingston 4y ago
  It depends on the profit motivators. Windows fell victim to telemetry and forced updates because Microsoft’s business model might not be what you think it is. Apple has a simple business model for macOS. It exists solely as a vehicle for selling Macs - premium computers with (most importantly) a fat profit margin. Keeping the customer wanting to buy new Macs (and maybe that new iPhone…and that Apple TV+ subscription…) is what drives their OS to be, generally, much less user-hostile than Windows. The user is the customer; whether through direct hardware sales or through the subscription purchases those hardware sales lead into. Microsoft, in turn, sells Windows to OEMs and the business world via bulk licensing. You, the consumer, buying a Windows 11 license is not what’s funding Satya Nadella’s new private island. It’s Initech Corp. buying 5,000 PCs with Windows because “no one ever got fired for buying IBM.” Disclaimer: this is largely all speculation, and if I am off the mark, do let me know.

NayamAmarshe 4y ago

Making tech accessible and safe for people who don't know any better should always be welcomed. But when you do that yet hide things from people who do know better, you're not making tech accessible, you're making tech worse. I really don't like how these companies behave sometimes, their utopia involves people with 0% knowledge and 100% obsession.

lowdose 4y ago

Don’t forget many bad faith actors are financially not able to cough up the $200 fee.

DeepYogurt 4y ago

> Bringing free antivirus to Mac is a good thing IMO, especially since Microsoft has been doing the same for years. Apple's been doing it for over a decade https://www.justinrummel.com/apples-built-in-anti-virus-xprotect/ https://www.justinrummel.com/apples-built-in-anti-virus-xpro...

grishka 4y ago

No, the main issue is Apple considering themselves an unquestionably trusted party. Notarization and all other shit. I want to build a macOS app at some point because every single one of modern instant messaging clients sucks, but I won't be paying $100/year to be able to "notarize" it. I had gatekeeper completely disabled, yet somehow it has recently reset to its asinine default and I got this "this app isn't from an identified developer, you should delete it" error. I hated it. If you must do code signing for whatever reason, at least let me install my own roots of trust for developers I personally consider trustworthy.