5 ms·

Developers are really lazy. We have terms like DX and UX. It’s not a false dichotomy at all.

by dcow 4y ago

lapcat 4y ago
> Developers are really lazy. Speak for yourself. > We have terms like DX and UX. It’s not a false dichotomy at all. It's still a false dichotomy, because they're not necessarily opposed. Making the native Mac software DX worse can also make the UX worse, and making the DX better can make the UX better. When I said "Eventually everything on the Mac will just be a cross-platform afterthought", I meant that the UX is becoming totally crappy. We get Electron, we get Catalyst, we get iOS apps on macOS. Crap. Bad UX. Lack of powerful software, due to excessive security restrictions, is also a bad UX. Endless "Cancel or Allow" dialogs are a bad UX.
- dcow 4y ago
  Lazy in this context doesn't mean “lacks work ethic”. You might be unfamiliar with the Gates quote. Point is devs often whine when they have to take the scenic route even if it’s safer for the user. Anyway, I’m not saying they’re at odds and you can only pick one. So we seem to agree. I’m saying devs should be applauding better security and not whining about the transition away from user-domain security which is kinda what is implied in the OP. We should be whining about not having access to to the system in ways we need. Better security needs to accommodate valid use cases not stifle creativity. We probably also agree there. Opining Linux because it’s still the wild west of software and you can do shit like zip up the user’s browser history, logins, and cookies, or idk dump entire hardware profiles without any user interaction, or prompt the user to install a new boot loader or drop your rootkit into initrd because your program “just needs their password to update” is just that.
  - lapcat 4y ago
    > I’m saying devs should be applauding better security and not whining about the transition away from user-domain security which is kinda what is implied in the OP. It's not better security, it's security theater. Security researchers roll out of bed in the morning and find bypasses to macOS TCC (Transparency, Consent, and Control). I've done it myself, and I'm not a professional security researcher. The so-called "security" doesn't actually stop real malware, it only stops honest developers from making a living.
    - dcow 4y ago
      People discover vulns all the time. A vuln is not theatre. You patch the vuln and you are secure. A vlun does not security theatre make. A fundamental design flaw in the security model or system which renders it irrelevant, on the other hand, is a problem. Are you saying there’s a fundamental flaw in Apple’s implementation of secure boot, code signatures, and sandboxing that makes it irrelevant?
      - lapcat 4y ago
        > You patch the vuln and you are secure. Except you aren't, because there's an endless series of them. > Are you saying there’s a fundamental flaw in Apple’s implementation of secure boot, code signatures, and sandboxing that makes it irrelevant? I said TCC, and you said everything except TCC. (Although sandboxing is pretty insecure on the Mac too.) The fundamental design flaw is that Mac OS X started as an open system, and Apple tried to tack all of these security features on afterward, without otherwise redesigning the operating system. There are two many legacy features, including "must not break" features, too many openings, too much interoperation, too much complexity. Moreover, it often seems to me that Apple security engineers are not particularly experienced with Mac OS X, which is why an old hack like me can relatively easily find things that they've overlooked.
        dcow 4y ago
        All I'm sayings is it's kinda weird to respond to people who are trying to make a system more secure by saying "well it will never be perfect so fuck it it's just theater". I mean really? I think we agree on everything else.
        lapcat 4y ago
        > it will never be perfect This is a straw man.
        lapcat 4y ago
        "Real world attacks (e.g., XCSSET) and researchers have consistently shown that TCC, while often a nuisance to users, does not present a significant obstacle to attackers." https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/ https://www.sentinelone.com/blog/session-cookies-keychains-s...

Developers are really lazy. We have terms like DX and UX. It’s not a false dichotomy at all.

by dcow 4y ago

Developers are really lazy. We have terms like DX and UX. It’s not a false dichotomy at all.

> Developers are really lazy. Speak for yourself. > We have terms like DX and UX. It’s not a false dichotomy at all. It's still a false dichotomy, because they're not necessarily opposed. Making the native Mac software DX worse can also make the UX worse, and making the DX better can make the UX better. When I said "Eventually everything on the Mac will just be a cross-platform afterthought", I meant that the UX is becoming totally crappy. We get Electron, we get Catalyst, we get iOS apps on macOS. Crap. Bad UX. Lack of powerful software, due to excessive security restrictions, is also a bad UX. Endless "Cancel or Allow" dialogs are a bad UX.

dcow 4y ago
Lazy in this context doesn't mean “lacks work ethic”. You might be unfamiliar with the Gates quote. Point is devs often whine when they have to take the scenic route even if it’s safer for the user. Anyway, I’m not saying they’re at odds and you can only pick one. So we seem to agree. I’m saying devs should be applauding better security and not whining about the transition away from user-domain security which is kinda what is implied in the OP. We should be whining about not having access to to the system in ways we need. Better security needs to accommodate valid use cases not stifle creativity. We probably also agree there. Opining Linux because it’s still the wild west of software and you can do shit like zip up the user’s browser history, logins, and cookies, or idk dump entire hardware profiles without any user interaction, or prompt the user to install a new boot loader or drop your rootkit into initrd because your program “just needs their password to update” is just that.
- lapcat 4y ago
  > I’m saying devs should be applauding better security and not whining about the transition away from user-domain security which is kinda what is implied in the OP. It's not better security, it's security theater. Security researchers roll out of bed in the morning and find bypasses to macOS TCC (Transparency, Consent, and Control). I've done it myself, and I'm not a professional security researcher. The so-called "security" doesn't actually stop real malware, it only stops honest developers from making a living.
  - dcow 4y ago
    People discover vulns all the time. A vuln is not theatre. You patch the vuln and you are secure. A vlun does not security theatre make. A fundamental design flaw in the security model or system which renders it irrelevant, on the other hand, is a problem. Are you saying there’s a fundamental flaw in Apple’s implementation of secure boot, code signatures, and sandboxing that makes it irrelevant?
    - lapcat 4y ago
      > You patch the vuln and you are secure. Except you aren't, because there's an endless series of them. > Are you saying there’s a fundamental flaw in Apple’s implementation of secure boot, code signatures, and sandboxing that makes it irrelevant? I said TCC, and you said everything except TCC. (Although sandboxing is pretty insecure on the Mac too.) The fundamental design flaw is that Mac OS X started as an open system, and Apple tried to tack all of these security features on afterward, without otherwise redesigning the operating system. There are two many legacy features, including "must not break" features, too many openings, too much interoperation, too much complexity. Moreover, it often seems to me that Apple security engineers are not particularly experienced with Mac OS X, which is why an old hack like me can relatively easily find things that they've overlooked.
      - dcow 4y ago
        All I'm sayings is it's kinda weird to respond to people who are trying to make a system more secure by saying "well it will never be perfect so fuck it it's just theater". I mean really? I think we agree on everything else.
        lapcat 4y ago
        > it will never be perfect This is a straw man.
        lapcat 4y ago
        "Real world attacks (e.g., XCSSET) and researchers have consistently shown that TCC, while often a nuisance to users, does not present a significant obstacle to attackers." https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-and-more-7-kinds-of-data-malware-steals-from-macos-users/ https://www.sentinelone.com/blog/session-cookies-keychains-s...