6 ms·

Can we hide the orange dot without disabling SIP?

79 points by alin23 4y ago

urbandw311er 4y ago
Kudos to the author for publishing this exploration even though it ultimately didn’t succeed. It’s still revealing and useful.
- jaggederest 4y ago
  Absolutely interesting to see people using ChatGPT to wrangle some assembler, as well.
  - stefan_ 4y ago
    In good old ChatGPT fashion, it is utterly wrong, of course. If you are passing some unknown struct to a function, you should make sure you at least get the size right.
    - GeoAtreides 4y ago
      ChatGPT Axiom of correctness: If an answer cannot be googled or cannot be obtained by making trivial modifications to an answer found on google, most probably GhatGPT's answer is incorrect.
      - dylan604 4y ago
        Yes, but to ChatGPT's credit, you won't know it is incorrect since there's no other way to corroborate the data. /s
ary 4y ago
TLDR; No, you can't (for now). This was a little bit of an uncomfortable read as I really didn't want to see this defeated, but I'm glad people are checking that it works as intended. The pessimist in me fears that when SIP bypasses are found this will be ready to go as part of a RAT. Realistically though the authors of RATs probably didn't need the example.
- bombcar 4y ago
  Apple could just go to the expense of adding a few extra LEDs to the case. They already have one in Caps lock - could put one behind the volume button or something. Or make it only appear on the internal monitor, not mirrored or external devices.
  - klabb3 4y ago
    This would be so much better, and harder for real attackers to obfuscate and mislead. It would be easier to secure as well. It should of course also be physically based, and not software. This would probably mean always-on BS like Siri would always leave the light on, which would be honest.
  - duskwuff 4y ago
    > Or make it only appear on the internal monitor, not mirrored or external devices. Using an external monitor shouldn't mean the user loses access to a privacy feature. (Especially because some systems, like the Mac Mini, don't even have an internal monitor...)
  - plorkyeran 4y ago
    I cannot see my Mac's case when I am sitting at my desk, and I'm not using an Apple keyboard. They make more than just laptops.
Cockbrand 4y ago
Bartender [0] hides and rearranges icons by manipulating how the menu bar gets rendered. IIUC, it takes screenshots of the menu bar and uses them to cover certain areas of it. This might be another promising approach for hiding the orange dot. [0] https://www.macbartender.com/ https://www.macbartender.com/
- alin23 4y ago
  Unfortunately it doesn’t work. The dot’s window level exceeds any user-available level so no app can draw something above the dot. The only thing that can appear above the dot is the cursor.
  - Cockbrand 4y ago
    Thank you for the clarification!
exabrial 4y ago
Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" or leaving the platform. Not everyone faces the same risks. Something like (just typing this out, haven't thought it through): Having Apple associate your hardware with an apple id. Logging into apple id and registering a key. Apple signs key and you can install key on the specific hardware. You can then use said key to sign a security policy. The key can be removed by install Apple's default key by anyone, increasing the security level back to normal.
- threeseed 4y ago
  Apple is not building laptops primarily for technical people. If you want to disable specific security mechanisms then disable SIP. But making that an option that developers will use to exploit less technical people is not good for the platform or frankly anyone.
- Wowfunhappy 4y ago
  > Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" But is that so bad? For technically-inclined users, I'm still largely unconvinced of the value of SIP. Either you want Apple to be in control of your computer—and I think that's a perfectly reasonable default, if it can be changed—or you want to take control. If you take control, you must by definition also take responsibility for delegating those privileges to locally-installed software—which you can do via the standard UNIX permissions model. Apple added an extra layer on top of UNIX permissions in order to limit the users' maximum privilege level. If the user tells Apple to GTFO, there's no need for an extra layer.
  - Terretta 4y ago
    > For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.
0x0 4y ago
macos 13.3 introduced another dot, a blue dot for location services. Unfortunately it seems to severely interfere with games. For example, playing Asphalt9 from the mac app store, on macOS 13.3, whenever the blue dot appears, which seems to happen almost every minute, the game's audio stops, any attached game controller becomes unresponsive, and if you were actively playing a single player race, the game pauses and shows the pause menu, as if you had changed focus to a different application. After about 10 seconds, the blue dot disappear and the game controller becomes responsive again, allowing you to unpause the game. This makes any attempt at actually playing the game an exercise in anger management.
- madeofpalk 4y ago
  Is that a problem with the dot, or a problem with the game?
  - zamnos 4y ago
    It's a problem where the Operating System decided to run a background task and caused the foreground task that the user was interacting with to develop UX issues. Arguably the game could do a better job of handing when the operating system pulls the rug out from under it, but managing the limited hardware resources is really the job of the operating system. So it's the blue dot.
- Klonoar 4y ago
  ...is the game prompting a location service to spin up? That's more alarming to me than the blue dot itself.
  - zamnos 4y ago
    It's possible, given all of the macOS games out there, but macOS often decides to check on its own location, either to report the weather, or to update the laptop location for Find My, in case it's been stolen.
    - 4y ago
snowwrestler 4y ago
From the previous HN thread linked from this article, it seemed like the “officially supported” ways to avoid the orange dot for live performance and editing video were either a hardware capture device, or an app that uses an API to output raw video to a window/display. https://news.ycombinator.com/item?id=29627382 https://news.ycombinator.com/item?id=29627382
xp84 4y ago
This is, I'm afraid, part of a vision (of which Apple is the preeminent sponsor but Microsoft definitely believes it too, they're just less aggressive) where the OS vendor is presumed to know best and the owner of the computer's wishes are occasionally considered on an "if possible" basis. Obviously they could allow whatever signatures go into SIP to be updated, so you could make changes and then bless your changed configuration, and it wouldn't really even be hard. But they consider most computer owners to be too stupid to be trusted with that kind of power. And, they do have a point, a lot of users would happily do any super unsafe things they're told, just in exchange for a promise of a free game or a cracked version of Photoshop or whatever. It's just sad for those of us who remember that computers used to really be almost infinitely customizable. If you didn't like something, and you cared enough, you could fix it. I assume that soon, SIP won't be a thing you could turn off even if you wanted, and while you will still be able to get a root shell on a Mac it'll eventually be on some virtualized entity whose permissions are curtailed to only a sandboxed environment.
- JumpCrisscross 4y ago
  > they could allow whatever signatures go into SIP to be updated, so you could make changes and then bless your changed configuration What's wrong with SIP being on or off?
  - koito17 4y ago
    Off the top of my head, dtrace and dyld are gimped with SIP enabled, and you cannot modify your system volume for whatever reason (yes, that means "sudo mount -uw /" fails). You cannot use LD_PRELOAD if SIP is enabled, even on your own apps. Kernel extensions also need you to disable SIP, which is annoying if you want to work on a kext or even install one. For a non-technical problem: if you want to be able to share your screen on apps like Discord and forward audio output, you have to install a kext (oops, can't do that anymore with SIP enabled!), or you use "system extensions" which run in user space and expose less APIs (oops, on Apple Silicon macs the user has to boot into recovery mode to temporarily disable some security option before system extensions can be loaded!) The result? A lot of Mac users are simply too wary set up audio output for Discord's screen sharing because it means having to boot into recovery mode and do a bunch of stuff that will scare the hell out of any non-technical user. So it's not just power users that are affected by silly Apple policies. Everyday users, too.
dylan604 4y ago
"Oh, and it also appears in screen recordings, which annoys me as well whenever I want to demo something." If only there was a way to take that screen recording into some bit of software and cover up this part of the image so that it no longer offends in this precious bit of content. It's not like you're going to post that RAW screen recording session to some place without doing anything else to it in a professional manner, are you? I actually forgot about the menu bar in macOS ever since they gave me the ability to hide it like the dock. When I don't need it, it's out of the way recovering precious extra rows of screen height. When I do need it, it just magically reappears. "It can also be a distraction for a specific group of people struggling with attention deficit." If you are distracted by a dot, how are you not distracted by all of the other info in the menu bar too?
- jmholla 4y ago
  > If you are distracted by a dot, how are you not distracted by all of the other info in the menu bar too? The other things in the menu bar have a consistent design (e.g. they're black and white) and are static (assuming you aren't changing values in them like increasing the volume). This easily allows it to fade into the background. This dot pulses and uses a color not used elsewhere in the menu bar. It has been intentionally designed to get your attention.
echelon_musk 4y ago
While we're here, does anyone know a way to keep FileVault enabled with SIP disabled? It seems like a huge anti-privacy measure from Apple. Want control of your system? No FDE for you!
- duskwuff 4y ago
  > While we're here, does anyone know a way to keep FileVault enabled with SIP disabled? File Vault works independently of SIP. There's no conflict.
  - echelon_musk 4y ago
    I confused SIP with SSV! With SSV disabled it's impossible.
    - deleted 4y ago
      [deleted]
    - duskwuff 4y ago
      That part is correct, and it's to save you from doing something rather dangerous. On modern macOS systems, the system volume is not encrypted. If SSV is disabled, there's nothing to prevent the (potentially modified) system from exfiltrating your password and/or your encrypted data after you log in -- File Vault would be unable to provide any substantial security guarantees in this configuration. Now, because you can modify the system, you could probably bypass this check, or work around it (e.g. by mounting an encrypted volume during startup). But you should probably think very carefully about what attacks you're permitting before you do that.
pentagrama 4y ago
I finished the article and was wondering if the author will show a image of how the dot looks like, and later find out that the first "image" is a video, and Firefox blocked the auto-play leaving the first frame that doesn't contain the dot. Have to right click on it and select play to reproduce it. I like that feature and avoid things moving around without interaction, but I think Firefox should put an overlay with a play button on native web videos, at least on mouse hover, isn't the first time I have to right click to know if is a video. And for the author, the use of descriptions at the bottom of images/videos is good for accessibility, a description like "Screen recording of the dot appearing" will avoided my confusion, and persons using screen readers will know it too (I checked and in the code there isn't a alt text for that (question: the alt="description" works for <video> like is used in <image>?)).
deleted 4y ago
[deleted]

79 points by alin23 4y ago

Kudos to the author for publishing this exploration even though it ultimately didn’t succeed. It’s still revealing and useful.

jaggederest 4y ago
Absolutely interesting to see people using ChatGPT to wrangle some assembler, as well.
- stefan_ 4y ago
  In good old ChatGPT fashion, it is utterly wrong, of course. If you are passing some unknown struct to a function, you should make sure you at least get the size right.
  - GeoAtreides 4y ago
    ChatGPT Axiom of correctness: If an answer cannot be googled or cannot be obtained by making trivial modifications to an answer found on google, most probably GhatGPT's answer is incorrect.
    - dylan604 4y ago
      Yes, but to ChatGPT's credit, you won't know it is incorrect since there's no other way to corroborate the data. /s

ary 4y ago

TLDR; No, you can't (for now). This was a little bit of an uncomfortable read as I really didn't want to see this defeated, but I'm glad people are checking that it works as intended. The pessimist in me fears that when SIP bypasses are found this will be ready to go as part of a RAT. Realistically though the authors of RATs probably didn't need the example.

bombcar 4y ago
Apple could just go to the expense of adding a few extra LEDs to the case. They already have one in Caps lock - could put one behind the volume button or something. Or make it only appear on the internal monitor, not mirrored or external devices.
- klabb3 4y ago
  This would be so much better, and harder for real attackers to obfuscate and mislead. It would be easier to secure as well. It should of course also be physically based, and not software. This would probably mean always-on BS like Siri would always leave the light on, which would be honest.
- duskwuff 4y ago
  > Or make it only appear on the internal monitor, not mirrored or external devices. Using an external monitor shouldn't mean the user loses access to a privacy feature. (Especially because some systems, like the Mac Mini, don't even have an internal monitor...)
- plorkyeran 4y ago
  I cannot see my Mac's case when I am sitting at my desk, and I'm not using an Apple keyboard. They make more than just laptops.

Cockbrand 4y ago

Bartender [0] hides and rearranges icons by manipulating how the menu bar gets rendered. IIUC, it takes screenshots of the menu bar and uses them to cover certain areas of it. This might be another promising approach for hiding the orange dot. [0] https://www.macbartender.com/ https://www.macbartender.com/

alin23 4y ago
Unfortunately it doesn’t work. The dot’s window level exceeds any user-available level so no app can draw something above the dot. The only thing that can appear above the dot is the cursor.
- Cockbrand 4y ago
  Thank you for the clarification!

exabrial 4y ago

Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" or leaving the platform. Not everyone faces the same risks. Something like (just typing this out, haven't thought it through): Having Apple associate your hardware with an apple id. Logging into apple id and registering a key. Apple signs key and you can install key on the specific hardware. You can then use said key to sign a security policy. The key can be removed by install Apple's default key by anyone, increasing the security level back to normal.

threeseed 4y ago
Apple is not building laptops primarily for technical people. If you want to disable specific security mechanisms then disable SIP. But making that an option that developers will use to exploit less technical people is not good for the platform or frankly anyone.
Wowfunhappy 4y ago
> Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" But is that so bad? For technically-inclined users, I'm still largely unconvinced of the value of SIP. Either you want Apple to be in control of your computer—and I think that's a perfectly reasonable default, if it can be changed—or you want to take control. If you take control, you must by definition also take responsibility for delegating those privileges to locally-installed software—which you can do via the standard UNIX permissions model. Apple added an extra layer on top of UNIX permissions in order to limit the users' maximum privilege level. If the user tells Apple to GTFO, there's no need for an extra layer.
- Terretta 4y ago
  > For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.

0x0 4y ago

macos 13.3 introduced another dot, a blue dot for location services. Unfortunately it seems to severely interfere with games. For example, playing Asphalt9 from the mac app store, on macOS 13.3, whenever the blue dot appears, which seems to happen almost every minute, the game's audio stops, any attached game controller becomes unresponsive, and if you were actively playing a single player race, the game pauses and shows the pause menu, as if you had changed focus to a different application. After about 10 seconds, the blue dot disappear and the game controller becomes responsive again, allowing you to unpause the game. This makes any attempt at actually playing the game an exercise in anger management.

madeofpalk 4y ago
Is that a problem with the dot, or a problem with the game?
- zamnos 4y ago
  It's a problem where the Operating System decided to run a background task and caused the foreground task that the user was interacting with to develop UX issues. Arguably the game could do a better job of handing when the operating system pulls the rug out from under it, but managing the limited hardware resources is really the job of the operating system. So it's the blue dot.
Klonoar 4y ago
...is the game prompting a location service to spin up? That's more alarming to me than the blue dot itself.
- zamnos 4y ago
  It's possible, given all of the macOS games out there, but macOS often decides to check on its own location, either to report the weather, or to update the laptop location for Find My, in case it's been stolen.
  - 4y ago

snowwrestler 4y ago

From the previous HN thread linked from this article, it seemed like the “officially supported” ways to avoid the orange dot for live performance and editing video were either a hardware capture device, or an app that uses an API to output raw video to a window/display. https://news.ycombinator.com/item?id=29627382 https://news.ycombinator.com/item?id=29627382

xp84 4y ago

This is, I'm afraid, part of a vision (of which Apple is the preeminent sponsor but Microsoft definitely believes it too, they're just less aggressive) where the OS vendor is presumed to know best and the owner of the computer's wishes are occasionally considered on an "if possible" basis. Obviously they could allow whatever signatures go into SIP to be updated, so you could make changes and then bless your changed configuration, and it wouldn't really even be hard. But they consider most computer owners to be too stupid to be trusted with that kind of power. And, they do have a point, a lot of users would happily do any super unsafe things they're told, just in exchange for a promise of a free game or a cracked version of Photoshop or whatever. It's just sad for those of us who remember that computers used to really be almost infinitely customizable. If you didn't like something, and you cared enough, you could fix it. I assume that soon, SIP won't be a thing you could turn off even if you wanted, and while you will still be able to get a root shell on a Mac it'll eventually be on some virtualized entity whose permissions are curtailed to only a sandboxed environment.

JumpCrisscross 4y ago
> they could allow whatever signatures go into SIP to be updated, so you could make changes and then bless your changed configuration What's wrong with SIP being on or off?
- koito17 4y ago
  Off the top of my head, dtrace and dyld are gimped with SIP enabled, and you cannot modify your system volume for whatever reason (yes, that means "sudo mount -uw /" fails). You cannot use LD_PRELOAD if SIP is enabled, even on your own apps. Kernel extensions also need you to disable SIP, which is annoying if you want to work on a kext or even install one. For a non-technical problem: if you want to be able to share your screen on apps like Discord and forward audio output, you have to install a kext (oops, can't do that anymore with SIP enabled!), or you use "system extensions" which run in user space and expose less APIs (oops, on Apple Silicon macs the user has to boot into recovery mode to temporarily disable some security option before system extensions can be loaded!) The result? A lot of Mac users are simply too wary set up audio output for Discord's screen sharing because it means having to boot into recovery mode and do a bunch of stuff that will scare the hell out of any non-technical user. So it's not just power users that are affected by silly Apple policies. Everyday users, too.

dylan604 4y ago

"Oh, and it also appears in screen recordings, which annoys me as well whenever I want to demo something." If only there was a way to take that screen recording into some bit of software and cover up this part of the image so that it no longer offends in this precious bit of content. It's not like you're going to post that RAW screen recording session to some place without doing anything else to it in a professional manner, are you? I actually forgot about the menu bar in macOS ever since they gave me the ability to hide it like the dock. When I don't need it, it's out of the way recovering precious extra rows of screen height. When I do need it, it just magically reappears. "It can also be a distraction for a specific group of people struggling with attention deficit." If you are distracted by a dot, how are you not distracted by all of the other info in the menu bar too?

jmholla 4y ago
> If you are distracted by a dot, how are you not distracted by all of the other info in the menu bar too? The other things in the menu bar have a consistent design (e.g. they're black and white) and are static (assuming you aren't changing values in them like increasing the volume). This easily allows it to fade into the background. This dot pulses and uses a color not used elsewhere in the menu bar. It has been intentionally designed to get your attention.

echelon_musk 4y ago

While we're here, does anyone know a way to keep FileVault enabled with SIP disabled? It seems like a huge anti-privacy measure from Apple. Want control of your system? No FDE for you!

duskwuff 4y ago
> While we're here, does anyone know a way to keep FileVault enabled with SIP disabled? File Vault works independently of SIP. There's no conflict.
- echelon_musk 4y ago
  I confused SIP with SSV! With SSV disabled it's impossible.
  - deleted 4y ago
    [deleted]
  - duskwuff 4y ago
    That part is correct, and it's to save you from doing something rather dangerous. On modern macOS systems, the system volume is not encrypted. If SSV is disabled, there's nothing to prevent the (potentially modified) system from exfiltrating your password and/or your encrypted data after you log in -- File Vault would be unable to provide any substantial security guarantees in this configuration. Now, because you can modify the system, you could probably bypass this check, or work around it (e.g. by mounting an encrypted volume during startup). But you should probably think very carefully about what attacks you're permitting before you do that.

pentagrama 4y ago

I finished the article and was wondering if the author will show a image of how the dot looks like, and later find out that the first "image" is a video, and Firefox blocked the auto-play leaving the first frame that doesn't contain the dot. Have to right click on it and select play to reproduce it. I like that feature and avoid things moving around without interaction, but I think Firefox should put an overlay with a play button on native web videos, at least on mouse hover, isn't the first time I have to right click to know if is a video. And for the author, the use of descriptions at the bottom of images/videos is good for accessibility, a description like "Screen recording of the dot appearing" will avoided my confusion, and persons using screen readers will know it too (I checked and in the code there isn't a alt text for that (question: the alt="description" works for <video> like is used in <image>?)).

deleted 4y ago

[deleted]