3 ms·

While I share the author's fear, the timeline they created doesn't really work. 1. Windows 10 S has mostly been a failure. 2. Web Environment Integrity, while

While I share the author's fear, the timeline they created doesn't really work. 1. Windows 10 S has mostly been a failure. 2. Web Environment Integrity, while horrifying, has not been rolled into Chrome! It's an early proposal. We should work to ensure it goes nowhere. 3. The above greatly pushes out the plausible timeline for events currently listed next to 2024, 2027, 2028, 2029, 2031, and 2032. An aside, I don't find "Apple enforces notarization" to be significant, since it only applies to code-signed applications. It would be better to list "2012 – Apple blocks unsigned apps by default on Mac" and "2016 – Apple hides option to allow unsigned apps from the Mac GUI." The rollout of System Integrity Protection should be in there too. I'm personally not against any of these changes in isolation, but they are absolutely part of the slippery slope the author is trying to highlight. Maybe I'm nitpicking, but I think the article would be more powerful if the content was more plausible. If you already agree this is a problem, the specifics don't matter, but if you're trying to show the pattern to someone new, the facts you present are important.

lapcat 3y ago
Agreed. (Except for the part where you're not actually against of these changes in isolation. I was against all of them.) Notarization is one of the most misunderstood aspects of Mac lockdown. It was just another annoying layer atop the preexisting system of Gatekeeper and Developer ID. Also missing on the Apple side are crucial dates such as 2007, the introduction of the locked down iPhone, and 2008, the introduction of the crApp Store. Apple did a bait and switch with iPhone lockdown. Many people seem to forget that it wasn't initially justified in terms of protecting the end user. Rather, it was justified in terms of protecting the cell phone carriers, i.e., "Cingular doesn’t want to see their West Coast network go down because some application messed up." Which we knew was total B.S. at the time, but that was the initial story. The Orwellian move was later made to change the story, and now it has always been about protecting the end user (from themselves).
- cachvico 3y ago
  > Rather, it was justified in terms of protecting the cell phone carriers I don't remember that at all. I do remember Jobs resisting the app store because he wanted everything to be a web app though (despite resisting the move to responsive web design). Can you provide a source for your claim?
  - lapcat 3y ago
    > Can you provide a source for your claim? "Cingular doesn’t want to see their West Coast network go down because some application messed up" is literally a quote from Steve Jobs. https://arstechnica.com/gadgets/2007/01/steve-jobs-knows-best/ https://arstechnica.com/gadgets/2007/01/steve-jobs-knows-bes... https://www.engadget.com/2007-01-11-jobs-confirms-iphone-is-a-closed-platform.html https://www.engadget.com/2007-01-11-jobs-confirms-iphone-is-... https://www.zdnet.com/article/steve-jobs-the-iphone-and-open-platforms/ https://www.zdnet.com/article/steve-jobs-the-iphone-and-open... https://archive.nytimes.com/bits.blogs.nytimes.com/2007/10/01/att-welcomes-programmers-for-all-phones-except-the-iphone/ https://archive.nytimes.com/bits.blogs.nytimes.com/2007/10/0... https://www.wired.com/2007/01/why-i-want-a-locked-iphone-2/ https://www.wired.com/2007/01/why-i-want-a-locked-iphone-2/ Of course this just proves another thing I said, which was "Many people seem to forget".
    - cachvico 3y ago
      Interesting - thanks! Seems odd to imagine a userspace app could take down a carrier network.
      - OkGoDoIt 3y ago
        2.5G and 3G networks were bad at the time, and many phone plans that included data had unlimited data. The only thing that kept them up was the fact that so few people had data-capable smart phones.
torginus 3y ago
I don't think Windows 10 S was a failure, but it was never aimed at the average consumer, rather than institutions who operate extremely locked down devices, like information kiosks, or school or library computers. These organizations need very efficient fleet management tools that can be operated by a small (even part-time) IT professionals.
23B1 3y ago
I don't get the impression that this was written with everyman in mind. The "someone new" won't understand the plausibility therein; better to appeal to the influencers that do.
- Wowfunhappy 3y ago
  I didn't mean to imply the author should have written for a general audience. There are plenty of techies who think this isn't a legitimate problem. I mean, if you're only writing for people who already agree with you, why bother at all?
  - latexr 3y ago
    > I mean, if you're only writing for people who already agree with you, why bother at all? To give those people, who may not be articulate or knowledgeable enough to explain the intricacies of a problem, the capacity to argue for or against a point when engaged in conversation. For example, there are people who are against behavioural advertising but they may not be able to cite specific examples of how it’s harmful, or how much, or to whom. Thus they would research those questions and make a post so others in similar situations are able to have informed discussions with those in their lives who don’t think behavioural advertising is a big deal.
    - Wowfunhappy 3y ago
      Okay, but it could do that more effectively if they picked better events for their timeline. I feel like the article, as it stands, basically only works on the basis of "the boiling frog of digital freedom" as a concept that people already feel is happening. Unfortunately, the actual details are poorly chosen—which don't matter if you're already bought into the concept, but are imperative otherwise.
      - latexr 3y ago
        My answer was more about the general reason to do it. I agree in the specific instance of this article, which is why I gave a different example. I meant to point that out in the original post.
Macha 3y ago
One of the big Windows 10 S problems is back in Windows 11, though. 1. You buy a device with Windows 11 2. The out of box experience demands you add a Microsoft account to proceed past it. There are workarounds for this, but mostly they are getting shut down. 3. You can't even get into the UEFI to install another OS without signing up to a MS account, because the UEFI is accessed via an OS level advanced startup option rather than the "press delete at bios screen" of the past
- TuringNYC 3y ago
  >> One of the big Windows 10 S problems is back in Windows 11, though. >> 1. You buy a device with Windows 11 I realize i'm techy an have techy friends, but I dont know anyone who has purchased a Windows machine in a decade. No one in my household, none of my friends, no office i've been at since 2017. The only interaction I have with windows is an old laptop used for MS Visio, which immediately dual-boots to Ubuntu when visio use is over. I rarely see anyone at conferences with anything but a macbook. My assumption was that the 30% market share windows has (https://gs.statcounter.com/os-market-share https://gs.statcounter.com/os-market-share) is from old-school corporations, government, city hall, etc. Am I missing something?
  - Macha 3y ago
    You're missing two things: 1. You're in a tech bubble. For a counter anecdote, the only Macs I encounter are those provided by my US employers in the technology sector. The US is particularly high in Mac market share, California more so, and the bay area may be the one Mac OS majority desktop/laptop share region on the planet. 2. Windows laptops don't get replaced that often. I know it's hard to believe from a tech/heavy user perspective, where it may feel like a 4 year old Windows laptop is so outdated and you need to replace it, especially if it was not one of the models that rival the Mac in price, but for the average user a Windows machine reached the point of being good enough for their uses in the Windows 7 era. This is because their uses (a) are not that strenuous (typing up office documents, posting on social media) and (b) unexciting, so they don't feel the need to upgrade the way they might with their smartphones. Notably, these users are also _not_ going to computing conferences to be spotted by you, or bringing their laptops to coffee shops (they have smartphones for that), etc. Note that despite that, Windows still has the majority of new sales in the US, steady for the last 3 years at 55% to Mac's 30%, and the decline in the years prior to that were mostly driven by iPads and Chromebooks, not Macs - the big jump in Mac market share in 2019 seems to be iPads being merged into the mac category, as iOS's share in this space disappears at the same time: https://www.statista.com/statistics/272667/market-share-held-by-operating-systems-in-the-us-since-2009/ https://www.statista.com/statistics/272667/market-share-held...
noam_compsci 3y ago
> Apple hides option to allow unsigned apps from the Mac GUI How so? Isn’t this still an option in settings? Or are you referring to something else?
- Wowfunhappy 3y ago
  > How so? Isn’t this still an option in settings? No, it's not. Starting in macOS Sierra, hid the "Allow from Anywhere" option in System Preferences. You can still allow unsigned apps, but you need to use a Terminal command: sudo spctl --master-disable Or you can whitelist individual apps by option-clicking them and selecting "open", but that's purposefully obtuse.
  - vinay_ys 3y ago
    I can still download or compile and install any binary I want. It only reminds me that this was done so and asks me to confirm. Isn't it?
    - Wowfunhappy 3y ago
      Use `spctl --status` to see the status of Gatekeeper. If Gatekeeper is enabled, the binaries you're downloading must have been signed by a valid developer ID. IIRC binaries you compile yourself get whitelisted automatically.
latexr 3y ago
> 2016 – Apple hides option to allow unsigned apps from the Mac GUI. Are you referring to System Settings? There was always a more convenient option which continues to work: right-click and select “Open”. Granted, you have to know that’s a solution and most people don’t (including developers, who recommend cumbersome methods in the documentation of their own apps), but the option was never removed nor is it hard to do.
- OkGoDoIt 3y ago
  I think having to right click and select “open” is effectively hiding the option from the GUI, since the assumption would be that does the same thing as double clicking. The whole point of a GUI is to be discoverable, and that workaround is very much not obvious or discoverable. If you right clicked and it said “open regardless of security concerns“ or something like that, then maybe it would qualify. The original article says the option was hidden from the GUI, not that it’s impossible to do.
  - latexr 3y ago
    > I think having to right click (…) then maybe it would qualify. Yes, I said so myself that it isn’t discoverable: > Granted, you have to know that’s a solution and most people don’t But once you know it it’s quite easy and within reach. > The original article says the option was hidden from the GUI, not that it’s impossible to do. I wasn’t replying to the original article; I was replying to a comment, in specific the text I quoted.
  - Wowfunhappy 3y ago
    ^ Yes, this is what I meant by "hidden from the GUI". Apple is purposefully obscuring the process. If you double click, the OS tells you "this Application is damaged" which is at best leaving out key information and at worst deliberately misleading. As I said in my original comment—I'm not necessarily against these changes in isolation. I think macOS handles the balance reasonably well. However, if you take these changes together, the throughline is clear. We went from "don't worry, Gatekeeper is entirely optional and easy to turn off" when it was first introduced to "don't worry, advanced users who can use the Terminal or know the specific hidden incantation can still bypass Gatekeeper."
hoseja 3y ago
These efforts always fail the first half a dozen attempts or so. Thankfully our corporate-state betters have deep reserves of effort!

lapcat 3y ago

Agreed. (Except for the part where you're not actually against of these changes in isolation. I was against all of them.) Notarization is one of the most misunderstood aspects of Mac lockdown. It was just another annoying layer atop the preexisting system of Gatekeeper and Developer ID. Also missing on the Apple side are crucial dates such as 2007, the introduction of the locked down iPhone, and 2008, the introduction of the crApp Store. Apple did a bait and switch with iPhone lockdown. Many people seem to forget that it wasn't initially justified in terms of protecting the end user. Rather, it was justified in terms of protecting the cell phone carriers, i.e., "Cingular doesn’t want to see their West Coast network go down because some application messed up." Which we knew was total B.S. at the time, but that was the initial story. The Orwellian move was later made to change the story, and now it has always been about protecting the end user (from themselves).

cachvico 3y ago
> Rather, it was justified in terms of protecting the cell phone carriers I don't remember that at all. I do remember Jobs resisting the app store because he wanted everything to be a web app though (despite resisting the move to responsive web design). Can you provide a source for your claim?
- lapcat 3y ago
  > Can you provide a source for your claim? "Cingular doesn’t want to see their West Coast network go down because some application messed up" is literally a quote from Steve Jobs. https://arstechnica.com/gadgets/2007/01/steve-jobs-knows-best/ https://arstechnica.com/gadgets/2007/01/steve-jobs-knows-bes... https://www.engadget.com/2007-01-11-jobs-confirms-iphone-is-a-closed-platform.html https://www.engadget.com/2007-01-11-jobs-confirms-iphone-is-... https://www.zdnet.com/article/steve-jobs-the-iphone-and-open-platforms/ https://www.zdnet.com/article/steve-jobs-the-iphone-and-open... https://archive.nytimes.com/bits.blogs.nytimes.com/2007/10/01/att-welcomes-programmers-for-all-phones-except-the-iphone/ https://archive.nytimes.com/bits.blogs.nytimes.com/2007/10/0... https://www.wired.com/2007/01/why-i-want-a-locked-iphone-2/ https://www.wired.com/2007/01/why-i-want-a-locked-iphone-2/ Of course this just proves another thing I said, which was "Many people seem to forget".
  - cachvico 3y ago
    Interesting - thanks! Seems odd to imagine a userspace app could take down a carrier network.
    - OkGoDoIt 3y ago
      2.5G and 3G networks were bad at the time, and many phone plans that included data had unlimited data. The only thing that kept them up was the fact that so few people had data-capable smart phones.

torginus 3y ago

I don't think Windows 10 S was a failure, but it was never aimed at the average consumer, rather than institutions who operate extremely locked down devices, like information kiosks, or school or library computers. These organizations need very efficient fleet management tools that can be operated by a small (even part-time) IT professionals.

23B1 3y ago

I don't get the impression that this was written with everyman in mind. The "someone new" won't understand the plausibility therein; better to appeal to the influencers that do.

Wowfunhappy 3y ago
I didn't mean to imply the author should have written for a general audience. There are plenty of techies who think this isn't a legitimate problem. I mean, if you're only writing for people who already agree with you, why bother at all?
- latexr 3y ago
  > I mean, if you're only writing for people who already agree with you, why bother at all? To give those people, who may not be articulate or knowledgeable enough to explain the intricacies of a problem, the capacity to argue for or against a point when engaged in conversation. For example, there are people who are against behavioural advertising but they may not be able to cite specific examples of how it’s harmful, or how much, or to whom. Thus they would research those questions and make a post so others in similar situations are able to have informed discussions with those in their lives who don’t think behavioural advertising is a big deal.
  - Wowfunhappy 3y ago
    Okay, but it could do that more effectively if they picked better events for their timeline. I feel like the article, as it stands, basically only works on the basis of "the boiling frog of digital freedom" as a concept that people already feel is happening. Unfortunately, the actual details are poorly chosen—which don't matter if you're already bought into the concept, but are imperative otherwise.
    - latexr 3y ago
      My answer was more about the general reason to do it. I agree in the specific instance of this article, which is why I gave a different example. I meant to point that out in the original post.

Macha 3y ago

One of the big Windows 10 S problems is back in Windows 11, though. 1. You buy a device with Windows 11 2. The out of box experience demands you add a Microsoft account to proceed past it. There are workarounds for this, but mostly they are getting shut down. 3. You can't even get into the UEFI to install another OS without signing up to a MS account, because the UEFI is accessed via an OS level advanced startup option rather than the "press delete at bios screen" of the past

TuringNYC 3y ago
>> One of the big Windows 10 S problems is back in Windows 11, though. >> 1. You buy a device with Windows 11 I realize i'm techy an have techy friends, but I dont know anyone who has purchased a Windows machine in a decade. No one in my household, none of my friends, no office i've been at since 2017. The only interaction I have with windows is an old laptop used for MS Visio, which immediately dual-boots to Ubuntu when visio use is over. I rarely see anyone at conferences with anything but a macbook. My assumption was that the 30% market share windows has (https://gs.statcounter.com/os-market-share https://gs.statcounter.com/os-market-share) is from old-school corporations, government, city hall, etc. Am I missing something?
- Macha 3y ago
  You're missing two things: 1. You're in a tech bubble. For a counter anecdote, the only Macs I encounter are those provided by my US employers in the technology sector. The US is particularly high in Mac market share, California more so, and the bay area may be the one Mac OS majority desktop/laptop share region on the planet. 2. Windows laptops don't get replaced that often. I know it's hard to believe from a tech/heavy user perspective, where it may feel like a 4 year old Windows laptop is so outdated and you need to replace it, especially if it was not one of the models that rival the Mac in price, but for the average user a Windows machine reached the point of being good enough for their uses in the Windows 7 era. This is because their uses (a) are not that strenuous (typing up office documents, posting on social media) and (b) unexciting, so they don't feel the need to upgrade the way they might with their smartphones. Notably, these users are also _not_ going to computing conferences to be spotted by you, or bringing their laptops to coffee shops (they have smartphones for that), etc. Note that despite that, Windows still has the majority of new sales in the US, steady for the last 3 years at 55% to Mac's 30%, and the decline in the years prior to that were mostly driven by iPads and Chromebooks, not Macs - the big jump in Mac market share in 2019 seems to be iPads being merged into the mac category, as iOS's share in this space disappears at the same time: https://www.statista.com/statistics/272667/market-share-held-by-operating-systems-in-the-us-since-2009/ https://www.statista.com/statistics/272667/market-share-held...

noam_compsci 3y ago

> Apple hides option to allow unsigned apps from the Mac GUI How so? Isn’t this still an option in settings? Or are you referring to something else?

Wowfunhappy 3y ago
> How so? Isn’t this still an option in settings? No, it's not. Starting in macOS Sierra, hid the "Allow from Anywhere" option in System Preferences. You can still allow unsigned apps, but you need to use a Terminal command: sudo spctl --master-disable Or you can whitelist individual apps by option-clicking them and selecting "open", but that's purposefully obtuse.
- vinay_ys 3y ago
  I can still download or compile and install any binary I want. It only reminds me that this was done so and asks me to confirm. Isn't it?
  - Wowfunhappy 3y ago
    Use `spctl --status` to see the status of Gatekeeper. If Gatekeeper is enabled, the binaries you're downloading must have been signed by a valid developer ID. IIRC binaries you compile yourself get whitelisted automatically.

latexr 3y ago

> 2016 – Apple hides option to allow unsigned apps from the Mac GUI. Are you referring to System Settings? There was always a more convenient option which continues to work: right-click and select “Open”. Granted, you have to know that’s a solution and most people don’t (including developers, who recommend cumbersome methods in the documentation of their own apps), but the option was never removed nor is it hard to do.

OkGoDoIt 3y ago
I think having to right click and select “open” is effectively hiding the option from the GUI, since the assumption would be that does the same thing as double clicking. The whole point of a GUI is to be discoverable, and that workaround is very much not obvious or discoverable. If you right clicked and it said “open regardless of security concerns“ or something like that, then maybe it would qualify. The original article says the option was hidden from the GUI, not that it’s impossible to do.
- latexr 3y ago
  > I think having to right click (…) then maybe it would qualify. Yes, I said so myself that it isn’t discoverable: > Granted, you have to know that’s a solution and most people don’t But once you know it it’s quite easy and within reach. > The original article says the option was hidden from the GUI, not that it’s impossible to do. I wasn’t replying to the original article; I was replying to a comment, in specific the text I quoted.
- Wowfunhappy 3y ago
  ^ Yes, this is what I meant by "hidden from the GUI". Apple is purposefully obscuring the process. If you double click, the OS tells you "this Application is damaged" which is at best leaving out key information and at worst deliberately misleading. As I said in my original comment—I'm not necessarily against these changes in isolation. I think macOS handles the balance reasonably well. However, if you take these changes together, the throughline is clear. We went from "don't worry, Gatekeeper is entirely optional and easy to turn off" when it was first introduced to "don't worry, advanced users who can use the Terminal or know the specific hidden incantation can still bypass Gatekeeper."

hoseja 3y ago

These efforts always fail the first half a dozen attempts or so. Thankfully our corporate-state betters have deep reserves of effort!