10 ms·
Is macOS’s new XProtect behavioural security preparing to go live?
- davidmurdoch 3y agoGreat. I already can't get my signed, notarized, and stapled Mac version of my app to be runnable on mac. Apple is so hostile to developers.
- Angostura 3y agoOdd. I can get asn unsigned, un-notarised app running just fine. I just need to hold control while opening it for initial run. Something odd happening here.
- davidmurdoch 3y agoSure, there are workarounds. But I can't ask people that download the app to perform Apple's rituals.
- greggsy 3y agoWhy not? If you’re able to demonstrate that you’re a trusted developer, they’ll respond positively to an FAQ. It’s not uncommon.
- davidmurdoch 3y agoUsers are fickle. And in the 5 years I've been deploying this app I've never had to ask users to do that. I'm sure it's fixable, the solution has just eluded me this far.
- tough 3y agoOr jump through several hoops into System Settings > Privacy & Security, and authorise the app. It's designed so regular users don't / can't bother to do so, tho
- VHRanger 3y agoLove the update from a year ago where you need to click through 3 layers of settings to run code someone else wrote on MacOS now. And on the other end, window's UX is going down the drain year over year.
- RONROC 3y ago[flagged]
- acdha 3y agoLook, I agree that this kind of non-specific rant isn’t useful but that level of response is pretty harsh. I’d at least be charitable and ask whether he’s doing something uncommon which would explain why it’s so much harder than normal.
- davidmurdoch 3y agoI had such a great reply to their unkind comment. I lost it after hitting submit, because it was flagged by the time I did. I wish they left it up.
- mschuster91 3y agoThe bastion rulesets won't impact your macOS app, unless you're attempting to do something that only malware or otherwise sketchy software would do.
- diogenes4 3y agoSurely it would be easier to simply disable internet access until the user enables it. Bonus points if you can control what it talks to at the IP stack and DNS level. Something i've wanted for decades at this point.... yea, little snitch does this, but it's not built in and belongs on my phone as well. Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior.
- greggsy 3y agoI recently attempted to trace exactly which app is making a particular DNS SOA query. I can confidently say that there are very few applications in the *nix space that do proper DNS reporting at all, and Little Snitch seems to be the only one that would map the actual app. I found no working solution to match a query to a pid in Linux. This tells me that either people rarely need to do this, or that it’s very hard to do in userland.
- mschuster91 3y ago> Preventing an app from accessing browser data feels like an approach to make people feel safe while providing no meaningful protections from most malware behavior. Depends on the threat model. Yes, protecting browser data does not help if the attacker gained entry into the system by exploiting a vulnerability in the browser. But it helps against all other entry points: USB sticks laced with malware (common threat against companies), malware that came as part of an email attachment or by dodgy warez, an attacker that's already in the network (either because they're laterally moving or because the victim is in a scenario like a public wifi) and exploits some vulnerability in network-enabled software... Classic defense in depth here, it massively raises the bar for attackers because to steal Chrome user sessions or passwords, you now need a code execution avenue but also a kernel-level or at least sandbox exploit to bypass Bastion.
- jamil7 3y agoCan you share the app? Maybe someone here can tell what the issue is. I'm able to distribute outside of the mac AppStore without users needing to jump through any hoops or right click etc.
- stouset 3y ago[flagged]
- davidmurdoch 3y agoYou are a liar.
- greggsy 3y agoThere’s an opportunity to remedy your problem but I don’t think this is the best way to leave that offer open.
- davidmurdoch 3y agoThey just made something up about me that is not true. They've insulted my integrity. They are a liar. No one in good faith can disagree.
- smoldesu 3y agoThere is no 'open offer' to consider. The only thing the grandparent did was fabricate a lie, and the only reasonable response is to call them out on it. Their comment was against HN guidelines (Assume good faith.), there's no reason to chide someone for calling them out on that.
- deleted 3y ago[deleted]
- davidmurdoch 3y agoIt's an Electron app AND blockchain related; hackernews's two favorite things to hate. I don't expect much love from this crowd. Heh. It's certainly either something I'm doing wrong, or a big in the software I'm using to automate signing, notification and stapling. Here's the issue I opened on the software I'm using to automate: https://github.com/electron-userland/electron-builder/issues/7755 https://github.com/electron-userland/electron-builder/issues... that issue kinks to the PR that adds the automation. It's a non-trivial thing to test, since it involves so many secrets and the notarization step can take over an hour, so I don't expect anyone here to actually want to look into it. My original comment really was just venting my frustration, not a cry for help (but I might be crying soon if I cant get to the bottom of this!).
- bitwize 3y agoApple has developed the first and only generally available "evil maid" resistant computer systems. Part of participating in this secure ecosystem involves more effort on your part to comply with the security requirements. Or you can just develop for vulnerable-as-all-getout Linux or Windows systems. Your choice.
- BiteCode_dev 3y agoHaving an evil made fidling my computer is not a big worry in my life. Not being a slave to the gafams is.
- acdha 3y agoIt’s not just the evil maid but what happens if your device is stolen (or scanned by the police), or you run malware by mistake and want to restore it to a trustworthy state. Most people should worry about those more than the evil maid scenarios.
- wkat4242 3y agoThe police regularly have zero day tools available like pegasus and celebrite. It doesn't really protect against well funded attackers.
- acdha 3y agoNotice how those tools don’t have perfect coverage, often don’t support fully patched devices or only work with e.g. short PINs, and in high profile cases it often takes months to crack iPhones? Nobody said this is easy but it’s a lot harder than it used to be.
- BiteCode_dev 3y agoNone of those scenarios matter to me: - I can't prevent the police from pegasusing my device. - I haven't have anyone infected by a malware in years, no matter the brand of device. - Most thief won't be able to do anything with any of my devices, no matter the brand. They are not very smart, and can't deal with a bios password, an encrypted disk or even simply a locked smartphones. They steal it anyway, and throw it away when it fails. But in the end, I don't optimize my life for the rare occasion of being stolen. I optimize it for my day to day problems, like being able to use my machine to do what I want to do every day, without having to hope I'm allowed to do it by corporations. I'm much more worried about the state of society that losing a phone once to a thief.
- deleted 3y ago[deleted]
- deleted 3y ago[deleted]
- angulardragon03 3y agoWeird. I just downloaded Ganache and it ran and opened just fine, no warnings. Are you experiencing this on your own machine, or just other machines? And what version of macOS?
- davidmurdoch 3y agoThe current published version is fine, thanks for trying it! I'm working on a new release, and haven't been able to get the Apple build to work. Lots has changed since the last release, certainly on my side and I presume also on Apple's. I've manually tested on Monterey.
- angulardragon03 3y agoAh ok, makes sense. I’d recommend you check out Apparency [1], which can inspect .app bundles and show you what’s up with the signing on your bundle. It looks like you include a few frameworks (which also need to be signed), so maybe you have components missing signatures/with mismatched signatures. [1] https://mothersruin.com/software/Apparency/ https://mothersruin.com/software/Apparency/
- davidmurdoch 3y agoThis looks like it will be immensely useful! Thanks!
- DueDilligence 3y ago[dead]
- steve_adams_86 3y agoI used to think this sentiment is overblown, but then I tried to develop a Mac and iOS app. Although I live in Canada, it took almost 3 weeks to become an Apple developer, having to supply every piece of ID in my possession and having many declined. They’re British Columbian identification in perfectly fine condition. The development process could have been much worse, but some aspects of swift development in XCode were frustratingly rough with a range of extremely well document to barely documented APIs. Can I do X with SwiftUI? Who knows. Does it support Y pattern well? Absolutely, and here are a dozen examples. Such a pain in the ass. I also have no idea when my app will be approved. It just generates air quality forecasts from multiple sources, provides alerts, shows active wildfire perimeters, and doesn’t allow any access to anything else. Just uses location, optionally. It’s been weeks now. Overall I’d rather not develop for apple’s devices again, but mostly because so little is in my control. The rest was fine. I strongly dislike having so little agency around being accepted into the platform and then publishing on it. Not having a say over my tool chain is also pretty frustrating when theirs is so buggy, slow, and unintuitive.
- jwells89 3y ago> Can I do X with SwiftUI? Who knows. Does it support Y pattern well? Absolutely, and here are a dozen examples. Such a pain in the ass. SwiftUI is still very green, especially on Mac where it hasn't gotten as much attention as it has on iOS. There are some things I'm starting to use it for over UIKit on iOS, but on macOS I wouldn't bother — AppKit might be a little rough around the edges compared to UIKit, mainly due to its age, but it's a great deal more suitable for production work on macOS than SwiftUI is.
- steve_adams_86 3y agoI guess that was another hang up. What should you use? Why? When is it reasonable to use cutting edge vs seasoned libraries? Thanks for that, though. I’ll likely give that a shot soon, because my current client loves the idea of MacOS apps. I like the idea of common code to rub on multiple platforms, but it seems like it’s too green.
- alberth 3y agoKYC has way more good benefits than bad.
- 1letterunixname 3y agoThe industry bar is low: Is it any better than MDE?
- deleted 3y ago[deleted]
- GavinAnderegg 3y agoFor those interested in more details on XProtect’s status on their systems, Howard Oakley (the author of this blog) also provides free utilities: https://eclecticlight.co/downloads/ https://eclecticlight.co/downloads/ XProCheck, which allows for easier viewing of XProtect log details: https://eclecticlight.co/consolation-t2m2-and-log-utilities/ https://eclecticlight.co/consolation-t2m2-and-log-utilities/ As well as SilentKnight + LockRattler for checking the status of XProtect updates and other security configuration: https://eclecticlight.co/lockrattler-systhist/ https://eclecticlight.co/lockrattler-systhist/
- tokamak-teapot 3y agoMore of this could be great for corporate machines. Currently they are often bogged down with poorly behaving third party security software, some of which causes real problems for users, which could be lessened if some of that software could be replaced with better behaving OS capabilities. Windows Defender (or whatever it’s called) looked like it might help similarly on Windows, but I haven’t seen it being used that way. It looks to me like the third parties keep looking for new features they can advertise, knowing that corporate InfoSec will mandate support for them quickly, and that an OS-provided solution isn’t sold in the same way, so will be deemed unsuitable. Anyone feel more optimistic?
- lloeki 3y agoScenario 1: corp buys into Apple's protection, gets rid of (most) third party software Scenario 2: corp keeps third party software, which bangs its head against Apple's protection which prevents such god processes to access information, thus corp disables Apple's protection and keeps using third party software.
- greggsy 3y agoThis is exactly how Symantec operated under Windows 7, which required you to disable a key security feature at boot. Not sure if it’s still a thing.
- derefr 3y agoScenario 3: Apple treats third-party software that "bangs its head against Apple's protection" as malware, force-disabling it; mandates all third-party software to be rewritten to just use control APIs for Apple's internal protection mechanism. (Compare/contrast: Hypervisor.framework)
- GeekyBear 3y agoWe've certainly seen Windows Defender delete software like uTorrent without any input from the system Administrator.
- 3y ago
- mattmcknight 3y agoIs there any software out there detecting an unusual volume of file encryption activities from a process that could indicate it is ransomware?
- Terretta 3y ago“RansomWhere? is a utility with a simple goal; generically thwart OS X ransomware. It does so by identifying a commonality of essentially all ransomware; the creation of encrypted files.” https://objective-see.org/products/ransomwhere.html https://objective-see.org/products/ransomwhere.html For a deep dive into this line of thinking, his post: Towards Generic Ransomware Detection (04/20/2016) — https://objective-see.org/blog/blog_0x0F.html https://objective-see.org/blog/blog_0x0F.html Malwarebytes purchased an activity detecting product and claimed to offer this type of protection, though that marketing has become more generic now: https://www.malwarebytes.com/cybersecurity/business/what-is-next-generation-antivirus-ngav https://www.malwarebytes.com/cybersecurity/business/what-is-... Given AV firms change hands and veer into dark patterns, forum posts like this one shouldn't recommend anything in particular as the ownership and policies can change overnight.
- Unfrozen0688 3y agoSentinelone et al. places canary files that when encrypted flags for ransomware to central management.
- sam0x17 3y agoHah, my minecraft region protection mod used to be called XProtect
- shepherdjerred 3y agoI love seeing all of the fellow HN users who participated in the Minecraft server community
- cjdoc29 3y ago...There was an HN Minecraft server community?
- shepherdjerred 3y agoAh! No, sorry, I meant that there are quite a few HNers that have some origin in the Bukkit/Spigot scene, e.g. they once wrote plugins for those platforms.
- callalex 3y agoI wonder why Apple finds the need to run all of this security software in the shadows with zero documentation, near zero user access to logging, and zero user access to what the system is doing. Is it just some leftover pride because a handsome actor in blue jeans said macs don’t have viruses on TV 15 years ago?
- kaba0 3y agoBecause a serious enough malware running rampant on their platform would cause actual monetary loss for them, potentially losing their image as a safe OS?
- callalex 3y agoIn that case isn’t it better to be seen doing something to counteract that possibility instead of hiding the effort?
- wkat4242 3y agoZero user control over technical functionality is totally Apple's MO these days. They were a lot better at this in the early OSX days, they only used to hide technical details but the user could still control them if they knew what they were doing. But since iOS they've been slowly pushing this model to Mac. It pushed me away from the Mac platform, I only use it for work now.
- nxobject 3y agoI do wonder whether they'll let other apps hook into the "don't access private data for X" safeguards. In this hypothetical, how many developers would choose this – over simply putting their private data behind a password?