6 ms·

I know people really dislike how Apple restricts your freedom to use their software in any way they don't intend. But this is one of the times where they shine.

I know people really dislike how Apple restricts your freedom to use their software in any way they don't intend. But this is one of the times where they shine. Apple recognised kernel extension brought all sorts of trouble for users such as instability, crashing, etc. and presented a juicy attack surface. They deprecated and eventually disallowed kernel extensions supplanting them with a system extensions framework to provide interfaces for VPN functionality, EDR agents, etc. A Crowdstrike agent couldn't panic or boot loop macOS due to a bug in the code when using this interface.

Avamander 2y ago
Microsoft is also trying to make drivers and similar safer with HVCI, WDAC, ELAM and similar efforts. But given how a large part of their moat is backwards compatibility, very few of those things are the default and even then probably wouldn't have prevented this scenario.
- nimish 2y ago
  > large part of their moat is backwards compatibility This is more of a religious belief than truth, IMO. They could strong-arm recalcitrant customers, but they don't.
  - vetinari 2y ago
    > They could strong-arm recalcitrant customers, but they don't. They really can't. When the customers have to redo their stack, they might do that in a way that doesn't need Microsoft at all.
    - nimish 2y ago
      These customers wouldn't be able to do that in time frames measured in anything but decades and/or they would risk going bankrupt attempting to switch. Microsoft has far more leverage than they choose to exert, for various reasons.
- nullindividual 2y ago
  Microsoft has routinely changed the display driver model, breaking backward compatibility. They've also barred print drivers.
rightbyte 2y ago
If the user want remote code execution (auto updates are) in kernel space, let them. Apple sell the whole hardware stack. I don't think limeting drivers would fly on Windows or Linux.
- commandersaki 2y ago
  Pretty sure there's an exception for drivers but requires at minimum notarisation from Apple, but more likely a review as well.
  - madeofpalk 2y ago
    They just developed a new framework that allows drivers to work just in user space https://developer.apple.com/documentation/driverkit https://developer.apple.com/documentation/driverkit
    - 12_throw_away 2y ago
      Well - recognition where it's due - that actually looks pretty great. (Assuming that, contrary to prior behavior, they actually support it, and fix bugs without breaking backwards compatibility every release, and don't keep swapping it out for newer frameworks, etc etc)
- jimbokun 2y ago
  No. Go buy a different product if you want that functionality. I'm sticking with my Apple phone so outages like this are much less likely to affect me.
- BobaFloutist 2y ago
  Ok what if they sold it off by default but there was a physical switch that could turn it on, that required hardware access? Good compromise?
  - School-Cotton 2y ago
    That’s exactly how macOS works (except it’s not a physical switch). You can disable SIP if you have hardware access to a machine.
brightlancer 2y ago
> I know people really dislike how Apple restricts your freedom to use their software in any way they don't intend. But this is one of the times where they shine. Yes, the problem here is that the system owners had too much control over their systems. No, no, that's the EXACT OPPOSITE of what happened. The problem is Crowdstrike had too much control of systems -- arguing that we should instead give that control to Apple is just swapping out who's holding the gun.
- maksimum 2y ago
  This is good nuance to add to the conversation, thanks. I think in most cases you have to trust some group of parties. As an individual you likely don't have enough time and expertise to fully validate everything that runs on your hardware. Do you trust the OSS community, hardware vendors, OS vendors like IBM, Apple, M$, do you trust third party vendors like Crowdstrike? For me, I prefer to minimize the number of parties I have to trust, and my trust is based on historical track record. I don't mind paying and giving up functionality.
  - __MatrixMan__ 2y ago
    Even if you've trusted too many people, and been burned, we should design our systems such that you can revoke that trust after the fact and become un-burned. Having to boot into safe mode and remove the file is a pretty clumsy remediation. Better would be to boot into some kind of trust-management interface and distrust cloudstrike updates dated after July 17, then rebuild your system accordingly (this wouldn't be difficult to implement with nix). Of course you can only benefit from that approach if you trust the end user a bit more than we typically do. Physical access should always be enough to access the trust management interface, anything else is just another vector for spooky action at a distance.
  - MinusGix 2y ago
    It is some mix of priorities along the frontier, with Apple being on the significantly controlling end such that I wouldn't want to bother. Your trust should also be based on prediction, and giving a major company even more control over what your systems are allowed to do has been historically bad and only gets worse. Even if Apple is properly ethical now (I'm skeptical, I think they've found a decently sized niche and that most of their users wouldn't drop them even if they moved to significantly higher levels of telemetry, due to being a status good in part), there's little reason to give them that power in perpetuity. Removing that control when it is absued hasn't gone well in the past.
adrr 2y ago
I can't run a 10year old game on my Mac but i can run a 30 year old game on my windows 11 box. Microsoft prioritizes backwards compatibility for older software,
- mulmen 2y ago
  If you are a Crowdstrike customer you can’t run anything today.
  - adrr 2y ago
    For apple you just need to be an apple customer, they do a good job on crashing computers with their OSX updates like Sonoma. I remember my first macbook pro retina couldn’t go to sleep because it wouldn’t wake up till apple decided to release a fix for it. Good thing they don’t make server OSes.
    - p_l 2y ago
      I remember fearing every OSX update because until they switched to just shipping read-only partition images you had considerable chance of hitting a bug in Installer.app that resulted in infinite loop... (the bug existed since ~10.6 until they switched to image-based updates...)
- branko_d 2y ago
  You can’t run a 30 year old driver in Windows, nor a 10 year old in all likelihood. Microsoft prioritizes userspace compatibility, but their driver models have changed (relatively) frequently.
- mdavidn 2y ago
  Maybe. Have you tried? 30 year old games often did not implement delta timing, so they advance ridiculously fast on modern processors. Or the games required a memory mode not supported by modern Windows (see real mode, expanded memory, protected mode), requiring DOSBox or other emulator to run today. DOSBox runs on Mac too, incidentally.
- 2y ago

Avamander 2y ago

Microsoft is also trying to make drivers and similar safer with HVCI, WDAC, ELAM and similar efforts. But given how a large part of their moat is backwards compatibility, very few of those things are the default and even then probably wouldn't have prevented this scenario.

nimish 2y ago
> large part of their moat is backwards compatibility This is more of a religious belief than truth, IMO. They could strong-arm recalcitrant customers, but they don't.
- vetinari 2y ago
  > They could strong-arm recalcitrant customers, but they don't. They really can't. When the customers have to redo their stack, they might do that in a way that doesn't need Microsoft at all.
  - nimish 2y ago
    These customers wouldn't be able to do that in time frames measured in anything but decades and/or they would risk going bankrupt attempting to switch. Microsoft has far more leverage than they choose to exert, for various reasons.
nullindividual 2y ago
Microsoft has routinely changed the display driver model, breaking backward compatibility. They've also barred print drivers.

rightbyte 2y ago

If the user want remote code execution (auto updates are) in kernel space, let them. Apple sell the whole hardware stack. I don't think limeting drivers would fly on Windows or Linux.

commandersaki 2y ago
Pretty sure there's an exception for drivers but requires at minimum notarisation from Apple, but more likely a review as well.
- madeofpalk 2y ago
  They just developed a new framework that allows drivers to work just in user space https://developer.apple.com/documentation/driverkit https://developer.apple.com/documentation/driverkit
  - 12_throw_away 2y ago
    Well - recognition where it's due - that actually looks pretty great. (Assuming that, contrary to prior behavior, they actually support it, and fix bugs without breaking backwards compatibility every release, and don't keep swapping it out for newer frameworks, etc etc)
jimbokun 2y ago
No. Go buy a different product if you want that functionality. I'm sticking with my Apple phone so outages like this are much less likely to affect me.
BobaFloutist 2y ago
Ok what if they sold it off by default but there was a physical switch that could turn it on, that required hardware access? Good compromise?
- School-Cotton 2y ago
  That’s exactly how macOS works (except it’s not a physical switch). You can disable SIP if you have hardware access to a machine.

brightlancer 2y ago

> I know people really dislike how Apple restricts your freedom to use their software in any way they don't intend. But this is one of the times where they shine. Yes, the problem here is that the system owners had too much control over their systems. No, no, that's the EXACT OPPOSITE of what happened. The problem is Crowdstrike had too much control of systems -- arguing that we should instead give that control to Apple is just swapping out who's holding the gun.

maksimum 2y ago
This is good nuance to add to the conversation, thanks. I think in most cases you have to trust some group of parties. As an individual you likely don't have enough time and expertise to fully validate everything that runs on your hardware. Do you trust the OSS community, hardware vendors, OS vendors like IBM, Apple, M$, do you trust third party vendors like Crowdstrike? For me, I prefer to minimize the number of parties I have to trust, and my trust is based on historical track record. I don't mind paying and giving up functionality.
- __MatrixMan__ 2y ago
  Even if you've trusted too many people, and been burned, we should design our systems such that you can revoke that trust after the fact and become un-burned. Having to boot into safe mode and remove the file is a pretty clumsy remediation. Better would be to boot into some kind of trust-management interface and distrust cloudstrike updates dated after July 17, then rebuild your system accordingly (this wouldn't be difficult to implement with nix). Of course you can only benefit from that approach if you trust the end user a bit more than we typically do. Physical access should always be enough to access the trust management interface, anything else is just another vector for spooky action at a distance.
- MinusGix 2y ago
  It is some mix of priorities along the frontier, with Apple being on the significantly controlling end such that I wouldn't want to bother. Your trust should also be based on prediction, and giving a major company even more control over what your systems are allowed to do has been historically bad and only gets worse. Even if Apple is properly ethical now (I'm skeptical, I think they've found a decently sized niche and that most of their users wouldn't drop them even if they moved to significantly higher levels of telemetry, due to being a status good in part), there's little reason to give them that power in perpetuity. Removing that control when it is absued hasn't gone well in the past.

adrr 2y ago

I can't run a 10year old game on my Mac but i can run a 30 year old game on my windows 11 box. Microsoft prioritizes backwards compatibility for older software,

mulmen 2y ago
If you are a Crowdstrike customer you can’t run anything today.
- adrr 2y ago
  For apple you just need to be an apple customer, they do a good job on crashing computers with their OSX updates like Sonoma. I remember my first macbook pro retina couldn’t go to sleep because it wouldn’t wake up till apple decided to release a fix for it. Good thing they don’t make server OSes.
  - p_l 2y ago
    I remember fearing every OSX update because until they switched to just shipping read-only partition images you had considerable chance of hitting a bug in Installer.app that resulted in infinite loop... (the bug existed since ~10.6 until they switched to image-based updates...)
branko_d 2y ago
You can’t run a 30 year old driver in Windows, nor a 10 year old in all likelihood. Microsoft prioritizes userspace compatibility, but their driver models have changed (relatively) frequently.
mdavidn 2y ago
Maybe. Have you tried? 30 year old games often did not implement delta timing, so they advance ridiculously fast on modern processors. Or the games required a memory mode not supported by modern Windows (see real mode, expanded memory, protected mode), requiring DOSBox or other emulator to run today. DOSBox runs on Mac too, incidentally.
2y ago