9 ms·

MacOS has been phasing out support for third-party kernel extensions and CrowdStrike doesn't use a kernel extension there according to some other posts.

ehutch79 2y ago
Also, it does actually work on MacOS despite this. We’ve had it catch someone getting malware.
nijave 2y ago
Whether you like macOS or not, they definitely are innovating in this space. They (afaik) are the only OS with more granular data access for permissions as well (no unfettered filesystem access by default, for instance) It's also a shame CrowdStrike doesn't take kernel reliability seriously
- fsflover 2y ago
  Qubes OS has a better model, security by compartmentalization: everything runs in separate VMs with hardware virtualization.
  - nijave 2y ago
    Android and iOS have compartmentalization as well but it's not hardware level (at least as far as I know).
  - throwaway48476 2y ago
    Qubes is great but no desktop GPU supports virtualization.
    - klodolph 2y ago
      I could be happy if the GPU was only used for compositing. If I were doing ML work, maybe I do that work in an ephemeral cloud environment. I know this doesn’t cover everyone’s use case, but it doesn’t have to.
    - fsflover 2y ago
      They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553 https://github.com/QubesOS/qubes-issues/issues/8553 See also: https://www.youtube.com/watch?list=PLQMQQsKgvLntZiKoELFs22Mtk-tBNNOMJ&v=FrKEUVB-BYM https://www.youtube.com/watch?list=PLQMQQsKgvLntZiKoELFs22Mt...
      - wtallis 2y ago
        > They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553 https://github.com/QubesOS/qubes-issues/issues/8553 You say they're planning to add a feature in the next release, but what you linked to is merely an uncompleted to-do item for creating a UI switch to toggle a feature that hasn't been written yet. I think you win the prize for the most ridiculous exaggeration in this thread. Unless you can link to something that actually comes anywhere close to supporting your claim, you're just recklessly lying.
        fsflover 2y ago
        The linked Issue #8553 is "just" about creating a toggle for GPU acceleration. It's blocked by Issue #8552 [0], which is the actual Issue about the acceleration and originally belonged to Milestone "Release 4.3". It seems to have been removed later, which I didn't expect or know about. Accusation of lying was completely unnecessary in your comment. Moreover, the Milestone was removed not because they changed their mind about the Release but for other reasons [1]. [0] https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552 [1] https://github.com/QubesOS/qubes-issues/milestone/28 https://github.com/QubesOS/qubes-issues/milestone/28 See also: https://forum.qubes-os.org/t/gpu-acceleration-development/24712/7 https://forum.qubes-os.org/t/gpu-acceleration-development/24...
        wtallis 2y ago
        Ok, so your [0] shows that the real work has barely been started. The only indication it was ever planned for the next release was a misunderstanding on your part about the meaning of a tag that was applied to the issue for less than one day last fall, and they've stopped tagging issues with milestones to prevent such misunderstandings in the future. It still looks to me like your exaggerated claim was grounded in little more than wishful thinking.
    - wolrah 2y ago
      > Qubes is great but no desktop GPU supports virtualization. Intel 12th-gen and newer iGPUs do, and AFAIK it can be unlocked on certain Arc cards as well but details are fuzzy.
- jazzyjackson 2y ago
  https://learn.microsoft.com/en-us/defender-endpoint/enable-controlled-folders https://learn.microsoft.com/en-us/defender-endpoint/enable-c...
  - nijave 2y ago
    Appears to be opt in vs opt out. I'm curious how many orgs use this
- eightysixfour 2y ago
  I'm sorry, restricting user's ability to change their computer is not innovation. It is paternalism.
  - wtallis 2y ago
    The user isn't being restricted. Third-party software is being restricted, by default, and those restrictions can be disabled by the user.
  - bsharper 2y ago
    The user can change anything they want, but a process launched by your user doesn't inherit every user access by default. You (the user) can give a process full disk access, or just access to your documents, or just access to your contacts, etc. It's maximizing user control, not minimizing it.
    - eightysixfour 2y ago
      I am talking about removing the ability to install kernel extensions. As for full disk access, go try and remove Photo Booth from you Mac.
  - samcat116 2y ago
    This is a feature not a bug in the enterprise.
mbreese 2y ago
I’m convinced that one reason for this move by Apple was poor quality kernel extensions written by enterprise security companies. I had our enterprise virus/firewall program crash my Mac all the time. I eventually had to switch to a different computer (Linux) for that work. It wasn’t Crowdstrike, but quality kernel level engineering isn’t was I think of when I think of security IT companies. But, also credit Apple here. They’ve made it possible for these programs to still run and do their jobs without needing to run in kernel mode and be susceptible to crashes.
- nijave 2y ago
  Not only security software, but really any 3rd party drivers have caused issues on Windows for years. Building better interfaces less likely to crash the kernel was a smart move
- drewg123 2y ago
  When I started doing driver development on MacOS X in the early 2000s, there were a number of questions on the kernel/driver dev mailing lists for darwin from AV vendors implementing kernel extensions. Most of them were embarrassing questions like "Our kernel extension calls out to our user level application, and sometimes the system deadlocks" that made me resolve to never run 3rd party AV on any system.
dagaci 2y ago
https://www.dropboxforum.com/t5/Apps-and-Installations/New-Dropbox-causes-Apple-Silicon-MacOS-to-boot-loop-kernel-panic/td-p/648641 https://www.dropboxforum.com/t5/Apps-and-Installations/New-D... Is this happening with or without kernel extensions?

ehutch79 2y ago

Also, it does actually work on MacOS despite this. We’ve had it catch someone getting malware.

nijave 2y ago

Whether you like macOS or not, they definitely are innovating in this space. They (afaik) are the only OS with more granular data access for permissions as well (no unfettered filesystem access by default, for instance) It's also a shame CrowdStrike doesn't take kernel reliability seriously

fsflover 2y ago
Qubes OS has a better model, security by compartmentalization: everything runs in separate VMs with hardware virtualization.
- nijave 2y ago
  Android and iOS have compartmentalization as well but it's not hardware level (at least as far as I know).
- throwaway48476 2y ago
  Qubes is great but no desktop GPU supports virtualization.
  - klodolph 2y ago
    I could be happy if the GPU was only used for compositing. If I were doing ML work, maybe I do that work in an ephemeral cloud environment. I know this doesn’t cover everyone’s use case, but it doesn’t have to.
  - fsflover 2y ago
    They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553 https://github.com/QubesOS/qubes-issues/issues/8553 See also: https://www.youtube.com/watch?list=PLQMQQsKgvLntZiKoELFs22Mtk-tBNNOMJ&v=FrKEUVB-BYM https://www.youtube.com/watch?list=PLQMQQsKgvLntZiKoELFs22Mt...
    - wtallis 2y ago
      > They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553 https://github.com/QubesOS/qubes-issues/issues/8553 You say they're planning to add a feature in the next release, but what you linked to is merely an uncompleted to-do item for creating a UI switch to toggle a feature that hasn't been written yet. I think you win the prize for the most ridiculous exaggeration in this thread. Unless you can link to something that actually comes anywhere close to supporting your claim, you're just recklessly lying.
      - fsflover 2y ago
        The linked Issue #8553 is "just" about creating a toggle for GPU acceleration. It's blocked by Issue #8552 [0], which is the actual Issue about the acceleration and originally belonged to Milestone "Release 4.3". It seems to have been removed later, which I didn't expect or know about. Accusation of lying was completely unnecessary in your comment. Moreover, the Milestone was removed not because they changed their mind about the Release but for other reasons [1]. [0] https://github.com/QubesOS/qubes-issues/issues/8552 https://github.com/QubesOS/qubes-issues/issues/8552 [1] https://github.com/QubesOS/qubes-issues/milestone/28 https://github.com/QubesOS/qubes-issues/milestone/28 See also: https://forum.qubes-os.org/t/gpu-acceleration-development/24712/7 https://forum.qubes-os.org/t/gpu-acceleration-development/24...
        wtallis 2y ago
        Ok, so your [0] shows that the real work has barely been started. The only indication it was ever planned for the next release was a misunderstanding on your part about the meaning of a tag that was applied to the issue for less than one day last fall, and they've stopped tagging issues with milestones to prevent such misunderstandings in the future. It still looks to me like your exaggerated claim was grounded in little more than wishful thinking.
  - wolrah 2y ago
    > Qubes is great but no desktop GPU supports virtualization. Intel 12th-gen and newer iGPUs do, and AFAIK it can be unlocked on certain Arc cards as well but details are fuzzy.
jazzyjackson 2y ago
https://learn.microsoft.com/en-us/defender-endpoint/enable-controlled-folders https://learn.microsoft.com/en-us/defender-endpoint/enable-c...
- nijave 2y ago
  Appears to be opt in vs opt out. I'm curious how many orgs use this
eightysixfour 2y ago
I'm sorry, restricting user's ability to change their computer is not innovation. It is paternalism.
- wtallis 2y ago
  The user isn't being restricted. Third-party software is being restricted, by default, and those restrictions can be disabled by the user.
- bsharper 2y ago
  The user can change anything they want, but a process launched by your user doesn't inherit every user access by default. You (the user) can give a process full disk access, or just access to your documents, or just access to your contacts, etc. It's maximizing user control, not minimizing it.
  - eightysixfour 2y ago
    I am talking about removing the ability to install kernel extensions. As for full disk access, go try and remove Photo Booth from you Mac.
- samcat116 2y ago
  This is a feature not a bug in the enterprise.

mbreese 2y ago

I’m convinced that one reason for this move by Apple was poor quality kernel extensions written by enterprise security companies. I had our enterprise virus/firewall program crash my Mac all the time. I eventually had to switch to a different computer (Linux) for that work. It wasn’t Crowdstrike, but quality kernel level engineering isn’t was I think of when I think of security IT companies. But, also credit Apple here. They’ve made it possible for these programs to still run and do their jobs without needing to run in kernel mode and be susceptible to crashes.

nijave 2y ago
Not only security software, but really any 3rd party drivers have caused issues on Windows for years. Building better interfaces less likely to crash the kernel was a smart move
drewg123 2y ago
When I started doing driver development on MacOS X in the early 2000s, there were a number of questions on the kernel/driver dev mailing lists for darwin from AV vendors implementing kernel extensions. Most of them were embarrassing questions like "Our kernel extension calls out to our user level application, and sometimes the system deadlocks" that made me resolve to never run 3rd party AV on any system.

dagaci 2y ago

https://www.dropboxforum.com/t5/Apps-and-Installations/New-Dropbox-causes-Apple-Silicon-MacOS-to-boot-loop-kernel-panic/td-p/648641 https://www.dropboxforum.com/t5/Apps-and-Installations/New-D... Is this happening with or without kernel extensions?