2 ms·

I wonder what happened that Apple/ARM has implemented something similar at nearly the same time. https://security.apple.com/blog/memory-integrity-enforcement/

I wonder what happened that Apple/ARM has implemented something similar at nearly the same time. https://security.apple.com/blog/memory-integrity-enforcement/ https://security.apple.com/blog/memory-integrity-enforcement...

astrange 1y ago
Intel already tried it once in 2019, failed and had to remove it. https://en.wikipedia.org/wiki/Intel_MPX https://en.wikipedia.org/wiki/Intel_MPX
- jpecar 1y ago
  Afaik Intel's first foray into this territory was their i960mx which ended up in F-22.
  - monocasa 1y ago
    Even before then the iAPX432 had object capability security wrt its memory.
- monocasa 1y ago
  I remember playing with it and finding out it was slower than just manual bounds checks in front of every memory access.
noir_lord 1y ago
Don't think it was any one thing so much as it makes a whole bunch of attacks more difficult - security is a perpetual arms race after all.
- MBCook 1y ago
  I agree it would’ve happened no matter what, it’s a very useful feature. I do wonder if Apple‘s announcement that they started shipping it may have pushed them to announce this/agree to a standard earlier than they would have otherwise.
fweimer 1y ago
Arm MTE is much older. Android already supported it with a limited number of devices: https://developer.android.com/ndk/guides/arm-mte https://developer.android.com/ndk/guides/arm-mte There is server hardware out there now that in theory can support MTE, but I don't know if there's commercial support for it. MTE needs to be set up by the firmware, it's not purely an OS/kernel matter.
- preisschild 1y ago
  GrapheneOS (hardened Android distribution) also has it enabled by default for the base OS and user-installed Apps that support it (you can also force it for all apps) on 8th Gen Google Pixels and newer Interesting thread: https://grapheneos.social/@GrapheneOS/113223437850603601 https://grapheneos.social/@GrapheneOS/113223437850603601
pjmlp 1y ago
The very first commercial system of this was done by Oracle in Solaris SPARC since 2015. https://docs.oracle.com/en/operating-systems/solaris/oracle-solaris/11.4/prog-interfaces/using-application-data-integrity-adi.html https://docs.oracle.com/en/operating-systems/solaris/oracle-... Intel had a first attempt at this with MPX, but the design had flaws, https://en.wikipedia.org/wiki/Intel_MPX https://en.wikipedia.org/wiki/Intel_MPX Then there is CHERI and the related ARM Morello, https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ Apple isn't a first here, one first among general public.

astrange 1y ago

Intel already tried it once in 2019, failed and had to remove it. https://en.wikipedia.org/wiki/Intel_MPX https://en.wikipedia.org/wiki/Intel_MPX

jpecar 1y ago
Afaik Intel's first foray into this territory was their i960mx which ended up in F-22.
- monocasa 1y ago
  Even before then the iAPX432 had object capability security wrt its memory.
monocasa 1y ago
I remember playing with it and finding out it was slower than just manual bounds checks in front of every memory access.

noir_lord 1y ago

Don't think it was any one thing so much as it makes a whole bunch of attacks more difficult - security is a perpetual arms race after all.

MBCook 1y ago
I agree it would’ve happened no matter what, it’s a very useful feature. I do wonder if Apple‘s announcement that they started shipping it may have pushed them to announce this/agree to a standard earlier than they would have otherwise.

fweimer 1y ago

Arm MTE is much older. Android already supported it with a limited number of devices: https://developer.android.com/ndk/guides/arm-mte https://developer.android.com/ndk/guides/arm-mte There is server hardware out there now that in theory can support MTE, but I don't know if there's commercial support for it. MTE needs to be set up by the firmware, it's not purely an OS/kernel matter.

preisschild 1y ago
GrapheneOS (hardened Android distribution) also has it enabled by default for the base OS and user-installed Apps that support it (you can also force it for all apps) on 8th Gen Google Pixels and newer Interesting thread: https://grapheneos.social/@GrapheneOS/113223437850603601 https://grapheneos.social/@GrapheneOS/113223437850603601

pjmlp 1y ago

The very first commercial system of this was done by Oracle in Solaris SPARC since 2015. https://docs.oracle.com/en/operating-systems/solaris/oracle-solaris/11.4/prog-interfaces/using-application-data-integrity-adi.html https://docs.oracle.com/en/operating-systems/solaris/oracle-... Intel had a first attempt at this with MPX, but the design had flaws, https://en.wikipedia.org/wiki/Intel_MPX https://en.wikipedia.org/wiki/Intel_MPX Then there is CHERI and the related ARM Morello, https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/ Apple isn't a first here, one first among general public.