5 ms·

> what do you actually want? Give me the ability to choose what I trust. “You can either trust Apple and nobody else, even yourself, or you can trust literally

by kqp 5mo ago

> what do you actually want? Give me the ability to choose what I trust. “You can either trust Apple and nobody else, even yourself, or you can trust literally everybody” is obviously not a good faith implementation of this. Apple excels at steering the narrative with false conflation and false dichotomy, I’d also remind you of the came-and-went secure boot debate, which Apple successfully steered into Apple owns the encryption keys vs no encryption, and people just kind of forgot to ask, wait, why can’t I have the keys to my device?

dangus 5mo ago
I think you should read up on how secure boot works with macOS and alternate operating systems before speaking this negatively about the implementation. Apple is already giving you exactly what you’re asking for. It’s not really even that different than a PC motherboard that gives you “Windows UEFI” and “enroll my own keys” as options. https://asahilinux.org/docs/platform/security/ https://asahilinux.org/docs/platform/security/ As far as code signing, again, what do you want Apple to do here? They already gave you a master switch to turn it off. You are free to turn it off then implement your own third party code signing solution if you’d rather choose who you trust. It’s not Apple’s fault if nobody else decided to make their own trust repositories and the only alternative on the market is to have no safeguard at all. And let’s not forget who Apple markets their computers to. These features aren’t for you and me, they’re for the non-technical customers who will absolutely get pwned by unsigned code. Go to the MacBook Neo marketing page and try to find a single image of someone writing code or even being gainfully employed.
- Nevermark 5mo ago
  This is that false dichotomy. You can turn off all protection, as you point out. So who Apple markets Neo's to isn't a factor. > Apple’s fault if nobody else decided to make their own trust repositories and the only alternative on the market is to have no safeguard at all. Does Apple provide a means for enabling third party trust systems, without disabling Apple's protections in general? If not, that is a serious problem of Apple's choosing. Nobody (to a first order approximation) want's to dispense with Apple's protection, or re-implement it, but to be able to carve out exceptions for specific classes of software.
  - F7F7F7 5mo ago
    Sounds like you should pick something other than MacOS.
    - wlesieutre 5mo ago
      Right, all they need to do is convince every end user they’re trying to distribute software to that they’re using the wrong OS and should replace their MacBook with something running Linux. No problem at all.
      - dangus 5mo ago
        Or Windows, the OS that is already vastly more popular than macOS.
    - dangus 5mo ago
      I decided to get into this subject in my comment before I edited it out because I thought it would be too much of a tangent/ruffle too many feathers. But, yeah, macOS power users these days seem to spend a lot of time criticizing the OS and the company and never seem to just switch to something else. Apple is the 4th most popular PC manufacturer on the market. You can use something else. It's not a monopoly, nor a duopoly like with iOS. I switched to Linux, and I've been beyond shocked at how smooth it's been. It's been better than both Mac and Windows in more ways than I expected. And sure, not perfect, but still.
      - theonemind 5mo ago
        I can charitably believe this comment is not disingenuous, however, there are effectively two options, which are Windows and macOS, regardless of three manufacturers making more Windows machines than Apple at number four with Mac. I would call it an effective duopoly
        rmunn 5mo ago
        There are effectively two options if you dismiss Linux a priori. Which yes, many people do. There are plenty of people who have no desire to try Linux. And if you're a developer then you have to consider those people, because many of the people who use your software are the type with no desire to try Linux. But there are fewer and fewer reasons not to try Linux, and that group of "I'd never use Linux", while still large, is slowly shrinking. I'd argue that Microsoft is doing more than Apple is to push people into reconsidering Linux (and, often, discovering that it's actually pretty good these days, and that your techie friend whom you call all the time to help you with Windows is actually happy to help you with your Linux questions instead). But slowly, over time, it's making less and less sense to dismiss Linux a priori.
wolvoleo 5mo ago
Exactly, Apple is making this a black and white choice on purpose. To make it unattractive to bypass them, and introduce legitimate security concerns if you do so. But those don't have to exist if the options were more fine-grained. The same with SIP (system integrity protection). You can turn it off but then you have to turn it all off. There's no way to keep secure boot but bless your own changes and sign them in some way, that you have approved. You know, as the owner and admin of your own computer. It's either leave it to Apple or be completely on your own. And to make the choice even more uncomfortable they also disable some features like running iOS apps.
jaredklewis 5mo ago
I don’t disagree with your post but I’m still unclear on how you envision gatekeeper should work. You want the ability to choose a different “authorities” that verify and sign binaries? That makes sense to me but is unlikely to relieve any of the issues in the post. Also what do you mean by “even yourself?” What would that option look like?
- IsTom 5mo ago
  You could like, just trust a single binary. Have a button right there in the popup that already shows up.
  - Barbing 5mo ago
    Maybe “Gatekeeper Light” hidden under advanced settings would satisfy everyday users + the technical crowd For plenty of users, a button right there in the popup is almost the same as no Gatekeeper for most scenarios, but if we can handle it why not let us
  - zarzavat 5mo ago
    Isn't that what right clicking and selecting Open does?
    - MrDOS 5mo ago
      Nowadays (as of Sequoia, I think), I find that I need to run `xattr -c Foo.app` to clear the “this was downloaded from the Internet” bit on the application bundle before I can right-click, “Open” it. Used to be that you only needed to do that with .apps extracted from zip archives, but it seems to apply to .apps copied out of disk images (DMGs) now, too.
    - odo1242 5mo ago
      They disabled the right-click-and-select-open feature; you now have to go to Settings to run the app.
      - 5mo ago
ActorNightly 5mo ago
I want the ability to run any linux distro on my macbook, like I can with any other computer that is not a macbook.
- tuna74 5mo ago
  Macs have enough open firmware to allow you to run any OS that you want. Linux Asahi only supports a certain subset of modern Mac HW, if you want to speed up development you should probably contribute to that project.
- isityettime 5mo ago
  The Asahi team does upstream their work, so eventually this will be possible with the M1 Macs. But it's an uphill battle because it's a reverse engineering effort on undocumented hardware that has a different separation of duties between firmware, hardware, and operating system than other systems that Linux already supports. It's a wonderful project, but if you want timely Linux support, you have to buy from a vendor whose chipset makers more proactively cooperate with Linux kernel developers. It would be wonderful if Apple shipped the Asahi team a bunch of docs hardware, and commissioned them to complete+productionize support for every single Apple Silicon Mac released up until now plus the upcoming gen. If they did that, maybe in one year support would be great and in two or three years, you coule use any distro you liked and get full support. But that's not really who Apple is or how they position themselves in the market afaict. This wish is sadly barking up the wrong tree.
- pjmlp 5mo ago
  Easy, don't buy Apple, I don't. Apple computers that I use are project assignments.
Wowfunhappy 5mo ago
> I’d also remind you of the came-and-went secure boot debate, which Apple successfully steered into Apple owns the encryption keys vs no encryption, and people just kind of forgot to ask, wait, why can’t I have the keys to my device? The Asahi Linux folks are building their own SecureBoot chain[1]. I guess you could argue they shouldn't have to do that. But it feels reasonable to me that that the party you're trusting should be the one who builds the trust chain. 1: https://asahilinux.org/docs/platform/open-os-interop/#m1n1 https://asahilinux.org/docs/platform/open-os-interop/#m1n1

by kqp 5mo ago

dangus 5mo ago

I think you should read up on how secure boot works with macOS and alternate operating systems before speaking this negatively about the implementation. Apple is already giving you exactly what you’re asking for. It’s not really even that different than a PC motherboard that gives you “Windows UEFI” and “enroll my own keys” as options. https://asahilinux.org/docs/platform/security/ https://asahilinux.org/docs/platform/security/ As far as code signing, again, what do you want Apple to do here? They already gave you a master switch to turn it off. You are free to turn it off then implement your own third party code signing solution if you’d rather choose who you trust. It’s not Apple’s fault if nobody else decided to make their own trust repositories and the only alternative on the market is to have no safeguard at all. And let’s not forget who Apple markets their computers to. These features aren’t for you and me, they’re for the non-technical customers who will absolutely get pwned by unsigned code. Go to the MacBook Neo marketing page and try to find a single image of someone writing code or even being gainfully employed.

Nevermark 5mo ago
This is that false dichotomy. You can turn off all protection, as you point out. So who Apple markets Neo's to isn't a factor. > Apple’s fault if nobody else decided to make their own trust repositories and the only alternative on the market is to have no safeguard at all. Does Apple provide a means for enabling third party trust systems, without disabling Apple's protections in general? If not, that is a serious problem of Apple's choosing. Nobody (to a first order approximation) want's to dispense with Apple's protection, or re-implement it, but to be able to carve out exceptions for specific classes of software.
- F7F7F7 5mo ago
  Sounds like you should pick something other than MacOS.
  - wlesieutre 5mo ago
    Right, all they need to do is convince every end user they’re trying to distribute software to that they’re using the wrong OS and should replace their MacBook with something running Linux. No problem at all.
    - dangus 5mo ago
      Or Windows, the OS that is already vastly more popular than macOS.
  - dangus 5mo ago
    I decided to get into this subject in my comment before I edited it out because I thought it would be too much of a tangent/ruffle too many feathers. But, yeah, macOS power users these days seem to spend a lot of time criticizing the OS and the company and never seem to just switch to something else. Apple is the 4th most popular PC manufacturer on the market. You can use something else. It's not a monopoly, nor a duopoly like with iOS. I switched to Linux, and I've been beyond shocked at how smooth it's been. It's been better than both Mac and Windows in more ways than I expected. And sure, not perfect, but still.
    - theonemind 5mo ago
      I can charitably believe this comment is not disingenuous, however, there are effectively two options, which are Windows and macOS, regardless of three manufacturers making more Windows machines than Apple at number four with Mac. I would call it an effective duopoly
      - rmunn 5mo ago
        There are effectively two options if you dismiss Linux a priori. Which yes, many people do. There are plenty of people who have no desire to try Linux. And if you're a developer then you have to consider those people, because many of the people who use your software are the type with no desire to try Linux. But there are fewer and fewer reasons not to try Linux, and that group of "I'd never use Linux", while still large, is slowly shrinking. I'd argue that Microsoft is doing more than Apple is to push people into reconsidering Linux (and, often, discovering that it's actually pretty good these days, and that your techie friend whom you call all the time to help you with Windows is actually happy to help you with your Linux questions instead). But slowly, over time, it's making less and less sense to dismiss Linux a priori.

wolvoleo 5mo ago

Exactly, Apple is making this a black and white choice on purpose. To make it unattractive to bypass them, and introduce legitimate security concerns if you do so. But those don't have to exist if the options were more fine-grained. The same with SIP (system integrity protection). You can turn it off but then you have to turn it all off. There's no way to keep secure boot but bless your own changes and sign them in some way, that you have approved. You know, as the owner and admin of your own computer. It's either leave it to Apple or be completely on your own. And to make the choice even more uncomfortable they also disable some features like running iOS apps.

jaredklewis 5mo ago

I don’t disagree with your post but I’m still unclear on how you envision gatekeeper should work. You want the ability to choose a different “authorities” that verify and sign binaries? That makes sense to me but is unlikely to relieve any of the issues in the post. Also what do you mean by “even yourself?” What would that option look like?

IsTom 5mo ago
You could like, just trust a single binary. Have a button right there in the popup that already shows up.
- Barbing 5mo ago
  Maybe “Gatekeeper Light” hidden under advanced settings would satisfy everyday users + the technical crowd For plenty of users, a button right there in the popup is almost the same as no Gatekeeper for most scenarios, but if we can handle it why not let us
- zarzavat 5mo ago
  Isn't that what right clicking and selecting Open does?
  - MrDOS 5mo ago
    Nowadays (as of Sequoia, I think), I find that I need to run `xattr -c Foo.app` to clear the “this was downloaded from the Internet” bit on the application bundle before I can right-click, “Open” it. Used to be that you only needed to do that with .apps extracted from zip archives, but it seems to apply to .apps copied out of disk images (DMGs) now, too.
  - odo1242 5mo ago
    They disabled the right-click-and-select-open feature; you now have to go to Settings to run the app.
    - 5mo ago

ActorNightly 5mo ago

I want the ability to run any linux distro on my macbook, like I can with any other computer that is not a macbook.

tuna74 5mo ago
Macs have enough open firmware to allow you to run any OS that you want. Linux Asahi only supports a certain subset of modern Mac HW, if you want to speed up development you should probably contribute to that project.
isityettime 5mo ago
The Asahi team does upstream their work, so eventually this will be possible with the M1 Macs. But it's an uphill battle because it's a reverse engineering effort on undocumented hardware that has a different separation of duties between firmware, hardware, and operating system than other systems that Linux already supports. It's a wonderful project, but if you want timely Linux support, you have to buy from a vendor whose chipset makers more proactively cooperate with Linux kernel developers. It would be wonderful if Apple shipped the Asahi team a bunch of docs hardware, and commissioned them to complete+productionize support for every single Apple Silicon Mac released up until now plus the upcoming gen. If they did that, maybe in one year support would be great and in two or three years, you coule use any distro you liked and get full support. But that's not really who Apple is or how they position themselves in the market afaict. This wish is sadly barking up the wrong tree.
pjmlp 5mo ago
Easy, don't buy Apple, I don't. Apple computers that I use are project assignments.

Wowfunhappy 5mo ago

> I’d also remind you of the came-and-went secure boot debate, which Apple successfully steered into Apple owns the encryption keys vs no encryption, and people just kind of forgot to ask, wait, why can’t I have the keys to my device? The Asahi Linux folks are building their own SecureBoot chain[1]. I guess you could argue they shouldn't have to do that. But it feels reasonable to me that that the party you're trusting should be the one who builds the trust chain. 1: https://asahilinux.org/docs/platform/open-os-interop/#m1n1 https://asahilinux.org/docs/platform/open-os-interop/#m1n1