3 ms·

Apple designed a bootloader for Apple Silicon Macs that allows you to run an unsigned OS without degrading security when you boot into MacOS. This wasn't an acc

Apple designed a bootloader for Apple Silicon Macs that allows you to run an unsigned OS without degrading security when you boot into MacOS. This wasn't an accident. Macs have always allowed you to run another OS. iDevices have always had a locked bootloader. People shouldn't confuse the two.

phire 4mo ago
And if Apple were going to change their mind and try to block linux, they would intentionally modify the bootloader to remove that functionality, not break the boot picker.
hollow-moe 4mo ago
M series macs are weird tho, yes the bootloader allows it but absolutely no documentation on the hardware, drivers etc. Can't help but to think the goal of this wasn't to actually allow third-party OSes, but for development purposes(and ye they could hide the feature behind apple account with paid dev license) or anti-anti-trust measures à-la Google with Firefox: in front of a jury of normal people they can simply say "look there's these nerds making Asahi" the same way "look we're not a monopoly Firefox has .2% market share".
- benoau 4mo ago
  I think they are wary about macOS becoming a designated DMA gatekeeper, it would certainly be very close to the user and income thresholds.
- GeekyBear 4mo ago
  > M series macs are weird More weird than the opaque Management Engines on Intel or AMD chips that can take full control of your system at any time that you have no control over? > Can't help but to think the goal of this wasn't to actually allow third-party OSes Apple has explicitly stated that allowing third party OSes is exactly the purpose of the new bootloader.
  - amiga386 4mo ago
    Yes, more weird than that. x86 PCs have fairly standardised boot and autoconfiguration (UEFI and ACPI). ARM based systems, including the Apple M series, don't. You just have to know what's there (device trees), and Apple isn't going to tell you. Hence why it's difficult to make another OS run on it, because you first need to find out what hardware's even there, and how to talk to it. It's initialised by Apple before iBoot runs, sure, but you don't even know what it is, so good luck writing a driver for it. The Intel ME / AMD PSP are creepy, and probably a security risk to the device owner, but they're not weird, you can run an OS without even knowing they're there, and they like it that way.
    - GeekyBear 4mo ago
      Asahi Linux already does use an open source UEFI implementation (U-Boot) to boot Linux. https://en.wikipedia.org/wiki/Das_U-Boot https://en.wikipedia.org/wiki/Das_U-Boot The Asahi installer will also allow you to install UEFI alone, in case you want to use UEFI to install some other OS. The hardware management engines in modern x86 chips are backdoors running at a higher privilege level than the installed OS's kernel. It's hard to see them as anything else.
      - okanat 4mo ago
        Apple's Secure Enclave and ARM's Truszone work the same way as Intel ME and AMD PSP. All of them have a separate specialized minimal OS running on a specially protected memory that cannot be accessed by the normal OS. Apple can lock your Mac just like other manufacturers can do via Intel ME. All of them are backdoors.
        saagarjha 4mo ago
        Secure Enclave is a completely different core, I don't understand why you are conflating it with TrustZone
        AKSF_Ackermann 4mo ago
        They don't. ME and PSP are separate cores with full memory and configuration bus access. TrustZone is nothing like this, it is a higher privilege level on the main cpu cores, more similar to SMM and used for pretty much the same purposes. Secure enclave is yet again nothing like any of the former and is similar to a TPM.
- phire 4mo ago
  The design of the exposed mechanism is explicitly about booting unsigned versions of MacOS. There is zero support for booting anything else, but no enforcement that it must be MacOS. However, apple's justification for exposing this mechanism to users appears to explicitly include "booting linux" even if the mechanism has zero explicit support for booting linux.
- zarzavat 4mo ago
  That's just a normal part of Mac development. Apple sees documentation as a net negative for them, something that can constrain them in the future. So they only document the major highways and leave everything else as an exercise to the reader. If you're using an unstable API they expect you to figure everything out yourself. It doesn't mean that they don't want you to use it though.
- joelthelion 4mo ago
  > Can't help but to think the goal of this wasn't to actually allow third-party OSes, but for development purposes Could also be pretending to be open while making sure nothing dangerous actually gets made.
nosioptar 4mo ago
If they allowed something similar on iphones, I'd switch to an iPhone the day an alternate os worked well enough for daily use.
- br0wnr1c3 4mo ago
  why? In my mind the appeal of the iPhone is iOS. The hardware is nice, but so is the hardware of certain Android phones. I think it would be nice if we could run unsigned apps on iOS (in the US), but booting your own OS on an iPhone is a whole different story
  - nosioptar 4mo ago
    I think iPhone hardware is better for the price on the used market. (I refuse to buy new phones. They're too locked down and shitty to warrant spending that much.)
  - NotPractical 4mo ago
    > I think it would be nice if we could run unsigned apps on iOS Apple enforces those restrictions via the permanently locked bootloader. The main benefit of unlocking the bootloader on an iPhone would be to run a modified version of iOS that allows for the installation of unsigned apps. Apple wouldn't like it and might even get litigious over it, but still. > (in the US) Apps intended for release onto alternative app stores in the EU, Japan, and Brazil still need to be approved and signed by Apple. These laws were nearly useless.
    - nosioptar 4mo ago
      I'd run ios if I could build my own apps for it without begging for Apple's approval to use my own device. Really, all I want from a phone is to be able to run Linux/xfce on it.
josephcsible 4mo ago
They're different for now, but it's frog-boiling. Apple has been steadily adding more and more hoops to the process for Macs, and eventually they are going to end up as locked down as iPhones.
yndoendo 4mo ago
IDecices should absolutely be treated as laptops and desktops which allow another OS to run on the device. This why I have not bought an Apple device for years. EU is the only governing body that would push owning the device you _buy_. Unfortunately their seem more geared moving to a surveillance state at the moment with chat control.
reactordev 4mo ago
I have fond memories in the early 2000s of getting the first MacBook Pro's with Intel Core i7's and the first thing we did at my company was build and install gentoo.
giancarlostoro 4mo ago
Reminds me of when the Xbox 360 came out, Microsoft had to buy a bunch of Macs because Macs had PowerPC processors, so it was kind of a no-brainer to get the darn thing going quickly enough. Ultimately Windows was the standard way to build Xbox games but it is kind of funny to think, one day someone at Apple saw an order for easily several dozens of Macs from Microsoft, and wondered if hell froze over.
- drfloyd51 4mo ago
  Back in the 2000s MS agreed to port Office and Internet Explorer to the Mac. This was a good move for both companies. Bill Gates appeared on screen during an Apple Conference to talk with Steve. Huge boos. Steve had to work the crowd back from the ledge. Then Office and IE were ported. It was so weird running Word on a Mac. It was a good port too. They did a good job of embracing Mac UI ideas. I found the Mac Word better than Win Word. I was kind of new to the Mac back then. I imagine Apple donated a bunch of early OS 10 machines to MS for development. I wonder if the MS Mac Dev team was a pariah at MS.
  - aesthesia 4mo ago
    Word was originally released for the Mac in 1985, so the deal was not that Office would be ported, just that MS would keep developing Office for the Mac.
napolux 4mo ago
People forgot already about Bootcamp

phire 4mo ago

And if Apple were going to change their mind and try to block linux, they would intentionally modify the bootloader to remove that functionality, not break the boot picker.

hollow-moe 4mo ago

M series macs are weird tho, yes the bootloader allows it but absolutely no documentation on the hardware, drivers etc. Can't help but to think the goal of this wasn't to actually allow third-party OSes, but for development purposes(and ye they could hide the feature behind apple account with paid dev license) or anti-anti-trust measures à-la Google with Firefox: in front of a jury of normal people they can simply say "look there's these nerds making Asahi" the same way "look we're not a monopoly Firefox has .2% market share".

benoau 4mo ago
I think they are wary about macOS becoming a designated DMA gatekeeper, it would certainly be very close to the user and income thresholds.
GeekyBear 4mo ago
> M series macs are weird More weird than the opaque Management Engines on Intel or AMD chips that can take full control of your system at any time that you have no control over? > Can't help but to think the goal of this wasn't to actually allow third-party OSes Apple has explicitly stated that allowing third party OSes is exactly the purpose of the new bootloader.
- amiga386 4mo ago
  Yes, more weird than that. x86 PCs have fairly standardised boot and autoconfiguration (UEFI and ACPI). ARM based systems, including the Apple M series, don't. You just have to know what's there (device trees), and Apple isn't going to tell you. Hence why it's difficult to make another OS run on it, because you first need to find out what hardware's even there, and how to talk to it. It's initialised by Apple before iBoot runs, sure, but you don't even know what it is, so good luck writing a driver for it. The Intel ME / AMD PSP are creepy, and probably a security risk to the device owner, but they're not weird, you can run an OS without even knowing they're there, and they like it that way.
  - GeekyBear 4mo ago
    Asahi Linux already does use an open source UEFI implementation (U-Boot) to boot Linux. https://en.wikipedia.org/wiki/Das_U-Boot https://en.wikipedia.org/wiki/Das_U-Boot The Asahi installer will also allow you to install UEFI alone, in case you want to use UEFI to install some other OS. The hardware management engines in modern x86 chips are backdoors running at a higher privilege level than the installed OS's kernel. It's hard to see them as anything else.
    - okanat 4mo ago
      Apple's Secure Enclave and ARM's Truszone work the same way as Intel ME and AMD PSP. All of them have a separate specialized minimal OS running on a specially protected memory that cannot be accessed by the normal OS. Apple can lock your Mac just like other manufacturers can do via Intel ME. All of them are backdoors.
      - saagarjha 4mo ago
        Secure Enclave is a completely different core, I don't understand why you are conflating it with TrustZone
      - AKSF_Ackermann 4mo ago
        They don't. ME and PSP are separate cores with full memory and configuration bus access. TrustZone is nothing like this, it is a higher privilege level on the main cpu cores, more similar to SMM and used for pretty much the same purposes. Secure enclave is yet again nothing like any of the former and is similar to a TPM.
phire 4mo ago
The design of the exposed mechanism is explicitly about booting unsigned versions of MacOS. There is zero support for booting anything else, but no enforcement that it must be MacOS. However, apple's justification for exposing this mechanism to users appears to explicitly include "booting linux" even if the mechanism has zero explicit support for booting linux.
zarzavat 4mo ago
That's just a normal part of Mac development. Apple sees documentation as a net negative for them, something that can constrain them in the future. So they only document the major highways and leave everything else as an exercise to the reader. If you're using an unstable API they expect you to figure everything out yourself. It doesn't mean that they don't want you to use it though.
joelthelion 4mo ago
> Can't help but to think the goal of this wasn't to actually allow third-party OSes, but for development purposes Could also be pretending to be open while making sure nothing dangerous actually gets made.

nosioptar 4mo ago

If they allowed something similar on iphones, I'd switch to an iPhone the day an alternate os worked well enough for daily use.

br0wnr1c3 4mo ago
why? In my mind the appeal of the iPhone is iOS. The hardware is nice, but so is the hardware of certain Android phones. I think it would be nice if we could run unsigned apps on iOS (in the US), but booting your own OS on an iPhone is a whole different story
- nosioptar 4mo ago
  I think iPhone hardware is better for the price on the used market. (I refuse to buy new phones. They're too locked down and shitty to warrant spending that much.)
- NotPractical 4mo ago
  > I think it would be nice if we could run unsigned apps on iOS Apple enforces those restrictions via the permanently locked bootloader. The main benefit of unlocking the bootloader on an iPhone would be to run a modified version of iOS that allows for the installation of unsigned apps. Apple wouldn't like it and might even get litigious over it, but still. > (in the US) Apps intended for release onto alternative app stores in the EU, Japan, and Brazil still need to be approved and signed by Apple. These laws were nearly useless.
  - nosioptar 4mo ago
    I'd run ios if I could build my own apps for it without begging for Apple's approval to use my own device. Really, all I want from a phone is to be able to run Linux/xfce on it.

josephcsible 4mo ago

They're different for now, but it's frog-boiling. Apple has been steadily adding more and more hoops to the process for Macs, and eventually they are going to end up as locked down as iPhones.

yndoendo 4mo ago

IDecices should absolutely be treated as laptops and desktops which allow another OS to run on the device. This why I have not bought an Apple device for years. EU is the only governing body that would push owning the device you _buy_. Unfortunately their seem more geared moving to a surveillance state at the moment with chat control.

reactordev 4mo ago

I have fond memories in the early 2000s of getting the first MacBook Pro's with Intel Core i7's and the first thing we did at my company was build and install gentoo.

giancarlostoro 4mo ago

Reminds me of when the Xbox 360 came out, Microsoft had to buy a bunch of Macs because Macs had PowerPC processors, so it was kind of a no-brainer to get the darn thing going quickly enough. Ultimately Windows was the standard way to build Xbox games but it is kind of funny to think, one day someone at Apple saw an order for easily several dozens of Macs from Microsoft, and wondered if hell froze over.

drfloyd51 4mo ago
Back in the 2000s MS agreed to port Office and Internet Explorer to the Mac. This was a good move for both companies. Bill Gates appeared on screen during an Apple Conference to talk with Steve. Huge boos. Steve had to work the crowd back from the ledge. Then Office and IE were ported. It was so weird running Word on a Mac. It was a good port too. They did a good job of embracing Mac UI ideas. I found the Mac Word better than Win Word. I was kind of new to the Mac back then. I imagine Apple donated a bunch of early OS 10 machines to MS for development. I wonder if the MS Mac Dev team was a pariah at MS.
- aesthesia 4mo ago
  Word was originally released for the Mac in 1985, so the deal was not that Office would be ported, just that MS would keep developing Office for the Mac.

napolux 4mo ago

People forgot already about Bootcamp