undefined | Better HN

0 pointsmesse4y ago0 comments

> Both Windows and macOS are approaching the iOS security model that depends on manufacturers blessing what software can run on their products, and banning software they don't want users to run.

That's been said for years, and hasn't held true. I can boot a Linux kernel on my M1 macbook. Apple could easily have locked it down in exactly the same manner as their iOS/iPadOS devices, yet chose not to. I can still install whatever I want. The default state of the system has a locked down root volume. And the default behaviour is not to install untrusted software, unless you jump through a couple of hoops. Those are good defaults. Those are damn good defaults for most people. If you're running untrusted code in your webbrowser all day long, you want your base system to be as unmalleable as possible, and as untrusting as possible to third party code. But I can still work around that with almost no hassle. Homebrew still installs software as easily as it used to nearly a decade ago; it just might need the occasional --no-quarantine flag for unsigned software.

Even recently they appeared to have actively assisted in the running on non-macOS operating systems on their hardware: removing the requirement for kernel images to be in mach-O format[1].

[1]: https://twitter.com/marcan42/status/1471799568807636994

0 comments

11 comments · 4 top-level

heavyset_go4y ago· 6 in thread

> > Both Windows and macOS are approaching the iOS security model that depends on manufacturers blessing what software can run on their products, and banning software they don't want users to run.

> That's been said for years, and hasn't held true.

It certainly has. Unsigned binaries were recently deprecated entirely on M1 Macs. Microsoft even released versions of the Surface that can only run Windows and only run apps blessed by Microsoft. With each iteration on these products, the screws are tightened a bit more.

Software freedom is not just about being able to run Linux. Most Mac users buy Macs because of macOS and its integrations, running Linux doesn't help them out. Software freedom on macOS definitely does, though. As it stands, that freedom has been chipped away at with new releases of Apple's software and hardware.

For example, I'm the author of several open source utilities for macOS. Users had no problem using the utilities a few years ago, but because they're unsigned or not Notarized, macOS tricks users into thinking that they're either broken or malicious. Even self-signing the apps has macOS treating them as if they're radioactive. Users don't understand the scary signing and certificate alerts, so they end up thinking they've downloaded malware. The solution to this is to pay Apple $100 every year, and then regularly have them scan and approve of the apps via Notarization. That's antithetical to software freedom. Regular users who want to use un-Notarized software are left frightened and without having their needs met. Software freedom is important for everyone, not just developers and power users.

azalemeth4y ago

Heck, the amount of work it takes just to install gdb and debug another process on Mac OS is insane. There's no clear instructions on apple's website: the best thing to do is follow a stack overflow post with something like 14 instructions on how to generate the right kind of self-signed cert, acknowledge all the warning messages, and then follow the various comments for os-version specific alterations. It took me ages.

mlyle4y ago

> Unsigned binaries were recently deprecated entirely on M1 Macs.

Except bins signed by self-signed certs are still treated basically the same as unsigned binaries were before.

my1234y ago

You don't even need a true signature. An ad-hoc one (which can be linker-generated) and has no cryptographic key attached is considered as valid.

1 more reply

heavyset_go4y ago

From my post:

> Even self-signing the apps has macOS treating them as if they're radioactive.

1 more reply

gruez4y ago

>That's antithetical to software freedom. Regular users who want to use un-Notarized software are left frightened and without having their needs met.

It's easy to argue "give me software freedom or give me death!" if you're a technically competent user that probably won't fall for a trojan, but what about everyone else? Don't you think there's a reasonable argument to locking down systems to improve security? To be clear, I'm not arguing for sacrificing software freedom wholesale for security, only in default configurations.

wiz21c4y ago

The argument doesn't hold. It uses the 99.9% of the users to crack down on the 0.1% (the devs) who have the ability to redefine what software is. Doing so, the big companies make sure they have the ability to rule their ecosystem. Using the argument of security, I'm sure they'll have the go from the governments.

So why would a company want total control on its ecosystem ? Because government don't want social unrest. So if you can ensure your platform is free of "terrorist", then you can discuss with government better. For example, if you're secure, you can position yourself as a reliable player on banking, e-health, etc. That is, you gain a very strong position to shape society in ways you're interested in. Don't forget that big companies have the power to do that and that those who command them are not required to be benevolent. They are private companies so there's no oversight on which interest they serve first.

It's not all doom and gloom though . As computer gets into our lives, more and more government and parliaments will become aware of the issue and there will be a place to fight for our rights. It's already the case.

The only thing that matter is : a computer is a general purpose machine and must stay a "general purpose" machine.

3 more replies

malwarebytess4y ago· 1 in thread

> Apple could easily have locked it down in exactly the same manner as their iOS/iPadOS devices

Yes. That is in fact the problem. They shouldn't have the ability at all. Given the ability it will be done, it is only a question of when and why.

Corps have this ability already and are building in tech to make circumvention even more difficult. We are one update away as it is now.

messeOP4y ago

How do you propose preventing that, outside of legal remedies? If they design the hardware it obviously can be done. Hell, with the right external chip you could do it with a MOS 6502.

And as for barring it legally, remember that there are valid uses for locked down systems. It can be a useful security barrier.

fsflover4y ago

> > Both Windows and macOS are approaching the iOS security model that depends on manufacturers blessing what software can run on their products, and banning software they don't want users to run.
> That's been said for years, and hasn't held true.

https://news.ycombinator.com/item?id=25074959

comex4y ago

However, if you jump through those hoops, you lose certain functionality, namely Apple Pay and the ability to run iOS apps on Mac.

j / k navigate · click thread line to collapse

0 comments

11 comments · 4 top-level

heavyset_go4y ago· 6 in thread

> > Both Windows and macOS are approaching the iOS security model that depends on manufacturers blessing what software can run on their products, and banning software they don't want users to run.

> That's been said for years, and hasn't held true.

azalemeth4y ago

mlyle4y ago

> Unsigned binaries were recently deprecated entirely on M1 Macs.

Except bins signed by self-signed certs are still treated basically the same as unsigned binaries were before.

my1234y ago

You don't even need a true signature. An ad-hoc one (which can be linker-generated) and has no cryptographic key attached is considered as valid.

1 more reply

heavyset_go4y ago

From my post:

> Even self-signing the apps has macOS treating them as if they're radioactive.

1 more reply

gruez4y ago

>That's antithetical to software freedom. Regular users who want to use un-Notarized software are left frightened and without having their needs met.

wiz21c4y ago

The only thing that matter is : a computer is a general purpose machine and must stay a "general purpose" machine.

3 more replies

malwarebytess4y ago· 1 in thread

> Apple could easily have locked it down in exactly the same manner as their iOS/iPadOS devices

Yes. That is in fact the problem. They shouldn't have the ability at all. Given the ability it will be done, it is only a question of when and why.

Corps have this ability already and are building in tech to make circumvention even more difficult. We are one update away as it is now.

messeOP4y ago

How do you propose preventing that, outside of legal remedies? If they design the hardware it obviously can be done. Hell, with the right external chip you could do it with a MOS 6502.

And as for barring it legally, remember that there are valid uses for locked down systems. It can be a useful security barrier.

fsflover4y ago

https://news.ycombinator.com/item?id=25074959

comex4y ago

However, if you jump through those hoops, you lose certain functionality, namely Apple Pay and the ability to run iOS apps on Mac.

j / k navigate · click thread line to collapse