As an individual, the freedom to install whatever OS you want is important.
As a company, you want to have the option to bootstrap the software from a cryptographically signed image so that group policies, etc. can all be enforced in one long, auditable chain starting from the onboard TPM. While most employees might not need that, something like that is useful for making sure remote datacenter access is secure.
Not saying that there aren't companies for which this is desirable. Such companies exist. What I am saying is that their reasoning is bullshit and has more to do with some people keeping their jobs, so it's job security instead of actual security.
I'm a proponent of proportional amounts of paranoia. Restricting everyone is disproportional. Preventing developers from installing software on their dev boxes probably does more harm than good.
On the other hand, putting tight controls on computers people use for admin access to servers is not a bad idea if your company is big enough that only the dev ops guys really need to be in there with real regularity, or if your company handles sensitive data. Then the practical layer of security might be worthwhile to make getting into the datacenter via a compromised engineer or dev box harder.
That's the scenario I'm familiar with: secure boot on a separate machine, and a tight lid on what software you can put on the system, in order to guarantee a baseline level of hygiene for any system that talks directly with the datacenter.
There's an incentive to disallow unauthorized software from running on your hardware platform: it forces users to go through approved channels for their software and data. If you own an App Store and services like iTunes, the financial incentives exist to ensure your users don't sideload content or use competing app/media markets.
...for now. The frog boils very slowly.
This reasoning is overused and wrong.
Apple's hardware is no good for other operating systems, it doesn't run well with either Linux or Windows, the support being shitty due to Apple's proprietary stuff. As an example the experience with the touchpad becomes much poorer and the battery life is reduced to about half.
Running Windows or Linux well puts Apple in the commodity hardware market and that's what they tried to avoid ever since Steve Jobs came back.
So as a matter of fact they do sell MacOS as a core part of the package and they don't intend for it to be replaceable. Just like they sell iOS. It's not like you can install another operating system on their iPhones and iPads. Those devices don't even belong to consumers that bought them actually. All you're getting is a license to use them.
Apple is definitely not in the hardware business. What they sell is licenses.
Ahhm. BootCamp[0] is an integral part of MacOS for a while. (and before that, for a couple of years, it was a free add-on). It is the apple mandated, supported, sanctioned way to run Windows on a Mac, including needed drivers. Battery life is not quite as good, true.
Your claim that "Apple is definitely not in the hardware business. What they sell is licenses." is contradicted, both by the existence of BootCamp, and by your inability to buy a license without the hardware (and/or at a price that does not include a profit premium on that hardware).
And Bootcamp is nothing more than smoke and mirrors, a checkbox to tick in order for apologists to have amo.
Having used Windows on a MacBook Pro 2016 for two years, my experience has been worse than with a commodity Levono at 1/4 the price.
Given that you were running Windows on your Mac, I gather that your argument is more one related to the licensing issues of running macOS on non-Apple hardware, rather than an argument that it isn't technically possible. In any case, there is this. Curious how the project will be impacted by these new changes. From the article, it seems that in No Security mode the bootloader may be modifiable in the ways that it needs to be for modifications like Clover to work.
Clover EFI bootloader https://sourceforge.net/projects/cloverefiboot/
Features
Boot OS X, Windows, and Linux in UEFI or legacy mode on Mac or PC with UEFI or BIOS firmware
Boot using UEFI firmware directly or CloverEFI UEFI firmware emulation
However, could you elaborate on why the fact that you cannot buy an OSX license proves your point that Apple is in the business of selling licenses? I am at loss.
It would be weird if a dev preferred the lockdown, and weirder still if my grandmother didn’t.
I am much more careful about what gets downloaded on my computer but I want to be able to do anything.
I’m a Dev and I prefer the lockdown, on my daily driver device that is. If it was forced on every device, I’d be opposed, but having it be something I can opt out of on my dev devices is perfect IMHO.
Disclaimer: I worked on this.
…which I don't believe Apple has opened up? Right now it's use Apple's keys for verification, or don't use the feature at all.
If word gets out to every shady character that stolen macbooks are effectively bricks, perfect.
(Note that untrustworthy drive firmware has an easy workaround at least in theory - just do full-disk authenticated encryption, and then the drive can't do anything worse than DoS you, which is sort of a thing drives tend to do on their own anyway.)
I work on OneCore (Windows) and sometimes I have trouble believing the kind of crap some hardware vendors ship as firmware.
Incidentally, an interesting defense against evil maid attacks involves glitter nail polish. Use it on a sticker over the case and take a photo. To verify your laptop is safe, compare the sticker with the photo. The key is that glitter polish has a lot of minute detail and is thus hard to replicate.
This only gives tamper protection, but evil maid attacks require interaction so it suffices for security.
So, no, the whole secure boot thing is just bullshit security theater and more lock in.
> So, no, the whole secure boot thing is just bullshit security theater and more lock in.
Only if you're only thinking about laptops, desktops, maybe phones and tablets. There are lots of types of machines out there physically exposed to users whom the machine-owners trust to varying degrees, ranging from "not at all" on up.
Think UPS package scanners, HVAC systems, various control systems in everything from warehouses to prisons, sensors and signage controls...
Now, Secure Boot doesn't address anywhere near anything close to "sufficient" in any of those environments, but it is one component of raising the costs of attacking them to a point to make the systems economically viable, or at least apparently so.
If someone disables SecureBoot, then the encryption keys become inaccessible and you will notice that something is wrong.
I don't quite understand your wipe the disk thing, since that will leave a trace, the attacker could just smash your computer or take out your drives.
Combined with a TPU that wipes keys when secure boot is enabled/disabled gives a pretty secure system, that still allows you to "eject" to an unsigned boot when needed.
I'm not sure how this would work on Apple devices. It seems to me they have reinvented the whole security infrastructure of their services, which it's not a bad thing, but also requires some serious hacking if you don't want your device locked down with Apple-only software. Is there any way you could possibly manage the trust chain of secure boot on devices with the T2?
I guess "Reboot into Recovery, Open the Secure Startup Utility and allow booting from external media and Set it to No Security" counts as serious hacking now :)
Maybe Apple users are not as concerned about being able to run other OSs, but there was a huge uproar a few years ago when secure boot was first introduced to PCs. Fortunately you can still turn it off, but its removal may be associated with an ostensibly compelling argument: "why would you not want security?" The answer to that can also be summed up in one word: freedom.