So, a locked bootloader with someone else's public key as the only one trusted? Can you even call that a computer?

This exact issue is something Stallman[1] and others have talked about for a while now[2].

[1] https://www.gnu.org/philosophy/can-you-trust.en.html

[2] https://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

I use a mac for work (and paid for by work) but refuse to spend my money on something I can't use the way I would like to use it. I think that these companies shouldn't be able to lock you out of you using your tractor/car/computer like everyone seems to be moving towards. It's a real shame. I understand if they want to void the warranty because a user blew away some critical firmware, but that's another ball of wax and it's on the user to suffer the consequences.

Agree wholeheartedly!

Void my warranty, boot with a scary splash screen, whatever, but don’t lock me out of the thing I ostensibly own. Or, maybe change the “buy” button to a “license to use” button in your store.

Well, certainly not a personal computer. :/

Apple no longer makes general-purpose computers. They only make pretty, locked-down, computerlike appliances.

The margins on general-purpose computers are simply too thin to sustain a $1T company.

Maybe, just maybe, it shouldn't be a $1T company? Maybe it should once again become a company that puts its customers and their experience before profits?

People are frustrated with technology lately. Even non-tech people. Apple has everything it would need to change that, but it decides to contribute to technology becoming ever more frustrating time and time again instead.

Agreed. But I can't think of an example of a company that ever voluntarily downsized. Downsizing usually happens because a new competitor arises that makes a product customers prefer. That's a very difficult proposition in the personal computer space.

If history is a lesson, any company that arises to compete with established players, gets acquired by them. And it's a shame no companies actually decline these acquisitions.

>no companies actually decline these acquisitions.

Not true. Yahoo made 2 separate offers to acquire Google, and an established social-media company offered to acquire Facebook (for a billion dollars IIRC).

The bootloader is not locked, why continuing to claim that over and over when Apple talked about it at WWDC?

Craig Federighi Said himself that they don’t boot other operating systems. Could you link the talk where they said it can run binaries not signed by Apple? The only thing I could find is where they still allow you to boot older versions which they don’t let you download anymore. To keep the actual mac experience.

It's because they don't want to support drivers for other OSes.

See this WWDC session: https://developer.apple.com/videos/play/wwdc2020/10686

and this manpage: https://pastebin.ubuntu.com/p/RwcT8stYMY/

Can’t find anything in both documents which allows booting of non Apple signed Software. The only thing I See there is something like SecureBoot on PCs, where Apple would need to sign your boot loader in order to be able to boot it.

--permissive-security is the setting that you want. You are then able to enroll hashes of unsigned kernels with kmutil.

Kmutil is only there to load kernel extensions? Or did that change with Big Sur?

It changed. You use kmutil create to create the artifacts and add the hash to the Secure Boot policy. (--help at https://pastebin.ubuntu.com/p/mN3Z2kfJWy/, no manpage)

TIL this has a man page

I haven’t watched anything. Are you saying you can boot another OS? Can you point me to where I can read or hear more about this?

Betteridge's Law of Comments

It is no longer a Personal Computer. And it is a security disaster if you cannot control own hardware of your computer. It should be made illegal for Apple to operate like this. User MUST have full control of the computer. It is user right and should be human right. Then only reason I used Macs is their respecting ability to use any OS I want if I Want.

Looks like you can supply your own unsigned kernel to boot something else.

kmutil lets you do it apparently: https://pastebin.ubuntu.com/p/mN3Z2kfJWy/ and bputil lets you disable the signature checking of the kernel https://pastebin.ubuntu.com/p/RwcT8stYMY/