Apps shouldn’t be able to read my entire hard drive unless I give it permission. And the core OS should be immutable.
Also not sure what you’re talking about. Custom mouse drivers of course still work.
I had Firefox, Thunderbird, Pidgin and a few others running in complete isolation from the base system, and from each other. I even had a separate Firefox jail that was only allowed to get out via a Tor socks proxy to avoid leaks (more of an experiment than a necessity, to be fair).
Communication between jails was done via commonly mounted nullfs. I have also setup QoS via PF for each of them.
They were all running on the host’s Xorg, which was probably also the weakness of this setup.
It was a pretty sweet setup, but required quite a bit of effort to maintain, even tho I automated most of the stuff.
Now I use macOS, and I would like more control over what apps do what. I’m not particularly impressed with the direction of the UI (it also doesn’t bother me terribly), but I welcome the finer grained security control.
References:
[0]: https://en.wikipedia.org/wiki/FreeBSD_jail
[1]: https://www.freebsd.org/cgi/man.cgi?query=jail&sektion=8&for...
For one thing: I always require certificate logins on SSH. On Mac I used to simply change /etc/ssh/sshd_config to this effect, but since Catalina macOS reverts this with every update. Clearly they don't want me poking around in there :(
IMO if you offer SSH you should offer certificate-only access as well, either with a glitzy on/off button or with a config file change, whatever. But nope...
With Apple you get a lot of security for 'free', however you give up a lot of customisation in return, even in terms of security features.
You can override it with a commandline flag but that would mean changing the launchdaemon which is protected by SIP as far as I know. But I will have a look for that to doublecheck.
Or maybe I'll attempt to contribute the important parts to an established project, like ezjail [0][1], which seems to be quite competent at handling jails, but is specialized on running services.
Refs:
[0]: http://erdgeist.org/arts/software/ezjail/
[1]: https://www-legacy.freebsd.org/doc/en_US.ISO8859-1/books/han...
The resistance to them seems to be largely due to lazy developers: it would be EASIER if the system let a developer do whatever they want with a “trust me, I’m smart” justification. But we can’t design for the occasional safe and smart developer: we need to design for the sloppy ones and the malicious ones. The smart and safe ones can find a way to work within the constraints. As for lazy and sloppy ones who can’t adapt to the constraints - adapt.
OS security is generally a shit show anyway. I don't think it's bad to lock down the OS for most users, but it should still be possible for expert users to get expert access.
If there are security consequences, they should be trusted to learn how to deal with them.
Most will - and the rest will have bad experiences.
Last I checked, it still is—IIRC, you have to run some specific commands in Recovery Mode to disable the protections, but for "trust me, I'm smart" developers, that shouldn't be a problem.
Personally, I haven't seen any particular need to do that. I can count the number of times I've been blocked by SIP from doing things I wanted to do on one hand, and none of them were critical.
Unix file access permissions designed 50 years ago for multi-user shells are not adequate when dealing with potentially hostile applications accessing your data.
Today I'm more worried of a random App encrypting $HOME or hoovering up all my PII.
Now if some people just give access to everything instead of using ACLs, that is another matter.
Also, actively circumvent protection devices is proof of malice and possibly even criminal intent (remember DMCA?) so I don't see your point.
I don’t think so.
I've been trying unsuccessfully to childproof a Big Sur laptop for a 12 year old for some time now — disable access to some built-in apps etc. I have yet to figure out how, without resorting to disable SIP.
There is Screentime, but that's an unreliable joke which has caused us a massive amount of headaches on iOS due to unreliability, has very limited features and can only be protected by a 4-digit PIN.
"Configuring which programs a restricted user can run" is _such_ an elementary task for an OS that I cannot believe that recent macOS has no provisions for that. I _must_ be missing something.
Now how do I turn off the dozens of daemons that go everywhere on the internet without my control, uploading telemetry, etc? I've still not figured out how.
I’m not saying it’s bad. More security is great! My kids use MacOS. I’m grateful for it. I love iOS too. But it’s absolutely dumbing the OS down and making it less of a professional machine.
- docker - you need to be able to bind any folder
- IDE - you need to be able to edit basically anything
- office software beyond "I have some things in 'Documents'" - same
- python, ruby, any other interpreter - same
- brew, or any other package manager - same
etc. This simply doesn't work well for many developer workflows. I tried to use a dedicated app for per-app security control like that (can't remember the name anymore) - but for development it was a disaster. It just makes you click "allow" on a popup 10 times a day until you stop paying attention. Now, macos is not at that level yet, but the direction towards that is the complaint usually.
Consider: An interpreter needs to run homebrew which installs new app, but the same interpreter running a script for your project should not read anything apart from those project files. Same interpreter needs to update local packages via bundle and git, but a random script you run shouldn't be able to access your ssh key via git commands. This is basically impossible to achieve without large compromises outside of selinux right now.
So how would you apply this principle to the python interpreter or to a program that gets compiled to a new executable many times during development?
I like the idea of granting folder permissions to regular third party apps I install and use. I always wanted that and I'm glad Apple is moving in this direction with the Mac.
But contrary to regular apps, language runtimes and software under development do not have a specific purpose. The whole point of software development is to create and test arbitrary code. It is pointless to grant privileges to code that changes in arbitrary ways with every keystroke.
During development, privileges have to be granted to the developer account, not to any particular software artifact. I generally think that granting privileges to software and granting privileges to people each has its legitimate place. One isn't generally better or worse than the other.
..and, office?! Do you keep spreadsheets in system folders?
I keep spreadsheets in project folders. Allowing full writes to a project folder allows taking over the shell. See above.
Folder-level permissions are not sufficient. Sorry, I shortened it too much, but basically - there's almost no practical difference between allowing writes to a dev project folder and allowing writes everywhere. (It would stop some really trivial attempts) Your actual system folders are safe of course... but who cares about those really?
This is actually a feature I wish Windows had. On Windows you can enable "protected folders" and mark folders as protected. Applications cannot access those folders until you grant it.
On Windows when granting an app permission to a protected folder you grant it access to all of your protected folders.
You cannot grant a specific application access to a specific folder only eg. grant VLC access to your video folder only but will have to grant VLC permission to all your protected folders. In the default configuration this includes all your personal documents.
I wish Microsoft would make the protected folder feature just as granular as I can hear it is an a mac.
I'm tired of granting every other app accessibility permissions for reasons I'm not even sure of, tired of having to grant access to my documents. It's just endless hassle and I don't feel like I'm actually safer. Every new version seems to bring something like this.
The important part is that system integrity protection can be disabled.
- scroll bars have been removed (but they can be enabled again), not sure when this happened, Catalina maybe?
- Ok/Cancel style dialog boxes are vertically stacked (since Big Sur)
- the completely intuitive "Save As..." action has been replaced with "Duplicate" (at least in Apple tools), no idea what's the reasoning behind this is TBH, this wouldn't make sense on iPhones either
- more vertical space wasted for window chrome since Big Sur, especially in the Finder
- "Natural Scrolling" (can also still be reversed thankfully)
- ...and probably a few more subtle changes which I don't care much about
I am a long-time Unix user, hardly an iOS user at risk of feeling lost on Macs, and while I have immediately turned back on my scroll bars, I was delighted by "natural scrolling," and I love that "Duplicate" makes it more clear that my documents are being auto-saved, as they should be.
These things aren't "dumbing down," they're just changes from the way things used to be. Some are better, some are worse, and both of those are opinions. I think labeling them as "dumbing down" and sneering dismissively at people who use iOS is unseemly, speaking of opinions.
Just to take one example, scroll bars were turned optional with default off -- a simpler UX that's in favor of less visible user interactions for the sake of reducing user complexity is usually considered dumbing down.
Now, in Apple Land, far behind the Reality Distortion Field, they may refer to the reduction of user interaction options as 'beautification' -- but everyone else usually just calls it 'simplification', which is often (diminutively, perhaps) referred to as 'dumbing down'.
(in reply to "scrollbars only disappear without a mouse" , so what? That's still a reduction in user-visible information -- do touch users somehow not need to be told that an active view can be scrolled by anything other than visual gestures and cues? It's a nice pipe-dream, indicative design, but there isn't any design standard that suggests that may be or even could be the case.)
tl;dr : when a user loses visible indications, and loses possible interactions, it's not uncommon to phrase the state as being 'dumbed down'.
But seriously: What you call "dumbing down" I'd mostly rather call "making peoples' lives easier".
If I had to guess, it's because Apple wants to remind you they already have your data in their cloud, so saving anything locally is creating a duplicate.
But yeah the waste of more vertical space in Big Sur was really surprising to me, considering Apple also tries to minimise it in other apps like Safari. Weird.
> scroll bars have been removed
Awesome! Less clutter. I only care about my position in a list or its length when I actually scroll.
> Ok/Cancel style dialog boxes are vertically stacked
Looks sightly weird, but it enlarges click targets and makes a crucial dialog easier to see and use. I guess that makes sense.
> more vertical space wasted for window chrome
I generally like the new style, but yeah, they went over board here 1/3 or 1/4 less height would be about optimal.
> Natural Scrolling
Why would you move your finger against the direction in which you're scrolling?
I do have it disabled on my mouse, so I can more easily flick it to navigate down pages.
Sort of. When the the scroll bar (thumb) is the thing that you want to grab in order to scroll though — where is it?
Because I'm scrolling *down* to reveal new content towards the bottom of the screen. Why should I move my finger "up" if I want to scroll "down" ;)
For touch screens it makes sense, no doubt, but for touchpad and mouse it's debatable. It's clearly a personal preference though, I just hope they never remove the settings option.
Except when you don't realize there is more content to be scrolled in any direction including left and right because there is zero indication.
> Why would you move your finger against the direction in which you're scrolling?
It makes absolutely no sense with a scroll wheel and yet, by default it's on for them.
Does it fail to work properly on Intel Macs? All of my x86 Macs are far too old to try Big Sur.
EDIT: Oh, I see -- first-party Apple apps can stream unlimited data, tracking your activity. Egads...