Hacker News Reader

Comment by feelin_googley | Hacker News Reader

"Conclusion

In this blog post, we briefly discussed High Sierra's "Secure Kernel Extension Loading" (SKEL) and demonstrated a new 0day vulnerability that can be exploited to fully bypass this new `security' feature.

Unfortunately when such `security' features are introduced - even if done so with the noblest of intentions - they often just complicate the lives of 3rd-party developers and users without affecting the bad guys (who don't have to play `by the rules'). High Sierra's SKEL's flawed implementation is a perfect example of this. [There are many other examples.]

Of course if Apple's ultimate goal is simply to _continue_ to wrestle control of the system away from it users, under the guise of `security', I'm not sure any of this even matters."

https://www.synack.com/2017/09/08/high-sierras-secure-kernel...

View on HN

It's unfortunate that there is an alleged 0day in this functionality. I don't know why the author is trying to accuse Apple of having the real goal of "wrestl[ing] control of the system away from it users". SKEL looks like a very good idea to me, and the presence of a bug does not make it any less of a good idea. It's also unclear in what way SKEL is supposed to be taking control away from Apple's users anyway. If anything, it's giving control to the users, because the users now get approval power over any KEXTs.

Try making a change to the /usr filesystem, for example. It's very hard in recent versions of macOS. It sounds like this type of thing is going to be harder in the future, and that's what the GP is talking about, I believe.

When this first came out I had some troubles with it. I guess since then homebrew and others have caught up to the changes. It hasn't been a problem for many months.

It's part of an overall trend. For example the gatekeeper security settings ux has slowly been removing options to run unsigned binaries bit by bit.

In 10.12 there is no obvious way on how to run unsigned binaries now. When you double click on an app multiple times, it refuses to run. If you go to security settings you cannot run the unsigned binary from there. You have to right click on the app and press open to get the old dialog that would allow you to run an unsigned binary like it's some sort of easter egg. In older versions you didn't have these restrictions.

Right-click an app and select Open is always how you've been able to bypass Gatekeeper to run unsigned binaries. That hasn't changed.

AFAIK the only thing that's changed since Gatekeeper was introduced was the Security preferences lost the option to allow unsigned apps.

I've run several unsigned apps on Sierra and previous versions with Gatekeeper, and not once have I right-clicked an app to do it.

Did you ever configure Gatekeeper in Security settings to allow for unsigned apps? It's plausible that updating to Sierra would preserve that setting, though I haven't tried (as I never configured my system that way).

The biggest problems I have had with my Mac came from a kernel extension that I didn't know got installed, and didn't get uninstalled when I uninstalled the accompanying program.

It's always interesting how they implement security features. With Vista MS introduced UAC which is a major headache if you develop any automated tools. But most users I have observed will always press "Yes" automatically because they have no idea what the message really means. The result is that life got worse for developers often forcing them to do less secure hacks and overall no gain in security.

> The result is that life got worse for developers often forcing them to do less secure hacks and overall no gain in security.

But, for comparison, life got considerably better for me. I fee much safer (but not safe, there's plenty to worry about with just access to my user files) knowing when something is requesting Admin privileges, and because of the UAC prompts it's actually possible for regular users to run as non-admin and still get stuff done.

The amount of windows boxes that aren't running email clients and web browsers with full privileges by default is a huge advance for the whole world. That people aren't as careful as they should be with allowing that access sucks, but I think it's probably an order of magnitude at least better than what came before with regard to how easy it was to gain full access on Windows boxes through simple exploits. To say that there's been no overall gain in security in windows completely ignores the absolutely horrid state of security on Windows a decade or more ago. There are reasons why Windows is much better with respect to security today, and UAC is definitely one of them.

MS + Google (via only recently more finely-grained Android permissions)

It amazes me at the arrogance in assuming users are idiots, so it's not worth engineering features for them.

"Warning: This installer is attempting to replace core Windows files. Do you want to allow it to do this?" isn't hard but gives substantially more useful information than "Do you want to allow this installer to do stuff?" (Current UAC)

"Warning: This installer is attempting to replace core Windows files. Do you want to allow it to do this?"

This better but in reality most users will still have no clue what it means.

And the software can just put in the installer "click 'Yes' on any windows messages to install."

They don't even need to do this. Users will literally just click "Yes" to anything obstructing their path forward.

http://i.imgur.com/H0uVqFe.jpg

I'm going to ask for a citation on that. Where is proof that average users will ignore reasonably worded security messages?

Because as far as I can remember (Windows back to 95, MacOS back to the 6100), we (ie computer science professionals) have never done what I would even call an "acceptable" job at attempting this.

And the argument, for 20+ years now, has always been "Har har, users are too dumb to read. We'll just abstract all those decisions away from them."

Stupid dialogs and lazy UX begat stupid users, not the other way around.

(E.g., for starters: https://ux.stackexchange.com/questions/756/what-are-some-alt... )

I mean, I feel like a big difference between me and my grandma is that I have an instinct for quickly getting to the "meat and potatoes" of whatever I'm doing on the computer.

I do a google search and click within 5 seconds the right link, even if the first couple are ads/irrelevant. When installing a program, I get through everything quickly, without wasting mental energy on the useless TOS and etc.

Whereas my grandma will see a TOS and think "oh my goodness, a contract! Do I need to sign this? What, should I read this?" Because she doesn't see many TOSs and doesn't get that they're not a legal document or whatever, and any actually interesting information is buried deep within swathes of legalize. She also doesn't have access to reddit/HN or whatever to quickly warn her if the TOS changes/contains heinous shit.

Anyway, I feel like this is why google and firefox buried their "untrusted website - go to it anyway" button in some clickies that even I have a hard time finding, to force people to actually consider the decision.

How can a normal user make a judgement whether something is OK or not?

Reply on news.ycombinator.com