Hacker News Reader

Comment by saagarjha | Hacker News Reader

Is macOS not large enough target, or is there something else at play here?

I would guess most of the things you'd want to do on a mac, you can just do as a user - - you can already access everything in the user's home directory for example.

>you can just do as a user - - you can already access everything in the user's home directory for example

As opposed to what other operating system? Even Linux with SELINUX allows that...

As opposed to Android, iOS… and some rare case of sandbox linux apps (small subset of flatpak, snap, etc.)

If we're talking about sandboxing, then macOS has that too. Apps installed through the MAS have specific sandboxes they can play in and require permission for the others.

Not in macOS Mojave. Sensitive directories (Safari, Mail, etc.) are inaccessible to apps without permission.

https://xkcd.com/1200/ points out that if malicious code runs as a user they can read my e-mails, access all my files, and keylog my passwords. By escalating to root, they can... what? Install OS updates and drivers? Mount and unmount disks? Access the serial port? Persist their access in a slightly harder to detect manner?

Of course, it's a different matter for shared computers in school computer labs. Or if mac servers were a thing.

It would be difficult for an arbitrary process to do that on macOS. They can access your files, but your passwords are in the keychain and emails in a data vault, both of which require permission to access.

Install ransomware that is annoying to remove.

Does it really matter if the ransomware is easy to remove? If you remove the ransomware, your files will still be encrypted.

Solid point.

It’s a minuscule market. 1% of the desktop market, which itself is a market in decline.

1% of the desktop market? No way. It's at least 10%.

Probably not that high worldwide. Either way, it’s still tiny and shrinking.

10% is neither "tiny" nor shrinking. If anything their year over year numbers are better compared to the overall market...

10% of laptops maybe but 10% of desktops? Think of all those thousands of Windows desktops in offices everywhere around the world.

The size of the market alone is not a good indicator. Macs are routinely sighted among C-level executives or journalists, and among their family members. And it looks like the kind of issue that could be exploited as part of an APT. It's pretty much the kind of thing that you expect to pop up for sale in shady places.

I sometimes see people make the argument that the tiny amount of Mac-users are somehow more important/valuable compared to the immense swath of non-Macs out there, and I always suspect it’s Mac-users trying to assert their own importance, stroke their own ego and/or justify their needless expenditure.

So tell me kind sir: what OS do you use?

I'm a Linux user who much prefers Linux to Mac and I agree with the comment you're replying to.

Exactly. I run my own arch distro and still recognize that macs are used by large numbers of higher ups in every single company I consult at.

I run Linux (edit: and a bunch of OpenBSD virtual hosts, I guess?) and don't own any Apple device. Sorry :).

The opposite, it’s a massive target. I believe the reasoning is that because it is such a large target the black market doesn’t set the price. It gets set by the bounty price the maintainer offers. I’m not familiar with the dynamics of the zero-day black market so I wouldn’t know myself.

It's just that the bug is worthless, beyond what the vendor will pay for it in a bounty.

Reply on news.ycombinator.com