Hacker News Reader

Comment by cerberusss | Hacker News Reader

If you want to know how much non-Apple kernel extensions you use, use "kextstat" and filter out com.apple. In my case, I only use Karabiner:

  % kextstat | grep -v com.apple
  Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
    185    0 0xffffff7f84cc0000 0x5000     0x5000     org.pqrs.driver.Karabiner.VirtualHIDDevice.v061000 (6.10.0) 4D004D1A-ED2F-3780-AD53-A10F286EC759 <51 6 5 3 1>
  %

View on HN

  Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
    109    0 0xffffff7f83eb3000 0x7000     0x7000     net.sf.tuntaposx.tun (1.0) 95DD963D-E23D-3B0F-8DE8-A4D2F6BFA5CC <8 6 5 1>
    110    0 0xffffff7f83eba000 0x7000     0x7000     net.sf.tuntaposx.tap (1.0) 23FDB715-3D0D-3A26-ACBA-E3794C231CB7 <8 6 5 1>
    111    3 0xffffff7f83ec1000 0xf0000    0xf0000    org.virtualbox.kext.VBoxDrv (6.0.12) 79AB3317-5F6D-3FE0-965C-92E45277AA0D <8 6 5 3 1>
    112    0 0xffffff7f83fb1000 0x29000    0x29000    com.intel.kext.intelhaxm (7.5.1) D0CC7B8F-1F62-33B1-BE6B-B5573D2A607B <8 6 5 3 1>
    117    0 0xffffff7f84000000 0x8000     0x8000     org.virtualbox.kext.VBoxUSB (6.0.12) B1285DF7-2D17-3497-A948-40825951123A <116 111 54 8 6 5 3 1>
    180    0 0xffffff7f84964000 0x5000     0x5000     org.virtualbox.kext.VBoxNetFlt (6.0.12) C1B5DFEA-CB4C-30BD-9A92-C92391F7BDE0 <111 8 6 5 3 1>
    184    0 0xffffff7f84a2f000 0x6000     0x6000     com.valvesoftware.SteamInput (4357.73.42) 17B6ECD0-A50A-3D6A-B350-9C70805EE129 <44 6 5 3>
    191    0 0xffffff7f85b19000 0x6000     0x6000     org.virtualbox.kext.VBoxNetAdp (6.0.12) F8D3E46F-C4EA-397A-ACB1-EF2BF77C0506 <111 6 5 1>
    193    0 0xffffff7f85b2e000 0x6000     0x6000     com.getdropbox.dropbox.kext (1.10.3) F29DD0CB-48D6-311A-9B69-E39CF775493C <8 6 5 2 1>

- Dropbox

- Virtualbox

- Tuntap for VPN

- Valve controller support

- Intel haxm for Android Emulator

Pretty insane for an application like Dropbox to use a kernel extension.

not overly, i'm fairly sure it provides a virtual filesystem

That is pretty insane.

Why? I can't think of an alternative that users wouldn't complain about.

Insanely useful?

They use it in SmartSync, so files that are actually stored in the cloud and not physically on your local machine, are visible and selectable in the Finder and automatically downloaded on demand.

It would be great if there were some user-space support for this in next year's macOS release. I think it would be useful for a lot of cloud storage providers.

Apple previously added third-party sync integration points into the Finder to stop Dropbox from injecting into that process (when it was easier and Apple was locking it down). It’s likely they do not want to break Dropbox and will try to support whatever it needs.

There is NSFileProviderExtension, but last I heard it was still a very immature API.

That is literally what the FileProvider Framework (https://developer.apple.com/documentation/fileprovider) allows.

What program are you using that relies on net.sf.tuntaposx.tun? macOS has had their own utun driver since a long time.

I would guess a VPN program which provides a layer 2 VPN option. utun only supports layer 3 VPNs.

Just like iOS. Which sucks because being able to be on my home network while not physically at home would have been nice in the past, mostly before Spotify was a thing.

DriverKit has support for building ethernet drivers:

https://developer.apple.com/documentation/networkingdriverki...

I could imagine this being used for implementing a layer 2 VPN.

ZeroTier has eliminated the use of the tap kernel extension in releases 1.42+ when used on macOS 10.13+. They aren't using DriverKit but a combination of poorly and undocumented features. They expect to eventually have to develop a DriverKit based implementation. Details at https://www.zerotier.com/how-zerotier-eliminated-kernel-exte...

DriverKit has only been around since 10.15 so currently it's not easy to correctly support a range of versions with everything so massively in flux and Apple's aggressive deprecation schedule. Writing and maintaining macOS system level software (including drivers, etc.) has generally become a pretty big headache since around 10.13, stuff is constantly breaking due to OS changes and regressions.

This obviously always happened to some extent, but the pace of breaking changes and bugs picked up massively around that time - I think a large part of the problem is that Apple's own developers don't actually need to use any of these features themselves, so they are just dumped onto 3rd party developers in a half-arsed state. I'm thinking of kernel extension authorisation (which was super buggy in earlier 10.13.x releases and still has weird quirks), various user consent additions (there are no APIs for directly checking or prompting for many of the permissions, let alone notifications when the user grants or revokes consent), DriverKit, EndpointSecurity, etc.

OpenConnect (https://www.infradead.org/openconnect/)

Hopefully Karabiner will be updated - it's the go-to tool for nonstandard key remapping (in my case, Right Shift to Escape).

Yep, I hope so as well. I'm not sure if it's a motivation for the developer(s), but I dutifully donate each year.

If it doesn't get updated, I'll have to start looking at custom mechanical keyboards. Their controllers (some small Arduino variant) allow any random key mapping.

But you can't apply that to the built in keyboard :(

I work in clamshell mode so much, that it wouldn't bother me too much. But nevertheless, it's going to hurt if it comes that far.

Good job for donating :)

Might be worth noting that Karabiner Elements can be sponsored through GitHub - I would very much encourage anyone who finds it as invaluable as I do, to consider giving what they feel it is worth to them!

The good news is that there appear to be multiple options for taking KE into this new kernel world, and the only cost is dropping support for older versions of macOS. Unfortunate, but not unexpected.

Just did exactly that -- got a PCB, case, switches and keycaps.

Thankfully PCB was QMK and VIA compatible so nice GUI to flash the firmware with my desired keyboard layout.

https://caniusevia.com https://github.com/qmk/qmk_firmware

Seems interesting to have people sharing these, so I'll happily chime in.

  $ kextstat | grep -v com.apple
  Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
  140    0 0xffffff7f83ac2000 0x4000     0x4000     com.intel.driver.EnergyDriver (2.0) 7FE9AF4A-A8C2-3099-A956-971DDC86A467 <8 6 5 3>
  171    0 0xffffff7f843eb000 0x29000    0x29000    com.intel.kext.intelhaxm (7.5.1) D0CC7B8F-1F62-33B1-BE6B-B5573D2A607B <8 6 5 3 1>
  173    0 0xffffff7f84c3b000 0x6000     0x6000     ch.tripmode.TripModeNKE (2.0.2) 1D30A109-766F-3620-B617-EA67C07823A9 <6 5 1>
  183    0 0xffffff7f8283f000 0x6000     0x6000     com.getdropbox.dropbox.kext (1.10.3) F29DD0CB-48D6-311A-9B69-E39CF775493C <8 6 5 2 1>
  195    0 0xffffff7f84d15000 0x15000    0x15000    com.vmware.kext.vmnet (1501.84.42) 1ED47440-F016-3E97-A701-E889165CCD39 <6 5 3 1>
  196    0 0xffffff7f84d2a000 0x13000    0x13000    com.vmware.kext.vmx86 (1501.84.42) 3327B843-5057-3EAA-B149-E1E6FF7B4F91 <8 6 5 3 1>
  197    0 0xffffff7f83ced000 0x7000     0x7000     com.vmware.kext.vmioplug.18.7.0 (18.7.0) 53E03BEC-2BFD-3A6D-B092-A2116987781F <61 6 5 3 1>

Edited, with a list of apps:

- VMWare Fusion (mostly just for fun things like trying out Linux distros and messing with TempleOS and old versions of Windows, mainly);

- Dropbox (Smart Sync);

- Trip Mode (for certain WiFi networks, namely tethering, enforces a whitelist of things allowed to use the network);

- Intel's Power Gadget thing (can give power usage and clock speed stats from the Intel CPU & Platform; I don't use this much).

$ kextstat | grep -v com.apple Index Refs Address Size Wired Name (Version) UUID <Linked Against> 86 0 0xffffff7f826a3000 0x185000 0x185000 at.obdev.nke.LittleSnitch (5430) 7462BC7A-1330-3F92-A73F-3FBFE331C74A <8 6 5 3 1>

Okay this is bad: I can not imagine NOT having Little Snitch watching over my shoulder.

Little Snitch seems to have prepared for this.

https://blog.obdev.at/little-snitch-and-possible-deprecation...

That's about a different deprecation back in 2018(?). Note this bit:

>But what happens if Apple will not or cannot provide the required features? NKEs will be deprecated, but not Kernel Extensions in general. We can still implement a Kernel Extension to augment the functionality of the NE framework.

That was before the WWDC 2019 announcement that all kexts are now deprecated and will be disabled soon. The Little Snitch team has been quiet about this.

Panic got some special exemptions to be in the Mac App Store previously, but they are not allowed to talk about it in detail. Perhaps LS is going a similar route and it will be revealed when Apple releases the next version of macOS.

How do people feel about Apple making these kinds of deals with Panic and others?

As a registered developer, there's a clear path to reach out to Apple and make my case, but that doesn't guarantee I can use the MAS. A lot of devs don't see a need for it though, because the Mac userbase, in general, knows how to get apps on the www.

As long as I can distribute outside, I'm okay with it. But I, and even the biggest Apple fans in the press, have acknowledged the walls closing in.

The developers of outbound firewall like Little Snitch, TripMode and RadioSilence have already voiced concerns how the alternative offered doesn't have the requisite feature capability required for their software and would actually cripple it. Apple has asked them to file "enhancement requests" with no guarantee that it will be implemented - https://forums.developer.apple.com/thread/79590 .

Thanks for the tip, interesting list, wonder why Samsung is on the list for T5 SSD drive ?

  System Version: macOS 10.14.6 (18G2022)

  kextstat -l | grep -v com.apple | tr -s ' ' | cut -f 7,8 -d ' '

  com.logitech.manager.kernel.driver (6.62.1)
  com.samsung.portablessd.driver (1.5.02)
  com.intel.driver.EnergyDriver (3.7.0)
  com.bitgapp.eqMac2Driver (2.0)
  com.objective-see.lulu (1.2.3)
  com.Cycling74.driver.Soundflower (2)
  org.virtualbox.kext.VBoxDrv (6.1.2)
  com.intel.kext.intelhaxm (7.5.1)
  org.virtualbox.kext.VBoxUSB (6.1.2)
  org.virtualbox.kext.VBoxNetFlt (6.1.2)
  org.virtualbox.kext.VBoxNetAdp (6.1.2)

> wonder why Samsung is on the list for T5 SSD drive ?

Maybe it's a driver to mount a Samsung phone as a virtual SSD?

I don’t have a samsung phone , only thing I have is there T5 SSD drive ?

Just a guess - Maybe to tell macOS how to SSD TRIM or do other tasks on Samsung specific SSD's?

Also, use this[1]!

[1]: https://objective-see.com/products/kextviewr.html

Interestingly, the only other kext (besides the one for Karabiner) I see on my machine is for LittleSnitch, which is also from Objective-See.

Also, I was expecting to see a kext from VMWare, because I use VMWare Fusion, but there wasn't one.

Huh, I have:

com.vmware.kext.vmnet

com.vmware.kext.vmx86

com.vmware.kext.vmioplug.18.7.0

You're right. I've got the same. It looks like the VMWare kexts don't get loaded until you launch VMWare Fusion and they're unloaded when it exits.

Little Snitch is actually from Objective Development. Objective-See does make a firewall application called Lulu, however.

Little Snitch is made by Objective Development Software GmbH [1] and not objective-see [2].

[1] https://www.obdev.at/products/littlesnitch/index.html [2] https://objective-see.com/products/kextviewr.html

Me too! Also virtual box.

Reply on news.ycombinator.com