Hacker News Reader

Comment by libria | Hacker News Reader

Very interesting overall.

> Apple allows booting unsigned/custom kernels on Apple Silicon macs without a jailbreak! This isn’t a hack or an omission, but an actual feature that Apple built into these devices.

Indefinitely? How do we know it's a feature vs a temporarily convenient oversight?

> Our goal is not just to make Linux run on these machines, but to polish it to the point where it can be used as a daily OS. Doing this requires a huge amount of work to be done, as Apple Silicon is a completely undocumented platform. In particular, we will be reverse engineering the Apple GPU architecture and developing an open source driver for it.

This looks like the major bullet point. The wiki is currently empty, but while it's WIP, it would be nice to see some of the major milestones or breakdown of the goal mentioned above.

Best of luck to Hector and the contributors!

View on HN

First of all the feature wasn't available in the initial Big Sur release and it only got available during the Betas for the first minor patch. Second of all, some Apple developer stated on Twitter that (during M1 unveil) he's finally able to show all the boot policy work they worked on the past year(s) to allow users to boot foreign OSes and without opening up holes for attackers.

Basically it boils down to: they could have just used iBoot without changing it at all to keep it as a brick like the iPhone/iPad/Watch, but instead they invested plenty of resources to allow it.

With all that work done to allow it, I'm sure there'll be plenty of people inside of Apple who'd protest if someone changes their mind and decides all this has to go away.

Kind of like all the work Sony did to allow Linux on the PS4 only to kill it later?

You don't own a mac. You can only do on it what it is profitable for Apple to let you do, today.

As much as I respect the incredible RE skills required for this task, I feel like this is shaky foundation unless an unpatchable bootrom exploit is discovered. Even then new models would be patched leaving existing users with an insecure platform that they can't replace when it breaks.

You don't really own any high-tech stuff anyway (with that interpretation). You can't boot your Intel of AMD CPU without their signed and sometimes encrypted code. You can't even initialise a single core, let alone the DRAM controllers.

Everyone likes to point at Apple, because that's easy, but it's neither new nor big nor special. There are practically three things at play:

- root-of-trust, if you have a better solution than CA-based signing, by all means, let the world know

- NDA/IP/Lawyerisms

- Apple and many others aren't selling hardware, they are trying to sell experiences or ecosystems, and that is the only reason they exist at all and also the reason a lot of the beige box hardware companies are either less visible, less profitable or both

Is it fun? No. But it's not some sort of automatic malice or 'haha you don't own things but you thought you did' all the time either.

> You can't boot your Intel of AMD CPU without their signed and sometimes encrypted code.

Except that Intel and AMD don't care what you run on your machine, they don't lose money if you don't run their software.

When you run Linux on a MAC, Apple isn't getting money from their iCloud subscriptions and from the store so they have a motive to stop you from escaping the walled garden.

You don't need iCloud to use macOS. And macOS itself is free, as is their awesome office apps, XCode and a lot of other useful apps and services.

Of course but if you run Linux they're sure you will never earn them any money from these services.

So at one point they could decide that they don't want people to use Linux on their Macs and there's nothing you could do.

Look at what happened to CentOS.

If they can sell you a mac for $1500 I don't think they are very concerned that you're not spending 50 bucks a year on iCloud.

I mean, if they prevent Linux you probably won't buy a mac at all, you won't prioritise using an M1 macbook over using Linux if you're a hardcore Linux nerd.

Bottomline is that yes they are greedy, but they are not trying to stop people from installing Linux on macs just to perhaps earn some extra dollars.

Counter point: they have no problem charging $1000+ for iPhones and lock them down to only run the operating systems and apps they approve because consumers of them were largely not technical enough to understand they don't own their own devices.

Apple is motivated to do this as soon as they feel they can get away with it and keep profits as high or higher.

I’m not saying they have any moral objections to locking the macs, it just doesn’t make any financial sense. Enough people want to run windows or linux for them to make the effort to make that possible. It’s also more in the spirit of PCs to have this possibility.

For phones, basically nobody wants to run android on an iphone, so it makes no sense to make it possible.

Keep in mind that they don’t lock down iOS because they hate our freedoms, it’s because it is much harder to make it safe and secure if it’s also very open. And since the market of people wanting to run other OSs is so small, they don’t want to take the additional cost.

As to owning you device. Unless you buy real hand stitched shoes with leather soles, your shoes are most likely completely impossible to repair, they’re basically molded rubber. It’s not because Nike hates freedom or even because they want you to buy new shoes more often, it’s because it’s so much cheaper to make shoes that way. But would you argue that you “don’t own your sneakers”?

How do you know the number of people that want this, and how large is the number of 'enough', and what other numbers come in to play? (Number of incidents, number of happy users, number of systems to support, number of binaries to consider during upgrades, number of sales... and is 'enough' a percentage? An absolute number? And how high does it need to be? And to what degree does it need to align with the goals of the product teams?)

My gut feeling would say: a bunch of hackers would be happy if they can hack on their code on Apple hardware but run plain FreeBSD or Linux while doing it. But that is not something you run a multi-billion business on...

My argument is that Apple wouldn’t be losing money by allowing people to install Linux on macs, it’s not about “preventing people from using macs without paying for iCloud”.

But in general, running Windows or Linux on macs is not uncommon, it’s definitely not just for hackers.

I don’t have any numbers at all but I’m sure nobody would doubt that it is orders of magnitude more common than people wanting to run homemade OSs on iphones.

iCloud is free unless you pay for extra space or features, and most people I know of don't.

PS3, and supposedly that was because some jurisdictions treated game consoles and computers differently for import tariffs (computers being cheaper to import), but those jurisdictions changed to not having a distinction.

Agreed with the underlying point you're making though. They allow this because it aligns with their current strategic objectives, and changes to those objectives can be arbitrary and capricious, at least from the viewpoint of the consumer.

I remember it was because geohot "jailbreaked" the PS3 using the Linux capabilities to some extent.

But I could be wrong.

There were two versions of the PS3: The original model and a slimmed down version released after a few years.

the timeline was something like this:

- Sony released the original PS3 with Linux running under a hypervisor that locked certain things (e.g. 3D rendering and their DRM)

- Sony released the PS3 slim without Linux. They claimed they didn't have the resources to make Linux run on it. (We later figured out all that was required were a few incredibly simple kernel patches)

- geohot found a somewhat unstable hardware glitch that, with some luck and a few tries, could escalate to hypervisor mode and enable e.g. 3D rendering from Linux. Their DRM was still untouched at this point and no one really cared.

- Sony released an update for the old PS3 models to disable Linux as well citing "security concerns"

After that more people started looking into the PS3 and marcan, me and others at fail0verflow eventually figured out their security wasn't all that great. It was actually so bad that we could calculate their private keys. Then they sued us for that but that's another story.

Got a link to that story?

zarvox already linked to the talk we gave at https://media.ccc.de/v/27c3-4087-en-console_hacking_2010.

We talked about how you could compute private keys but didn't release any keys for obvious reasons.

Essentially Sony had N different sets of keys protecting different levels of their system (e.g. one keyset for the hypervisor and another one for the kernel). What we found allowed to compute the private signing key given two public signatures.

Due to some technicality this meant that you needed another bug which allowed to extract these plaintext signatures. (The best comparison today would be that we found a universal code execution bug but you still needed to find your own info leak to defeat ASLR which we either didn't share or didn't have for all keysets).

What happened then was that geohot used this flaw we found together with a simple bug that leaked two plaintext signatures to extract one of the most important keys and published that one on his website.

Sony responded by suing him and us as well - probably because they assumed that we worked together. After a few month they reached a settlement with geohot where he promised to never hack any Sony product ever again. At the same time they simply dropped the lawsuit against marcan, me and a few other friends from fail0verflow without having ever served us. Those months resulted in quite some stress for me and personal and legal issues for another friend.

https://media.ccc.de/v/27c3-4087-en-console_hacking_2010

I actually think other os got canned before the jailbreak. If I recall correctly it provided extra incentive.

They may have wanted to make it harder to jailbreak. Another argument is that they weren't profitable to sell as computers but largely become profitable via the money they made off games sold for the platform including money paid by game developers.

The same goes for any device you can buy today. We should demand more of manufacturers in general, I agree.

But you cannot expect that Apple should give you a legally enforceable contract (or whatever) pertaining to a product you haven't bought yet and they haven't even made yet.

The fact that the boot process on the M1 chip is explicitly not locked down on release is at least showing a modicum of goodwill.

I'd say there might be ongoing work to support Windows/BootCamp but in true Apple tradition (or maybe due to MS delays) it is being kept secret

Apple's outright said it's a matter of Microsoft agreeing to license Windows on ARM for consumers. Right now putting Windows on an ARM Mac is about as legal as Hackintoshing.

I don't think that's what Apple said at all–they just said the ball is in their court, which means that they want Microsoft to write Bootcamp essentially.

Yeah. Someone - cough cough Microsoft - would need to be convinced to write a Boot Camp Assistant app equivalent (okay), a Windows bootloader (okay), various device drivers for Apple Silicon hardware revisions for Windows (big ugh), graphics drivers for Apple Silicon GPUs for Windows (VERY big ugh). Microsoft will need to very motivated to distribute Windows on ARM for this to happen, even if Apple gives them access to all the info they need which is not a given by any means.

...I don't think this is going to happen, and Apple probably doesn't either.

Apple have developed Bootcamp and provided drivers so far for Intel Mac. But shipping Bootcamp for Windows ARM would be an EULA violation until Microsoft loosen theirs conditions. Changing this is literally step 1.

Wether Apple would develop Bootcamp for ARM or not is purely theoretical discourse until then.

The only driver Apples needed to develop for Windows are Mac specifics though, like the stuff that was managed by the T1. Not trivial, but not the end of the world to have to make. Things like wifi drivers and especially the graphics drivers are just the chip vendor's standard preexisting Windows drivers.

Apple is now the vendor of at least the GPU. I don't think they're going to write a Windows driver for that - the incentives are just not there.

If I remember correctly Windows on ARM is still limited to 32bit Apps.

And you can actually download Windows on ARM from Microsoft Insider Preview for Free. And run it on top of Parallels Desktop 16.

Windows on ARM supports 64bit ARM apps.

What you were possibly remembering was that Windows on ARM when it was first introduced only supported emulating x86 apps. Although x64 emulation is currently in preview.

https://docs.microsoft.com/en-us/windows/uwp/porting/apps-on...

Legacy x86-64 app emulation has only just appeared in alpha form and still has massive compatibility issues.

I'd still call it something we hope to see in the future, instead of a working proof of concept.

https://www.youtube.com/watch?v=OhESSZIXvCA

That would make a lot of sense. Windows is in a tight spot right now because OEMs have lagged on ARM. Apple could offer MS a way out of that, while at the same time giving people one more reason to spend money on a Mac.

There is a significant number of people working at Microsoft who use Windows on a Mac as it's generally nice (and expensive) hardware. I'm sure they'd be thrilled to see Bootcamp operational on ARM Macs.

Right, if MS is serious about Windows on ARM, they should support the Mac as a show case and also to allow all future Mac buyers the chance to run Windows. Of course, Apple can't announce much until Microsoft makes an announcement about Windows on AS Macs.

Is MS not busy looking at doing their own ARM silicon for future Windows powered Surface devices after release of M1 and the failure Qualcomm with the Snapdragon 8cx (we just use ARM reference designs) ???.

They do have the chops for it since they have done Xbox and Hololens and various other devices in-house.

It's a rumor. If they're starting now I expect results in 2-5 years and in Azure first.

> They do have the chops for it since they have done Xbox and Hololens and various other devices in-house.

Not sure about the Hololens, but the XBox contains an x86 AMD processor.

Maybe they are already developing their own "MS1" in secret ?

But even if they are, it would make sense to release Windows 10 for the M1 and getting Win-developers to start porting their applications to ARM, so they could leap-frog Apple on ARM if they manage to build a 'better' ARM SoC

https://www.theverge.com/2020/12/18/22189450/microsoft-arm-p...

There are rumors.

Or they could take significant market share away from Windows, possibly permanently, by offering increasingly more performant machines. Seems like a better move to me.

Linus Tech Tips actually just released a video a couple of hours ago where they compared the Surface Pro X SQ2 with the M1 MacBook Air. It was not pretty.

https://www.youtube.com/watch?v=OhESSZIXvCA

So basically, the M1 Macbook Air is two to three times faster than the SQ2, including comparing ARM Windows on the SQ2 against ARM Windows in a VM on the M1 Air.

Relatedly, I wrote this on Twitter a few weeks ago: cargo build of sccache on a Lenovo Yoga C630 (Snapdragon 850) in WSL: 4 minutes 55 seconds. On a Macbook Air M1: 55 seconds

WSL 1 or 2? WSL 1 has very slow disk access, so compiling can be pretty slow. I.e. I would expect WSL to be slower for disk reasons even it was running on an M1.

The virtualized Windows comparison was just brutal.

It’s 100% on the mark that video.

He’s off on the strategic focus of Apple (where he says that the M1 benefit because Apple is taking a mobile OS and adapting it for the desktop vs Microsoft is taking a desktop OS and adapting it for mobile architectures. The truth of the matter is that Apple has been consistently making CPUs for about a decade that blow away the competition on compute per watt. Like 2-3 years before the industry catches up to where Apple was. They’re just bringing that same power to laptops/PCs as they’ve saturated what that buys them on mobile (not fully but it’s not a big enough sales driver as mobile sales growth has slowed). That’s why you see AirPods and M1 - “where else can we deploy our perf per watt and vertical integration advantage”.

As for “why are there so few ARM versions of apps”, that’s purely the vertical integration piece again. Apple makes it very clear the old tech line is dead so developers have a clear thing to explain to their management. Microsoft tries to keep everyone happy which means devs are like “I’ll wait until this actually has industry buy in” which then Microsoft uses as “well there’s no interest here and maybe the tech won’t work out/vendors won’t materialize” and “we can’t ask our customers to pay this transition cost”.

Is there any point of running windows outside of intel processors? I'm aware they have an ARM offering but it's not clear what the "killer apps" of the OS/arch pair are.

I'd think linux/BSD drivers would be the concern here!

It's a feature because it's literally a whole set of command line options and settings in their boot policies, which is documented in man pages, with all the warnings about normal users not having to use any of this that you'd expect.

It's a whole pile of code that Apple doesn't need, and could've just removed or never written in the first place, that was written explicitly and only so people could run unsigned kernels on Apple Silicon macs.

Yup, the wiki is almost empty - I was hard at working getting the site/IRC/branding/etc worked out. Expect things to pick up steam on that front starting tomorrow, as I will now focus on hardware documentation and getting things through low-level boot bring-up.

This is really promising, but I do think scepticism is warranted - Apple loves their walled gardens.

There's a not-insignificant number of people that want to do more with their Mac than run software from a single marketplace.

Yes, I am one, but is Apple really better off selling more machines but having fewer people inside their eco-system?

Presumably those people would just not buy Apple hardware if buying into the ecosystem was a requirement. So if that number is non-zero, and Apple sells hardware above cost, then yes, Apple is better off selling only its hardware and not its services to this small subset of the market.

Thats the thing though. The hardware is so good that there are people who would run Linux on the Mac if they could, but since they can't they cave in and just run MacOS. I have an M1 and its so much better than my Linux XPS 15 that I just end up using the M1 (and getting sucked into their eco-system). And this is just their first release!

But it's not like they get a whole lot more money from someone being 'in the ecosystem'. The main thing would be an iphone, but even counting that I think that they'd make more selling the hardware with a little flexibility than hoping to lure people in. The fact of the matter is that the M1 isn't just a good laptop, it is the best, and the next round will be better. That's enough of a sales pitch that honestly the software might be holding them back.

Or they could, I don't know, help Linux OEMs reach that level.

they may be better off in future antitrust proceedings

> Indefinitely? How do we know it's a feature vs a temporarily convenient oversight?

I would point out that Apple has permitted booting alternative operating systems throughout their m68k (at least the m68ks that could meaningfully boot Linux or a BSD derivative) [1], PowerPC [2], and Intel [3] phases. It's only on Intel they actively made this a feature, because Windows Bootcamp probably allowed to sell them a certain percentage more Macs.

The only reason to believe they would change this is that the Apple Silicon architecture changes would have Apple be interested in the Mac being some sort of equivalent to an iPod Touch. I don't really see Apple being interested in that, and Apple reps have gone on record to argue similar points as well.

[1]: e.g. https://wiki.netbsd.org/ports/mac68k/ [2]: e.g. https://wiki.netbsd.org/ports/macppc/ [3]: Uh, anything that boots on x86 EFI will probably boot.

> The only reason to believe they would change this is that the Apple Silicon architecture changes would have Apple be interested in the Mac being some sort of equivalent to an iPod Touch.

I don't see any great difference/reasons why the iPad pro is locked, and a MacBook isn't.

I hope Apple "computers" will remain unlocked, but I'm not sure I see a real business case for Apple to keep them open.

And at that Bootcamp is a BIOS emulation layer. You don't need to go through the bootcamp process to run operating systems with native EFI support such as Linux, Windows 7+, etc.

I don't think recent Intel macs even support "Boot Camp" (CSM) any more. You need to go through UEFI, Boot Camp now is just a software wizard for getting UEFI Windows installed.

You're totally correct, it is indeed just putting the drivers on the installation media and partitioning magic.

On 2017+ machines you don’t even need an external drive, during the partitioning setup it carves out a temporary partition to store the contents of the ISO + their drivers, windows installation customisation etc. And it’s all deleted after the installation of the drivers after windows is installed

My 2015 Mac (running Big Sur) did that temporary-partition dance too.

It's one of the easiest windows installs you can do.

Apple adds limitations to protect the system: "too strict!"

Apple gives the chance to disable these limitations to power users: "they should be disabled by default!"

Apple disables limitations: "temporary convenient oversight?"

...

It's a bad faith argument. The presupposition is that Apple is inherently motivated to actively lock things down, because that's what they do with the iPhone. This glosses over that Apple has no reason to actually do so, only has reasons not to do it on the Mac, and has gone on record saying they won't treat the Mac as the iPhone. It's based on the notion that Apple would be against free booting a priori for some reason.

Mind you, not all bad faith arguments are unwarranted. I kind of get where it comes from. But it's important to recognize that's that what it is, and there's no reason to actually believe it.

> The presupposition is that Apple is inherently motivated to actively lock things down, because that's what they do with the iPhone. This glosses over that Apple has no reason to actually do so, only has reasons not to do it on the Mac, and has gone on record saying they won't treat the Mac as the iPhone.

What is the difference between an iPad pro and a MacBook? If Apple can get away with a 30% tax on all commercial software, and arbitrarily manage which applications are "allowed" - why would they not want to extend that to their laptops? If they still get people to buy and developers to develop?

> If they still get people to buy and developers to develop?

Well they won't get away with that at all, especially not in the long run as people abandon ship to platforms that do allow free development and tinkering. Apple is still a hardware company with hardware sales making up the overwhelming majority of their profits (over 75%). It would be beyond stupid to risk that just so they can live out a control fantasy, especially because they don't need to live out that control fantasy to make good money from the Mac App Store.

Well they won't get away with that at all, especially not in the long run as people abandon ship to platforms that do allow free development and tinkering.

Before the M1 Macs shipped, Apple's Mac revenue hit an all-time high of a smidge over $9 billion [1]. During a global pandemic and economic crisis.

The Mac will be 37 years old on January 24, 2021 and yet, it continues to gain momentum, not lose it. Between 1984 and now, not a year has gone by without the same narrative: Apple is doomed if they don't change their ways…

The M1 Macs are probably selling like proverbial hotcakes—we'll find out on January 27th [2].

People seem to forget that the Mac mini, the MacBook Air and the 13-inch MacBook Pro are the entry-level, consumer oriented computers in Apple's lineup. These machines are the opening act.

And even as stunningly fast as these machines are, especially on a performance per watt basis, we haven't even seen the take-no-prisoners, kick-ass professional Apple Silicon Macs yet.

We’ll probably see Macs from Apple that don't have the space and power constraints of the current lineup. If they cranked the current SoC beyond the current 3.2 GHz, added more cores and started at 16 GB of RAM… they would capture another huge chunk of the market, including a significant number of Linux users…

[1] https://www.apple.com/newsroom/2020/10/apple-reports-fourth-...

[2] https://www.apple.com/investor/earnings-call/

You realize that the Mac App Store has been around for 10 years and people have been saying that Apple is going to lock down MacOS for just as long?

The reason people assume apple will prevent you from doing what you want with your computer, is because it’s the logical consequence of the strategy they’ve followed for the past 10 years over their whole product line. From phones, to cable, to messenging software. They’re into vertical integration and walled ecosystem.

Simply asserting this without evidence does not make it so.

If Apple truly had this strategy they're doing a horrible job at it. Mostly since you are free to boot (or work on doing so at least) NetBSD and countless other things on practically every Mac they've ever released, including the latest ones. They're doing a horrible job at communicating this strategy too, because they're communicating the opposite. For this Apple Silicon phase, it seems they've also missed a huge opportunity to finally execute on this strategy by spending a little time and money to develop the tools to do the opposite of that strategy and give users a way to boot unsigned kernels.

I just don't buy it, sorry. I don't even get why Apple would want to do this outside of sheer malice.

> Simply asserting this without evidence does not make it so.

Goes in both directions.

> Mostly since you are free to boot (or work on doing so at least) NetBSD and countless other things on practically every Mac they've ever released, including the latest ones.

Gatekeeper wasn't a thing either, until it was, indeed, a thing.

> They're doing a horrible job at communicating this strategy too, because they're communicating the opposite.

Surely that's the whole point of a trap?

> For this Apple Silicon phase, it seems they've also missed a huge opportunity to finally execute on this strategy by spending a little time and money to develop the tools to do the opposite of that strategy and give users a way to boot unsigned kernels.

Sure, because right now they're trying to sell the idea of M1 Macs.

> I just don't buy it, sorry. I don't even get why Apple would want to do this outside of sheer malice.

App Store, censorship, ... You could turn that around and ask why they would want to lock down their iOS devices, and why you think that those reasons wouldn't apply to Macs.

>Surely that's the whole point of a trap?

I've been hearing about this supposed secret Apple plot to lock down the Mac and take away third party software distribution and operating systems for a decade now. If this is indeed Apple's plot, then they're really slow at implementing it. Maybe they'll sort it out in another decade.

they never had a real advantage on the desktop / laptop that would justify locking you in, until now.

They could do it on mobile thanks to the vastly superior user experience.

When steve jobs announced itunes on windows he said "hell froze over". That should tell you how much they take openeness into consideration.

I'm still waiting for iMessage to be an open protocol, or for my iphone to be able to use a standard charging cable...

> Surely that's the whole point of a trap?

I mean, this is exactly the bad faith argument I was talking about right here. If you want to view this as smoke and mirrors until they "trap" you by all means go ahead, but it does shut this conversation right down.

We've seen Apple remove competition from the App Store at will.

This is not theoretical.

I'm not sure how that means anything when it comes to locking down Macs. If you're trying to make a general argument "Apple is capable of doing bad things", that's of course trivially true but does not at all imply they're interested in locking down the Mac's bootloader?

What “competition” have they removed?

Apple is trying to make a trusted computing platform (for various reasons) with the side-effect that activities that they do not feel like supporting (for various reasons, money and experience being the first that come to mind) are not available. It's not a hand-wringing evil person in a throne trying to think of ways to make people sad.

I see nothing wrong with any of these speculations. If you or Apple don't like speculation the answer is for them to communicate their intention.

They've plenty communicated their intention to not turn the Mac into the iPhone/iPad. And besides which, it would be a disastrous product strategy to do that, from a company that's absolutely top-of-the-ball when it comes to product strategy.

There are entitlements on macOS that are not provided outside of the App Store, such as NetworkExtension API VPNs.

There is also no way to turn off the persistent, hardware-serial-number-based APNS connection to Apple, tracking the system from IP to IP whenever it's on, even when no apps are running.

You also can't wipe and restore a mac with filevault without an online reactivation from Apple, even if you have local bootable install media.

There are several concrete, technical advances toward the thing they are claiming not to be doing. macOS is indeed becoming more like iOS every release. It's not just unfounded paranoia.

There is also no way to disable your persistent radio connection on your cell modem (except for turning it off), and your network provider will know your location and radio tower etc as well. Same applies to your mac: you turn the appliance off and then the connection is off as well. You turn it on and it's connected again.

The matter of Filevault isn't necessarily a bad thing, for many people it's a highly desirable feature. I like the fact that iOS activation lock significantly lowered the value of stolen iPhones; I look forward to the same happening with MacBooks.

And if you don't like it, just switch it off.

You can't switch it off. Every current mac requires an online reactivation, even ones without an activation lock.

How could activation lock possibly work otherwise? Once wiped, it doesn't know if it's activation locked anymore.

Are you serious?

https://news.ycombinator.com/item?id=25074959

Sorry, that seems like a total non sequitur to me. What about that (an outage + a failure to correctly handle the outage on the clientside) suggests Apple is planning to lock down macOS like iOS, either in terms of hardware or software?

Or rather, maybe you'd like to explain what you think Apple would have to gain from doing something like that?

You cannot start any non-Apple applications unless Apple explicitly allows them and keeps a list of what and when you are running. Looks totally fine...

Again, I'm having trouble making the leap from this:

"Apple checks which macOS applications I run in order to verify that the developers credentials are still valid and not expired/revoked, but only for macOS apps and not executables in general, and you can still open apps that are not signed with a Developer ID using a manual bypass" (which is certainly not ideal but seems like a reasonable security compromise. There's no evidence they're keeping a list of this information anywhere.)

to:

"Apple will lock down macOS and make it utterly impossible to run any executable or even scripting code that hasn't gone through a strict review process"

Since you're unwilling (or unable?) to explain that leap without just spouting pithy 3-word comebacks, I guess we're done :)

I suggest you read the comments in the linked thread. Why do I have to repeat those who can explain better than me? It's pretty clear that the current state:

1) cannot be called "fully unlocked",

2) more locked than what people used to have, even on Apple devices.

It might be fine for you, but it certainly is potentially bad for privacy and freedom. Look up keyword "tor" in the thread if genuinely want to understand and not trolling.

Maybe you should go back and read the article that spawned this thread. Apple literally put engineering time + effort just to allow 3rd-party OSes to be run on their chip. That doesn't strike me as the move of a company that wants to lock down their OS.

You can disagree with the tradeoffs Apple decided to make in the name of security/privacy, fair enough. And you can certainly blame them for their mistakes (like not thinking to handle a case where their Developer ID verification servers were offline). But practically, these tradeoffs don't really hamper almost anyone's usage of the OS, and the few people for whom it does can disable them.

But isn't it possible to turn off System Integrity Protection and Gatekeeper?

> They've plenty communicated their intention to not turn the Mac into the iPhone/iPad.

Of course not, because they need to differentiate. This doesn't mean they renounce their plans to further lock down macOS. Running non-appstore apps is getting harder and harder each year.

Apart from the fact they've actively stated (repeatedly, during their main presentations) that running arbitrary code on a mac will not be changing.

For a company that seems sometimes to go out of its way to not give any information on anything it doesn't make sense to clearly and concisely make that statement.

While at the same time continuously tightening the noose on Gatekeeper. I wonder why people wouldn't take their word for it...

This is always trotted out.

There’s not a single piece of access I’ve lost. It’s a couple of dialog boxes.

> running arbitrary code on a mac will not be changing.

i wonder how much of this is thanks to peoples "gnashing of teeth" about mac getting an iphone lockdown

in the end its speculation, but id wager a guess apple wouldnt have a big problem locking down macos if people didnt make a big deal out of it

It's almost certainly not due to "gnashing of teeth." They've always marketed the MacBook line as a general computing device for power users. The idea that they would make it impossible for developers to use their primary computing product is ridiculous. They know how many of these things they sell to students, developers, etc.

Just a note - it's often very easy to measure the validity of your ideas by considering the economics of the ideas. Apple effectively neutering development on their premier general purpose computer would obviously reduce the amount they sold. The same isn't true for the iPhone, which effectively no one develops on.

It's also very clear that Apple sees the iPad Pro—not the Mac—as their vision for locked-down general purpose computing. I honestly wouldn't be surprised to see a notebook iPad with a fixed keyboard, or a desktop iPad in the shape of a small iMac. These seem unlikely and perhaps absurd... but not nearly as absurd as locking down the platform Apple expects developers to use.

They have communicated their intention openly. Just listen to any of the podcasts where Gruber interviews senior execs about this.

>How do we know it's a feature vs a temporarily convenient oversight?

Considering the level of GUI work that outright supports this feature in recovery mode on an M1, I'm inclined to think it's not an oversight.

>Indefinitely? How do we know it's a feature vs a temporarily convenient oversight?

Basically nothing can be known to be indefinite. But Apple has signaled that they'd be open for ARM Boot Camp if Microsoft was to sell non-OEM Windows for ARM licenses. So it seems like Apple might consider multi-booting a feature.

> Indefinitely? How do we know it's a feature vs a temporarily convenient oversight?

The fact that Apple documented it.

If Apple would cooperate just a tiny bit, I assume the Linux community would gladly do all the rest for them. The M1 Macbooks are actually quite reasonably priced IMO. Right now it's even hard to find an AMD Ryzen 4000 laptop with >FHD screens...

If you get Linux developers onto your platform, you unlock the server market, I assume. I don't get why Apple would not open that possibility for their silicon future.

I think a downside to have Macs running Linux would be extended hardware support and evasion of their obsolescence strategies.

Overall, I think they could win a lot, so there is a desperate hope they change their minds on that. At least, I would be completely lost on them, if AMD manages to match their performance and there gonna be well-screened AMD laptops.

Apple, you got this current advantage to win people like me over. Once the others catch up, this opportunity will probably not arise again, as I will never ever settle on MacOS or Windows, especially with the current course of increasingly restricting how I could use a >1.5k€ device.

If the M1 Air had proper Linux support (at least committed), I would buy right now in an instant. I naively believe, if you don't get Linux people like me, Apple's silicon endeavour will not get a hold in the larger CPU/GPU market.

> Indefinitely? How do we know it's a feature vs a temporarily convenient oversight?

Could not the same be said for any computer manufacturer? How do we know for sure Dell won't start locking down future XPS models?

Seems to me that it would also be a great opportunity to port each of these builds to a homebrew package.

Except for potential Anti-trust litigation, I don't see any reason for Apple to 'not lock' its M series computers from boot loader to app store in the near future as the walled garden + vertical integration has been their most successful business strategy.

One should be naive to think that the conversion to M-series wasn't done with the intention to lock the macOS platform akin to iOS.

I wouldn't be even surprised if doing so didn't attract anti-trust issues as they got away with iPhone, iPad which are not lesser computer than a PC especially since several applications are becoming 'mobile first' or even 'mobile only'; So it's ridiculous to compare smartphones, tablets to game consoles whenever this topic is brought to the discussion.

> Indefinitely? How do we know it's a feature vs a temporarily convenient oversight?

Apple could take most of the speculation/hostility away by simply giving their word for it. But they don't ...

Reply on news.ycombinator.com