Comment by Maursault | Hacker News Reader

Comment by Maursault | Hacker News Reader

Parent Full thread

> running the system "out of spec" had less potential for permanent damage

You may have a point, unless this insinuated physical damage from altOS on Apple Silicon never appears.

> Apple-sanctioned alternative operating systems such as VMware ESXi have also caused problems in the past and should not be used at all anymore

VMWare currently supports running their bare metal hypervisor on (at least) Intel Mac hardware (except for Mac Pro due to COVID straining VMWare development, and not because ESXi causes Mac Pros to detonate), but does not consider any Mac with VMWare an enterprise-grade setup.

> because Apple does not seem to play well with others on that level (by releasing uncoordinated firmware updates).

Please accept some humble advice: since there are three and only three reasons to update anything: bugfixes, pressing security issues and the last a need for new features, generally, one should never update firmware, and this is especially true the moment the update appears. In the first case, unless the bug prevents booting, it couldn't be less important, secondly, worrying about firmware security issues is silly, because if you can't physically prevent access to the computer, it's pwned anyway no matter how secure the firmware is. And in the last case, if you have a functioning system in production, then it doesn't need new features, get out of here with needing new features on production. The notion is absurd on it's face.

>secondly, worrying about firmware security issues is silly, because if you can't physically prevent access to the computer, it's pwned anyway no matter how secure the firmware is

This is just completely wrong. You're peddling bad 20-year-old advice that hasn't ever been completely true, and especially not anymore.

First, firmware updates often patch vulnerabilities that would allow attacks without physical access. Most obviously, vulnerabilities in the networking hardware can allow attackers to take control a machine by sending crafted packets. But other hardware issues can also, e.g., make it possible for untrusted code to perform a privilege escalation of some kind. You want firmware updates to protect yourself.

Second, Macs/iOS devices and PCs—through the Secure Enclave and TPM, respectively—offer really good protection against physical access attacks. They verify the integrity of boot components and are only able to decrypt the system volume if they detect an untampered boot chain. Further, they can lock down direct memory access to protect powered-on systems from bypasses to user authentication. This is why nowadays, if a thief steals your laptop and you had the hard drive encryption with hardware security features on (on Windows, if you set up with a Microsoft Account, this is enabled without any further action by the user), you can feel fairly secure that even a technically savvy thief cannot access your data. Firmware updates can fix vulnerabilities in these security systems.

Nice straw man, because you didn't disagree with me, you disagreed with someone else's argument. Actually, in the old days, every update was applied as soon as humanly possible. It is only in the last 25 years that admins have been required to carefully examine updates and weigh the risks of production possibly going down or getting funked against I suppose apparently the incessant barrage of novel network firmware attacks.

It's not even arguably a straw man.

Above, you said, "worrying about firmware security issues is silly, because if you can't physically prevent access to the computer". That's not someone else's claim, it's yours. If you didn't intend it to be your claim, you erred in expressing it, since that's what it conveys. That's the claim the other poster refuted. I simply don't understand you when you say they "disagreed with someone else's argument"? I control F'd the parent posts and found no such claim made by anyone, except you.

Your (apparent) claim is obviously wrong for the reasons already pointed out by the other poster, including that there are firmware-level attacks that do not require physical access. Some of these vulnerabilities can be fixed by firmware updates. So, if possible, it makes sense to promptly apply each patch that will fix such a vulnerability.

> secondly, worrying about firmware security issues is silly, because if you can't physically prevent access to the computer, it's pwned anyway no matter how secure the firmware is.

Not true. Apple hired some of the best security experts in the world to build a system that was resistant to pwnage even if the attacker has physical access to the machine:

https://mobile.twitter.com/XenoKovah/status/1425800637166596...

I just want to point out that this tweet is wrong when it claims that Secure Boot does not protect against physical presence attacks. This misunderstands the point of Secure Boot.

Secure Boot can indeed be disabled, but that will change the TPM PCR values, so assuming a standard BitLocker configuration, the TPM will fail to unlock the BitLocker key. So if you try to disable Secure Boot on such a machine, you will be unable to boot unless you have the BitLocker recovery key.

Blah blah blah, you’re talking out your ass, VMware ESXi can and will fry trashmac when run with incompatible firmware that can sneak in while booted into macOS releases that came after the ESXi release..and neither Apple nor VMware may warn you before the glue comes off.

Reply on news.ycombinator.com