Hacker News Reader

Why is it okay to reduce security to install kexts on an external disk or a MacBook Pro but not on his Mac Studio?

Perhaps he uses the Mac Studio for more important work?

Sure but what is the reason? Is it just “I want maximum available security on this computer”? Or is there a known exploit?

Just allowing kexts to be loaded should not increase the attack surface or expose the author to any currently known exploits. The reason that people avoid doing it anyways is because third party kexts have a history of obvious vulnerabilities and don't receive the same amount of eyeballs that first party kernel extensions do.

As you put it, it really is a desire for maximum security at play here.

(Not trying to be difficult, just one more question)

Booting that computer from an external drive with third party kexts would also increase the attack surface, right?

>Just allowing kexts to be loaded should not increase the attack surface or expose the author to any currently known exploits

"Just allowing kexts to be loaded" sure, it wont. But "just allowing kexts to be loaded" makes no sense as an action, unless you also actually intend to and do load at least one kext.

In which case, it absolutely increases the attack surface.

Reply on news.ycombinator.com