MacOS 10.15: Slow by Design (2020)
sigpipe.macromates.com
sigpipe.macromates.com
I’m very glad this advice has been as niche as it has been. It’s awful advice unless you really know what you’re doing and why you’re doing it.
Anyway, I still run 10.15 daily and the only thing that I’d call slow by design is the thermal design of the laptop it runs on. Even so I think just thoroughly clearing dust out of it gave it at least another few more years of being a pretty decent laptop.
However, seems SIP can only be disabled temporarily (until next reboot?), at least according to https://developer.apple.com/documentation/security/disabling... but it's unclear for how long it is disabled.
SIP is personal preference. Personally I find that Mac OS is too buggy with SIP enabled. I had an issue where disk space was disappearing into a directory that was hidden by SIP, because the OS was leaking update images.
These two OS’s have very different types of user and attacker (speaking in generalities), and thus different security trade-offs during design.
The main risk with Mac is that someone downloads a “Mac cleaner” or something similar which installs malware, or that malware is hidden in a legitimate looking app, and this is what SIP protects against. Even informed power users can make these mistakes - it only takes downloading one compromised utility!
IMO for most ‘home’ use where it is used as a main OS by a person without too much familiarity with computers, Ubuntu and many Linux distros are probably less secure than Mac - for instance the average user is conditioned to run random terminal commands they find on the internet and give them sudo permission. Obviously I’m excluding the majority of use-cases such as routers, consoles, tvs, servers where users access to the underlying OS is heavily restricted.
That wasn't related to SIP, so I don't think we can just throw random unrelated security issues against SIP to justify it being a bad thing.
Bedsides, is the moral of the Zoom story really that application Developers should be given unfettered access to the OS and the freedom to do whatever they want? It sounds like the opposite - an example of exactly why security has to be built into the OS and can't be left to companies like Zoom.
Plus, some categories of technical users like sysadmins are probably the worst possible people to disable SIP because even though the probability of attack is much lower, the potential impact is orders of magnitude higher.
I always ignore spam text messages, but got a phishing attack message made to look like a USPS update about 2 months ago they almost fooled me because I had a legitimate package that was missing. I clicked the link, and even entered my email address in the landing page form and was about to enter credit card details for a $2 ‘redelivery’ charge - which I was also primed for because I’d recently paid USPS a similar amount to redirect my mail after moving.
I was creating a one-time use virtual card to make the payment when my thoughts caught up with me and I realized it wasn’t a legitimate page.
Good old Apple, slowing my(?) Computer down daily to protect me from myself.
Does anyone tally attacks by type? i suspect most successful attacks against sysadmins are via social engineering/xss/token stealing on their perfectly uncompromised machines rather than malware.
Either 1) we say that Mac-using developers are stupider than Linux using-developers, and it’s irresponsible for Mac-using developers specifically to turn it off.
Or 2) we say that Linux is “horribly” insecure and it’s irresponsible for developers to use Linux whatsoever and they should go out and buy a Mac immediately to save themselves.
Or 3) we say that Mac-using developers are not stupider than Linux using developers and it’s fine to turn it off if they want.
Personally I’ll go for #3.
SIP does not protect you against installing and running malware.
SIP protects certain system components on the Mac, that's all.
Also on Windows, the first thing I do is disable the Windows Defender. And believe it or not, I haven't had any viruses for as long as I can remember using computers.
On the other hand, half a year ago I've investigated a compromised macOS system at work where the user clicked a wrong button on some innocently looking dialog and ended up with a rogue extension in Google Chrome which was not possible to uninstall. Why didn't SIP prevent that from happening?
Prove it.
Try for yourself: prove your have not done [X] in the last 10 years.
They've claimed to have never gotten a virus. They have no way of knowing if this happened, as a virus isn't going to demonstrate it's presence.
1. I never downloaded malware
2. Windows Defender is useless and doesn't catch anything.
Because a Chrome extension is not part of the system. The clue is in the name, System Integrity Protection. Were Chrome extensions something that interacted withe kernel, or other system functions, you'd have a point. Arguably XProtect could've kicked in, but now would expect the software running the extension to have reasonable protection agains that sort of thing.
Linux doesn't have SIP, or Gatekeeper, or XProtect, but you know it doesn't have any of those features. The developers know it doesn't have any of those features, so the absence of those features are part of the attack surface that the vendor (in this case the Linux OSS community) is aware of in the threat model.
If you have SIP disabled, no-one is trying to solve any problems that this causes for you. Anyone writing malware to target a SIP-disabled system knows Apple isn't trying to patch those issues because having SIP disabled is not a valid system state they're trying to protect. There won't be patches for you, and given that it's closed source, it's not like you can fix it yourself.
I don't think that running malware on your computer is a good idea. Just don't do it.
I don't think that having vulnerabilities on your computer is a good idea. Just don't do it. /s
> SIP does not solve any problems.
Of course it does. We might disagree with the tradeoffs it's making, it might not be worth it at all, it might be a wrong approach from the start. But saying it does not solve any problems is disingenuous at best.
SIP absolutely solves a specific problem. It prevents rogue software from writing to protected areas. Whether that matters to you is your business, but to suggest no-one else should want to prevent any old homebrew package or DMG installing a keylogger is a bit silly.
This is a misreading of the linked document. Disabling SIP is permanent until re-enabled. That's why the document is warning you to only disable it temporarily and then re-enable it. The warning wouldn't be necessary if it automatically re-enabled.
"Warning
Disable SIP only temporarily to perform necessary tasks, and reenable it as soon as possible. Failure to reenable SIP when you are done testing leaves your computer vulnerable to malicious code."
> The main task of SIP on Mac is to protect the safety and integrity of the system files and directories, preventing them from modifications or attacks from unauthenticated processes. It brings a high level of security to the entire system.
The feature has only existed for around 7 years and macOS wasn’t horribly broken before that time.
Nice you found out and mention it here.
It has been like that since new generation x86 CPUs provide compatibility with the previous generation with more speed... Pushing an uncalculable number of tons of perfectly working hardware to the trash, most of the time to keep executing the same tasks with an updated software.
When the software performance/optimization declines, the hardware is accused of being too old. Even if hardware speed never declines with age. I understand we need new hardware for new usage; but not for a new version of Windows, Office or MacOS.
Just check https://en.wikipedia.org/wiki/Andy_and_Bill%27s_law
It goes the same with webpages load, library number and sizes... always a declining optimization with faster hardware.
Those interested to block the check should look at this list : https://support.apple.com/en-us/HT210060 and block the IPs associated with notarization. It is possible to do that with pf, which is integrated in macOS but it should be done after every update since the pf.conf file will get overwritten.
But I guess with how fast computers and storage is today, it's probably easier to recompute the hash every run. My desktop can do SHA-512 at 1 GB/s (`openssl speed sha512`), which is fast enough to be imperceptible for 99% of binaries.
Anyway, I thought OP meant Ventura sends the hash to Apple's server every run. That would be far too expensive to be reasonable.
To compute the checksum you have to read the entire executable, but to execute it, you only have to map the parts that are needed at startup into memory.
That, I think, is the reason Apple didn’t do this at every process launch before: their OS supported (too many) systems that booted from a spinning disk.
1. If you have run it in the past aren't you already screwed? Maybe this can effectively "disarm" otherwise entrenched malware?
2. Could they track the list of signatures that you have asked about in the past $timeframe and your system can frequently check for newly flagged signatures? This would allow longer caching without high delay until new blocks take effect. (Similar to moving from OCSP to CRLs)
And if you don't add Terminal to the developer tools in Security preferences you still get slow performance for scripts.
This is not true. Gatekeeper will phone home regardless. The stapled notarization tickets are actually the fallback, in case the server check fails for some reason, such as no internet connection.
Remember that notarization tickets can be revoked by Apple! In fact, security researchers have found many instances of notarized malware. Notarization is no guarantee against malware. A notarization ticket just says that the app was validly signed, and that Apple checked the app for malware at the time and didn't find any. At the time. Malware checks are improved. Malware is found after the fact.
https://developer.apple.com/forums/thread/116812
Apple can revoke tickets without synchronously checking on every first launch. Mac malware isn't that common, so they could easily use a CRL pushed to clients (for example) on a regular schedule.
Yes. This can be verified with a packet trace.
It can also be verified visually. Download a notarized stapled app, disable your internet connection, and launch the app. You'll see a Gatekeeper dialog like this:
"Safari downloaded this file on [date]. As of [date], Apple checked it for malicious software and none was detected."
Notice "As of [date]".
Then press Cancel, re-enable your internet, and launch the app again.
This time "As of [date]" is gone! It's phoned home to check.
False.
It does, but it is the hash of the developer’s certificate. For most developers, this uniquely identifies the single application they publish. If you launch a unique constellation of apps then it uniquely identifies your machine.
Apple committed to sending this OCSP check not in plaintext within a year, but that was more than a year ago.
This part has been accomplished.
However, Apple has reneged on the opt out user preference.
We've seen what happens when average users get an operating system that doesn't protect them; Windows XP was an interesting time.
I traded the 2019 MBP for a 14" M1 Pro as soon as I could and haven't looked back. This machine is great.
The corollary is that macOS’ increasing reliance on GPU all over the system is really nice on Apple Silicon, where they don’t need to make such a stark trade-off between GPU power and battery, and can scale usage smoothly.
expect more to come, probably some captchas
My job forced me to use Windows, and it is terrible for my productivity and what not. One day, one of the screens stopped working when in use with dual display another day the fingerprint reader stopped working for log-ins, but still works for the first half of setting up a new fingerprint. I can't even charge my headphones without special drivers!
Look. We all have our pet peeves with OSs, but they are not relevant to TFA
It’s 2022 and Windows touchpads and touchpad drivers don’t hold a candle to my 2011 MacBook.
What, specifically, is the problem with touchpads on windows?
Some specific issues though I have seen is general lack of responsiveness or missing the first bit of movement and no gestures or gestures that just don’t work as well.
- Mac touchpads have near-perfect wrist detection so you almost never get an errant input.
- There is virtually no input lag. It’s especially crucial when scrolling long pages. On a Mac, you can flick the touchpad and the page will scroll all the way down.
- Furthermore, they perfectly recognize up to 10 fingers. There’s a lot of great software that allows you to set shortcuts to different mouse gestures like 3-,4-, 5-finger swipes, tip-taps, and more.
- There’s a really smooth acceleration curve that allows you to be extremely precise with the mouse while also allowing it to span great distances when needed.
Like the other poster said, there are so many subtle differences that amount to a gargantuan delta between the two experiences.
I don't perceive any lag on both my thinkpad and my pro admitedly crappy Dell laptop on Linux when scrolling anything and I don't recall having felt a significant difference with windows when it was last fired up or on Mac laptops I tried in the past. Most of the difference usually came from a difference in the speed and acceleration settings but these are configurables.
Can't speak about gestures because that is something most people don't use.
1. when I type only the tip of my fingers enter in contact with the laptop, my wrists are in the air.
2. if I rest my hands on the laptop they sit on both side of the trackpad, not on it.
The acceleration is okay on the touchpad, but the fact that it carries over to the mouse as well is an abomination.
I only ever miss two apps from macOS: Preview and LaTeXiT.
For me the experience has been the opposite. I could never get used to things not working fluidly enough. When I finally decided to embrace the level of integration apple devices provide, the world of pain that windows was to work with eased up a lot. Windows seemed a patchwork of things cobbled together with no real coordination, parts that don't work very well together, and messy visual/interaction design where the users' point of view hasn't been a priority.
My Lenovo Thinkpad doesn’t even have a discrete GPU and drives my monitor fine, much better than the $2,000+ MacBook Pros I had.
There are concrete things that just do not work on macOS or, if they do work, not work well.
Lastly, macOS is a compromise in two wrong directions. One is that it’s not Linux, so the Unix experience is compromised and dealing with Homebrew is a pain. I constantly had trouble with asdf and other Linux tools on macOS that I never have issue with in WSL on Windows. It seems any tool on macOS needs several workarounds. That doesn’t exist on Windows for development tools because I directly use Linux through WSL. Then I get to use Windows for everything else, which has much more stable driver support. The other direction is macOS, which keeps moving towards a locked down, mobile-like experience.
also this laptop keeps giving me static shocks. i never had issues with pre 2015 era macbooks which i think were pretty good.
Conversely, to supply one Gladwell's worth of anecdata, I've never had a MacBook (in 10+ years) that has had any issues with streaming audio over Bluetooth (several TaoTronics dongles, standalone speakers, PLT headphones, Aftershokz headphones, etc.)
I don't underestand how Apple getting a list of everything i run is "security". But everybody is doing it (Google, Apple, Microsoft, Facebook) so it must be good.