> the great majority of users are oblivious of the detection and remediation of malware on their Macs, which occurs in complete secrecy
This is a problem that Apple could solve but chooses not to. Everything the author is doing is admittedly a poor workaround for Apple's lack of user notification.
Anyone remember those old ads of PC vs Mac and Mac not getting viruses? Because, I do...
Virus can self execute, replicate and spread (like biological ones) while malware (layman also refer to troyans) need user actions and unawareness to execute.
Am I totally wrong?
It's incredibly intellectually lazy to suggest 'marketing'.
Apple's ideology has always been that regular, everyday computer users shouldn't have to concern themselves with low-level details of system administration in order to write a book or edit a video or whatever it is they're doing.
In addition, unless they have some breakthrough, elegant or innovative way of addressing stuff, they leave it to 3rd-party developers.
It's also myopic to complain about something as low-level as malware remediation while glossing over the fact that Apple enabled end-to-end encryption for iCloud [1] and gave users who aren't system administrators or security experts the ability to protect themselves if they are the target of a state level attacker [2].
Addressing security/privacy at this level is a very Apple thing to do.
In my opinion, it should be a no-brainer: end-to-end encryption and protection from state-level attackers vs a widget that alerts me the OS zapped a malware download.
As far as malware on macOS goes, having the operating system deal with this unbeknown to the user is actually a good thing for those everyday, regular users, who would probably screw things up worse if they had to play some direct role in this.
BUT for system administrators, developers and power users, the APIs and command line tools are there for them to get into the weeds of malware remediation if they want to.
[1]: https://www.apple.com/newsroom/2022/12/apple-advances-user-s...
[2]: https://www.apple.com/newsroom/2022/07/apple-expands-commitm...
If you really want an innovative way of doing it is trying to give the user a good track record so they know exactly where that came from.
Exactly! Since there’s nothing the average everyday user can do about the malware, there’s really no need to alert them.
There’s a lot of stuff in system logs that would worry none-technical users if they knew about them.
So the user can sleep well when Pegasus gets all his data. Charming. /s
I mean, in a perfect world all of this would be perfectly exposed to users and they would know every single action their computer takes. I don’t actually disagree that putting in some effort to better surface how XProtect works could be valuable. But the current situation is generally fine and the accusations that Apple is trying to hide this stuff from you do not seem well supported.
You still seem to be missing the point. This is about end users not developers.
This is a UI problem, not an API problem. You want to make a technical point, because you're a technical person, but you're missing the forest for the trees, because this isn't a particularly technical problem. This is a typical Apple problem of paternalism, Apple believing that Apple should take care of everything, and users shouldn't worry their pretty little heads about anything.
> I mean, in a perfect world all of this would be perfectly exposed to users and they would know every single action their computer takes.
We're not talking about "every single action", we're talking about the OS detecting malware on an end user's Mac and then... not bothering to tell them about this fact. Imagine if you went to the doctor for a physical, took some tests, the tests indicated you had an STD, and then... the doctor just gave you some drugs and didn't bother to tell you that you had an STD. That would be malpractice. You'd want to know. You'd need to know. Because one doesn't just "randomly get" either an STD or malware. How you got it (and especially who you got it from) is just as important as that you got it.
> Nobody says the system firewall runs in “complete secrecy” either even though it doesn’t warn you when it blocks connections.
1) You have to manually enable the firewall. It's disabled by default on macOS.
2) Unlike malware, you can just "randomly get" connection attempts from the internet. Attackers are probing everything. I can see that in my web server logs.
I make a simple claim: if macOS takes action to remediate malware then it ought to tell the user. Simple question: Do you agree or disagree with that claim?
All of the discussion about logging and endpoint security is because the author has determined in testing that macOS actually fails to tell the user when it remediates malware.
To follow my earlier analogy, this is like talking about how to do your own STD tests when your doctor neglects to tell you whether you got an STD. But you doctor should really tell you, and then you wouldn't need your own tests. But you seem overly focused on the tests rather than the telling.
I am fully supportive of keeping users informed of how their systems work, and I always will be. Many parts of Apple, and the software industry in general, don't care for this very much, so this is unfortunately not as universal as I would like it to be. There's a lot of places in their OS that Apple chooses to not prioritize this effort, or does a poor job.
It's important to note that "tell the user" is not actually all that simple, just like being the person who tells you your medical results doesn't just read out your blood test. Throwing up a "we detected 10 threats" notification is not relevant to most users. When a doctor sits down with you they are obligated (I believe legally?) to make sure you understand what the results mean, how confident they are of the conclusions, your risk factors that might have influenced what they found, and what your next steps are. The same applies to malware detection and remediation, except with "medicine" swapped with "computers" for things people don't really understand.
I work in this space on another platform, and the problems we regularly run into include things like:
* We aren't 100% confident that we've detected malware
* Users sometimes actually find malware to have some helpful functionality (e.g. photo filter app that uploads all your photos, not just the ones you hand it)
* Malware authors target mechanisms that we can provide feedback to users
* Saying you didn't find any malware can lead users to think there is no malware
* Users don't really know to do with "oh we found malware and fixed it for you"
…
There aren't impossible problems to solve (at least, I hope they aren't…) but they definitely require some thought. I don't quite know how Apple does malware scanning; my understanding was that they do a lot of signature matches which should help with "we are confident this is malware", but considering some of the behaviors described in the article ("macOS detected malware and didn't do anything?!") I suspect some of these are less reliable. In any case, I get the feeling that Apple has not prioritized notifying the user of this because they don't want to spent the time on it for whatever reason. They don't really want to keep it secret, hence the API for third parties to perhaps solve the problem for them, but they aren't doing it themselves. Perhaps they really should; I think it's fine to be upset about this. The specific complaint I had was that the author seemed to imply that Apple purposefully underdocumented the API and made it hard to use for normal people, when that wasn't the purpose of it at all.