Hacker News Reader

Comment by AgentME | Hacker News Reader

MacOS has been phasing out support for third-party kernel extensions and CrowdStrike doesn't use a kernel extension there according to some other posts.

View on HN

I’m convinced that one reason for this move by Apple was poor quality kernel extensions written by enterprise security companies. I had our enterprise virus/firewall program crash my Mac all the time. I eventually had to switch to a different computer (Linux) for that work.

It wasn’t Crowdstrike, but quality kernel level engineering isn’t was I think of when I think of security IT companies.

But, also credit Apple here. They’ve made it possible for these programs to still run and do their jobs without needing to run in kernel mode and be susceptible to crashes.

Not only security software, but really any 3rd party drivers have caused issues on Windows for years. Building better interfaces less likely to crash the kernel was a smart move

When I started doing driver development on MacOS X in the early 2000s, there were a number of questions on the kernel/driver dev mailing lists for darwin from AV vendors implementing kernel extensions. Most of them were embarrassing questions like "Our kernel extension calls out to our user level application, and sometimes the system deadlocks" that made me resolve to never run 3rd party AV on any system.

Whether you like macOS or not, they definitely are innovating in this space. They (afaik) are the only OS with more granular data access for permissions as well (no unfettered filesystem access by default, for instance)

It's also a shame CrowdStrike doesn't take kernel reliability seriously

Qubes OS has a better model, security by compartmentalization: everything runs in separate VMs with hardware virtualization.

Qubes is great but no desktop GPU supports virtualization.

I could be happy if the GPU was only used for compositing.

If I were doing ML work, maybe I do that work in an ephemeral cloud environment.

I know this doesn’t cover everyone’s use case, but it doesn’t have to.

They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553

> They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553

You say they're planning to add a feature in the next release, but what you linked to is merely an uncompleted to-do item for creating a UI switch to toggle a feature that hasn't been written yet. I think you win the prize for the most ridiculous exaggeration in this thread. Unless you can link to something that actually comes anywhere close to supporting your claim, you're just recklessly lying.

The linked Issue #8553 is "just" about creating a toggle for GPU acceleration. It's blocked by Issue #8552 [0], which is the actual Issue about the acceleration and originally belonged to Milestone "Release 4.3". It seems to have been removed later, which I didn't expect or know about. Accusation of lying was completely unnecessary in your comment.

Moreover, the Milestone was removed not because they changed their mind about the Release but for other reasons [1].

[0] https://github.com/QubesOS/qubes-issues/issues/8552

[1] https://github.com/QubesOS/qubes-issues/milestone/28

Ok, so your [0] shows that the real work has barely been started. The only indication it was ever planned for the next release was a misunderstanding on your part about the meaning of a tag that was applied to the issue for less than one day last fall, and they've stopped tagging issues with milestones to prevent such misunderstandings in the future. It still looks to me like your exaggerated claim was grounded in little more than wishful thinking.

Am I missing something? This is to add a toggle button and the developers say they are blocked because GPU acceleration feature doesn't exist so the button wouldn't be able to do anything.

See my other comment here.

> Qubes is great but no desktop GPU supports virtualization.

Intel 12th-gen and newer iGPUs do, and AFAIK it can be unlocked on certain Arc cards as well but details are fuzzy.

Android and iOS have compartmentalization as well but it's not hardware level (at least as far as I know).

https://learn.microsoft.com/en-us/defender-endpoint/enable-c...

Appears to be opt in vs opt out. I'm curious how many orgs use this

I'm sorry, restricting user's ability to change their computer is not innovation. It is paternalism.

The user isn't being restricted. Third-party software is being restricted, by default, and those restrictions can be disabled by the user.

The user can change anything they want, but a process launched by your user doesn't inherit every user access by default. You (the user) can give a process full disk access, or just access to your documents, or just access to your contacts, etc. It's maximizing user control, not minimizing it.

I am talking about removing the ability to install kernel extensions.

As for full disk access, go try and remove Photo Booth from you Mac.

This is a feature not a bug in the enterprise.

https://www.dropboxforum.com/t5/Apps-and-Installations/New-D...

Is this happening with or without kernel extensions?

Also, it does actually work on MacOS despite this. We’ve had it catch someone getting malware.

Reply on news.ycombinator.com