Hacker News Reader

Comment by nijave | Hacker News Reader

Whether you like macOS or not, they definitely are innovating in this space. They (afaik) are the only OS with more granular data access for permissions as well (no unfettered filesystem access by default, for instance)

It's also a shame CrowdStrike doesn't take kernel reliability seriously

View on HN

I'm sorry, restricting user's ability to change their computer is not innovation. It is paternalism.

The user can change anything they want, but a process launched by your user doesn't inherit every user access by default. You (the user) can give a process full disk access, or just access to your documents, or just access to your contacts, etc. It's maximizing user control, not minimizing it.

I am talking about removing the ability to install kernel extensions.

As for full disk access, go try and remove Photo Booth from you Mac.

The user isn't being restricted. Third-party software is being restricted, by default, and those restrictions can be disabled by the user.

This is a feature not a bug in the enterprise.

https://learn.microsoft.com/en-us/defender-endpoint/enable-c...

Appears to be opt in vs opt out. I'm curious how many orgs use this

Qubes OS has a better model, security by compartmentalization: everything runs in separate VMs with hardware virtualization.

Qubes is great but no desktop GPU supports virtualization.

I could be happy if the GPU was only used for compositing.

If I were doing ML work, maybe I do that work in an ephemeral cloud environment.

I know this doesn’t cover everyone’s use case, but it doesn’t have to.

> Qubes is great but no desktop GPU supports virtualization.

Intel 12th-gen and newer iGPUs do, and AFAIK it can be unlocked on certain Arc cards as well but details are fuzzy.

They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553

> They plan to add GPU acceleration in the next release: https://github.com/QubesOS/qubes-issues/issues/8553

You say they're planning to add a feature in the next release, but what you linked to is merely an uncompleted to-do item for creating a UI switch to toggle a feature that hasn't been written yet. I think you win the prize for the most ridiculous exaggeration in this thread. Unless you can link to something that actually comes anywhere close to supporting your claim, you're just recklessly lying.

The linked Issue #8553 is "just" about creating a toggle for GPU acceleration. It's blocked by Issue #8552 [0], which is the actual Issue about the acceleration and originally belonged to Milestone "Release 4.3". It seems to have been removed later, which I didn't expect or know about. Accusation of lying was completely unnecessary in your comment.

Moreover, the Milestone was removed not because they changed their mind about the Release but for other reasons [1].

[0] https://github.com/QubesOS/qubes-issues/issues/8552

[1] https://github.com/QubesOS/qubes-issues/milestone/28

Ok, so your [0] shows that the real work has barely been started. The only indication it was ever planned for the next release was a misunderstanding on your part about the meaning of a tag that was applied to the issue for less than one day last fall, and they've stopped tagging issues with milestones to prevent such misunderstandings in the future. It still looks to me like your exaggerated claim was grounded in little more than wishful thinking.

Am I missing something? This is to add a toggle button and the developers say they are blocked because GPU acceleration feature doesn't exist so the button wouldn't be able to do anything.

See my other comment here.

Android and iOS have compartmentalization as well but it's not hardware level (at least as far as I know).

Reply on news.ycombinator.com