|
| ▲ | nvme0n1p1 9 hours ago | parent | next [-] |
| Are you sure you linked the right page? This looks like a list of workarounds the Asahi team had to figure out. |
| |
| ▲ | LoganDark 8 hours ago | parent [-] | | Oh, my bad, I think the one I intended was this one: https://asahilinux.org/docs/platform/security/#apples-unspok... > Rumours circulating that Apple are actively hostile towards efforts such as Asahi, or that their security must be bypassed or jailbroken to run untrusted code are unfounded and false. In fact, Apple have expended effort and time on improving their security tooling in ways that only improve the execution of non-macOS binaries. An example of this is giving their Boot Policy configuration tool the ability to wrap raw AArch64 code in a proper Mach-O format starting with macOS 12.1. This is only ever required for enrolling a boot object that is not already a macOS kernelcache. | | |
|
|
| ▲ | bigyabai 10 hours ago | parent | prev | next [-] |
| Most of those accommodations are for macOS, and make very few (if any) concessions for alternative operating systems. We're talking Qualcomm-tier effort. Intel and AMD set the standard for "tremendous effort" bringing up support for alternative OSes. Nvidia follows behind, and Apple's support is (somehow) behind Nvidia's foot-dragging. |
| |
| ▲ | HDBaseT 9 hours ago | parent | next [-] | | This is true, although Apple could of just as easily prevented alternative OSes as a whole if they wanted to. | | |
| ▲ | Rohansi 9 hours ago | parent [-] | | They already have the ability to prevent alternative operating systems. They use the same or similar SoCs in their other product lines and those do not let you do this. Yes, Apple put effort into making it possible to install alternative operating systems on Macs, but that is an exception to the design because the chips are designed to be locked down. I expect Apple to remove the option at some point because nobody is using it on any of the recent hardware. |
| |
| ▲ | LoganDark 7 hours ago | parent | prev [-] | | I see a lot of dual-purpose here. Maybe you don't, or maybe you figure it's just a coincidence that Linux can also benefit from this. Apple definitely had it in mind, and designed for it, even if they don't release documentation. |
|
|
| ▲ | foltik 8 hours ago | parent | prev | next [-] |
| Absolutely not. They put in the literal bare minimum possible effort short of locking down the platform entirely. You get a jmp to some arm64 instructions of your choosing, with a bunch of CPU features locked out. |
| |
| ▲ | LoganDark 8 hours ago | parent [-] | | I will admit I am a bit confused by them locking out features like that, especially since they didn't at first. I wouldn't jump to assuming it's hostile, though. |
|
|
| ▲ | oblio 7 hours ago | parent | prev [-] |
| > tremendous efforts Tremendous efforts would be to publish reference manuals for all their hardware components. Apple is doing the bare minimum, which is to not build 10km tall walls around its walled garden. But in the modern day of walled gardens, that's viewed as generosity. |
| |
| ▲ | LoganDark 7 hours ago | parent [-] | | This is Apple we're talking about. What may be the bare minimum for you was a lot of work for them. Work they could have passed up and we would've all had to simply deal with it. They do that all the time, and there's nothing we can do about it. But here they didn't. Here they did "the bare minimum" to allow custom operating systems on their newer hardware. That should be commended. Yes, we should celebrate that hardware we purchase and own still allows us to run code we wrote. Because the alternative is that it could not. Their non-macOS devices already don't. To be perfectly clear, Apple is like a lifeline to a lot of people. They are one of the last bastions of quality in the hardware and software world. This is why it's such a disappointment that they've been faltering lately: we had high expectations of them, which hasn't been quite so true for the rest of the industry for a while. So it is a big deal that hidden gems like this continue to crop up from them: it is a sign that some of their core values still remain. And I really hope the new CEO will bring back some of what they lost after Steve Jobs. | | |
| ▲ | foltik 5 hours ago | parent [-] | | Being able to run “custom” code is the default state of computers, and doesn’t require additional effort on the part of the manufacturer. How do you think they got their own code on there? Apple has just not spent effort in the opposite direction to lock it down in this case. That’s not something to celebrate, we should demand it as the bare minimum, ideally via the law. | | |
| ▲ | LoganDark 3 hours ago | parent [-] | | It literally takes effort to reach Apple's level of platform security while simultaneously having escape hatches designed to allow custom code without compromising the trust in the first-party code. Even simple, arbitrary decisions like having the secure boot state be per-operating-system rather than platform-wide take effort. Keep in mind Apple designed everything from the ground up including the silicon, so they did not just pull a part off the shelf that already can execute any code and then lock it down, they took their already very locked-down iPhone/iPad SoCs and specifically re-engineered the chain of trust to have these escape hatches while preserving the trust in macOS. Very careful engineering and not the "default state" of anything. There are a lot of shortcuts they could have taken to leave us with less freedom and they did not take those shortcuts. For that, I am grateful. |
|
|
|
