gargravarr

MacOS has some very strange ideas on removing permissions. When you allow kexts in modern OS releases, the signature gets added to an SQLite database in /var/db (you have to consult this database to get the signatures if you want to whitelist kexts in an MDM). Now kexts are quite invasive, hence Apple's caution on allowing them in the first place.

What happens if you want to revoke a kext? Delete the entry from the SQLite DB? Nah. Guess what, SIP prevents any and all deletions from that DB. You have to disable SIP to revoke a kext's permissions. And because the signature is not a hash, but instead a two-part vendor/product, it's entirely possible for a malicious version of an existing kext to be released that is then permitted by the signature.

As an admin with security focus, this to me seems completely backwards. I get that Apple don't want to make the permitting operation to be too difficult in the first place, because these are end-users we're talking about, but the lengths they go to in order to prevent the permissions being revoked is downright strange.

Not any more:

https://www.theverge.com/2018/11/12/18077166/apple-macbook-a...

"The parts affected, according to the document, are the display assembly, logic board, top case, and Touch ID board for the MacBook Pro, and the logic board and flash storage on the iMac Pro."

That doesn't leave much salvageable.

64GB will cost you $800 now. When you need it, it may cost half that, or less. And Apple was notorious for underspec'ing the maximum amount of RAM a machine could take - it was common for a machine to take double the Apple official maximum because the DIMM densities increased with time. Since the integration of the memory controller into the CPU this is less of an issue, but the soldered RAM means you're limited to the amount that Apple is prepared to give you, which until this model has been far less than the CPU actually supports - the 15" i9 could be spec'd to 32GB, but the CPU could address 64GB.

Apple's attitude to upgrading is to replace the entire machine. It's both expensive and absurd. I bought a 2008 MBP back in uni in 2010. I later upgraded the RAM and disk when I could afford to, and when I had reached the limits of what it had. That machine served me well for 5 years. There's nothing else on the market today I'd trust to be a daily use machine for 5 years straight.

Even the XPS 13s are more serviceable than their rival MBP 13"s. The RAM may be soldered on both but the XPS uses a standard NVMe SSD. It's saved me a few times already.

Not just the risk of data loss, but the inconvenience of restoring the machine is much higher. This means the only solution to restoring a modern Mac notebook is to replace the entire logic board - everything else may be functional except the storage, which is a consumable by most considerations, but now the entire board must be swapped. And if it's out of warranty, which let's face it, it's extremely likely to be, then you are completely and utterly stuck. You either have an enormous bill from Apple or an authorised repair shop (and Apple is notoriously cagey about allowing third parties access to their replacement parts) or you have to hunt down a machine for spares to do the swap yourself, and now with Apple's invasive security measures requiring communication with Apple's diagnostic tools to perform certain swaps, storage failure can render the machine entirely useless for months, if not permanently. Whereas if the disk was replaceable, just order one from the most convenient store, swap it in, restore from Time Machine.

The Function Key MBPs have a problem with their flash storage where they may randomly and unpredictably die, taking all the data with them. The fix is a firmware update, which also takes all the data with it. Fantastic, Apple, we bought six of those machines, and because the users are actively, y'know, using the damned things, it's not really convenient to tell them they'll be without their machine for a week while the service centre gets around to it, and then multiple hours of restoring their Time Machine backups. On the plus side, the SSDs in those machines are not soldered. Yes, they're proprietary, but it's something - if those machines suffer failure, I could grab an SSD on eBay and get them running again. It's almost worth the risk.

Xbox One X.

Now with 40% more confusion.

Mostly bandwidth, reliability and interference robustness. The Wii U certainly proves it's possible, although that's streaming 1280x720. Displays at much higher resolutions require considerably higher bandwidth and are much more expensive as a result. Plus, if your screen is in one place, the source is likely to be there too, so why not just make it more reliable with a cable.

I wasn't aware of this kernel flag (nor am I surprised it exists), seems like it would be useful to the article's author. However, by default it's left enabled, which allows the kernel to automatically set up the environment based on what it can glean from the hardware. So my comment was in regards to the machine without intervention.

Linux provides /dev/random and /dev/urandom to all applications as well as relevant API calls, but the quality of those is always in doubt (especially with urandom, which recycles the entropy pool when it gets too low). CPU hardware PRNGs are supposed to be much higher quality, when they work. So it's all about depending on the CPU to actually do what it's advertising - the CPUID flag advertises a high-quality hardware RNG, but then the firmware bug completely nurfs it.

My understanding is that implementing a PRNG in software results in a very small entropy pool. At the OS level, it can collect entropy from a vast number of sources, including things that an application won't have access to, which is why the OS exposes the RNG to applications. It also means maintaining such a PRNG in your software. Basically, it's the same old dependency argument again - there is nothing inherently wrong with using the tools the environment provides for you rather than building your own, but it does mean that the tools have to work properly. This is especially critical for cryptographically-secure PRNGs - those are things you really do not want to be maintaining yourself if you can access a high-quality source of random data, but again, if the PRNG doesn't work, you're in deep trouble (see for example Yubico's broken PRNG chips on the Yubikey 4). Hardware PRNGs on the CPU itself were supposed to dramatically improve the state of random data provisioning, but when bugs like this hit, it shows the weakness of depending on the stack beneath.

By which time the next release comes out.

You can't win with Apple now.

Disk images don't work with Macs any more. Apple has forced us onto 'workflow-based' installations which are supposed to ensure firmware for all subsystems are installed as well, by running the OS installer every time. However, this is pretty time-consuming.

You really don't have 'complete control' of Macs any more. Apple do what they like with your hardware.

Well now, that's interesting. I include LibreOffice v5 with my standard install of Mojave. I ran a fresh install earlier this week just to test the upgrade, which worked. Only then did I try opening the applications. And LibreOffice v5 opened without a fuss. I read this article and tried downloading v6. Sure enough, I hit this exact issue. That's seriously inconsistent Apple. Thanks for the unnecessary grief.

No question that this idea would be pure hell on a cramped plane in cattle-class. There's even mention in the article that, yes, the plane can manage the flight, but even with a full fuel load they can't spare the weight of more passengers and cargo. It seems completely disconnected from the real world, which, okay, it's mostly science at this stage and looking at severe jet lag from such a long flight. The implication is that it's nowhere near ready for the masses and is a curiosity at best.

The most I've managed on a plane is a 12-hour flight from London to Hong Kong, and that's enough. Nobody will be able to afford beds on such a flight except the ultra-rich, and that's assuming you can sleep on planes at all (I can't). In an era where fossil fuel emissions are dangerously damaging the planet, this is also a strange time to unveil such a concept as we need to fly less. On the other hand, versus a a stopover flight, if you're flying this distance, doing it in one go is much more fuel-efficient as the plane spends far longer in the upper atmosphere reducing drag, and only burns take-off fuel once. But this isn't something that needs to be offered to the masses if there genuinely is a market for it.

Even if a 20-hour-long flight was completely harmless to both physical health and the environment, I cannot think of anything I would rather do less than sit in a tin can at 40,000 feet for that duration.

Agreed, I do and don't want to know what on earth Google was doing with /var that led to this situation in the first place...

Indeed, just the first page was enough for me. The OP made a simple point - that clearly-stated facts didn't add up, and the entire first page was either suggested workarounds or unrelated advice. Completely useless and not addressing the original point in the slightest. I don't blame him for his final post on the thread before ragequitting.

I think you have the wrong idea, I read nothing in the article about Greta criticising her own parents. Your quote itself even states the target - world leaders. Her argument is coherent and logical. She is not taking issues with being born, she is taking issues with world leaders making empty promises. I think she understands what she's saying.

Please read the article again.

As much as I admire Scott Adams as an insightful and intelligent cartoonist, I don't agree with his post here. The children who started the Extinction Rebellion were not, for the most part, 'scared into' their action by adults. They started this movement specifically because they learned that adults weren't doing anything. Adams' laissez-faire attitude in this post is exactly the reason why we're in this catastrophic spiral already - nobody is taking any action, there are comforting news reports of new technologies or tree-planting drives, but the overarching truth is that the climate is changing, and rapidly. There is reason to be scared enough to actually do something.

Edit: I would argue this is the single most wrong thing I have ever read:

Throughout all modern history, when we humans see a problem coming from far away, we have a 100% success rate in solving it.

No, no we really don't. We have a 100% success rate of slapping bandages on broken legs, of being forced into literal do-or-die scenarios before we act in a mildly positive manner. No amount of foresight has ever overcome human stubbornness or stupidity. Both level-7 nuclear disasters had causes known years in advance but were hushed up. We will turn blind eyes to hideous pollution and environmental disaster, to miles and miles of documented scientific evidence, in the name of short-term profit. That is our success rate. And the buck stops with the millenial generation.

He talks about 'informed adults' currently making rational decisions but he himself is not a climate scientist, of which there are a large number, screaming from the rooftops that we need action. CO2 levels are too high. We must do everything we can right now before the spiral is too strong to break out of. Laissez-faire is the worst thing we can do. He's right about nuclear technology and its safety (just about; Fukushima may have happened in 2011 but the plant was 40 years old at the time). It's not profitable to roll back all the stuff generations have invested billions and billions of dollars into - oil, coal, cars, global shipping - so the adults in charge are hesitant and frequently outright hostile to the idea. That's why Greta Thunberg had to make a stand, and that's why others stand with her.

Mr. Adams, if you read this, I wonder if you have become like your characters who are too numbed by the absurdity of their situation to believe they need to do anything about it. And just like your setting, this isn't going to get any better if we all stand around thinking it will.

I'm guessing they have had to deal with DDoS attacks a lot, and as a sysadmin I can sympathise with their frustrations - it doesn't just affect the person fleeing to them, it affects their entire hosting platform, their other customers, and ultimately them getting paid for hosting those other customers. They're probably sick of it, which explains the drastic action. I can understand why they would threaten this if they've had to ride through multiple attacks, especially if it appears someone under fire is using them for 'cheap DDoS mitigation' when it's specifically a service they don't offer.

Okay, fair point. I can only assume they would only do this for persistent and malicious violation of the rules; it's a pretty good incentive not to do anything nasty with them if they can lock you globally out of your zone for a year. In fairness, so could any other provider if they so chose. As a registrar, I can guess the amount of abuse they have to deal with (spam domains, illegal content etc.) is high enough that they're pretty tired of dealing with it, so they take the Roosevelt approach:

Speak softly, and carry a big stick.

Again, I don't agree with this approach personally if it affected me, but I do understand it from a business POV. Letting the customer know in advance that they do have this power will weed out the ones who are most likely to fall into it.

It does indeed go beyond a suspension, it's a ban, and that's why I equate it to Amazon and Google blocking any new accounts - they are banning you from their platform, arguably for life. At least EasyDNS offer it to be 12 months.

I'm no DNS expert, but AFAIK, you can transfer the zone to another provider (one that you don't violate the T&Cs with) and from there you could conceivably regain control over the domain.

Many platforms (e.g. Amazon, Google) will block your account without warning and any new ones you create trying to get back into their platform, and defend their behaviour with generic 'violation of T&Cs' statements to kick you off their platforms permanently. I'm not condoning this behaviour, but at least EasyDNS spell this out plainly. And since DNS is their core product, the mechanism makes sense.

Personally I'll take a blunt 'no, we won't tolerate this' over a load of hot air. Get to the point and let's move on. This gets my approval.

The out-of-network stuff is the most insane part of the American health system. No question, it's deliberately set up to trip up those who need urgent care. There are plenty of stories of people who go out of their way to find an in-network hospital to have surgery with an in-network surgeon, only to be billed for the anaesthesiologist who is out of network - something they cannot object to because they're being put under. Even if they could ask, what choice do they have - take the surgery while awake? So beautifully set up to screw over the patient.

It's often said that health is a highly profitable business in America. And yet it is astonishing how feverishly the average Joe will fight against free healthcare because those who make the profits have convinced them it's bad for them. Look at any country with nationalised healthcare; none of us in the UK have a bad word to say about paying for the NHS through National Insurance if it means we can walk into any GP's surgery or hospital and never need to worry about money or insurance.

In the best possible way I hope the system breaks completely and it has to be rebuilt from the ground up. Maybe then some semblance of fairness can creep in.

Very. Which is why the NSC was built to isolate it for at least 100 years (presumably it will be reinforced regularly by successive generations). Nothing we can do except allow it to decay to safe levels over time.

It doesn't, but after the disaster, the basement areas were eventually filled with a lot more concrete. It's not just the very thick concrete pad between it and the groundwater, and it no longer generates enough heat to threaten to melt through.

I think I disagree here; the only positive I can see to price gouging is that it might act as an encouragement to those who might otherwise stay in harm's way to quickly get the heck outta Dodge. Price gouging may well be the clearest illustration of the laws of supply & demand, but they are still exploitative. There is no need to double the price on something that's in demand to ensure supplies from elsewhere come in; stores have supply chains and logistics networks. They can figure out in seconds where vital things are being bought up. They can predict trends and know what's going to be in demand. There is absolutely no need to send prices through the roof.

If Shepperson was really trying to help, he would have offered those $500 generators for the cost of shipping (divided by 19 generators) plus a modest profit. Double the price is exploitation, pure and simple, and is a nice thing to have the government protect consumers from. Doesn't matter that there were people willing to pay his asking price; in times of crisis, there should be no need for those people to be that desperate. Making money off the backs of those not in a position to argue? No morals, IMO. But then, that's capitalism, isn't it...

See also: Pascal's Wager[1]

The leaks about mass-surveillance don't fit the criteria, as best I can tell. It's in their best interests not to, as you state.

[1]https://en.wikipedia.org/wiki/Pascal%27s_wager

Work:

Laptop model: Dell Precision M3520

CPU: i7 7820HQ 2.9GHz

RAM: 32GB DDR4 (upgradeable)

Screen: 15" 1920x1080 matte

Comments: If you want something fast to get work done on, I cannot fault this machine. The keyboard is great, the chassis is a good size, shape and weight (I like "traditional" laptop designs), screen is very readable, touchpad works well, hardware is expandable (HDD, SSD, RAM and wifi card), has lots of ports (3x USB3 A, HDMI, Thunderbolt 3 USB-C, ethernet, even has a VGA port!). Battery life on the Intel GPU is 4-5 hours, which is good for the power it packs, and drastically lower on the nVidia Quadro card (I keep it set on the Intel since I don't need graphics performance). I run Ubuntu 18.04 on it with the Cinnamon desktop environment. I use almost every feature of this laptop on a daily basis. The only thing I dislike is the pointing stick, which is oversensitive and not adjustable, so I ignore it.

---

Personal:

Laptop model: Clevo P641RE

CPU: i7 6700HQ 2.6GHz

RAM: 16GB DDR4 (upgradeable)

Screen: 14" 1920x1080 matte

Comments: powerful, compact and extremely expandable, but perhaps too far down the 'power is everything' route. Battery lasts 1 hour on the nVidia Geforce 970m GPU even at idle, and 2 days in sleep mode. Doesn't work on planes (fires up and clicks off, even with the battery charged). 4x USB3.0 ports, HDMI, ethernet, 2x DisplayPort. Awful keyboard (requires very firm presses), passable trackpad. Good screen. Spec'd to be powerful enough to last me ~5 years. Also runs Ubuntu 18.04 with Cinnamon. Has a SATA SSD for primary and smaller NVMe disk for Steam. 10/10 performance, 5/10 usability.

Laptop model: MacBook Pro Retina 2014 15"

CPU: i7 4870HQ 2.5GHz

RAM: 16GB DDR3 (soldered)

Screen: Retina 15" glossy (2880x1800)

Comments: Extremely portable, sturdy and usable. Great keyboard, touchpad and extremely nice screen. Fantastic battery life for its age. Decent ports (2 USB3.0, HDMI, 2 Thunderbolt 2). Lightweight, portable and fast. Has MagSafe power. Gets very hot in use and the metal case is not suitable as a laptop. MacOS GPU switching works very well. Runs Mac OS 10.14. Crippled by Mac OS restrictions and inability to upgrade parts (RAM, SSD is proprietary, battery is glued in) plus limited expansion (nobody got behind Thunderbolt 2, did they?). Probably Apple's most balanced and usable offering ever.

Sure, correcting typos, I wouldn't hold that against them. However, when they intentionally scratch out search terms for no apparent reason and show extremely vague matches, it's completely useless. I was searching for a specific error message that was causing my MacBook to freeze on login. Instead, the only two terms Google preserved were 'mac os'. First result was Apple's own page on the OS. Every result was entirely useless. Fine, if there's no actual result for this error message, tell me, but don't make me scan through a page full of irrelevant links and make me figure out myself why they're irrelevant.