Most active commenters
  • saagarjha(5)
  • pjmlp(3)

←back to thread

MacOS Catalina: Slow by Design?

(sigpipe.macromates.com)
2031 points jrk | 11 comments | 22 May 20 15:39 UTC | HN request time: 1.25s | source | bottom
Show context
brendangregg ◴[22 May 20 22:34 UTC] No.23277837[source]▶
Adding network calls to syscalls like exec() is utterly insane. This road can lead to bricked laptops where you can't run anything to fix it (imagine an unexpected network error that the code doesn't handle properly). And crackers will just use ways to overwrite running instruction text to avoid the exec().

The comments on the article are annoying: it good that there's a mini way to reproduce, but please, use some further debugging like tcpdump (it still exists on osx, right?). Last time I summarized osx debugging was https://www.slideshare.net/brendangregg/analyzing-os-x-syste...

I'd also stress test it: generate scripts in a loop that include random numbers and execute them.

replies(5): >>23278280 #>>23279465 #>>23279751 #>>23279958 #>>23303509 #
xvector ◴[22 May 20 23:28 UTC] No.23278280[source]▶
There is no excuse for this except for sheer, utter incompetence. Everyone involved in writing and shipping this should be ashamed of themselves.
replies(3): >>23278582 #>>23278927 #>>23279035 #
drvdevd ◴[23 May 20 01:17 UTC] No.23278927[source]▶
This is what I scrolled all the way down this thread for - to see if anyone thinks this is a good design/security decision on Apples part. I’m trying to understand what the reasoning is for this particular decision and if it actually makes the OS more secure in any meaningful way? Or does it actually- just degrade performance with very limited benefits? Are there any real benefits to this VS current security design in popular Desktop Linux distros at this point?
replies(2): >>23279051 #>>23279476 #
saagarjha ◴[23 May 20 03:02 UTC] No.23279476[source]▶
It checks that executables have been notarized by Apple? I can't say I really think notarization is great, but I think it's clear from their perspective how it would be beneficial?
replies(1): >>23279758 #
1. drvdevd ◴[23 May 20 03:53 UTC] No.23279758[source]▶
Sure. But as Brendan Gregg pointed out in his comment - doing this at the level of exec() on a UNIX-like OS is ... a questionable technical choice to say the least.

What’s the Linux equivalent of “notarization”? I’m not sure. Of course there’s probably more than one answer to that - let’s just taking signing packages as an example.

In theory Apple could put their weight behind vetting some of the popular open source packages perhaps? Or delegate that to the maintainers of those repositories and make them trusted? Like homebrew, for example (maybe a poor example, but you see how I’m trying to compare this with Linux...)

This is after all, what actually makes macOS useful to people on the command line 99% of the time, anyway.

So anyway, I agree on the surface it seems like this might be beneficial to Apple, but it doesn’t appear to be well considered.

They could invest more time in better sandbox and/or container type features that let people define some of their own more granular security boundaries. But they aren’t I guess? What are they doing here?

replies(2): >>23280794 #>>23280841 #
2. john_alan ◴[23 May 20 07:35 UTC] No.23280794[source]▶
Watching the notarization video from WWDC last year they explicitly said it wouldn’t affect command line apps.
replies(1): >>23281271 #
3. pjmlp ◴[23 May 20 07:42 UTC] No.23280841[source]▶
Apple OSes never were about CLI, pre-OS X you didn't have a CLI as standard OS feature.

Selling UNIX underpinning was just a marketing move for willing to betray GNU/Linux and BSD in name of a better laptop experience, instead of helping OEMs selling their stuff.

Something that NeXT also did against the Sun workstations market.

On Linux side of the this kind of security measures never work, because the moment someone introduces something like this, the distribution gets forked.

It works on ChromeOS and Android, because it hardly matters to userspace that Linux is the actual kernel, Google could embark (and it is actually) in a kernel replacement project and most stuff would just work.

replies(1): >>23281269 #
4. saagarjha ◴[23 May 20 08:50 UTC] No.23281269[source]▶
I'm not sure I particularly appreciate your use of the word "betray" for the BSDs. Sure, macOS is not really a great adherent to the GNU philosophy, but for the BSDs it actually did fairly well for a while. (It's still true UNIX, if barely.)
replies(1): >>23281346 #
5. saagarjha ◴[23 May 20 08:50 UTC] No.23281271[source]▶
I believe that some of the problems here have actually started affecting command line apps in Catalina.
replies(1): >>23281832 #
6. pjmlp ◴[23 May 20 09:03 UTC] No.23281346{3}[source]▶
Take as you wish, if those users were actually supportive of the BSDs, they would be giving their hard earned cash directly to OEMs selling proper FreeBSD, OpenBSD, NetBSD, DragonFly based devices.

One cannot give the money instead to Apple and then come back complain that they were mislead.

NeXTSTEP was also a true UNIX, that wasn't why most business bought it, rather Renderman and other graphical based tooling.

I have used Apple platforms on and off since the LC II days, their commercial view was always quite clear to me.

replies(2): >>23281454 #>>23285252 #
7. saagarjha ◴[23 May 20 09:19 UTC] No.23281454{4}[source]▶
I am actually curious who sells BSD hardware these days.
replies(1): >>23281536 #
8. pjmlp ◴[23 May 20 09:37 UTC] No.23281536{5}[source]▶
Examples from Germany,

https://www.tuxedocomputers.com/

They do GNU/Linux, but BSDs should probably work on their hardware, as mentioned on this old post (sorry in German).

https://www.tuxedocomputers.com/de/Infos/News/OpenBSD-6-3-cu...

Or by getting in touch with companies like os-cillation.

https://www.os-cillation.de/en/opensourceprojekte/bsd-specia...

replies(1): >>23282018 #
9. john_alan ◴[23 May 20 10:40 UTC] No.23281832{3}[source]▶
Only if you don't specify your terminal as a dev tool
10. saagarjha ◴[23 May 20 11:18 UTC] No.23282018{6}[source]▶
Thanks for the links. I probably won’t be buying any of those soon, but they looked surprisingly beefy for the price point. As an aside, the immature part of me giggled a bit to see the German for product dimensions:

> max 1,65cm dick

11. trasz ◴[23 May 20 18:33 UTC] No.23285252{4}[source]▶
The problem with BSD on the desktop isn’t the BSD, it’s the desktop. Open Source desktop environments are still ages behind OSX.