• 1 Post
  • 550 Comments
Joined 3 years ago
cake
Cake day: July 31st, 2023

help-circle





  • “But that’s unenforceable”, some will claim.

    And to that, let me remind us all of a little-known concept called cryptographic attestation. If that doesn’t ring any bells, then the term “secure boot” should.

    Once this shit passes into law, that’s the next step. Operating system vendors have their private keys to sign attestation tokens saying “John Johnson is an adult” and you’re only getting one if you verify your government ID. When you go to a website, your browser sends your signed token to the website and then the website checks if it’s a valid token signed by Microsoft, Apple, or Google.

    But Linux?, you may be wondering. No. No Linux. Kiss it good-bye. Your bank will “require” identity attestation for “extra security”, and your bank doesn’t give a fuck about Linux. Your bank will check against whatever list of public keys they want to trust, and it ain’t going to include anything not backed by a global megacorporation.





  • It’s not. They both expose a POSIX API and userspace, but the underlying architecture is very different. macOS is in part based on the Mach microkernel, and creating a process has a bunch of work related to that.

    Even ignoring that difference, macOS has built-in signature checking that suspends a newly-started process the first time its executable is seen.