Hacker Newsnew | past | comments | ask | show | jobs | submit | oneplane's commentslogin

I think the comment mainly pointed out the distinction between education using digital methods, vs. educating about digital things.

Only if you boot into macOS and connect it to the internet. iBoot2 never changes by itself, you, the user, decides if you want to boot into recovery or macOS and run an update.

So can Apple stop signing new iBoot2 versions? Sure! And that sucks. But it's a bit of FUD to claim that Apple at arbitrary points in time is going to brick your laptop with no option for you to prevent that.

Granted, if you boot both macOS and Asahi, then yes, you are in this predicament, but again, that is a choice. You can never connect macOS or recovery to the internet, or never boot them.


> You can never connect macOS or recovery to the internet, or never boot them

In other words, you're completely fucked if you brick your install. I consider iBoot a direct user-hostile downgrade from UEFI for this reason.

YMMV, but I would never trust my day-to-day on an iBoot machine. UEFI has no such limitations, and Apple is well-known for making controversial choices in OTA updates that users have no alternative to.


> In other words, you're completely fucked if you brick your install. I consider iBoot a direct user-hostile downgrade from UEFI for this reason.

That's a bit of a creative perspective, isn't it? You have no control over the UEFI implementation of your vendor, same can be said for AGESA and ME, as well as any FSP/BSP/BUP packages, BROM signatures or eFused CPUs. And on top of that, you'll have preloaded certificates (usually from Microsoft) that will expire at some point, and when they do and the vendor doesn't replace them, the machine might never boot again (in a UEFI configuration where SecureBoot cannot be disabled as was the case in this Fujitsu - that took a firmware upgrade that the vendor had to supply, which is the exception rather than the rule). For DIY builds this tends to be better, Framework also makes this a tad more reliable.

If anything, most OEM UEFI implementations come with a (x509) timer that when expires, bricks your machine. iBoot2 is just a bunch of files (including the signed boot policy) you can copy and keep around, forever, no lifetimer.

Now, if we wanted to escape all this, your only option is to either get really old hardware, or get non-x86 hardware that isn't Apple M-series or IBM. That means you're pretty much stuck with low-end ARM and lower-end RISC-V, unless you accept AGESA or Intel ME at which point coreboot becomes viable.


Basically your counterpoint is that I'm absolutely right to be concerned, but I'm wrong because UEFI can also be implemented with the same objectionable backdoors that Apple implements.

We're done here, have a nice day.


It's not a counterpoint, it's a display of your factually incorrect statement.


except apple silicon notebooks are notably unbrickable[0]? you can always do https://docs.fedoraproject.org/en-US/fedora-asahi-remix/trou...

[0](through any user-accessible software action, obviously)


Gee, another "we did not need cloud, so by not using cloud, we stopped spending on something we did not need"-story. Duh. The real story is why someone who doesn't need cloud services starts using them anyway.

If you need it, use it, if you don't need it, don't use it. It's not the big revelation people seem to think it is.


You don't need the root account, unless you need to bypass all policies. In such a scenario, you a use the root access reset flow instead, reducing standing access.

As for other flows (break glass, non-SSO etc), that can all be handled using IAM users. You'd normally use SAML to assume a role, but when SSO is down you'd use your fallback IAM user and then assume the role you need.

As for how you disable the root account: solo accounts can't, but you can still prevent use/mis-use by setting a random long password and not writing it down anywhere. In an Org, the org can disable root on member accounts.


To me that sounds like security by obscurity not actual security.

If you have the ability to go through the reset flow than then why is that much different than the username and password being available to a limited sets of users. That would not have prevented this from happening if the determination was made that all 3 of these users need the ability to possibly get into root.

As far as having an IAM user, I fail to see how that is actually that much better. You still have a user sitting there with long running credentials that need to be saved somewhere that is outside of how you normally access AWS. Meaning it is also something that could be easily missed if someone left.

Sure yes you could argue that the root user and that IAM user would have drastically different permissions, but the core problem would still exist.

But then you are adding another account(s) on top of the root account that must exist that you now need to worry about.

Regardless of the option you take, the root of the problem they had was 2fold. Not only did they not have alerts on the usage of the root account (which they would still need if they switched to having long running IAM users instead, but now they would also need to monitor root since that reset flow exists) and their offboarding workflow did not properly rotate that password, which a similar problem would also exist with a long running IAM user to delete that account.

At the end of the day there is not a perfect solution to this problem, but I think just saying that you would never use root is ignoring several other issues that don't go away just by not using root.


Not using root means not bypassing policies. There is no way to not bypass all policies. So yes, never using root makes that issue go away completely.

As for all the other stuff: what it does is it creates distinct identities with distinct credentials and distinct policies. It means that there is no multi-party rotation requires, you can nuke the identity and credentials of a specific person and be done with it. So again, a real solution to a real problem.


It solved “a” problem buy not “the” problem.

It depends on what the goal of all of this was, which is unclear. If the goal was simply to get the data that they originally wanted it does not solve that problem and it would have just happened a different way.

According to the article there was 11 days between the first actions taken and them finding out it happened.

If instead of a root account you have a long running IAM user that you can then assume into the role you normally use through SSO. If you also do not monitor that account with proper alerts and proper offboarding procedures than they could have logged into that account and retrieved the data they wanted.

Which again is the reason I am saying they just saying not using root is not a magic bullet that would have avoided problems. Maybe the situation would have been different but they still could have done a lot in 11 days.


The problem was that the user's credentials were revoked but because the root account was a shared credential it wasn't revoked. Was the break-glass account also a user-specific account, it would have fit in with any 'revoke anything for user XYZ' workflow instead of being a root account edge-case.

So, in short, this would likely have prevented this, as the normal off boarding for user-bound credentials worked out fine already.


Resetting the root password requires proving access to the email address associated with the root account. It also leaves a massive papertrail.


By "massive papertrail" do you mean "a pair of emails to the associated address"?


No, a massive amount of CloudTrail logs.


Does it? Pretty sure that logging in as root generates one cloudtrail per action, regardless of whether or not you did it with a saved password or you reset the password. Resetting the password doesn't generate a cloudtrail event as far as I've seen.


This is just a Windows VM with extra tooling. Makes it look slick, doesn't make it "Windows apps on Linux".

Similar projects exist for gaming for example Looking Glass, which also uses a Windows VM on KVM (the "Windows in Docker" thing is a bit of a lie, Windows doesn't run in the container, Windows runs on KVM on the host kernel).

UX wise, this is similar to RAIL.

That's not to say that this isn't neat, but it's also not something new (we still have two flavours: API simulation/re-implementation and running the OS [windows]). If this was a new, third flavour, that would be quite the news (in-place ABI translation?).


And I had to come here to find out what it actually was. Why don't project pages ever actually tell you what it is, what it does and how it does it?

Half the time it's something like "Plorglewurzle leverages your big data block chain to provide sublinear microservices to Azure Cloud infrastructures"

At least this one kind of shows you having to install Windows.


I call this the "marketing website problem".

Unfortunately many companies have realized that engineers don't make purchasing decisions. (Mearly suggestions) Rather, C-Suite, who knows nothing about the technical side of things, and everything about the buzzword side, makes the decisions. As a result, companies know that if they just throw a bunch of inflated marketing mumbo-jumbo at the user, while it will turn off every engineer asking "WTF does this actually do and how does it work", some C-Suite will run out and purchase it without asking, then force their entire team to use it because it "produces synergy of the AI block chain and big data cloud APIs while enhancing productivity". Then us Engineers are stuck using it, whether we wanted it or not.


Agree. Have even seen too many companies whose main product completely avoids such questions. I don’t get it.

Must be why I’m not wealthy. I always figured one would have to show people a reason why they should give boat loads of money…


> Must be why I’m not wealthy. I always figured one would have to show people a reason why they should give boat loads of money…

This one hit hard. It turns out Phineas Barnum was right this whole time.


> Why don't project pages ever actually tell you what it is

If it's a good thing with substance, they do.

If they don't, don't use it. This usually hints at a broken culture/missing substance. It _can_ also be ineptitude, but that too is not your problem but theirs.

You woke up this morning not having the problem this sets out to solve. You can go to sleep and rest easily this night, knowing that you still don't have whatever problem this sets out to solve.

If you should one day wake up and notice that you have a problem this could solve, you will find yourself googling for a solution, again side-stepping this whole marketing nonsense.


Agreed, a lot of product pages read like Rick & Morty's interdimensional cable.


I was complaining about this sort of thing in another thread.


Missed opportunity to call it "Linux Subsystem for Windows", or LSW in short.


I think this name would be confusing. For one - it is for linux, not windows.And it is a subsystem running Windows. So, it should be called Windows Subsystem for Linux, or WSL.


You might be missing context here.

There is a feature of Windows called “Windows Subsystem for Linux (WSL)” already that basically does the inverse of this (windows host, Linux VM).

https://github.com/microsoft/WSL

The feature is a windows subsystem (for running Linux).


I think this may be a woosh moment where they're saying the Microsoft version should be called LSW because it's for Windows. Probably sounds more obvious with a more sarcastic tone


The concept of a "subsystem" in Windows has evolved since the operating system's inception when Windows NT was designed to support multiple operating system environments through distinct subsystems. Win32 subsystem, which features case-insensitive filenames and device files in every directory, and the POSIX subsystem, which supports case-sensitive filenames and centralized device files: Windows subsystem, the Subsystem for Unix-based Applications (SUA), and the Native subsystem for kernel-mode code were the main subsystems at first.

/SUBSYSTEM linker switch was used to specify the target subsystem at compile time, enabling applications to be compiled for different environments such as console applications, EFI boot environments, or native system processes.

In this nomenclature, WSL follows the original naming conventions (although SUA should have been called WSUA).


Watch out. You are explaining serious stuff under a comment that was essentially "watch out, your parent comment was sarcasm".


Sure, but a little education is useful as background is often lost.


I do love this sort of nerd talk!


Except WSL doesn't actually use any of the nt subsystem machinery in either of its incarnations.

And also, it doesn't really follow that nomenclature. Those all follow "user code target" Subsystem. Windows Subsystem, OS/2 Subsystem, Posix Subsystem, etc.


WSL1 used pico processes/providers, system call translation, and directly used NT Kernel Executive. I hope they resurrect it someday in the future.


that's the joke!


Jokes are supposed to be funny.


Not everybody can afford a humour bypass, good surgeons are hard to come by.


If wine was LSW1 than this is LSW2


I think this is accurate. WSL v1 did not use a VM, just like Wine. However both WSL v1 and Wine struggled with compatibility issues. WSL 2 gave up and used a VM instead. You pay a performance penalty but compatibility issues mostly go away.


Well, I discrepe a lot with the "compatibility issues" of Wine... Essentially when sometimes can run better and with less issues legacy software that modern Windows.


Example: My company uses MS Teams for meetings. Wine cannot run it reliably.


Counter example: my windows 10 machine can't play my copy of crysis, but my Ubuntu machine can under wine.


To be fair. Neither can my MacBook, and that is an official release.


It's literally just dockur/windows:latest + FreeRDP rootless mode + a small daemon that runs in the VM that tells you what apps are installed via an API.

If you don't want the latter part, you'd be better served with the dockur/windows image + FreeRDP


I believe Cassowary (https://github.com/casualsnek/cassowary) is an older tool that does pretty much this.

My experience with it is that FreeRDP in rootless mode isn't very good for Windows applications that do anything special with window borders. Using Office and many other programs became a pain.

When it worked, it worked really well, though. Reminds me of the same feature that VMWare used to offer many years ago for running XP/Vista programs on Windows 7 through a VM.


can you do "pass a single window" with freeRDP? I haven't actually seen that before so forgive me for asking.

This project looks like it does that, but I could be wrong.


Yes, it's rootless mode. FreeRDP only works with X11, so it runs in Xwayland and the integration isn't as smooth as it could be.

It's reminiscent of rootless mode in Parallels, just as janky, too.


This is incorrect. FreeRDP has supported Wayland since a long time via their `wlfreerdp` client - which is now deprecated, Wayland support is now available via their `sdl3-freerdp` client. The SDL client was alpha quality a couple of years ago, but as of the last couple of recent releases, it's been pretty decent. I'm unsure though if its reached full feature parity yet with the X11 client.


Thanks for pointing this out, you have just made my life easier


Spoke a little too soon, can't seem to get rootless mode working with sdl-freerdp3 in the latest kwin_wayland, but desktop mode works


> can you do "pass a single window" with freeRDP?

That's what "rootless" mode does.


and with MS making sure you have to sign in with a MS account... i dont really see the point of this.


> MS making sure you have to sign in with a MS account

if you are capable of running linux, you're capable of working out the various ways to bypass that sign-in "requirement".


But if using hello@example.com as the email, and using F10 and oobe or whateve command you pulled off Google stop working, and then you have to move to more exotic options, like downloading programs to modify disk images to prepare a USB drive to install an LTSP or IoT copy of windows 10 it's all just such a waste of time to do something that should be easy all because someone at Microsoft got on this kick that what they want is more important than what the customer wants. It's so frustrating!


You basically need to do that anyway, because defaults are janky.


As a non-coder/engineer Linux user…I’ll admit that’s actually not obvious to me. Linux is trivially easy to run these days.

I could probably drop my dad in Mint and he’d assume windows just looks different. Maybe that’s a tad facetious but also ehhhh I could maybe get away with it


Only the home version has that issue.


Exactly the same thing of WSL2


In-place ABI translation is how wine works, what do you mean?


You don't need to be in the Apple ecosystem to buy an Apple TV and only use non-Apple services.

The only thing that will probably suck is the lack of things like MiraCast and Google's Casting stuff, but you could use third party AirPlay software (still free IIRC) to stream whatever you want if you want to use screen mirroring.

These days people tend to use their media boxes as App Launchers for other services anyway, so it doesn't really matter that much anymore.


Yeah, the Apple TV would be my suggestion as well even if it's your only Apple device. Other than streaming service apps (Netflix, Hulu, etc...) I think the only app I've installed is Tailscale. It's a great device that is slightly more privacy respecting than similar devices from Roku or Smart TV manufacturers.

I've never owned a Mac before but now I'm thinking about getting one just so I can write software to run on my Apple TV. It's a pretty powerful computer that's tiny, silent, always on, barely uses any power, and is connected to my TV.


As a tip: the VLC app for Apple TV is incredibly useful. It can play video files (in essentially any format) from local network shares.


I use Plex for that and it works great.

I'm going to check out VLC though. Thanks for the tip.

One other app that I had and forgot about is some remote play client for Steam. I start Steam on my desktop PC then pair my PS5 remote to the Apple TV, start the Steam tvOS app, and I can play games from my PC on the Apple TV.


If the long-lived token is actually a private key that is non-retrievable and the secrecy and origin is attested by a HSM, I'm fine with that.


It's not withholding, it's just not part of the AppStore if you do it. There are plenty of other ways to distribute your software, and yes, Apple will also still co-sign it or provide entitlements if you need those. Just not in the AppStore.


That seems like an unnecessary and unreasonable trade barrier. There isn't a technical or user-experience reason to exclude these sorts of apps.


That's not the argument; the argument is that this would be some form of "there is only one method and it is being withheld", which simply isn't the case.


It's not sudden, the account owner disappeared and the account user (the one making all the noise) did not get ownership transferred.

Is this a great situation? No. It's also not "I did everything right and boo hoo AWS did a boo boo". AWS is not your friend, but you also weren't the customer, that was the middleman you gave ownership to.


That does not appear to be an accurate representation of the story linked in the article[1]. There was no middle man. What are you referring to?

[1] https://www.seuros.com/blog/aws-deleted-my-10-year-account-w...


The article says so:

> AWS blamed the termination on a “third-party payer” issue. An AWS consultant who’d been covering my bills disappeared, citing losses from the FTX collapse. The arrangement had worked fine for almost a year—about $200/month for my testing infrastructure.

He essentially got screwed over by the consultant. Everything else is a side-effect but not material to the cause.


Immediately after that it clearly states there was an alternate payment on file, and the termination was not handled like a payment issue.


AWS has no such thing. It also is not an alternate either way since the owner of the first payment method would have this in an MPA, not in a member account, and in AWS, member accounts are not considered payers and any payment methods are ignored.

The article makes a variety of claims, some of which can be dismissed because they factually do not exist with AWS, and some of which cannot be verified at all. But precedent shows that when your middleman in a savings scheme drops out, you are screwed, and that is what happened here.

That doesn't make this fun, and it would be better if everyone had a personal account manager, but that's not the reality of today.


Both are legacy dinosaurs, it makes sense they start eating each other.


Palo Alto is a legacy dinosaur? Pretty sure they are the current market leader in both firewalls and SOAR.


There are market leaders in everything from DSL modems to tape drives. Most companies in 2025 don't own hardware firewalls. You're proving his point.


> Most companies in 2025 don't own hardware firewalls. You're proving his point.

Then all the posts I see in /r/networking about which firewall product is recommended are figments of my imaginations? (The consensus recommendations are PA if you have the money, Fortigate if you don't.)


Firewall is a dead end was evident by the low growth of palo alto in this segment. Nikesh him self mentioned it multiple times. Market is very saturated. All these companies which still buy are looking at refreshing their existing firewalls stock.


> All these companies which still buy are looking at refreshing their existing firewalls stock.

Companies looking to refresh firewalls with more firewalls contradicts the statement "Most companies in 2025 don't own hardware firewalls.".

If most companies don't own them, what are they replacing?


Are you thinking of Cisco or Juniper? Please link me to where Palo Alto sells DSL modems or Tape Drives.


I did not say they are; I said there are.


Doh, my bad.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: