[HN Gopher] Sonoma's log gets briefer and more secretive
       ___________________________________________________________________
        
       Sonoma's log gets briefer and more secretive
        
       Author : ingve
       Score  : 204 points
       Date   : 2023-10-07 12:59 UTC (1 days ago)
        
 (HTM) web link (eclecticlight.co)
 (TXT) w3m dump (eclecticlight.co)
        
       | dangus wrote:
       | Given that Apple already had a way to unhide the private info,
       | and that we are on the .0 release, this _could_ just be a bug. It
       | could be a new thing going in the log that isn't working right.
       | 
       | Also, I can see why ShareKit has potential to contain very
       | private info. I don't know that I'd love for my computer to save
       | a list of share sheet activity in plain text.
       | 
       | > If you used Macs before Sierra, chances are that you were happy
       | to browse their logs when necessary
       | 
       | Citation needed, I say chances are 99% of Mac owners have never
       | opened system logs.
        
         | throwaway290 wrote:
         | > chances are 99% of Mac owners have never opened system logs.
         | 
         | Because on a Mac it's not necessary in 99% cases
        
           | ranger207 wrote:
           | Yeah this is the Apple philosophy in a nutshell: it works
           | >99% of the time, when it doesn't work you're holding it
           | wrong
        
       | e28eta wrote:
       | The log censorship _has_ to be because sketchy / malicious apps
       | are reading private data from the log. And it seems pretty
       | obvious that the greater good is achieved by blocking that
       | personal data.
       | 
       | As a user, I certainly wish there was a logging level / filter /
       | setting of "things that are broken that you can do something
       | about", along with the ability to dig into the underlying trace
       | data that helps you better understand details about the problem.
       | But I think it's pretty clear to everyone that's not the user
       | that Apple is solving for. Even if you did have a clear bug &
       | root cause, good luck getting it acknowledged & fixed through
       | their public-facing bug tracker.
        
         | lapcat wrote:
         | > The log censorship _has_ to be because sketchy / malicious
         | apps are reading private data from the log.
         | 
         | No, they aren't: "Currently, the only way to see unmasked log
         | entries is through a special profile."
        
           | zshrc wrote:
           | These profiles are provided by Apple for the explicit use of
           | debugging... what makes you think bad faith actors wouldn't
           | take advantage of harvesting such juicy data? Especially at
           | the verbose rate macOS provides...
        
             | lapcat wrote:
             | (1) Very few Mac users have installed the private log
             | debugging profile.
             | 
             | (2) The number of Mac users who have both installed the
             | private log debugging profile and also installed malware
             | without knowing it is vanishingly small.
             | 
             | (3) People mostly use the profile temporarily and then
             | uninstall it, so even in the vanishingly small number of
             | cases, the window of opportunity is a lot smaller.
             | 
             | It would be a lot of effort for no return. Bad faith actors
             | are looking for easy, plentiful targets. Expert users who
             | comb the logs are the opposite of that.
             | 
             | In fact, it's a great deal of effort to find useful
             | information in the logs even for good faith actors looking
             | at their own machines, because of the loquaciousness of the
             | OS.
        
               | hirsin wrote:
               | > Bad faith actors are looking for easy, plentiful
               | targets
               | 
               | Citation needed, especially when we know that spear
               | phishing is the simplest of the known exceptions to this.
               | I.e. https://news.ycombinator.com/item?id=37720580
        
               | alpaca128 wrote:
               | Have you ever looked into the average email inbox? 99% of
               | bad actors are simply casting a net as wide as they can
               | to find the most gullible people. Targeted, specialized
               | attacks are rare.
        
               | dspillett wrote:
               | _> Targeted, specialized attacks are rare._
               | 
               | But people basing their routines around the assumption
               | that it won't happen to them, is why some notable attacks
               | have succeeded.
               | 
               | Obviously you need to base your practises around your own
               | risk profile and their will be a point of limited
               | likelihood of useful return on effort that will be
               | different for different people/organisations, but some
               | _should_ be paranoid enough to worry about that other 1%
               | of attempts.
        
               | lapcat wrote:
               | How exactly is a bad faith actor going to spearfish
               | [people who have temporarily installed the Apple private
               | logging profile]? And why? What exactly do people like
               | Howard, the article author, and me have in our private
               | debugging logs that's interesting, useful, and worth
               | spearfishing specifically people like us?
               | 
               | Keep in mind, crucially, that the aerospace employees
               | were _publicly known_ via LinkedIn to be aerospace
               | employees. How is it publicly known who has temporarily
               | installed the Apple private logging profile? Who besides
               | the article author would even announce that publicly?
               | Also, the value of hacking an aerospace company is known.
               | 
               | You can come up with any conspiracy theory you like, but
               | the level of plausibility in this case is nonexistent.
        
           | j16sdiz wrote:
           | Those profiles need user interaction to enable. (unless that
           | is a enterprise managed device)
        
         | saagarjha wrote:
         | Nope, it's so when you send them a sysdiagnose it doesn't
         | obviously contain your email and your entire browsing history
        
       | zappb wrote:
       | Pretty sure this is privacy related. Just enable more verbose
       | logging to see all your personal details in said logs again.
        
         | lapcat wrote:
         | > Pretty sure this is privacy related.
         | 
         | Under the section heading "Privacy", the author wrote:
         | "Censorship to maintain privacy is an important feature in the
         | Unified log, and is responsible for so many of its entries
         | being peppered with <private> instead of revealing potentially
         | sensitive data."
         | 
         | So yes, this is privacy-related.
         | 
         | > Just enable more verbose logging to see all your personal
         | details in said logs again.
         | 
         | From the article:
         | 
         | "Apple has now decided that some log content is too private to
         | reveal even when privacy has been removed. I came across this
         | recently..."
         | 
         | "Of course, it may be possible to turn this additional privacy
         | off, but the documentation leads us once again to a guessing
         | game."
        
           | bastawhiz wrote:
           | > Apple has now decided that some log content is too private
           | to reveal even when privacy has been removed. I came across
           | this recently...
           | 
           | If this is true then why is it being logged in the first
           | place? Logs probably aren't the right way to expose that
           | data.
        
             | fiddlerwoaroof wrote:
             | It's better to have one place to look for diagnostic
             | information. This sort of just-in-time masking seems
             | optimal to me.
        
               | bastawhiz wrote:
               | Diagnostic information shouldn't contain secrets. If you
               | need access to that, there are mechanisms to access it.
        
             | saagarjha wrote:
             | There are surely ways to make those show up as well.
        
               | bastawhiz wrote:
               | But you shouldn't! Could you log your DB creds to your
               | error logs for debugging? Sure! But they shouldn't go
               | there! If you need to check them, use the mechanism for
               | accessing creds.
        
       | xp84 wrote:
       | The big issue which the author mentioned, where Macs now spew
       | logs at a rate of thousands of messages per second is the real
       | WTF. I don't even have a problem with verbosity _per se,_ the Mac
       | logs are not only informing of events that have a severity level
       | of debug (such as "Woke from sleep due to network" or info, such
       | as "Display #1 was disconnected" - they're brimming with literal
       | errors. It's as though a few years ago they decided to simply
       | give up on having a stable OS which at least functioned
       | correctly, even on a clean install at idle. The logs make clear
       | that most components are full of uncaught exceptions that
       | apparently they don't even care about. It's weird that they don't
       | think this will eventually destabilize the whole system.
       | 
       | With that level of neglect among Apples system developers, the
       | logs may as well just be piped to /dev/null anyway, because ain't
       | nobody got time for digging through that volume of logs to
       | troubleshoot anything. It's a far cry from 10 years ago, when if
       | you were having something wonky happening, you could go right to
       | Console and find the whole story spelled out for you.
        
         | jjtheblunt wrote:
         | It doesn't say thousands of messages per second in general, but
         | adds "when loquacious" to imply when recording some aberrant
         | intense diagnostic info.
         | 
         | I mean you can check this pretty easily.
        
           | uoaei wrote:
           | You buying new Macbooks for everyone? Where do I sign up?
        
         | nneonneo wrote:
         | Developing on Android similarly drives me mad because of the
         | volume of garbage spewed in Logcat. Yes, you can filter, buy if
         | the problem is in an external component you might need to see
         | the full log - and then it's wading through MBs of random
         | errors, warnings, and other nonsense trying to figure out what
         | the relevant log bits actually are.
        
           | grishka wrote:
           | Samsung devices are especially bad with this in my
           | experience.
        
         | lazide wrote:
         | They've always been this way. Eventually the OS will get
         | noticeably shitty, then it will be embarrassing, then they'll
         | do a cleanup sprint and fix most of them.
        
           | cglong wrote:
           | IMO, the current dip in quality has been lasting a lot longer
           | than in previous iterations.
        
             | xctr94 wrote:
             | It used to be that even-numbered releases fixed bugs and
             | stabilized the OS, with notable features coming in odd-
             | numbered releases. Now they don't care. Unifying iOS and
             | macOS has become the goal, and probably some PMs are
             | getting nice promotions thanks to that. The golden
             | stability of macOS (a la Snow Leopard) is gone. Now I get
             | random reboots every other week, so I keep a tight Time
             | Machine schedule.
        
             | lazide wrote:
             | Agreed. I blame post-Covid burnout.
        
               | charrondev wrote:
               | I went through a period of burnout at my work during
               | Covid.
               | 
               | I was in Canada at the time though and our lockdowns
               | lasted through almost 2 years though (unlike many places
               | in the US that either did not do lockdowns at all, or did
               | only for a very short period).
               | 
               | For reference in Quebec the holiday periods in 2020 and
               | 2021 had restricted travel where you could be fined
               | thousands of dollars if you left your neighborhoods.
               | https://globalnews.ca/news/8474592/quebec-covid-
               | dec-26-2021
               | 
               | In any case during this time period of being stuck,
               | isolated and inside most of the year I had little else to
               | do but throw myself into my work. Today I have the same
               | job and a much healthier balance but that's mostly due to
               | a really good manager that noticed and helped me out.
        
               | ajmurmann wrote:
               | In my experience engineering teams usually always want to
               | fix issues like this. However, this typically come down
               | to something leading to either pressure to ship features
               | relenting and engineering being allowed to clean up debt
               | or awareness of quality issues increasing. Seems like
               | burnout would be a factor if Apple tried to fix it but
               | failed or took forever.
        
               | kandros wrote:
               | Changing to a yearly release cycle is what made quality
               | and stability a non-priority. MacOS has been buggier and
               | buggier since
        
               | catiopatio wrote:
               | [dead]
        
               | bredren wrote:
               | I'd suggest quality and stability of the rapidly
               | advancing Apple ecosystem became the priority.
               | 
               | MacOS has had to keep up with a relentless march in
               | services and devices each with their own peculiarities.
               | 
               | iPhone has had to have an annual release cycle, and there
               | are multiplatform apps and crossplatform features to
               | maintain and extend on deadline.
        
               | bmitc wrote:
               | I have been at a company that transitioned from normal
               | release cycles to arbitrary yearly release cycles. Every
               | year became a literal race to fix issues, improve
               | existing features, and add new features. It was a
               | gigantic mess. The yearly release cycle only really gives
               | a few months to do all of that, because the other months
               | are doing integrations, testing, and bug fixes to get the
               | release out the door.
               | 
               | I can certainly see that if the emphasis on new features
               | greatly outweighs that of bug fixes and improvements,
               | then you can extend the implementation months for larger
               | features because you can just bleed the bug fixes and
               | improvements into next year's release. But then that
               | year's feature set takes precedence and dept accumulation
               | occurs.
               | 
               | My own experience with macOS is that it stopped "just
               | working" a decade ago Apple stopped caring about it and
               | poured everything into iOS. And then this is exacerbated
               | by today's mode of operating by just treating features
               | like they're free and frequent release cycles.
        
               | newsclues wrote:
               | It's not the release cycle per say, but the need to pack
               | new features in each cycle for marketing and sales.
               | 
               | A regular release cycle that focuses on security,
               | stability and incremental improvements, is fine as long
               | as there isn't a need to constantly push new features in.
        
               | steve1977 wrote:
               | Mac OS X had a yearly release cycle in the beginning if I
               | remember correctly.
               | 
               | In my opinion, the drop in quality was probably at least
               | also related to Steve Jobs' death.
        
               | lapcat wrote:
               | > Mac OS X had a yearly release cycle in the beginning if
               | I remember correctly.
               | 
               | That's not correct. Here are the # of months since the
               | previous Mac .0 release:
               | 
               | 10.1.0 6
               | 
               | 10.2.0 11
               | 
               | 10.3.0 14
               | 
               | 10.4.0 18
               | 
               | 10.5.0 30 (delayed due to iPhone)
               | 
               | 10.6.0 22
               | 
               | 10.7.0 23
               | 
               | (Steve Jobs resigns)
               | 
               | 10.8.0 12
               | 
               | 10.9.0 15
               | 
               | 10.10.0 12
               | 
               | 10.11.0 11
               | 
               | 10.12.0 12
               | 
               | 10.13.0 12
               | 
               | 10.14.0 12
               | 
               | 10.15.0 12
               | 
               | This was a logical progression until 10.8. The
               | fundamental software development principle is that
               | immature software is easier to improve, because there's a
               | lot of low-hanging fruit -- glaring bugs and missing
               | features -- whereas mature software is harder to improve
               | and easier to accidentally break. That's why major
               | updates should come more slowly as the software matures
               | over time.
               | 
               | It's no coincidence that Tiger and Snow Leopard are
               | viewed as high points in Mac OS X quality and stability.
               | It's not because of the .0 releases, which were very
               | buggy like any .0 releases; it was because they
               | ultimately became very stable after many many months of
               | minor bug fix updates with no major updates (30 and 23
               | months respectively).
               | 
               | Also worth mentioning: major Mac OS X updates used to
               | cost $129. Now they cost $0. You get what you pay for.
               | Now users are _pushed_ into updating whether they like it
               | or not. You might wonder whether the principle starts to
               | apply: if you 're not the customer, you're the product.
               | After all, Apple has been transitioning into a so-called
               | "services" company. They'd rather sell yearly
               | "subscriptions" (more accurately, rentals) than major OS
               | updates.
               | 
               | > In my opinion, the drop in quality was probably at
               | least also related to Steve Jobs' death.
               | 
               | This may be true, but note that the change in OS release
               | schedule coincides with the death of Jobs. Mac OS X 10.8
               | was the first post-Jobs release and also the start of the
               | annual schedule.
        
               | steve1977 wrote:
               | Thanks for the details. Just to be clear, I'm certainly
               | not in favor of the yearly release cycle. Or rather, I'm
               | not in favor of any primarily calendar driven release
               | cycle.
        
               | semi-extrinsic wrote:
               | FWIW, the update from (checks notes for the naming)
               | Ventura to Sonoma is pretty much just a bugfix release,
               | there were almost no noteworthy new features.
        
               | lapcat wrote:
               | > Sonoma is pretty much just a bugfix release
               | 
               | There's no such thing as a major bugfix release. Every
               | major update introduces more bugs than it fixes, and
               | Sonoma is no exception to that hard rule. Which bugs were
               | fixed? I've personally filed multiple new bugs against
               | Sonoma.
               | 
               | I wrote about this in my previous comment: "It's not
               | because of the .0 releases, which were very buggy like
               | any .0 releases"
        
               | semi-extrinsic wrote:
               | Sure. My point was that it's a release where everything
               | looks exactly like it did before, and there were no
               | noteworthy new features AFAICT.
        
               | newsclues wrote:
               | I think it started when they decided to add feature bloat
               | like emojis and crap. 2011ish with iOS 5 was the
               | beginning of the downfall.
               | 
               | I worked AppleCare, and noticed a trend in bugs after
               | that.
        
               | corbezzoli wrote:
               | Poor developers, making 500k/year working in perfectly
               | safe conditions must be real tough.
               | 
               | I don't think burnout is the reason for the dip in
               | quality, Apple software has been crap for a long time on
               | the Mac.
        
               | ajmurmann wrote:
               | I don't think there is any correlation between
               | compensation and burnout. Why would you bring comp into
               | this discussion?
        
               | corbezzoli wrote:
               | [flagged]
        
               | meibo wrote:
               | Maybe the fruit bar at Apple Park is only restocked once
               | a week now. Not a joking matter.
        
               | sgjohnson wrote:
               | And how exactly are those things related?
        
               | lazide wrote:
               | Oddly, being paid more and being safer while others get
               | worse can actually contribute to burnout. Comraderie and
               | morale matter.
               | 
               | Burnout is more about a disconnect and dysregulation
               | between workload/emotional regulation/stress/morale than
               | it is about any one of those factors.
               | 
               | As anyone who has burnt out at a super boring job, or a
               | pointless but high stress job can attest.
               | 
               | A high stress, high risk, job that matters, keeps someone
               | interested, and someone can take breaks from is much less
               | of a burnout risk than one that someone can't see matters
               | , or they don't grow in, regardless of the stress level
               | or ability to take breaks from.
        
               | zogrodea wrote:
               | Thank you for the reminder. This random developer (not
               | from Apple) does feel some exhaustion, but I have it
               | lucky compared to some other folk and should be grateful
               | for that. Hoping those other folk who have it worse will
               | have some relief too...
        
             | wkat4242 wrote:
             | I wonder if it's just the sign of the times.
             | 
             | When I worked at a (formerly state monopoly)telco around
             | 2000 it would happen that an inspector would come in and
             | look for any warning lights on equipment. If you were
             | around you'd better know how to fix it right away.
             | 
             | These days that kind of attention to detail is long lost in
             | the sea of competition and cost cutting. But issues tend to
             | build up now and cause really expensive megaprojects to
             | really fix them.
             | 
             | I could imagine software engineering followed a similar
             | trajectory.
        
           | MichaelZuo wrote:
           | No, my macbook pro running Mojave gets only a few dozen
           | errors per minute, let alone thousands per second.
        
       | eviks wrote:
       | What a waste of a system with a typical no user configuration
       | approach
        
       | habitue wrote:
       | I have to think that if you want this level of insight and
       | control over your system, you're going to be less frustrated by
       | not using MacOS at all and switching to Linux or a BSD.
       | 
       | Macs are appliances, like a fridge. When your fridge breaks, you
       | don't look at the logs and try to diagnose it yourself, you take
       | it to a repair shop. Apple has been pretty clear they really
       | don't want you poking around on their systems.
        
         | mpalmer wrote:
         | Pity the IT teams who are forced to administer these
         | circumspect fridges because employees won't use Linux.
        
           | jasonjayr wrote:
           | "Continuing to use the apple fridges requires a subscription
           | to applecare to fix and diagnose any problems we previously
           | could fix, the TCO of this hardware is now higher...."
        
           | dangus wrote:
           | This is hilarious. The idea that the typical IT admin wishes
           | that Linda in Marketing would use Linux is so divorced from
           | reality.
           | 
           | IT just wants a fleet of systems that are easy to
           | automatically deploy, patch, and restrict dangerous actions
           | on. The easier they are for the lowest common denominator
           | employee to use, the fewer tickets get opened.
           | 
           | The idea that your IT team will ever waste their time
           | crawling through your local system logs is unrealistic.
           | 
           | I'm not saying the log shouldn't be there or shouldn't
           | function properly, I just think that macOS being commercial
           | and popular makes it very easy to administer compared to a
           | Linux desktop. You just buy off the shelf products like Jamf
           | and click a few buttons and that's about it, voila, you have
           | a managed fleet.
           | 
           | The architectural elegance of the system is secondary to the
           | amount of labor cost it saves.
           | 
           | You can even order a computer directly from Apple shipped to
           | your employee's house and have it zero touch provisioned. I'd
           | love to see a Linux laptop with that capability (really, I
           | would _love_ to see it).
        
             | WesolyKubeczek wrote:
             | > The idea that the typical IT admin wishes that Linda in
             | Marketing would use Linux is so divorced from reality.
             | 
             | Truth nowadays is, as long as Chrome can be launched, Linda
             | won't be able to care less.
        
               | nullindividual wrote:
               | You'd find out real quick that Chome isn't the only app
               | she needs. That "truth" is also divorced from reality.
        
             | mberning wrote:
             | Not sure why you are downvoted, because this is spot on.
             | You can tell many people on HN nave never worked in an
             | enterprise environment. As a developer I would love to have
             | a Linux laptop, but a Mac is as close as I can get.
             | Companies do not have the resources or wherewithal to
             | manage and secure 3 or more disparate desktop platforms.
        
             | pknomad wrote:
             | I worked as a CPE before moving onto SRE and this is spot
             | on. Jamf and others like Kandji are excellent tools for
             | deploying, configuring, and erasing the device at scale and
             | same thing for InTune for windows.
             | 
             | There's no equivalent for Linuxes other than agent based
             | CMs like Puppet or Chef and those tools don't deliver the
             | same features as the tools that are offered for windows and
             | macOS.
        
           | mvncleaninst wrote:
           | from my experience IT people normally worship windows for
           | some bizarre reason, which imo is a joke of an OS compared to
           | the other two
        
             | ranger207 wrote:
             | Windows's fleet management features are far better than Mac
             | and Linux. Centralized user management, patching, policies,
             | and application deployment all built into the OS "just
             | works" for IT in the same way Macs "just work" for users.
             | It's not something that can be seen as easily from a user
             | perspective though. I've been... frustradedly enjoying
             | watching the IT department from the company that acquired
             | us attempt to recreate Active Directory in aggregate with a
             | bunch of third party tools on our Macs. An example: last
             | week I had a meeting with IT because one of their tools
             | wasn't collecting logs or whatever. Turns out the tool
             | didn't have the full disk access permission turned on. No
             | good enterprise management solution should allow the
             | endpoint to override settings from corporate, and
             | especially it should have a way to change every setting on
             | the device remotely. Windows has that built in to Pro and
             | Enterprise editions, Linux has enough server management
             | tools that you can sorta build one yourself, Macs like to
             | think the company's laptops belong to the users.
        
               | fiddlerwoaroof wrote:
               | I'm glad Apple's pushing back on the abilities of
               | corporations to install rootkits and other spyware on
               | their employee's laptops. One would think that, after
               | things like the Solarwinds hack, IT departments would be
               | more skeptical of making a big single point of failure
               | for security issues: I don't think the purported DLP and
               | other justifications for this software are really
               | adequate.
        
               | ranger207 wrote:
               | Well, I don't think employees should be bringing their
               | own laptops to work anyway. It's extremely borderline
               | with phones IMO and they have facilities like work
               | profiles for handling that specifically. But the business
               | should be able to do whatever it thinks necessary with
               | the business's laptops it issues to employees. Sometimes
               | it's even required to legally.
        
               | fiddlerwoaroof wrote:
               | I'm not talking about personal devices, I think the
               | typically IT policies at large corporations cause more
               | problems than they solve and I think Apple making certain
               | things impossible is a great idea to help push back on
               | these policies: for example, IT should not need on-demand
               | screen recording or key logging access and, especially,
               | should not be able to put such software on an employee's
               | work laptop without explicit consent on the part of the
               | employee.
        
               | ranger207 wrote:
               | I'm sorry, my last comment was unnecessarily snarky. I
               | was coming back to delete it and write a more respectful
               | one but you had already replied.
               | 
               | BLUF: For reasons of security and compliance, licensing,
               | and low levels of computer skills among users, privacy-
               | invading enterprise management tools give IT departments
               | the best and most efficient way to accomplish their
               | goals. IMO if you don't want work looking at personal
               | stuff, then don't do personal stuff on work devices.
               | 
               | In short, this discussion highlights the difference
               | between computer power users (developers in particular)
               | and IT. If you're a dev, you're likely highly motivated
               | to get work done, practice security best practices, and
               | keep your system in a well-running configuration. The
               | average employee (which does include many devs) is not
               | like that. When you think of the things you might want
               | privacy for on your work device, it's probably going to
               | be things like checking the news, listening to music,
               | maybe putting YouTube on in the background. Innocent
               | stuff that a micromanager might not like but is probably
               | better for employee mental health anyway. When IT thinks
               | of what an average user would want privacy for, their
               | experience tells them that it's Facebook, porn, and shady
               | gambling sites that say "you've won $1 million just click
               | notmalware.exe to claim it!!!".
               | 
               | I and most IT departments wouldn't mind if everyone used
               | their work computers for only the former non-work
               | activities. I'd bet that the vast, vast majority of IT
               | guys think that "boss constantly monitors your screen"
               | software is creepy and unethical. 99% of users don't get
               | their computers infected trying to download more RAM
               | because Excel is slow because they have a dozen workbooks
               | open. But there's one user that does, it's hard to
               | identify who it is in advance, and once it happens once
               | management wants it to never happen again.
               | 
               | As far as immediate screen recording or key logging, I
               | can tell you from personal experience that some people
               | cannot do anything outside of their established workflow.
               | That includes clicking the link in the email I sent them,
               | clicking the "download support tool" button, clicking the
               | downloaded file, and clicking "allow access". Walking
               | someone through that series of steps over the phone
               | during COVID was about half an hour of wasted time for
               | both me and them. The next time they needed support
               | though, I could just hop on via the support tool
               | immediately. (Just for clarification, the tool was
               | approved and licensed for us to use; it wasn't just
               | Teamviewer I got the user to install. For administrative
               | reasons though, many of the systems that were our
               | responsibility were not installed by us.)
               | 
               | The creepy micromanaging screen logging stuff that runs
               | constantly is not good. Those capabilities are good and
               | useful in many circumstances, but in the type of stuff I
               | think you're thinking about I agree it's horribly
               | unethical. To be frank, I don't think that OS permissions
               | preventing that from working is the right line of defense
               | against that though. If it gets to the point where
               | management thinks that's even an appropriate solution
               | then management has clearly lost the plot and OS
               | permissions won't help.
               | 
               | Automatically installing software is also difficult. What
               | should IT do if, for example, Docker Desktop changes
               | their licensing terms and now we need to move everyone to
               | Rancher Desktop? What if networking wants to move
               | everyone from some horrible IPSec VPN installed in 2013
               | to a new and modern Wireguard-based client? What if the
               | helpdesk is inundated with tickets asking how to install
               | the new version of Acrobat since the corporate newsletter
               | announced we now had it? Just install it individually for
               | user after user after user, or install it for everyone at
               | once and be done with it? (Acrobat was the worst. IIRC I
               | had to install three different versions over the course
               | of a year once, and one of those versions required that
               | you completely remove every trace of the old version
               | first or else the new version would fail silently when
               | you tried to start it. And of course Adobe's uninstaller
               | wasn't comprehensive enough. I remember a ~2 week period
               | where three quarters of my tickets were manually removing
               | the old version of Acrobat and installing the new one.)
               | 
               | You said installing software should require the user's
               | explicit consent. Linda in HR is probably going to
               | dismiss the popup asking to install the new VPN because
               | she doesn't know what it means. It's bad enough already
               | with updates. If you don't have automatic silent
               | background installs, that means that the day after the
               | old VPN stops working, Linda and a dozen other people are
               | going to submit tickets saying they can't access the
               | network anymore. You won't have problems: you know what a
               | VPN is, you read the emails from IT detailing that
               | they're upgrading, you know that the new version will be
               | faster. Not everybody is as good with computers as that.
               | Automatically installing new software often means
               | avoiding a bunch of tickets allowing helpdesk to work on
               | actually meaningful things.
               | 
               | Those privacy-invasive tools are critical to IT getting
               | their work done. Now, I absolutely get why people have
               | bad attitudes towards IT. IT is often unfairly biased
               | against users. After all, the only users they interact
               | with most of the time are morons, and that paints an
               | unfair stereotype. Like, for example, the stereotype that
               | those users are morons: it's not the user's job to use a
               | computer, it's the user's job to do whatever their job
               | it, and the computer is a tool to do that. Yeah, users
               | should know a little bit about how to use their tools,
               | but that's a little difficult to enforce. IT guys in
               | general have a terrible attitude towards the people it's
               | part of their jobs to help, and that makes interacting
               | with them unpleasant. And corporate-ordered creepiness is
               | often implemented via IT. IT gets a bad rap and they
               | often deserve part of it.
               | 
               | But regardless, not using those tools is like managing a
               | fleet of servers by SSHing into each one individually.
               | Even if you have failproof processes where you never
               | forget a step, it just doesn't scale. IT has management
               | breathing down their neck constantly, along with half a
               | dozen other teams all with their own concerns and
               | problems: networking keeps moving switchports to
               | different VLANs and forgetting that they need to update
               | the routes to the printers; security says they need this
               | AV tool installed to hit a certification management wants
               | to put on the homepage; management found out last week
               | about a guy who's done nothing but manage his fantasy
               | football team for the past three months and thinks the
               | solution is to watch everyone's screen at work. I'm not
               | claiming IT is unique in this regard to be clear: devs
               | with too many project managers have the same sorts of
               | complaints. But fundamentally when IT does something
               | stupid to your computer, there's a very good chance that
               | it's been caused by something akin to someone in a
               | completely different department doing something insecure
               | and now IT has to prevent that from happening again.
               | Centralized tools that allow you to control computers
               | remotely, install software automatically, and change
               | settings as a super-superuser are required for managing a
               | fleet of devices operated by people who want to get
               | things done.
               | 
               | My personal policy is that work-owned equipment is for
               | work stuff only and I will never use it for personal
               | stuff. If I want to listen to music or whatever, I'll use
               | my own device. This avoids every problem with employee
               | privacy on work devices. If I could wave a magic wand and
               | make every person follow that perfectly then none of this
               | would even be a controversy. But people do want to do
               | personal things on work computers, and IT departments
               | have things they need to get done across entire fleets,
               | and the intersection of those things causes problems.
        
               | fiddlerwoaroof wrote:
               | > If it gets to the point where management thinks that's
               | even an appropriate solution then management has clearly
               | lost the plot and OS permissions won't help.
               | 
               | I generally agree, but it helps everyone--IT especially--
               | to just say "Apple won't let us do that"; rather than
               | having to say, "it's possible but I won't do that".
        
               | TeMPOraL wrote:
               | > _Now, I absolutely get why people have bad attitudes
               | towards IT. IT is often unfairly biased against users.
               | After all, the only users they interact with most of the
               | time are morons, and that paints an unfair stereotype.
               | Like, for example, the stereotype that those users are
               | morons: it 's not the user's job to use a computer, it's
               | the user's job to do whatever their job it, and the
               | computer is a tool to do that. Yeah, users should know a
               | little bit about how to use their tools, but that's a
               | little difficult to enforce._
               | 
               | The big part of people's bad attitude towards IT is that,
               | from user perspective, they're noticeable only when they
               | suddenly make it more difficult or impossible for the
               | user to _actually do their job_. And they do it often
               | enough that they 're seen as an outside force that's at
               | best annoying, at worst dreaded.
               | 
               | Now sure, the typical user may not know the other side of
               | the coin, and in many cases the annoyances are legitimate
               | from the POV of safety and effectiveness of the company
               | as a whole. But then, occasionally IT seems to not see
               | the costs either.
               | 
               | I'm biased here, but I have this negative bias towards IT
               | despite being rather experienced and savvy computer user,
               | because I've been on the receiving side of changes that
               | make it hard for software devs to do their work, in
               | companies that make money selling software.
               | 
               | My favorite example is Windows Defender "realtime
               | protection" - a functionality that adds a noticeable cost
               | to individual I/O operations (writes) on any file except
               | those on one of several exclusion lists (excluding by
               | location in the filesystem, excluding by the process
               | making the I/O call, etc.). This feature has really bad
               | interaction with typical software dev work - version
               | control, building software, running tests, and other
               | things a dev does constantly, tend to do a lot of tiny
               | I/O operations, and they _all_ suffer the penalty. This
               | can easily make all your actual work activities take 2-3x
               | longer - or more, when you account for the
               | disproportional distraction it causes[0].
               | 
               | Now, the corporate IT decides the endpoint machines are
               | not allowed to add additional exclusions to the list,
               | _even if otherwise the user has local administrative
               | rights_. The list is fixed, contains mostly system stuff,
               | and all your dev tooling and source code is not on it. I
               | wonder if anyone tried to calculate the total cost of
               | this one decision - money lost by software releases being
               | effectively delayed 2x, and in associated extra salaries
               | for one of the most expensive employees in any tech
               | company? Is it worth it, relative to whatever this
               | decision saves? Is it worth sticking to it, and ignoring
               | tickets from software dev begging for help, and /or
               | replying to them that the company will reimburse them for
               | a _laptop cooling pad_?
               | 
               | --
               | 
               | [0] - https://xkcd.com/303/. Or, when single `git add` of
               | a file takes 2 seconds instead of near-instant, that
               | slowly makes you avoid touching it. `git commit` taking 1
               | minute instead of few seconds (for executing post-commit
               | hooks) is the difference between being in the flow and
               | browsing HN. Etc.
        
               | glhaynes wrote:
               | Yes. It doesn't surprise me that some organizations want
               | to spy on their users, but I'm thankful Apple is making
               | it harder for them to do so without making it transparent
               | to the end users what's going on.
        
             | bandrami wrote:
             | I say this as a dedicated Linux user of 25 years: neither
             | Linux nor Mac have anything approaching the remote mass
             | administration capabilities of Windows. Windows brings a
             | ton of problems with it, but the ability to just GPO
             | literally anything you want is the big reason it's popular
             | among back office admins.
        
           | barkingcat wrote:
           | Macs are some of the easiest things to administer because of
           | the rock solid MDM, nuke and block, lost item mitigation (as
           | soon as declared lost, can wipe remotely, and even sometimes
           | track via geolocation for filing police reports and for
           | insurance claims). The pervasiveness and userfriendliness of
           | filevault makes it so much easier than trying to enforce luks
           | on linux.
           | 
           | If you do encounter an OS level issue that can't be solved by
           | first or 2nd tier local support, wiping from internet
           | recovery is the next step, followed by sending it back to
           | Apple (if you are within applecare) for direct replacement.
           | 
           | The Apple Business team is incredible, and is much better
           | than regular genius bar service at the apple store.
           | 
           | They are pricy on the whole, but it's worth it if you have a
           | need for macs in your environment.
        
             | mdekkers wrote:
             | > Macs are some of the easiest things to administer because
             | of the rock solid MDM, nuke and block, lost item mitigation
             | (as soon as declared lost, can wipe remotely, and even
             | sometimes track via geolocation for filing police reports
             | and for insurance claims).
             | 
             | All these things you mention are not "administration" in a
             | "manage systems that end-users use", they are "manage
             | devices" activities. Macs have the literal worst
             | business/enterprise administration
             | administration/manageability experience. At previous
             | $client, they had in excess of 30k desktops, and in excess
             | of 50k total endpoints.
             | 
             | They spawned a new opco, and that new opco wanted all macs.
             | 12 months along, that was all thrown out because of the
             | ongoing challenges of securing, managing, and administering
             | the devices, and supporting the userbase. It wasn't even a
             | TCO thing (that was also wild, about 4x over a "regular"
             | workplace, that being either Win10 or a supported Linux
             | build), it was a "we never want to see Mac's in the entire
             | global organisation ever again.
             | 
             | Macs have their place. There are plenty of environments
             | where they can function adequately. Medium and Large
             | Enterprise isn't amongst those, and that is 100% due to the
             | dire administration experience.
        
               | Joeri wrote:
               | I wonder how apple manages their fleet. It would amuse me
               | to no end to discover their own ops team is equally
               | frustrated at the state of macOS.
        
               | [deleted]
        
               | saagarjha wrote:
               | JAMF I believe.
        
               | [deleted]
        
               | frizlab wrote:
               | > 12 months along, that was all thrown out because of the
               | ongoing challenges of securing, managing, and
               | administering the devices, and supporting the userbase.
               | 
               | But did the admin team know about the macOS environment?
               | We're a Mac only environment in my company and the
               | management AND securing of all the devices is trivial
               | (can be done easily by one person for more than 100
               | devices with time to spare, and it's scalable).
               | 
               | But of course if the team is used to other OSes, they
               | won't know the tools and will find it difficult to manage
               | Macs.
        
               | detourdog wrote:
               | this bas alsays been my experiencd.
        
         | herpdyderp wrote:
         | I've been debugging and fixing my Macs on my own (well, with
         | internet help of course) for 20 years. They're still more
         | flexible than windows imo.
        
           | willdr wrote:
           | More flexible than Windows isn't exactly a compliment.
        
             | hackmiester wrote:
             | Seriously - this dichotomy is absurd. My workplace has been
             | RHEL for 20 years and has quietly side stepped all of this
             | nonsense. Yes, even after the acquisition.
        
               | jftuga wrote:
               | What laptops do they issue out to engineers? What issues
               | do you run across?
        
               | skydhash wrote:
               | The way I use my laptop (plugged and always attached to a
               | monitor, keyboard and external mouse), a desktop would be
               | the most appropriate choice. And no, I don't want to work
               | at coffee shop and a smaller, lighter, cheaper laptop
               | could do if I wanted to be mobile around the house (WFH).
        
           | jabbany wrote:
           | Can you get macos to stop dropping .ds_stores all over the
           | place? (I really do want to know)
           | 
           | Because you can get Windows to never drop thumbs.dbs without
           | much hassle.
        
             | gabeio wrote:
             | > Can you get macos to stop dropping .ds_stores all over
             | the place? (I really do want to know)
             | 
             | You can prevent it from dropping them on network drives
             | (SMB stores): https://support.apple.com/en-us/HT208209
        
               | jabbany wrote:
               | I know about this. Unfortunately it is in no way
               | sufficient.
               | 
               | I want it to stop dropping these _anywhere_, and I'd be
               | more than happy to give up thumbnail functionality for
               | this. However, afaik the "easiest" way to do this is
               | apparently to bind a hook to listen to all file system
               | writes by everything and then sweep up the junk whenever
               | it is detected...
        
             | sillysaurusx wrote:
             | Haha. The only way I found was to mount a read only file
             | system.
             | 
             | The ds store has to be one of the silliest design
             | decisions. But say la vee.
        
               | keyle wrote:
               | "C'est la vie"
        
           | makeitdouble wrote:
           | That's definitely an aspect that got worse during these 20
           | years though, and Apple has no incentives to reverse the
           | trend. If anything, there C* suite explicitly advocates for a
           | more iOS like model all across the board.
           | 
           | Parent's comparison point was linux, but I'd argue current
           | macos isn't that far from current windows.
        
         | [deleted]
        
         | NewJazz wrote:
         | _When your fridge breaks, you don 't look at the logs and try
         | to diagnose it yourself, you take it to a repair shop._
         | 
         | Well... Won't the repair person want to look at the logs??
        
           | tomxor wrote:
           | No they just check the "water damage" sensors regardless of
           | the problem and then tell you the price of changing the
           | bottom bit, the top bit, and the price of a new machine,
           | which are conveniently all the same price.
           | 
           | [edit]
           | 
           | Aha, touched a predictably sore Apple spot there I see.
        
         | aequitas wrote:
         | > When your fridge breaks, you don't look at the logs and try
         | to diagnose it yourself, you take it to a repair shop.
         | 
         | I for one welcome the ability to troubleshoot and fix the
         | devices I'm using. Unless it's still in warranty (but maybe
         | even then) I do want to look at logs or diagnose the problems.
         | Order the replacement part online and have it running again.
         | There's no reason I must rely on someone else to do something I
         | could and should be able to do myself.
        
         | user3939382 wrote:
         | > their systems
         | 
         | It's my system.
        
           | [deleted]
        
           | walteweiss wrote:
           | It's yours only when it's a free system, you know. Otherwise
           | it's precisely their system.
        
         | duped wrote:
         | Some people can and do fix their own appliances, so that's a
         | terrible analogy
        
         | [deleted]
        
         | mdekkers wrote:
         | > Apple has been pretty clear they really don't want you poking
         | around on their systems.
         | 
         | Sorry, _Who's_ system? Apple can do with their systems whatever
         | they want, but mine is mine, not Apple's
        
           | Condition1952 wrote:
           | it's not yours, it's granted to you under a license
        
         | walteweiss wrote:
         | Oh, I find it beautiful that it's 'their system.' When on a
         | free system like Linux, *BSDs it's your system.
        
         | cjensen wrote:
         | My last fridge literally had the ability to press some buttons
         | to get error information as an encoded sound. An app is used to
         | decode the audio to obtain something that can be read. Sadly it
         | was a break in a component that cannot be swapped out.
         | 
         | I've fixed appliances, and the best source of information about
         | what is wrong is usually the microcontroller. Sometimes it's
         | just a hex error code, and that's enough. A firehose of text
         | like MacOS currently produces is unusable.
        
       ___________________________________________________________________
       (page generated 2023-10-08 23:02 UTC)