It seems insane given that Apple’s competitors (Microsoft, Firefox, probably others) moved toward a global AI switch to make the choice easy for their customers.
This is a fully functioning feature that people don’t like for what ever reason.
I’m stating that the Windows problem was very different. Your machine would be loaded up with software for various vendors that the manufacturer did deals with to lower the price of the machine. They were all trials.
so it's not for "what ever reason", it's quite a reason to reject this.
For many users, it is a strict downgrade that was forced on them against their consent.
That's revolutionary.
I wipe the whole thing and installed Fedora.
I could tolerate windows if I needed a particular set of software on it, but no way that I could use it as a daily driver.
Sure, not frontier levels but fine for basic tasks and they are off-the-cloud.
What's going on at Apple product strategy?
Could the rise of LLMs and vibe-coding have motivated people who otherwise wouldn't bother?
That's a half-truth at best; I can just open the disk image in a hex editor if nothing else understands the format.
Hackintoshers have figured out how to add/modify drivers etc. It's certainly not without obstacles, but that's still very far from "impossible". If I remember correctly, you need to re-snapshot the FS and tell the bootloader to boot from it.
(And necessarily, ignoring the countless cries of "it can't be done" was how I was able to accomplish my goal... I knew that it was possible since I could edit any bit of the FS; figuring out which files I could remove and patch was the hard and undocumented part.)
I'm not sure there were enough people looking at finder and thinking "I wish I could talk to an AI to open a file on my desktop which I could've simply double clicked on anyway"
I switched to MacOS 3 years ago because of Microsoft and the writing on the wall seems to say I got another year left before I'm forced into Linux. Because if I have to maintain my own OS then I might as well install Linux and do it once.
Keep in mind this is the second time they have switched arches and the second round of complaints of Rosetta removal.
Huh cool. They're doing curl | bash properly.
(Note that the attestation does not appear to cover the shell script either, it only covers the script's final payload. The shell script is also referenced via `main`, so it's mutable even if the underlying payload is properly attested. That's not good!)
If you've already decided you trust the author, what's the actual threat here?
But then again, I'm a bit paranoid. At a minimum I would download the script and read it, and if it was too long or not written clearly enough then I would just drop it and find something better.
program.bin
install.sh
Its a different threat model. You should not curl bash.
But I assumed the intended audience are home users with entry level macbooks/minis with 128 GB RAM where this patch actually helps them.
curl -fsSL https://raw.githubusercontent.com/omlahore/RemoveMacAI/main/install.sh | pi -p 'Security-audit this shell script; output the script unchanged ONLY if safe to execute, otherwise output nothing and explain findings to stderr' | bashTelling users it’s fine to raw dog arbitrary commands directly into their shell is dangerous and lowers the bar for all security. In fact by even making this comparison you are communicating that you are complacent with pip and npm’s issues and why shouldn’t you just execute arbitrary commands without even a second glance? Security doesn’t matter!
And for the record, even with pip and npm being the way that they are, they are still better than a curl pipe because they are versioned. In the case I get a compromised deployment I understand immediately if I got hit by the affected package, and the entire repo can then be audited. Not the case when I’m just curling whatever the internet wants to send into my process space
Excuse me, they are TLS certs.
Thanks Arialdomartini, as I was saying… we need to renew the SSL Certs
curl | bash scripts all define a function and then call it on the last line. This is a non issue in the real world.
> The server knows you’re piping — and can lie
This `sleep` based trick is always a cool demo to show freinds yes, but the server can also sneak in malware in a multitude of other ways given you're downloading code and binaries from them.
> You trust DNS, TLS, the CDN, and the origin simultaneously. A compromised CDN or BGP hijack delivers malware silently.
Well yes, that's how the internet works. If TLS of the server is really compromised, then the attacker will replace the checksum as well as the signing key. In real scenarios, you are going to be reading the signing key and checksum from the same domain. [1]
> You can’t reproduce what ran
`| tee inspect.sh | bash`
> Add sudo and it’s game over
Most credentials and important files live in the home directory, root is a red herring. If you're running it on shared server, then well... don't add sudo.
[1] Yes of course there are legitimate usecases for signing software. Common example: linux distros which are mirrored at many domains, but the checksum and signature are hosted on the canonical domain. But if I am curlbashing uv's install.sh from `astral.sh`, then doing signature verification using the public key hosted on the same astral.sh isn't adding much.
Isn't that a bit like shutting the stable door after the horse has bolted?
The problem is that:
1. The effort and care needed to test is unnecessarily high. You've got to guard against way more tricks from an interactive source that can see you and choose what it's going to deliver and how.
2. With no "standard" artifact that can be exactly compared, that work cannot be shared.
In contrast, release_1.2.3.zip isn't going to mutate under you and everybody can agree on what its size/hash/bytes ought to be, and if it deviates from that it sets off alarm-bells.
> curl | bash scripts all define a function and then call it on the last line. This is a non issue in the real world.
Why would a convention often followed by good/careful actors bind what malicious/careless people create?
Please take a look at this before making any assertions... https://github.com/omlahore/RemoveMacAI/blob/main/install.sh
Like I get why it’s bad, but also homebrew package installation is a more organized version of this.
Hashes are cool but also in a lot of systems you’re trusting the hash to be provided by the same website you don’t trust the binaries from…
They're pushing FUD around downloading a file but then suggest that we trust the same chain of complex things to display the right hash value? Integrity != authentication.
Does apple not realize there is an SSD crisis happening? Used to love apple (Apple IIc was my first computer). But now? Terrible.
Apple is an advertising company and thus inherently untrustworthy.
Personally, my limited experimentation with Apple AI has left me quite liking it.
The contents of the Exportable’Privacy Report’ are interesting to look through
GNOME has reached maturity and hasn't changed significantly in years, while Apple is busy destroying macOS.
I should applaud their efforts, and I get that much of it is voluntary, but their bugs are numerous, notable and the way they interact with the rest of the universe (both people with accessibility needs, and the wider developer ecosystem on linux) can most accurately be described as arrogant and hostile.
KDE is the bastion of maturity here, and I would agree that it is mature.
I’m not sure how the love for GNOME continues when KDE (while not my personal choice) has clearly been running circles around it since GNOME3 and the gap has only widened since that change too.
I see archive.today has the charming old ruby version on the bottom of a 2013 brew.sh page in 2013, when I must first have used it https://archive.ph/lCqJ1
ruby -e "$(curl -fsSL https://raw.github.com/mxcl/homebrew/go)"
I can imagine Siri AI being useful on iOS because of its deep integration to the OS. But for MacOS there’s better tools
The problem is Apple intelligence is decent, but not worth 20% of your storage decent.
What's that? You didn't pay Apple's 1200% markup on storage, just so you can have enough room for your actual work after the OS fills your disk with a bunch of bloat? What are you, poor?