They have it. It’s called Xprotect. I’m surprised it hasn’t been used to remove the bad certs.
replyhttps://fullmetalmac.com/cybersecurity/macos-security/xprote...
XProtect removes malware, not certificates
replywhat are the capabilities? presumably it could a apply a diff, patch or overwrite a file. in this case it's not even in the protected partition.
replyMicrosoft even has multiple express channels. For example Windows Defender definitions are practically real-time
replyJust like Apple has. The problem here is whoever made the decision not to use that capability:
replynot quite. this is more similar to Windows Quality Updates. Defender updates are real time (up to multiple times a day, and delivered p2p)
replyI have no idea how they have got this far without a method to add small patches outside monolithic OS updates.
replyYou're either not an Apple user, or never noticed Settings → General → Software Update → Automatic Updates
I think they meant that Apple’s updates seem to be the opposite of incremental, and they’re not wrong. If anything, Apple has moved in the exact opposite direction in the past decade, moving towards using enormous cryptographically-signed volumes (“sealed” is the term). This makes Apple really happy because they can make sure the users aren’t allowed to modify any of the “system“ files themselves for any reason, but also means that they can’t incrementally update things as easily as they did before. They ship multi-gigabyte “patches” every time.
replyBeing able to trust the OS is a huge advantage, though, and they built the rapid response mechanism to handle those updates:
replyhttps://support.apple.com/en-us/102657
The big question is why they’re not using it for things like this, where a tiny layered file system update would benefit almost all of their users immediately.
but the volume with these certs isn't protected. you can edit the files with vim. i'm curious what the holdup is.
reply