On the Great Security of Apple Silicon Machines

[crazy dave]

Hector Martin published a long piece detailing how “From a security perspective, these machines may possibly qualify as the most secure general purpose computers available to the public which support third-party OSes, in terms of resistance to attack by non-owners.”

And that:

“Apple's approach to third-party OSes is essentially "have fun". We do not have any expectations of direct support, documentation, or additional development effort from them, nor do we expect them to attempt to hinder third-party OSes in any deliberate way. They have explicitly developed the ability to securely run third-party OSes and bootloaders on these machines, and left the rest to us.”

The above was already fairly obvious but he goes into detail on all the big and little things Apple did to allow 3rd party OSes to boot while noting they are for macOS first. Finally:

Apple Silicon machines are designed first and foremost to provide a secure environment for typical end-users running macOS as signed by Apple; they prioritize user security against third-party attackers, but also attempt to limit Apple's own control over the machines in order to reduce their responsibility when faced with government requests, to some extent. In addition, the design preserves security even when a third-party OS is installed.

…

The ability to have a security state per OS is unique to these machines, and allows for things like dual-booting a full-secure macOS and Linux

The whole write up is pretty good and worth a read if you’re interested in how Apple Silicon is not Apple locking down the Mac to extract as much profit as possible from sheeple as the doomsayers predicted:

GitHub - AsahiLinux/docs: Asahi Linux documentation

Asahi Linux documentation. Contribute to AsahiLinux/docs development by creating an account on GitHub.

github.com

While I’m sure they’re not perfect, it’s clear that Apple have worked really hard on these systems and it’s nice to see the Mac and macOS getting this kind of attention to detail again. Most of us would probably never know it without projects like Asahi Linux. Speaking of which: a couple of the engineers on Twitter who worked on the security system and its design wrote back to Hector and thanked him for the write up and the acknowledgment of their efforts. That was nice:

https://twitter.com/x/status/1504101914081992708