oneplane

6 ms·

1.
by oneplane 16d ago
I don't think so, the XNU and macOS LS architecture doesn't assume you're going to do policies based on the internal memory topology of a process. It's usually done with multiple processes and having one be very constrai
2.
by oneplane 17d ago
Windows has virtualisation based sandboxing and NT has object-level security (albeit not often used correctly and granularly) and macOS has (among other things) SIP and a subsystem called sandbox that does exactly what it says: it sandboxes
3.
by oneplane 28d ago
It usually does, in this case as well since it's SPL.
4.
by oneplane 29d ago
Wouldn't it have made more sense for Claude to suggest using the existing Linux-Airprint-VM project/product that already does this exact thing? There's even a zero-install method via https://printervention.app whe
5.
by oneplane 2mo ago
It's been extensively reported on, and any AWS user that clicks on the health dashboard would also have seen it, even if they don't consume from news outlets. As for use it gets: plenty of use, mostly when someone needs to have th
6.
by oneplane 3mo ago
How is it crazy? It's perhaps not granular (the repository is the boundary, and that's that), but you can definitely restrict who can pull or push as easy as you can make rules for SSH. Plenty of not-very-granular "enterprise
7.
by oneplane 4mo ago
What are you even talking about. Every M1 Mac and earlier runs Linux. Even all the way back to PowerPC. Granted, the M1 and up are not 100% covered yet (driver-wise), but they aren't EOL either. And if they were, Linux would still run
8.
by oneplane 4mo ago
Since SIP, it's MDM with DDM and you can basically leave engineers be local admins as it has no impact on the system state anymore.
9.
by oneplane 4mo ago
I'd rather go back to bare metal than use Azure.
10.
by oneplane 4mo ago
Those local options exist, and have been around forever, but the problem is nobody is doing it without cutting corners and with pay-as-you-go elasticity (and the 'call an API, get a VM instantly' effects that go with it). Most on-
11.
by oneplane 4mo ago
Not really, some of the IP is core to the product and it cannot function without it. In theory if you do something like come up with a complete replacement for EUV, you could, but everyone with deep pockets has already been trying to do tha
12.
by oneplane 5mo ago
Which is why I wrote about running the exact UI that was referenced, with the same window server, window manager and desktop environment.
13.
by oneplane 5mo ago
That statement makes no sense. X11 works fine on macOS and running it in rootful mode with Gnome essentially works the same way it would work on an OS that uses the Linux kernel. Granted, it will not integrate with anything hardware-wise by
14.
by oneplane 5mo ago
It does, it's called FreeIPA (or RedHat IdM). The only GPO parts it doesn't do are those that are not related to policy in the IAM sense (i.e. configuring some application related thing). There's other systems for that, just
15.
by oneplane 6mo ago
Oh yeah, you got the same process down pretty much yourself, wasn't an RTFM dig or anything like that. It was more aimed at others who might end up here, more tools, more better! It's interesting how with some systems/enginee
16.
by oneplane 6mo ago
There is a lot of documentation from Apple on how all of this works, but this is indeed expected behaviour. A way to make this smoother would have been: 1. Doing the password reset 2. Reboot straight back into recovery 3. Update you
17.
by oneplane 6mo ago
Run it in a restricted VM, which is not joined to AD and cannot talk to it either. PAM will not save you, either will Airlock Digital or something like ATP or anything else like it. Software for running VMs is free. > Giving users local
18.
by oneplane 6mo ago
That online builder is very cool, well done! I've been trying out similar things to help internal teams to use systems and languages like Rego (for Open Policy Agent) to have a visual and more 'a la carte' experience when sta
19.
by oneplane 7mo ago
When they shrank the disc it just became minidisc ;-) But that was technically MO, not just optical. And: it was in a cartridge so I suppose they really should have called it minidisk.
20.
by oneplane 8mo ago
Don't enable anything you don't need. Use the OS-native priority modes; i.e. no Slack messages after 18:00, no general message notifications unless from specific contacts, disable web browser notifications universally etc. no noti
21.
by oneplane 9mo ago
I think the comment mainly pointed out the distinction between education using digital methods, vs. educating about digital things.
22.
by oneplane 10mo ago
It's not a counterpoint, it's a display of your factually incorrect statement.
23.
by oneplane 10mo ago
> In other words, you're completely fucked if you brick your install. I consider iBoot a direct user-hostile downgrade from UEFI for this reason. That's a bit of a creative perspective, isn't it? You have no control over t
24.
by oneplane 10mo ago
Only if you boot into macOS and connect it to the internet. iBoot2 never changes by itself, you, the user, decides if you want to boot into recovery or macOS and run an update. So can Apple stop signing new iBoot2 versions? Sure! And that s
25.
by oneplane 11mo ago
Gee, another "we did not need cloud, so by not using cloud, we stopped spending on something we did not need"-story. Duh. The real story is why someone who doesn't need cloud services starts using them anyway. If you need it,
26.
by oneplane 11mo ago
The problem was that the user's credentials were revoked but because the root account was a shared credential it wasn't revoked. Was the break-glass account also a user-specific account, it would have fit in with any 'revoke
27.
by oneplane 11mo ago
Not using root means not bypassing policies. There is no way to not bypass all policies. So yes, never using root makes that issue go away completely. As for all the other stuff: what it does is it creates distinct identities with distinct
28.
by oneplane 11mo ago
No, a massive amount of CloudTrail logs.
29.
by oneplane 11mo ago
You don't need the root account, unless you need to bypass all policies. In such a scenario, you a use the root access reset flow instead, reducing standing access. As for other flows (break glass, non-SSO etc), that can all be handled
30.
by oneplane 11mo ago
This is just a Windows VM with extra tooling. Makes it look slick, doesn't make it "Windows apps on Linux". Similar projects exist for gaming for example Looking Glass, which also uses a Windows VM on KVM (the "Windows i

More ›