> This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!
> Apple’s most recent OS where it appears that low-level system API such as exec and getxattr now do synchronous network activity before returning to the caller.
Can anyone confirm this? Because honestly this is just terrifying. I don't think even Windows authorises every process from a server. This doesn't sound good for both privacy and speed.
But you can't be 100% sure that the server where the information is sent is not putting in a database your IP, the app you run and whatever else. As a power user I would prefer a prompt before anything is sent.
There are two new Security/Privacy Settings that I just noticed last night.
"Full Disk Access" to allow a program to access any place on your computer without a warning. A few programs requested this, so it looks like it's been around for a while.
The other one is "Developer Tools" and it looks pretty new. The only application requesting it is "Terminal". This "allows app to run software locally that do not meet the system's security policy". So, my reading of this is that in Terminal, you could run scripts that are unsigned and not be penalized speed-wise.
I wonder what "Developer Tools" grants in practice. Clicking the (?) for viewing built-in help does not mention this particular setting, it skips right over it going from "Automation" above it to "Advertising" below it.
Granted I don't typically use Terminal.app (iTerm 2 user), so I launched terminal and did some privileged stuff. Had to grant Full Disk Access to, say, `ls ~/Library/Mail`, but "Developer Tools" never popped up.
Are you running a beta build or something?
---
Update: Okay, I checked on my other machine and that one does have it (Terminal is listed but disabled by default). What in the actual fuck?!?
No, I played around with Terminal.app for quite a while already. Actually the category does show up on another machine of mine (see edit)... I suspected that maybe I never ran Xcode on the first machine since I upgraded to Catalina, so I launched Xcode, but again, no luck. I'm at a complete loss now.
Terminal actually gives an error if you poke into the top level library folder with full disk access disabled, no prompt to change without me looking on stack overflow for the solution.
As mentioned in a reply to a sibling, Xcode has been installed (for like five years) on this machine, and launching it doesn't help. The next step would be to compile and run an application with it, which I haven't bothered.
I would expect checks for Xcode to go through xcselect rather than a simple directory check. Installing the command line tools (sudo xcode-select --install) might actually be a better idea to test this.
I thought the same, but actually this method worked for me when I wanted the the Spotlight "Developer" option to show up (the CLT were already installed). I have the Developer panel under "privacy" as well, even if I never installed Xcode on my machine
No, SIP is fully enabled on both the machine with the Developer Tools category and the one without.
Interestingly, I rebooted the machine without after some benchmarking and experimentation with syspolicyd (see https://news.ycombinator.com/item?id=23274903), and after the reboot the category has mysteriously surfaced... Not sure what triggered it. Launching Xcode? Xcode and CLT were both installed on the machine, but I'm not sure when I last launched Xcode on this machine. Another possible difference I can think of: the machine without was an in-place upgrade, while the other one IIRC was a clean install of 10.15.
In the worst case scenario, you can probably insert into the TCC database (just a SQLite3 database, located at ~/Library/Application Support/com.apple.TCC/TCC.db) directly:
INSERT INTO access VALUES('kTCCServiceDeveloperTool','com.apple.Terminal',0,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1590165238);
INSERT INTO access VALUES('kTCCServiceDeveloperTool','com.googlecode.iterm2',0,1,1,NULL,NULL,NULL,'UNUSED',NULL,0,1590168367);
(Should be pretty self-explanatory. The first entry is for Terminal.app, the second entry is for iTerm 2.)
Back up, obviously. I'm not on the hook for any data loss or system bricking.
Yes. I got mine to appear through mysterious yet fully SIP-enabled means, but if all else fails for you you can temporarily disable SIP to change this.
I was going to be that guy and say “man spctl”, but that usage isn’t listed there. If you run spctl with no arguments, it will tell you, however. The man pages on macos really do leave something to be desired.
I'm using the Kitty terminal, and observed the script launch delay described in the blog post. After adding Kitty to "Developer Tools", the delay disappeared. Thanks!
How could this possibly not be absolutely awful on projects that run hundreds of executables during their execution (e.g. some shell wrappers like oh-my-zsh call out to a large amount of different scripts every time they run).
not sure if I'm lucky or somehow I disabled something but the trivial script problem isn't affecting me on any of my machines. I am using Homebrew for a large % of command line/scripting so maybe that's why?
I think coming to this realisation about Stallman's ideas (not the man, mind) is something that most rational computer users are bound to do. It happens at different times for different people, but I think people very rarely go back after that "Hang on a second ....??" moment.
I remember once he said "proprietary software subjugates people" and I just sort of blinked a bit. It seemed sort of over the top. And over time I started to understand that the way things end up working out, it is very true.
I always wonder why people usually choose to neglect privacy issues about Apple.
First, there was Apple scanning photos to check for child abuse[0] (that obviously got no attention on this site), then there was this one - Apple uploading hashes of all unsigned executables you run.
Do people really accept that company's "privacy" selling point?
If Microsoft wasn't doing ever worse privacy things with Windows I'd seriously look into switching away from Mac OS given the ever growing issues it's been having with every release.
I find Linux to be a usability nightmare. Weird cut and paste behavior, difficult to resize windows, terrible trackpad support. macOS and Windows will have to get a lot worse before I switch.
Why I prefer the three button UNIX style mouse style and I don't ever seem to recall having problems with windows resizing on UNICX an unixlike systems.
I found at least in Gnome and KDE Plasma window management works pretty much just how Windows works. Cut and paste it just cut and paste - Do you mean how you can select text and use middle click on the mouse to paste without even needing to do anything but select?
Most fans of Linux will claim the fact that you can choose any number of clipboard managers to customize things to your liking is a critical aspect that draws them to the platform.
Others among us (whether reformed or uninitiated) will commonly cite this same stuff as the reasons we avoid Linux on the desktop.
how many DE did you try? you have a variety of choices now, I would recommend trying a popular one such as Ubuntu / Elementary OS / Linux Mint
You should get a very nice experience out of the box with these, which can be reproduced quite easily with less "bloated" distributions such as Arch or Gentoo if you prefer to install things yourself
It does depending on what software you want to run.
There is no actually good alternative to Photoshop. gIMP is not remotely in the same league. Pixelmator and Affinity Photo are brought up but they're also like nano vs emacs. Photoshop doesn't run on Linux AFAIK. I'm sure for a graphic designer the same is true for Illustrator. The cheaper alternative exist and you can maybe get by but there's missing so many features.
If you're into games there is really only Windows. Same for VR.
I'm sure there are other categories.
I did serious dev on Linux and that dev didn't require any games or apps so it was great and I loved it. It ran my editor of choice and otherwise I only needed a browser and a terminal. But as soon as I step out of that small subset it's pretty much MacOS or Windows only, at least for the things I want to do with my computer.
I wonder how viable just running PhotoShop in a VM is these days, if you have the extra RAM and are OK with the extra minute to boot up the VM each time to use the program?
VirtualBox has a 'seamless mode' as well, I wonder how well it works on a Linux host and a macOS/Windows guest.
Without WINE, and it’s associated instability, which operating system, other than MacOS or Windows, would run Ableton, Logic Pro, Adobe Premiere, or Final Cut Pro, all applications I depend on for my income and, due to the fact that my clients use this software, for which an FOSS equivalent or alternative doesn’t exist?
Now imagine the millions of other people in my situation and rethink your comment.
> Without WINE, and it’s associated instability, which operating system, other than MacOS or Windows, would run Ableton, Logic Pro, Adobe Premiere, or Final Cut Pro, all applications I depend on for my income and, due to the fact that my clients use this software, for which an FOSS equivalent or alternative doesn’t exist?
> Now imagine the millions of other people in my situation and rethink your comment.
The comment still holds. Linux should still be considered. I didn't proclaim that it would be a realistic alternative in every case, but I'd wager that for a large proportion of software engineering roles, it would be.
Is there software that may also be suitable for basic image and video editing work and therefore fine for a subset of these creative professionals you refer to? Absolutely. I've seen great results from folks using Blender, Inkscape, OpenShot, GIMP, Krita and others.
We shouldn't just dismiss an OS immediately, and that's what my comment was trying to get at.
The other thread reply on this topic notes the reasons Linux is not considered a viable desktop replacement for many people.
Personally I'd need to run a VM for a bunch of software or fight Wine. That's assuming my machine has the right hardware support for everything and even then the trackpad support is likely to not be great.
It's really frustrating to see Apple make all these poor decisions and they almost never are willing to admit their mistakes and go back. In the rare case when they do (e.g. butterfly keyboard, Mac Pro), it takes them years to turn around.
That has been my view as well. It isn't Apple that is particularly good with anything Software ( I will give them they have an Edge in UX ). But Microsoft is just horribly bad every time I look at it makes macOS looks good.
> a degraded user experience, as the first time a user runs a new executable, Apple delays execution while waiting for a reply from their server.
The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg), i.e. "/usr/bin/stapler staple <path>." Otherwise, Gatekeeper will fetch the ticket and staple it for the user on the first run.
(I'm the author of xcnotary [1], a tool to make notarization way less painful, including uploading to Apple/polling for completion/stapling/troubleshooting various code signing issues.)
I mean, when I’m developing in a compiled language with the workflow edit code -> compile -> run (with forced stapling), changing it to edit code -> compile -> staple -> run doesn’t make it any less slow...
But TFA and my personal experience do point to a noticeable delay after each recompile in dev workflows, and TFA claims this is due to notarization checks... So I guess I’m confused and you’re talking about something else?
An update: flat out denying network access to syspolicyd using Little Snitch could cut down on the delay. (Yes, syspolicyd does send a network request to apple-cloudkit.com for every single new executable. Denying its access to apple-cloudkit.com only isn't sufficient either since it falls back to IP address directly.) Note that this might not be a great idea, and it still has nonzero cost — a network request has to be made and denied by Little Snitch.
Here's my benchmarking script:
#!/bin/zsh
tmpfile=$(mktemp)
cat >$tmpfile <<EOF
#!/bin/sh
echo $RANDOM # Use a different script each time in case it makes a difference.
EOF
chmod +x $tmpfile
setopt xtrace
time ( $tmpfile )
time ( $tmpfile )
unsetopt xtrace
rm -f $tmpfile
If your local terminal emulator is immune with "Developer Tools" access (interestingly, toggling it off doesn't bring back the delay for some reason), you should be able to reproduce the delay over ssh.
I can repro this locally as well. Interesting if it's inconsistent with Apple docs and when Gatekeeper should be firing, as running stuff locally without distributing/downloading is somewhat out of scope for notarization.
Reached out about this to Apple dev support, hope to get more insight.
Xcode (the UI) is able to bypass GateKeeper checks for things it builds.
The "Developer Tool" pane in System Prefs, Security, Privacy is the same power. Drag anything into that list you'd like to grant the same privilege (such as xcodebuild). This is inherited by child processes as well.
The point of this is to avoid malware packing bits of Xcode with itself and silently compiling itself on the target machine, thus bypassing system security policy.
Reminds me of the AV exception folder our corporate IT created for developers. Soon absolutely everything developers needed or created was installed into that folder. Applications, IDEs, you name it.
Guilty as accused. I try to keep to an absolute minimum. Like docker data-dir and IDE. With that i can atleast use my machine.
otherwise this macos notarisation, along with a possibly of cpu heating issues with left thunderbolt usage and corporate av scanning, makes my machine, next to useless
GateKeeper only triggers the check for things downloaded from the internet.
IOW, it checks if your binary has a quarantine flag attached via an extended attribute.
> The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg)
Maybe in some cases, but the article says "even if you write a one line shell script and run it in a terminal, you will get a delay!"
Shell scripts don't come in bundles. I don't think this kind of stapling is possible for them? I don't think it'd be reasonable to expect users to do this anyway.
The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr.
Two posts from Apple dev support (Cmd+F "eskimo") describe this in more detail.
I recently learned that `xattr -cr path/to/my.app` solves the “this App is damaged would you like to move it to the trash” you get when you copy an app from one Mac to another.
No, it’s just that they’re becoming more popular. When you become a popular desktop OS, governments and militaries want to start using it which comes with some strange requirements. It also means that you can’t rely on “obscurity” to provide any sort of security, where before you could overlook some things.
I don’t know why grand op is downvoted. DoD requirements literally require a timeout setting for screensavers to begin locking. This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks.
The long term effects come from the required changes to the development security model to remain productive and profitable (took MSFT a few OOB hotfixes and service packs to fix that example above, look when gnome kde xscreensaver etc introduced that feature etc)
Because it’s not, that’s why I pointed to xscreensaver feature implementation. Lock time is separate from screensaver activation time which is separate from energy saving activation time.
What defines when a locking screen saver is “locked”? 10m? Or 10m1s? You are making assumptions and that is what DISA spells out. Which forces the OS design to change in subtle ways. Like xattrs on files as great grand op was alluding to.
Does that provide clarity into how development security models evolve over the lifetime of an application?
It would appear to mean it's a hacky, over-technical solution to a problem that shouldn't exist in the first place, as copying things from one computer to another should just work™. This is one place where macOS used to shine and seems to be increasingly falling behind in.
> The Gatekeeper behavior is specific to running things from Finder (not Terminal), and only if you downloaded it via a browser that sets the com.apple.quarantine xattr.
The article says the described problem isn't limited in this way:
> This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!
If you read the comments of the article and do your own testing, you will find that reality appears to be more complicated than the article suggests. Users have shown using both timing and wireshark that the shell scripts do not appear to be triggering notarization checks.
I can't upgrade IntelliJ any more, because it's trying to write to privileged file locations that I (the owner of the computer) no longer have access to. Believe me, I've tried to work around this, macOS has it locked down completely.
I use and upgrade IntelliJ fine. Install Jetbrains Toolbox and everything is installed in your home dir. What kind of locations are you having troubles with?
A few months ago I installed Rider (an IntelliJ-based IDE) on my Mac without toolbox, and upgrading it was a pain. I don't remember the details, but using JetBrains toolbox makes upgrading as simple as clicking a button and waiting until the download / install is complete.
Reminds me of the terrible delay I faced after having Sophos installed on my Mac.
Having to wait 5-10 seconds for a new terminal tab as Sophos churns (checking autoccomplete scripts, rbenv, etc) was infuriating. Oddly, there was fate sharing with Internet interception, so there was a good chance the browser was getting dragged down too, and vice versa.
Convincing corporate IT of how bad the problem was was maddening. Based on what this author says, 10.15 on rural internet sounds like hell.
> I am so glad I decided years ago to leave closed operating systems behind.
The problem is, there's nothing else out there. Everything is going to shit in one way or another. Windows is now a disaster, Linux was always a disaster in terms of user experience and isn't improving.
Mac OS was the last bastion of somewhat good, thoughtful design, user experience and attention to detail and now they've gone to shit too.
Linux was always a disaster in terms of user experience and isn't improving.
Curious: what have you tried? People who use "Linux" as a catch-all in terms of UX usually have only tried a single distribution with a single desktop environment.
It's really hard for me to use non i3wm supporting OSes now, even though I have to use Windows from work, and have used Macs for the better part of the last 2 decades personally and in college.
Interesting. I regularly use RHEL (server/CLI only) but have not tried desktop Linux in a while.
I get a fair bit of weekly exposure to Windows 10 and well, it's not like heaps of fun, UX wise.
I'm reluctant to drop Apple mainly because I'm so 'tied up' with the rest of the ecosystem, iphone, Apple Music, iCloud etc.. They are not irreplaceable (for sure) but it always feels like moving away will cost way too much effort and be a pain...
Well played, Apple.
> I'm reluctant to drop Apple mainly because I'm so 'tied up' with the rest of the ecosystem, iphone, Apple Music, iCloud etc.. They are not irreplaceable (for sure) but it always feels like moving away will cost way too much effort and be a pain... Well played, Apple.
People who have used ubuntu might want to just once try arch linux.
I had an ubuntu machine that took a while to boot even with an SSD. Later I installed arch linux on the same machine and boom! it would be to the desktop in seconds. It was night and day.
Debian is just as quick, and does not have the problematic "rolling" updates of Arch. (It does have the "testing" and "unstable" channels which are roughly comparable, but the Debian folks won't tell you to use them in production.)
Debian - or Devuan if you don't want systemd - can be made as spartan as you want. It boots in those mentioned few seconds on my 15yo T42p (Pentium M@1.8GHz, 2GB). Use Sid/Unstable if you want more up-to-date software with the accompanying larger flow of updates.
> Curious: what have you tried? People who use "Linux" as a catch-all in terms of UX usually have only tried a single distribution with a single desktop environment.
Yup. You've just described a disaster. How many permutations of <hundreds of distros> x <dozens of DMs> must a user try before finding a good UX?
Mac is a BSD. OpenBSD exists. FreeBSD exists. NetBSD exists.
Because there are at least four BSDs, Mac therefore isn't good.
Do you see how ridiculous applying that logic to any operating system is?
Linux isn't a disaster. It's a kernel. There are Linux distributions with great user interfaces and great UX, developed by people who are great at it. There are also distributions that aren't.
It sort of depends on what really fascinates you, right? I'll avoid naming some of the most popular ones, because it's likely that you've already tried them. If you haven't, I'd really recommend giving them a try. Many people seem to really love them.
In terms of defaults:
I've heard really good things about Solus, and its use of AppArmor seems really cool. Never touched its package manager, so I won't recommend it, but it might be worth checking out. Its desktop environment is really snappy and has an interesting design philosophy.
Elementary is really cool as a boutique distribution; I don't personally feel any urge to use it seriously (I dislike apt as a package manager), but I always keep its live environment on a flash drive, because it works without any setup on basically anything I throw it at, painlessly, and without error. It's got a cool indie app store full of curated Elementary-centric free software, and overall just feels great. Using it, you'll probably notice a few areas that it clones Mac on, and a few that feel delightfully different.
Clear Linux (Intel's desktop distribution) is pretty popular right now because of how simple it is & how Intel seems to be going to great lengths to optimize it and make it a serious contender, but I don't like its desktop environment (vanilla GNOME 3 as far as I'm aware) all that much.
ChromiumOS is probably the best-designed desktop operating system on the planet right now technically, and I say that as a person who really hates Google. UI-wise it's so-so, but UX-wise it's really something special.
But more interesting are desktop environments in general, since they can be used with any variant of Linux you feel the urge to use. There's an exception there, though, in that Elementary's DE and Deepin's DE tend to not work so well or nicely on platforms that aren't Elementary or Deepin.
There are modern environments:
Plasma has hands-down the best UX of any sort of desktop operating system assuming you've got an Android smartphone; you say you're coming from Apple's environment, so imagine the interop between your Mac and your iPhone, but going both ways instead of just Mac -> iPhone. Texting, handling calls, taking advantage of the computing resources of connected devices, using your phone as an extra trackpad, notifications, unlocking your PC, painless file-sharing, pretty much anything you'd like. There are a bunch of distributions that ship with Plasma by default.
Solus's Budgie is kind of neat in that it takes the main benefit of GNOME 3 (ecosystem) with far fewer downsides.
There are also retro environments, if those are your thing. There's a pretty much perfect NeXTSTEP clone (including the programming environment, not just the UI), amiwm is still pretty interesting, there are clones of basically every UNIX UI under the sun, so on.
I'm not the best person to answer your question, because for the most part I don't go out of my way to use new desktop environments and distributions, and nothing above is my first choice. (In terms of window management, I usually stick with 9wm & E just because I have ridiculous ADHD and 9wm forces me to focus while E allows me to tile painlessly if I ever need it. I use three distributions overall, none of which are very popular at the moment, pretty much solely because I'm really picky with package managers & design philosophies.) That's a "me" issue rather than a Linux issue, though.
This is excellent and indeed largely novel information, thank you.
It sounds like the finding right combination of DE and package management solution plays a big role here. I don't remember much of my experience with Gentoo's package manager in the early 2000's other than finding it generally did its job (if a bit slowly)... Experience with package managers on Mac (brew, macports) hasn't been great so I'm eager to play around with modern ones on Linux. Same goes for the DE actually: stock, out-of-the-box, macOS is essentially unusable for me until I get my customization (scroll, trackpad, KeyboardMaestro) done exactly right, I can't imagine this not being better on Linux, if anything for the ability to switch among the various DE's.
I'm starting to contemplate this (fully untested) strategy: trying out a few distros and installing the one I like best on VMWare Fusion and then try to use it as much as possible, falling back to macOS if I get stuck or I'm short on time but gradually replacing Mac-specific stuff as I find suitable replacements.. TextMate, the masterpiece of Allan Odgaard (author of the article being discussed here) probably going to be the toughest one. If I'm successful, I should eventually be able to let Linux 'out of the box' and run it on real hardware..
PS: amiwm! This is going to be a must. I do miss the Amiga, a fair bit..
pacman (wonderful interface; so-so technically; dislike the distro that uses it because of technical choices)
InstallPackage (GoboLinux is kind of cheating, because InstallPackage isn't a "real" package manager, but that's kind of the point)
I love TextMate, too! Something you might find nice is how easy it is to run Mac in a VM on Linux; there are scripts that manage the entire thing for you, and it's pretty painless (and so fast; I was surprised). Useful if you have a few packages you can't find replacements for.
You mention Apple Music elsewhere, which you might be interested to know has an Android client and a web client, and you can probably get a native client on Linux, though I'm not immediately aware of one.
> I love TextMate, too! Something you might find nice is how easy it is to run Mac in a VM on Linux; there are scripts that manage the entire thing for you, and it's pretty painless (and so fast; I was surprised).
That would be excellent! I like the idea of swapping host and guest with this VM strategy, sort of evolutionary platform switching.
Thank you for writing this overview of interesting Linux distributions, their UX and package managers, such good info.
The last few years I've run Linux VMs on a Macbook, but I'm transitioning to a Linux desktop probably running a macOS VM, which you mentioned in another comment - didn't know there was a practical solution.
It sounds like distros like Elementary and PopOS might suit me as a gentle transition from Macs.
> Do you see how ridiculous applying that logic to any operating system is?
Somehow, when you ask a person about PC or a Mac, the answer is: Windows or MacOS, and then the discussion is about their quirks, or advantages, or deficiencies.
You ask about Linux, and this is what you get:
> Linux isn't a disaster. It's a kernel. There are Linux distributions with great user interfaces and great UX
So, once again: which one of the hundreds of permutations of <distro> x <DM> has a great UX?
Ask a person about UNIX, they'll list Mac, Solaris, whatever. All UNIX distributions! I listed a bunch elsewhere in this subthread. Feel free to check them out, but for some reason I'm beginning to suspect that you're probably not going to.
Ubuntu pretty much works out of the box for a lot of "regular" users (I'm excluding gaming, which also works but is not as easy).
I'm sure there are other user-friendly distros that similarly let average users browse the internet, write documents, listen to music and watch movies painlessly.
I'd say gaming on Ubuntu LTS (if not Linux in general) is quite easy provided you stay in the safe haven of games that natively support the OS, which to be fair is a pretty solid selection of games these days albeit one which is pretty much a strict subset of the games on Windows. As soon as you go outside that area and start messing with Wine or whatever all bets are off, though.
Agreed! I play a lot of games on Linux, bought via Steam or GOG, occasionally with help of WINE but mostly without. I excluded gaming because if one thing is likely to cause more problems than on Windows, it's games. But yes, I use Ubuntu even for gaming.
The fact I can install Steam and play an AAA like Mad Max or Shadow of Mordor mostly seamlessly makes me wonder why people still claim Linux on the desktop is a no-go.
>The fact I can install Steam and play an AAA like Mad Max or Shadow of Mordor mostly seamlessly makes me wonder why people still claim Linux on the desktop is a no-go.
Because they and few others are exceptions? Can you play the latest CoD? GTA V? Assasin's Creed maybe?
I think you're missing the point. I'm not arguing that Linux is the best platform if your use case is primarily gaming. Nothing beats Windows -- or a console! -- if gaming is the most important thing to you.
> GTA V?
I honestly don't know, but it wouldn't surprise me if I could using WINE. A huge library of Windows AAA games work on WINE.
> Assasin's Creed
I don't know, but Mad Max and Shadow of Mordor are pretty much the same kind of game as Assassin's Creed, following the same kind of gameplay and using the same kind and complexity of 3D graphics/engine.
In any case, these are not exceptions. I forgot to mention the XCOM remake, Alien: Isolation (this is interesting because it has tons of graphics effects, including chroma aberration -- it looks awesome on Linux), SOMA, Victor Vran, Warhammer 40K Dawn of War II, L4D2, and many others. There are tons of Linux games on GOG and Steam, many of them AAA games. If you count indie games or 2D platformers there are literally thousands of them, but I guess that's not what you're after.
My point is that you can't run most AAA games actually, and many of those you can - will give you enough problems (like frame drop or some graphical features unavailable).
And I really don't understand what's the point of being able to run some games. I want to play the games I'm interested in, not the ones that 'are playable'.
>I don't know, but Mad Max and Shadow of Mordor are pretty much the same kind of game as Assassin's Creed, following the same kind of gameplay and using the same kind and complexity of 3D graphics/engine.
No sure what's your point here. You can't replace one with another just because they have similar mechanics.
Steam\GoG has many games that run on linux and macos (by the way), but most of them are indie platformers or things like that. People don't play random games just to kill some time (well, some do), they play TITLES.
> I forgot to mention
more exceptions. They will stop being exceptions when you will be able to run 80% of titles without any issues and not sooner than that.
Gaming is not important to be, I'm a PS4 guy ever since macos switch, just pointing out that games are still has little to do with linux unless we are talking about rare AAA titles and indie scene
My point is that Linux is a valid gaming platform with many AAA titles and tons of indie games, not that it's the best or ideal gaming platform. Of course Windows is better for gaming.
> And I really don't understand what's the point of being able to run some games. I want to play the games I'm interested in, not the ones that 'are playable'.
With this definition neither Windows nor the PS4 are valid gaming platforms, since not every game can be played on them.
> They will stop being exceptions when you will be able to run 80% of titles without any issues and not sooner than that.
So now it's 80% when before it was "a few exceptions"? Sorry, I'm uninterested in discussing your arbitrary definitions with you. Nice try moving the goalpost.
PS: re: "without any issues", back when I used Windows for gaming, there was always some issue. The graphics card, drivers, config issues. I guess Windows is not a gaming platform either then?
Hardly. The existence of a distro I don't like doesn't degrade my experience using a distro I do like. You may as well be upset at an ice cream shop for having dozens of flavors when you only like strawberry. Choose the one you like and ignore the ones you don't. It's not rocket science, even children can figure that out.
If an icecream shop only has one flavor, I might get lucky and discover it's the flavor I like. But more likely, I'll just be screwed and have to settle for something I don't like. Only an icecream shop with variety can hope to give the most amount of people an optimal experience.
Unless the ice cream shop provides you with hundreds of flavours, 90% of which are nearly indistinguishable from each other. And hardly anyone on this planet can answer a straight question of "Which flavour is good".
Moreover, I've been running Linux for decades now, both in my personal laptop and at work, and Ubuntu has been (mostly) frictionless for me. I'm not an average user, of course, but for most users a friendly distro would work just as well as Windows (browsing the internet, using whatsapp web, watching movies). In some cases I've had a better user experience with Ubuntu than with Windows or OS X, namely seamlessly installing a wireless HP laser printer.
I only tried Ubuntu, a few month ago. For the day or two spent with it:
- multi-language support requires a lot of work to get to the same point as macos.
In particular I use third party shortcut mappers to get language switching on left and right command keys (mimicking the JIS keyboards, but with an english international layout). That looks like something I’d have to give up on code myself.
- printer support is not at the same level.
Using a xerox printer, some options that appear by default on macos where not there on ubuntu. I’m sure there must be drivers somewhere, or I could hunt down more settings. But then my work office two other printers. It would be a PITA to hunt down drivers every time I want to use another printer.
- Hi DPI support is still flagged as experimental, and there’s a bunch of hoops to jump through to get a good setting in multi-monitor mode. Sure it’s doable, but still arcane.
- sleep/wake was weird. It would work most of the time, but randomly kept awake after closing the lid, or not waking up when opening. Not critical, but still not good (I’d ahte to have the battery depleted while traveling)
Overall if I had no choice that would be a fine environment. But as it is now, with all its quirks, I feel macos is still a smoother environment.
Fair enough. I'm not a Mac OS X user so I don't know how it would compare. I can only compare it with my past experience with Windows, and I think it's superior (for me) to Windows circa 7 -- I stopped using Windows entirely at that point, so I wouldn't know how later versions of Windows fare.
Portability is also a fair issue to raise, but it's simply not a problem for me. When I say Linux "on the desktop", I literally mean it: to me a laptop is simply a slightly more portable desktop computer. I sometimes take my work laptop to/from the office, and the battery lasts long enough for that. I'm not worried about longer trips, since I don't use laptops for that. Again, if you do care about this (which is completely fair), I'm aware many Linux distros still have issues with battery life. You certainly can't compete with a Macbook Pro, that's for sure!
I do note that my experience with printers is opposite to yours. Like I said, when trying to connect to an HP wireless printer, Ubuntu autodetected and self-downloaded the necessary drivers; however, it took a lot of patience to get it to work with a Macbook Pro. Today, that I have it configured for my Ubuntu laptop and my wife's Macbook Pro, the Mac will sometimes fail to print (the print job simply stuck in limbo) while my laptop prints reliably. Who knows?
And like I said in another comment, I game (or used to, anyway) a lot with Ubuntu, and many games are even AAA (though they tend to arrive later than on Windows).
So I really have a hard time believing Linux is not "ready for the desktop". It is, and has been for many years now.
edit: one last thing. You mentioned HDPi modes, multimonitor, multilanguage... none of those are for average users. My mom would be comfortable browsing the net, reading mail and watching movies on Ubuntu. She doesn't even know what HDPi is, nor does she want external monitors. (Spoiler: she still uses Windows because she can't learn anything else at this point... I've thought of tricking her by themeing Ubuntu to look like Windows, but that would just be mean).
Without HiDPI support lots of applications become useless when you use a HiDPI display. Even Steam does not respect HiDPI settings in Gnome 3 even when setting custom environment variables.
It's probably a case of "I don't miss what I don't use" then. I'm a power user, I cut my teeth with MS-DOS and I've been using Linux for work and gaming for more than a decade (and less intensive usage before that) and I really never noticed anything about HiDPI. That has to mean something :)
For the printers, you are right in that it’s far from being a solved problem on macos. I had an EPSON all in one before, and it was also a pain to get everything working. If I remember correctly the generic driver could print, but we didn’t get “advanced” options without going through the EPSON pkg installer and all the garbage coming with it. I’d totally imagine the linux driver being done cleaner than that.
For the record I’ve worked with a decent number of devs using linux workstations, so I totally vouch for your use case. I’d just temper the niche nature of multi-language support; that’s an everyday need for basically all Asia. Granted my use of shortcuts is niche (I wouldn’t need them if I had enough keys), but looking at maintenance projects annual reports there seem to be a sizeable amount of quality of life fixes still on the way.
With Linux you have to pay for proper support. HP is by far the best company in terms of supporting Linux printers. It isn't the Linux ecosystem's fault that other printer companies do not care.
I feel like people still have in mind what Linux desktop was 15 / 20 years ago. It improved a lot in the past years, battery life improved on laptops, Ubuntu that was already very stable and feature complete also got a lot of things with previous releases and I've personally been running Arch on my main computers now for 5+ years and haven't got any major issues while upgrading.
This list is quite comprehensive, but also quite boring. It's just a list of bugs and things that are suboptimal on Linux. You could write one about any operating system. Some of the items like 'such-and-such needs to be configured using a text file' are also not even real problems.
What do you mean by 'there goes your install'? There are multiple ways you could run bleeding-edge software before it's packaged for Arch. See for example every 'xxx-git' package in the AUR. Or Flatpak.
I use Linux everyday, and it's a UX disaster. I have tried Gnome, Xfce, Cinnamon, KDE, I like none of them. The only DE that I somewhat liked (Unity) was discontinued.
Linux sucks, but I use it becuase it sucks less than windows, for programming at least.
Well, my head is spinning, but I've made a bit of progress. I thought I'd start by trying out a few of the ones you and others have characterized as user-friendly as well as one of the more bare-bones ones.
The (hopelessly unscientific) test plan was:
Challenge 1 - write live system ISO to USB drive and boot it on my 2015 MacBook Air (which, though old, still counts as exotic, I guess.)
Challenge 2 - make sure display, network, trackpad and keyboard (+ intl. layout) work correctly. Be able to SFTP to my Mac
Challenge 3 - with little to no docs reading (how is the package manager invoked from CLI?), use the terminal to set up the right environment for a couple of relatively portable hobby projects I've been recently working on (on Mac), compile and test them. This includes, among other things, installing clang or g++, SDL2, Wine (to run an ancient ARM assembler) and finding a usable GBA emulator.
Limitations:
A: 8GB RAM. More ambitious stuff (KVM macOS, VisualStudio Code) will have to wait for an actual install.
B: Deliberately avoiding exposure to the docs is silly but I thought
such an approach would give me an indication as to whether
there exists a distro that uhm, "thinks like me".
Candidates:
Ubuntu, Mint, Fedora, KDE Neon (which, if I'm not wrong, is Ubuntu LTS preconfigured as the latest KDE) and Void.
Results:
Challenge 1: unremarkable. All worked right off the bat except for Void, which made it as far as showing the mouse pointer but then froze.
Challenge 2: well, boring ;) All distros were pretty much ready to use and required minimal tweaking. With the tweaking part ranging from effortless (Mint) to minor headscratching (Neon). Not sure whether /etc/X11/XF86Config still exists but I did not miss editing it today.
Challange 3: more interesting:
Neon: all worked as expected except some trial and error required to get Wine working: wine32 was required but it wasn't getting installed by default, apparently. (Not a whole lot easier on Mac anyway, with separate downloads & installs for Wine and XQuartz)
Ubuntu: I failed as apt refused to acknowledge the existence of the packages I needed. This is weird as I believe Neon relies on the same package database. Though undoubtedly my fault, not reading the manual, it is perhaps a bit interesting that I could not readily find my way around the problem.
Fedora: everything worked except for Wine, as the live system ran out memory (disk space) on installing it. Not a big deal, everything else worked very well. Aside: I'm an avid runner and "DNF" is not the most likeable of names for a program I have to use very frequently! j/k..
Mint: everything worked at take one.
I know this isn't even scratching the surface of the surface but I think for now I'm going to go ahead and play more with Mint and Fedora after installing them on MB Air hardware or MB Pro VMware.... with a mind of getting back to KDE/Neon eventually.
interesting! Thanks for posting your feedback, I think mint is really great, I'm an ArchLinux user but I like having mint installed on some laptop, the installation is very straightforward and I feel it's way less bloated than Ubuntu for example. And pretty much everything worked out of the box with the laptops I've installed it on (mostly dell laptops).
I haven't used Ubuntu much lately but I remember always having to add community repository to get some package I needed. (Also one of the reason I love Arch, a lot of packages there updated more quickly than most distro + the AUR for everything not present in official repo)
Aye, very happy to have found what look like really viable alternatives, this is promising. And if I manage to make the transition, I will eventually want to try out more sophisticated distro's like Arch, I am quite sure of that.
I would say that Archwiki covers a lot of things for a lot of distros, but yeah I would only recommend Gentoo to 'advanced' users, or if you really want to get into it the hard way.
Fedora 32 Workstation is pretty good if you want to see the best of what Linux can offer. It may not be the lightest and fastest distribution but it is easy to install and everything works. You'll get to experience Gnome which is the most original Linux desktop environment and the best one in terms of user experience in my opinion.
If you want something more traditional with the start menu or dock or desktop icons, perhaps something like KDE Neon is better place to start. It might feel more familiar. Will be lighter/faster too.
Put each of them on a USB and run them live on your machine for few minutes each and see which one makes more sense to you.
I think the fact is there simply isn't a solution that works for both the "layperson" and highly technical people who want to do development. Laypeople cannot be trusted to admin their machines, but experts need access to those bits. Leaving a backdoor to real admin access for the experts just means laypeople will abuse those backdoors and mess up their machines again, with dire consequences for the entire planet. You see the same problem with power user UI features vs dumbing down for phones and average users. People keep trying to bridge this divide and I'm just not sure it can be done.
> Laypeople cannot be trusted to admin their machines
Yeah, but they're the ones who paid for their machines. So... you're saying they're not allowed to use them how they wish?
> Leaving a backdoor to real admin access for the experts just means laypeople will abuse those backdoors and mess up their machines again
Remembering the last 20 years of computer history, most of the critical fail wasn't caused by "laypeople abusing backdoors" but horrible security holes in popular, widely used software packages: Outlook, Flash, Acrobat Reader, Internet Explorer. Apple/Microsoft are not locking down their OSs to protect users from themselves, but rather from other developers. We, software engineers, seem to have completely failed our users as a profession.
I happen to enjoy using linux on my laptop. In fact, I think it’s pretty great. But that’s because I can customize it to work the way I want—something that I found hard or impossible to do back when I was using MACOS.
If you add "unfixable" to "disaster" the problem becomes more clear.
Windows is a unfixable disaster, you can't fix it sorry.
Mac OS is now an unfixable disaster, you also can't fix it sorry.
Linux may be a UX disaster, but you can, uniquely, modify it. You can change your UI. You can attempt to fix the problem, and have a real shot at doing so.
Linux is the only one where you can do something about the problem - which is a strong reason to prefer it.
Not only can you modify Linux in theory, it is actually getting _easy_ to do so.
The biggest reason I enjoy elementary OS as a distro is that everything lives on GitHub, package releases happen through GitHub Actions, etc. Fixing a bug can be faster than merely filing a radar in the Apple ecosystem.
> Linux was always a disaster in terms of user experience and isn't improving.
Nonsense, 'Linux' can be what you make it. You can have it as sleek as something straight out of the fruit factory or as spartan as a VT100 and anything in between. If you're new to the game the pre-packaged 'consumer' distributions might be a good starting point but for those with a bit of nix savvy - of which I assume there to be many on this board - those bells and whistles probably just get in the way.
If my 8yo daughter and my 82yo mother can use Linux - the latter through a remote X2go session from her kitchen table in the Netherlands to my server under the stairs in Sweden - I'd say people around here can be assumed to be able to handle it. The nice thing about 'Linux' is that you can change out those parts which you find disagreeable for whatever reason for those you like better, this in contrast to that last bastion of somewhat good, thoughtful design, user experience and attention to detail* which by your own statement has been changed into excrement. Just take out the shitty bits and replace them with something better... oh, no, not possible...
That is why the parent poster is right in this sense, things in 'Linux' land might not be perfect - and can never be 'perfect' since one person's perfection is another's nightmare - but at least you get to do something about it.
>Linux was always a disaster in terms of user experience and isn't improving
I'm honestly pretty baffled as to what keeps this meme alive, as KDE and GNOME are both very popular and provide simple, intuitive interfaces for the typical user. Plasma is only complex if you're the type that really wants to customize, but there its complexity is (mostly) necessary for its wide range of possible configuration. People have this idea that desktop Linux users are all a bunch of dorks playing around with Arch and tiling window managers all day and then posting their anime wallpaper setups on /r/unixporn, but that hasn't actually been true for a long time.
Yeah Linux is awesome. I don't get the hate either. I have like 5 apps I use in Linux Mint, and they look exactly the same way they do in MacOS (Spotify, Discord, Firefox, Godot, Sublime, VSCodium, Terminal)...
The settings UIs in Mint are easily way better than in Windows and Mac.
I hate bloated OSs and unfortunately Mac OS is one of them. I know how everyone wants everything to work out of the box and I know it's very natural to want so but I cringe if I find out my OS doing something behind my back. That's why I'd never use Windows, Mac OS, Ubuntu, etc. They all violate my privacy and slow my system to do so.
I use Debian, I like Debian. When I run Wireshark I don't see unknown requests destined to debian.com. That is the definition of simplicity for me. And yes, it doesn't always work out of the box, you have to install some drivers, change configurations but it's getting better and easier. Yet, I'm a software developer so I understand and like that stuff.
> Linux was always a disaster in terms of user experience and isn't improving.
No, you can't define it as a disaster, it's not. If you're an end-user that understands nothing of computers maybe you can but otherwise it's not a disaster. It's just harder and getting easier by day.
Might want to make it a used/refurbished Mac. Newer Macs don't run Linux well (at least as of yet); the whole T2-chip based stuff on newer machines is especially problematic.
If it checks with Apple servers every time you execute a new binary, what happens if you don't have an Internet connection? Are you just unable to run new code?
The article says "One way to solve the delays is to disable your internet connection" so I assume it just doesn't bother with notarization when you do that.
Which makes a mockery of the whole security angle - how can this be utterly essential for security while connected and then just tossed aside as optional as soon as you exit Wifi range? It can't be both.
The linked website isn't loading, so I don't know what it says, but: if we're talking about notarization, you can "staple" the notarization to a .app or a .pkg, which means you don't have to do the internet lookup at all, and you can run the apps without having access to the internet. I'm not sure about the technical details, but I would assume you add some sort of signature that's like "This .app with hash X has been notarized and it's fine" signed by Apple's secret key.
> If it checks with Apple servers every time you execute a new binary, what happens if you don't have an Internet connection? Are you just unable to run new code?
It waits 5 seconds while trying to connect, and then it gives up and caches the program as un-notarized, allowing it to run faster on later executions.
Notice that notarization seems to be disabled if the network is disabled from within the OS. To observe the 5 second delay you need to cut the connection outside (e.g., on your router), while the mac still thinks it is connected. I observed it by running catalina inside a virtualbox, and disabling its network.
Damn, I too have noticed that when developing in compiled languages (C, C++, Go, Rust, what have you) the first execution after a recompile is always noticeably delayed. I thought it was odd but didn’t bother digging into it. This must be why! (Can’t recall having this problem with scripting languages, but maybe subsequent modifications don’t trigger a notarization check? Edit: Yeah TFA does mention this.)
I understand the purpose of notarization but I feel like they could've come up with a much better solution to this. A network call __everytime__ someone runs an executable is not acceptable. But for the cases where the user is offline, Apple must keep a list of notarized apps on the machine...
I've been forced to update to this pile of shit because latest iOS requires latest Xcode which in turn requires Catalina. It's a nightmare.
First off the new apps (music, podcasts, etc) are terrible. They killed off iTunes but replaced it with much worse. These apps don't behave like standard macOS apps, the UI is full of inconsistencies and is just so empty. This website has nice examples of the failures of modern Mac OS: https://annoying.technology
For some reason after updating the "new updates" badge was stuck on the system preferences icon (and even on the preference pane itself) despite no updates being available. I ended up having to delete a plist and reboot to fix it, apparently a common issue.
The Mail app will now randomly play the "new mail" sound. I can't confirm it for sure but I'm assuming it's treating read, existing mails when they are moved to the trash/archive or newly created drafts. They screwed up the mail app, a problem that has been solved for decades. WTF? The worst is that I see no major changes in there, so why touch the mail client in the first place if you're not even going to give me additional features in exchange?
Xcode was stuck upgrading in the App Store. It would start the process and never make any progress. Cancelling it had no effect. Rebooting cancelled it but the second attempt, while making progress, ended up failing with a generic error message with no actual information. Logs are useless because they're being spammed by all the background processes even during normal operation making it impossible to find anything. Finally the third attempt succeeded.
1Password now takes 5 more seconds to unlock my password database. Somehow this disgrace of an OS slowed down the password hashing process by an order of magnitude.
Switching screen resolutions or connecting to an external screen takes a good 10 seconds of flickering and frozen UI before everything starts working again. This is now actually worse than both Windows and Linux. I dread moving the laptop or touching the USB-C cable (also because USB-C is so brittle) when it's connected to an external monitor out of fear that it'll disconnect/reconnect and I end up in a 30-second cycle of flickering.
I upgraded a couple of days ago, so those are not early bugs. Apple had a year to fix all of this. The Xcode thing might be an isolated issue but there's no excuse for the general performance penalty or the stuck update badge which has many hits on search engines suggesting it's a widespread issue.
Re: downloading Xcode, this page has saved me hours: https://stackoverflow.com/questions/10335747/how-to-download.... It's just a list of direct links to each version of Xcode at apple.com. Mystery why Mac App Store downloads still can't be bulletproof after all these years.
I actually prefer the App Store approach because that way the majority of my updates are in one place and can be done automatically in the background. The problem is that it used to work fine and they managed to break it.
I usually keep at least one prior release of Xcode on my machine, up to the latest patch for its series. So right now I have 11.5 and 11.4.1. I've hit so many problems with new versions in the past. I wish I could just let MAS handle it for me, but it's just never been an option, aside from the issues it has actually working.
This one drives me nuts. I mean what in the hell is that downloading doing that it manages to fail arbitrarily. This is downloading files, how the fuck can it be so complicated and broken.
> I've been forced to update to this pile of shit because latest iOS requires latest Xcode which in turn requires Catalina. It's a nightmare.
I'm literally halfway there as I type this, Xcode 'installing components'. Having to upgrade essentially everything just to get the right dev tools for the current iOS is madness, feels like buying a new house to fit the new coffeemaker...
Forcibly relocated to a refugee camp tent with leaking water pipes next to your air mattress. But at least everything around you in your tent is white, flat, and material and your coffeemaker works.
I install new versions of Xcode about every two weeks on average. The amount of time it takes to have a new Xcode running is at least an hour: first you download a massive XIP, then the system "verifies" it forever when you try to open it, then it takes forever to unarchive because it's huge, then you need to copy it from ~/Downloads to /Applications which takes another couple of minutes. Then you hit the component installation part… (I think this step has something to do with installing new MobileDevice frameworks?)
Have you actually done anything to try and fix these issues? Because this is not typical
I use 1password and it doesn't take 5 seconds to open. Did I accidently install linux or something? because since it's the OS causing your delay it would be causing me to have the same delay.
xcode installs just fine for my entire team. Just did the update myself, worked just fine.
I plug into a dock and undock constantly during the day, and while it could be quickinger, 10 seconds and flickering is NOT my experience.
and what the fk are you doing to your connections that you consider usb-c brittle?!?
There's a lot more non-determinism in a modern MacOS install than you imagine. "WFM" doesn't invalidate the anecdote to which you reply. TFA is about putting network requests in system calls ffs.
What makes you think that your experience is the typical one? I've had these problems as well and so have a lot of people I've talked too. Obviously that's just more anecdotes and doesn't prove anything but neither does your comment.
I've just tried connecting to my external monitor again and 10 seconds is exactly how much it took - no exaggeration there. The internal monitor goes blank for 1 or 2 seconds, then both monitors turn on and it takes another ~8 seconds for the UI to adjust and the windows to be moved to the proper place.
> you consider usb-c brittle?!?
It's much easier to unplug USB-C than HDMI or DisplayPort, for one. USB-C itself is a terrible mess that requires an engineering degree to figure out what's compatible and not, and maybe it's just me and I have a shit hub but I had an external hard drive crash midway through a file transfer due to power issues despite being powered by a Apple charger (the hub and all the peripherals went dark and the laptop stopped charging, then started cycling on and off where every time the drive tries to start up again it kills everything).
OP is a typical Apple "You're holding it wrong" reaction. It's never Apple's fault when its OS doesn't work right - it's always the user's fault. Despite the user paying a premium for Apple, or Apple having control over hardware its OS works with.
I also upgraded days ago, assuming they would have had time to fix the bugs. However, I can say the USB-C external screen flicker was plaguing me before the upgrade and hasn't gotten worse. Turning off hot corners, oddly, helped, although the problem hasn't gone away.
I don't share your issues with Catalina [1] but I have to agree Podcast app's UI design is very strange. The primary interface should be the "Episodes" tab.
Just like Twitter's UI, app developers think they know what content is best for you with a 'feed' or 'featured'... they've completely abandoned chronological ordered lists of content unless you click 2-3 buttons.
[1] Catalina has been painless for me, not sure why my experience was different than everyone else
> The Mail app will now randomly play the "new mail" sound.
It’s not quite random: it plays the sounds as it gets new email, but then it takes anywhere between a couple of seconds to a minute for the new email to be visible in the UI. Infuriating.
> Xcode was stuck upgrading in the App Store. It would start the process and never make any progress. Cancelling it had no effect. Rebooting cancelled it but the second attempt, while making progress, ended up failing with a generic error message with no actual information.
I just normally kill the store-related daemons when that happens.
I've had a similarly painful experience upgrading last week. Though it doesn't seem quite so bad as the posters above, and after making a few fixes most everything is back to normal.
My one remaining serious annoyance is that my external monitor color settings are screwed up and there appears to be no fix. Reds are purple and everything is just a little washed out, which is a shame for a 4k monitor that was beautiful with Mojave.
Strangely, right before the computer restarts, or if booted in safe mode the color starts to look perfect again, but I can't seem to replicate that in normal operation.
I have this issue constantly, even the laptop screen itself will get 'washed out'. The solution is to go to Displays > Colour Profiles and change the profile to any other one and then change back to the default.
Our help desk is wise enough to keep existing mac users on the oldest supported macOS version; but inevitably at some point in the future they'll have to roll out the latest version. This will be the week when I will exchange my macbook for a Windows 10 ThinkPad. A lot of our dev teams have moved to this setup alreay using WSL or a VM for Linux if really needed and it has been really smooth (our helpdesk staying on top of the Active Directory and Windows Update management game also).
I share almost all of these issues. What drives me super nuts is the multi-display support which NEVER "just works".
I have to disconnect and reconnect USB-C 3 times, turn off the second monitor, switch inputs, restart the €3000 machines twice or whatever. So annoying, how does this pass QA at all?
Also, don't setup and use multiple users at the same time. That's really messy as well.
Since Steve left us, over time I've witnessed so many issues crop up in the Apple ecosytem, for users/customers and developers, and it's clear that there's nobody to be shit-scared of anymore at Apple.
So many recent things would have pissed him off.
There's no way the 'notch' would have appeared. Nor the fact that the iPhone camera design stopped the device sitting flat on a surface.
They don't give a shit if you're not using an Apple monitor. Witness the ProDisplay, which doesn't even have a power button, and talks to the computer to turn on.
Your experience certainly sounds bad, but none of this is normal; mail sound, USB-C cable brittleness, 1password slowness, all of it works nicely for me.
I completely understand why things are going the way they are as our computing environment has become ever more hostile. But I am very nostalgic for the time where I would power up a Vic-20 and within seconds be able to get to work.
Teaching my daughter to program on a modern computer, we spend more time bootstrapping and in process, than we do in actual development.
Because that was the experience on those old machines. Switch it on, straight to BASIC prompt in a second or so. If you want to program it’s frictionless. And you can’t break it because BASIC is in ROM.
> Teaching my daughter to program on a modern computer, we spend more time bootstrapping and in process, than we do in actual development.
Arch Linux does not help with this, unless you make it boot into a VIC-20 emulator or something. Arch can help with boot speed, but once you're booted you're back in a full modern OS. So fine, install VSCode and Python... okay, now you get to figure out libraries. Manage terminals. Arrange a filesystem. This is not getting you closer to the VIC-20 or C64's "boot into BASIC".
This is very possible on Arch Linux, moreso than other distributions. After installing Arch, just run the following two commands:
sudo pacman -S xonsh
chsh --shell /usr/bin/xonsh
Bam! You're booting straight into a full Python environment when you turn on your computer. This is similarly achievable with other languages as well, including BASIC.
No, although `pacman -Syu python base-devel` isn't exactly a burden. But then what? If you're trying to get back to a simple "turn on computer, land in simple programming environment", how does it help that you have python and gcc available? You still have to manage libraries, learn to use a compiler, and all the other joys of modern development. The only thing Arch Linux gained you was a bit simpler OS and maybe better boot times.
Yes it does. When you pacstrap you include base devel. From that moment onwards your you will have a full programming environment all ready to rock and roll on your installation.
Yes, and you have a full operating system and all the joys of modern development. You absolutely do not have anything like a VIC-20 that you can power on end have a basic programming environment 5 seconds later. At best, you turn it on and 5 seconds later have a python shell, where you can do a certain amount of development before you get to experience the joys of managing libraries and dependencies. Thus bringing us back to what I perceived as the primary complaint that there's way too much setup and baggage required just to get to the actual programming part.
You can use python without needing to manage any packages -- you'll have to write most things from scratch, but isn't that the hardware BASIC non-internet experience regardless?
That computers are just slower to interact with now is such a truism that we hardly remark upon it any more. It seems utterly insane that in the early 90's I could just run Windows 3.1 on a bit of kit that in all likelihood wouldn't even power a toaster today, and the experience was, well, frictionless. I don't recall ever thinking "wtf is this thing doing?", whereas today, by contrast, if I have the audacity to be afk for long enough for my Windows 10 box to go sleep I know I am in for an infuriating waste of minutes' worth of disk thrashing before the bloody thing even deigns to reacknowledge my existence.
I call this 'Outsourcing the cost of development to the user'...
Getting knowledgeable people costs money so we build more abstractions that lower the cost of development and pass the costs of development from the company to the user in the form of requiring more hardware to do the same thing.
How come I need 16Gb of RAM these days when 8Gb did it yesterday? How come my phone needs 4Gb of RAM while my 2012 tablet had 1Gb? Sure the hardware is cheaper but we're still not using the hardware to it's fullest.
My 256MB RAM, 900Mhz Duron machine (single core, naturally) in ~2002 (IIRC?) could do just about everything my modern one can. We even had video chat! It was just much lower res. The limiting factor in online stuff was, by far, connection speed, not the power of my hardware. That was about the point where the hardware was fast enough and had enough memory that I could multitask in a modern way without hitting problems like popping/stuttering audio or bad swap issues. Aside from legitimate increases in memory use for higher-res media, most everything since then, from my perspective, has been pure bloat. Why does 16x that memory and two cores at double the clock feel insufficient for extremely similar workloads and software feature-sets? Fucking bloat is why. Largely, but far from solely, web-tech infesting everything.
Before that, my 64MB RAM 100mhz Pentium could usually have a couple things open before it'd hit swap too badly. I'm talking like Word and a web browser, not calc and notepad. None of the equivalent programs to those can even open all on their own in a footprint smaller than 64MB these days, let alone with other programs and the OS in the same space. Hell, how many operating systems fit in that with a GUI as capable and usable as, say, Win98se (let alone something really incredible on the performance front, like BeOS)?
I agree with the main sentiment, but I have made my peace with it. Mainly Java and Electron based apps because they do provide us with a nice thing that was impossible years before unless you wanted to become a digital hermit: Linux on the desktop.
I can now use simplenote, discord, slack, the jetbrains dev suite, visual studio code, and this is without including separate developments like Steam, which has made it effortless to switch between Windows, Linux and Mac.
That being said, I still consider Mac OS the superior OS (this call home issue from the article aside), mostly because the font rendering still works better after all these years, Windows and Mac still have better quality software available for them, and Mac still does not have the forced updates as Windows does. Also I have noticed that in Ubuntu, some electron apps like Simplenote, the copy and paste of text is funky at times, like not even letting me select stuff.
The reason is very simple: developers don't want to develop anymore, they just want to offload real programming to third party libraries, where what used to take 100 lines of code to accomplish will take 10K or more (because, obviously, the library will do the most general version of what it wants to do). All this is considered "good development practices", which means that programs will inflate to take whatever memory is available and run slower for as long as we continue to use the same practices.
This has quietly become a pretty serious issue. Most software developers have simply stopped caring about systems with traditional HDDs. This is even true on Linux - I found out a while back that all the KDE developers are using SSDs, which is why they weren't fixing issues where startup time is affected by disk latency. I eventually gave in and bought a 250 GB SSD for my old laptop, there was simply no other option.
I switched to a linux desktop full time last week because of this exact problem. VPN w/ windows would flake out on me all the time, and I got sooo tired of just...waiting. Remember when windows search worked? Like, you could press the windows key, type what you were looking for and find it? Quickly?
Being able to turn the computer on, type in my password and have it be just..ready is so incredibly refreshing. Having a terminal with 0 latency, where copy/paste is sane? Worth a zillion dollars to me right now.
Currently playing with opensuse tumbleweed, i'll probably get frustrated by something and move to arch, so I can fix that something and also be frustrated by a hundred other things.
I don't have a ton of experience with other options, but 2 weeks in and tumbleweed has been pretty plug and play! 0 issues getting my netcore/python/golang/docker dev stack up. I get a weird popping noise in my usb dac at the login screen but that's the only issue I've had so far. Teams screen sharing even works perfectly! I chose it over Ubuntu 20 because I knew I wanted kde and it seems like a first class citizen in tumbleweed, while still being vaguely stable. Not-quite-bleeding edge! I ran freebsd/kde for fun back in the halycon days of lamp stack and gnome never felt...right to me when I would test drive Ubuntu desktop.
Good to know. Personally I think that Ubuntu has gone downhill. I preferred unity over gnome. On a fresh install of Ubuntu, gnome is confusing with it's split with two taskbars that has some overlap in functionality.
Windows search turning into bing search is one of the most frustrating little things. You used to be able to instantly pull up files by name but now it just dumps you random garbage from the internet.
It’s still really fast if you disable Cortana and Internet search results. I launch most programs by hitting the windows key, a few characters and enter.
I remember being able to watch network traffic and if you (or some other actual person on you network) weren't doing anything nothing would be there. Yes even if you had a few webpages open but weren't clicking anything. Now your machine's "idle" and you capture on your network interface and it scrolls at hyperspeed.
This is upsetting for me, too. And for a few others. But actually very few people care because they just don't see it. The people who designed it this way take care that users at large have no idea what is going on.
It's really very sad, because users have no idea what is going on and there is no incentive for bad programs to improve (actually, there is generally incentive in the opposite direction, because it's work to write well-behaving apps). Users just know that they need to keep buying new computers and that their battery life is worse, but they can't figure out why so they point fingers at everyone but who they should actually be blaming.
Remember when shitty user-hostile spying wasn't a library you included that assured you in its readme it was "made with [heart] in California"? Ah, the days when only criminals and bigcos casually engaged in shady crap.
That's a somewhat unrelated discussion, but yes, I am not very happy with the current state of software where people think they are entitled to out-out analytics information coming off my machine.
Well, I remember the days when a message in Windows cropped up saying (standard at the time when a program crashed): "Do you want to send the error report to Microsoft" and my boss called me, asking a bit concrened, "Please, tell me honestly, what do you think - should we send them this error report?"
I've been doing some network programming lately, specifically low level raw socket work. Sitting there with wireshark running the sheer volume of traffic with applications dialing home was kind of shocking.
I mean, I know it's happening, I (sadly) expect it to happen now. But seeing all the bits whizzing over the wire brought home just how much your machine is reporting about what you're up to.
> It seems utterly insane that in the early 90's I could just run Windows 3.1 on a bit of kit that in all likelihood wouldn't even power a toaster today, and the experience was, well, frictionless. I don't recall ever thinking "wtf is this thing doing?" ...
I generally agree, but I sometimes ran Windows 3.0 on a 386SX-16 in the early 90s, and often wondered why it ran so slow on my admittedly underpowered but supported system.
At some point I read (perhaps in Compute! or BYTE) that Windows made something like 20 or 30 syscalls to draw one line of a window's border. That seemed exceptionally inefficient to me, so I stopped using Windows. I generally worked in DOS, but if I wanted a GUI, Geoworks provided an experience at least ten times better (subjectively) -- smooth UI, ability to multitask, a surprisingly good word processor and other well-designed software included.
I recall windows 95/98 being pretty slow to boot. I also recall being warned by teachers not to move the mouse while things were booting as that would allegedly slow things down further.
These days the only real time I wonder "wtf is this thing doing" is when I'm waiting about 5-10 seconds for my mac to wake up from sleep.
Here is a Pentium 200Mhz starting Win95, only about 20 seconds from "Starting Windows 95" to the login screen. 40 seconds including the full powerup/BIOS sequence. Not too bad.
> Windows 10 box to go sleep I know I am in for an infuriating waste of minutes' worth of disk thrashing before the bloody thing even deigns to reacknowledge my existence.
Yeah, what the heck is this? I use a win10 box solely for gaming, and every single time I wake from sleep, Antimalware Executable keeps my machine from doing anything for several minutes. It's infuriating.
For many years, I had a very nice experience with NOD32. By far the best antivirus I have used in terms of UI and resources. Well, admittedly not that high of a bar.. but they really seem to care about efficiency and and elegance.
Considering the built in one is pretty slow (and gives useless notifications), I expect it would be an improvement.
And now that "the web is the internet" even more than ever, developers and designers are giving us spinners/loading indicators ALL THE TIME. At least in my tabs they are.
The web is much, much, much slower than it used to be.
It takes less than five seconds for my Windows 10 to go from asleep to ready for work, and that includes logging in with Windows Hello (the fingerprint reading is crazy fast).
At the Computer History Museum, I use an IBM 1401 mainframe (1959). When you hit the power button, relays go ch-ch-chunk and it's immediately ready to use. Because it has magnetic core memory, it even has the previous program already in memory, preserved over power-down. Computers have taken many steps backwards as far as startup time. Of course, loading a new program from punch cards is slow, so some things have improved :-)
I've spent surely coming up on years watching and reading all the content you've either created or helped produce. Indeed some things may have improved, but I sure enjoy the heck reading and watching all your exploits with 'legacy computing'!
> I completely understand why things are going the way they are as our computing environment has become ever more hostile.
care to elaborate a bit? what did you understand?
i just can't get my head around this idea that most non-mobile OSes have become such hostile environments...
yes, the population at large only uses their phones and tablets and doesn't care much. but they would be left without any entertainment if it wasn't for those of us who still need decent non-mobile environments.
We're moving away from general purpose computing, and Apple is one of the greatest forces in this.
Also, they are a threat to a free market for software, as they regulate their walled garden with arbitrary rules and skim off a lot of value.
I honestly don't understand why a large portion of developers have so much love for Apple. I'm personally a proud owner of a desktop PC with an ASUS motherboard. It serves me fine, and gives me full control over the software installed on it. I'm not a laptop-person but I believe there are many perfectly capable non-Apple laptops out there.
Apple uses the same tools you do. They just might not be using it like you are; you can find a lot of features that clearly have no reason to exist outside of Apple nonetheless shipping with their software.
Is there a list somewhere of Apple's in house dev environments or workflows? I wonder what cool tricks they use internally that could be pretty useful generally.
Nothing special that can really be talked without internal context. You can get a hint at how they use their own tools though (which are available externally) if you pay careful attention to their public appearances and presentations.
That's kind of my point - it's surprising to me that they're shipping slow hardware and software, when they're used to develop that same hardware and software. Developer time is expensive.
I would actually be quite happy if the engineers were forced to work on four-year-old MacBook Pros and develop against Display Zoomed iPhone 7 and the second generation Apple Watch, using the toolchain and software they push to their developers.
No. A special directory can be created at the root of the file system called /AppleInternal. Then, if you work at Apple, you can put some special files there that do stuff. I've read somewhere that they are able to easily disable all of this privacy protection crap and other annoying stuff.
There's nothing really special about /AppleInternal, it's just a fairly normal directory that a couple of tools change in order to do things like offer more detailed diagnostics or the option to create a Radar. On a normal internal install there are some internal utilities, many of which are listed here: https://www.theiphonewiki.com/wiki/Category:Apple_Internal_A.... But their code is all Xcode projects and stuff, it's not like they're really using special tools for themselves except in certain cases. There are a couple of internal tools that possess entitlements to bypass security, but more often than not engineers just run with the security features disabled, which you can do yourself.
I wouldn't be surprised if they've determined that developers will generally put up with a bad experience in order to have access to the massive iOS market.
Yes, that is what drives me crazy whenever people say Mac is only 9% of revenue and they dont care about it.
If the Mac revenue was separated out on its own, it would be about Fortune 120, that is higher than Kraft Heinz. With plenty more space for growth. Apple only has 100M Active Mac users. There are 1.4B Windows PC.
Except all of Apple's other devices are built on macOS. Apple's clear de-prioritization of macOS based on revenue numbers is so insane I can barely believe it's happening. If developers, who use Macs in large numbers today, go to another platform, there's very real risk that their entire empire starts to come apart at the seams. And, this may just be me being naive, but it doesn't seem like that much work to keep macOS going, all they have to do is stop trying to turn it into iOS. They are literally doing a tremendous amount of active engineering work that drives developers away from their platforms.
They are risking their entire empire because (apparently) someone at Apple has an axe to grind with macOS's Unix underpinnings. And until they start getting real consequences (developer's leaving in huge numbers), it doesn't seem like it's going to stop. The tragedy is, if they ever do reach that point, where developers are leaving in huge numbers, it'll be too late. Platforms are a momentum game, you're either going up, or you're going down. And once you're going down, you're as good as dead.
100% agree! If more people understood this, I hope this narrative would gain some traction and eventually reach Apple management.
To me, the idea that an OS is mostly finished is completely bananas. There's so much room for improvement and hardly any of that potential was tapped into in what's starting to feel like a decade.
And if Apple had invested into a successor for Cocoa, there might be a larger gap between native apps and (Electron) web apps, leading to some lock-in. Instead most new stuff is not native and for good reasons (and I do dislike the way they don't adhere to Mac conventions, but still).
I think ultimately the problem is Tim Cook. He's too attached to Apple's stock price. I think that's the one metric that he believes rates his performance. But inertia is a bitch. Like in politics, the effects might hit hard only once he's out and it could be too late to fix by then.
If I think about how much this impacts the economy overall (i.e. make millions of knowledge workers a little bit less efficient) then I can only hope that I'll see more sophisticated organizational structures in my lifetime that prevent such erosion.
Agree. That's probably also one reason why more and more people want to use cross-platform app frameworks instead of developing for iOS natively. That way, you can do most of the dev work on Windows and Android, and you'll only need to use Mac & XCode for compiling the iOS binary.
I was thinking exactly this, 8 years ago.
I moved from an imac + mbpro to linux only.
It took longer than expected. I even intended to buy put options, but someone I trust told me otherwise and to invest in equity instead, which I did, because I know that most buy decisions are not made rationally.
But it looks like the time has come now?
On the other hand, I have been off by several years before.
People are crazier than you think, especially when it comes to status and association with brands and self-confirmation of past decisions. They might well put up with Apples moves for a few more years.
Apples Macintosh division is the most profitable PC company in the world and has been for at least a decade. In fact, Macintosh is likely more profitable than all other PC companies combined.
Just an estimate. Revenues about $25B a year with net margins around 15-20% works out to $4B to $5B in profits a year. It’s possible margins are slightly lower than that but historically they were 20%+.
The rest of the market is roughly $100B, and has net profit margins of 2-3%.
So many of the frameworks have shared code between macOS and iOS (e.g. MapKit, Foundation, Contacts etc..), so a perf fix in iOS pays dividends on macOS too.
Perf changes are too numerous to mention, I’d recommend watching last year’s WWDC keynote describing the iOS 12 v/s 13 perf advancements.
I agree. This kind of behavior certainly smells like teams doing their development work on high-capacity low-latency networks without much performance oversight.
In our company many of us have similar issues. I have always loved OSX but this time it is driving me crazy. I though the issue was some sort of company antivirus/firewall, or it could even be a combination of that and this issue (maybe my vpn + path to company firewall is what magnifies the issue in this post). The thing is that some commands take 1 second, some others take 2 minutes or even more. Actually, some commands slow down the computer until they are finished (more likely, until they just decide to start).
For example, I can run "terraform apply" and it could take up to 5 minutes to start, leaving my computer almost unusable until it runs. The weird thing is that this only happens sometimes. In some cases, I restart the laptop and it starts working a little bit faster, but the issue comes back after some time.
It's already been a few months since I try to run every command from a VM in a remote location, since I am tired of waiting for my commands to start.
I have a macbook air from 2013 which never had this issue.
Any easy fix that I could test? Disconnecting from the internet is not an option. Disabling SIP could be tried, but I think I already did and didn't seem to fix it, plus it is not a good idea for a company laptop.
Don't we have some sort of hosts file or firewall that we can use to block or fake the connectivity to apple servers?
A command like `terraform` shouldn't trigger the check because the quarantine system is bypassed altogether when you download and extract an archive. Maybe this is a red herring and your initial gut inkling is correct.
IIRC the big thing that changed with 10.15 for CLI applications is that BSD-userland processes (i.e. ones that don't go through all the macOS Frameworks, but just call libc syscall wrappers like fopen(2)) now also deal with sandboxing, since the BSD syscall ABI is now reimplemented in terms of macOS security capabilities.
Certain BSD-syscall-ABI operations like fopen(2) and readdir(2) are now not-so-fast by default, because the OS has to do a synchronous check of the individual process binary's capabilities before letting the syscall through. But POSIX utilities were written to assume that these operations were fast-ish, and therefore they do tons of them, rather than doing any sort of batching.
That means that any CLI process that "walks" the filesystem is going to generate huge amounts of security-subsystem request traffic; which seemingly bottlenecks the security subsystem (OS-wide!); and so slows down the caller process and any other concurrent processes/threads that need capabilities-grants of their own.
To find a fix, it's important to understand the problem in fine detail. So: the CLI process has a set of process-local capabilities (kernel tokens/handles); and whenever it tries to do something, it first tries to use these. If it turns out none of those existing capabilities let it perform the operation, then it has to request the kernel look at it, build a firewall-like "capabilities-rules program" from the collected information, and run it, to determine whether it should grant the process that capability. (This means that anything that already has capabilities granted from its code-signed capabilities manifest doesn't need to sit around waiting for this capabilities-ruleset program to be built and run. Unless the app's capabilities manifest didn't grant the specific capability it's trying to use.)
Unlike macOS app-bundles, regular (i.e. freshly-compiled) BSD-userland executable binaries don't have a capabilities manifest of their own, so they don't start with any process-local capabilities. (You can embed one into them, but the process has to be "capabilities-aware" to actually make use of it, so e.g. GNU coreutils from Homebrew isn't gonna be helped by this. Oh, and it won't kick in if the program isn't also code-signed, IIRC.)
But all processes inherit their capabilities from their runtime ancestors, so there's a simple fix, for the case of running CLI software interactively: grant your terminal emulator the capabilities you need through Preferences. In this case, the "Full Disk Access" capability. Then, since all your all CLI processes have your terminal emulator as a runtime ancestor-process, all your CLI processes will inherit that capability, and thus not need to spend time requesting it from the security subsystem.
Note that this doesn't apply to BSD-userland executable binaries which run as LaunchDaemons, since those aren't being spawned by your terminal emulator. Those either need to learn to use capabilities for real; or, at least, they need to get exec(2)ed by a shim binary that knows how.
-----
tl;dr: I had this problem (slowness in numerous CLI apps, most obvious as `brew upgrade` suddenly taking forever) after upgrading to 10.15 as well. Granting "Full Disk Access" to iTerm fixed it for me.
Apple replaced the very simple (i.e. function fits in a cache line; inputs fit in a single dword) BSD user/group/other filesystem privileges system, with a Lisp interpreter (or maybe compiler? not sure) executing some security DSL[1][2].
This capabilities-ruleset interpreter is what Apple uses the term "Gatekeeper" to refer to, mostly. It had already been put in charge of authorizing most Cocoa-land system interactions as of 10.12. But the capabilities-ruleset interpreter wasn't in the code-path for any BSD-land code until 10.15.
A capabilities-ruleset "program" for this interpreter can be very simple (and thus quick to execute), or arbitrarily complex. In terms of how complex a ruleset can get—i.e. what the interpreter's runtime allows it to take into consideration in a single grant evaluation—it knows about all the filesystem bitflags BSD used to, plus Gatekeeper-level grants (e.g. the things you do in Preferences; the "com.apple.quarantine" xattr), plus external system-level capabilities "hotfixes" (i.e. the same sort of "rewrite the deployed code after the fact" fixes that GPU makers deploy to make games run better, but for security instead of performance), plus some stuff (that I don't honestly know too much about) that can require it to contact Apple's servers during the ruleset execution. Much of this stuff can be cached between grant requests, but some of it will inevitably have to hit the disk (or the network!) for a lookup—in the middle of a blocking syscall.
I'm not sure whether it's the implementation (an in-kernel VM doesn't imply slowness; see eBPF) or the particular checks that need to be done, but either way, it adds up to a bit of synchronous slowness per call.
The real killer that makes you notice the problem, though, isn't the per-call overhead, but rather that the whole security subsystem seems to now have an OS-wide concurrency bottleneck in it for some reason. I'm not sure where it is, exactly; the "happy path" for capabilities-grants shouldn't make any Mach IPC calls at all. But it's bottlenecked anyway. (Maybe there's Mach IPC for audit logging?)
The security framework was pretty obviously structured to expect that applications would only send it O(1) capability-grant requests, since the idiomatic thing to do when writing a macOS Cocoa-userland application, if you want to work with a directory's contents, is to get a capability on a whole directory-tree from a folder-picker, and then use that capability to interact with the files.
Under such an approach, the sandbox system would never be asked too many questions at a time, and so you'd never really end up in a situation where the security system is going to be bottlenecked for very long. You'd mostly notice it as increased post-reboot startup latency, not as latency under regular steady-state use.
Under an approach where you've got many concurrent BSD "filesystem walker" processes, each spamming individual fopen(2)-triggered capability requests into the security system, though, a failure-to-scale becomes very apparent. Individual capabilities-grant requests go from taking 0.1s to resolve, to sometimes over 30s. (It's very much like the kind of process-inbox bottlenecks you see in Erlang, that are solved by using process pools or ETS tables.)
Either Apple should have rethought the IPC architecture of sandboxing in 10.15, but forgot/deprioritized this; or they should have made their BSD ...
In the Apple Sandbox Guide v1.0 [1], it mentions Dionysus Blazakis' paper [2] presented at Blackhat DC 2011.
In the latter, Apple's sandbox rule set (custom profiles) is called SBPL - Sandbox Profile Language - and is described as a "Scheme embedded domain specific language".
It's evaluated by libSandbox, which contains TinyScheme! [3]
From what I could understand, the Scheme interpreter generates a blob suitable for passing to the kernel.
That sounds about right. I was doing some work in this area very recently, which found a couple of methods to bypass sandboxing entirely, but somewhat humorously the issues did not require me to have any understanding of how the lower levels of this worked ;)
The Scheme interpreter only runs when compiling a sandbox. It's compiled into a simple non-Turing-complete bytecode, and that's what's consulted on every syscall. This has been the case since… 10.5 or something. It's always been on the path for BSD code. And Cocoa operations lower to BSD syscalls anyway. There's no system for them to get a "capability" for a directory tree; on the contrary, file descriptors ought to be able to serve as capabilities, but the Sandbox kext stupidly computes the full path for every file that's accessed before matching it against a bunch of regexes. This too has been the case as long as Sandbox has existed.
There is a bunch of new stuff in 10.15, mostly involving binary execs (and I don't understand all of it), but I'm pretty sure it doesn't match what you're describing.
> Much of this stuff can be cached between grant requests, but some of it will inevitably have to hit the disk (or the network!) for a lookup—in the middle of a blocking syscall.
Running any kind of I/O during a capability check is a broken design.
There is no reason to hit the disk (it should be preloaded), much less the network (such a design will never work if offline).
> IIRC the big thing that changed with 10.15 for CLI applications is that BSD-userland processes (i.e. ones that don't go through all the macOS Frameworks, but just call libc syscall wrappers like fopen(2)) now also deal with sandboxing, since the BSD syscall ABI is now reimplemented in terms of macOS security capabilities.
Is this actually new in macOS 10.15? I seem to recall this being a thing ever since sandboxing was a thing, even all the way back to when it was called Seatbelt.
> That means that any CLI process that "walks" the filesystem is going to generate huge amounts of sandboxd traffic, which bottlenecks sandboxd and so slows down the caller process.
Is this not implemented in the kernel as an extension? I thought the checks went through MAC framework hooks. Doesn't sandboxd just log access violations when told to do so by the Sandbox kernel extension?
> Unlike macOS app-bundles, regular BSD-userland executable binaries don't have a capabilities manifest of their own, so they don't start with any process-local capabilities (with some interesting exceptions, that I think involve the binary being embedded in the directory-structure of a system framework, where the binary inherits its capabilities from the enclosing framework.)
I am fairly sure you can just embed a profile in a section of your app's binary and call the sandboxing Mach call with that…
> I seem to recall this being a thing ever since sandboxing was a thing, even all the way back to when it was called Seatbelt.
Maybe you're right; I'm not sure when they actually put the Seatbelt/TrustedBSD interpreter inline in the BSD syscall code-path. What I do know is that, until 10.15, Apple tried to ensure that the BSD-userland libc-syscall codepath retained mostly the same behavioral guarantees as it did before they updated it, in terms of worst-case time-complexities of syscalls. Not sure whether that was using a short-circuit path that went around Seatbelt or used a "mini-Seatbelt" fast path; or whether it was by hard-coding a pre-compiled MAC ruleset for libc calls that only relied upon the filesystem flag-bits, and so never had to do anything blocking during evaluation.
Certainly, even as of 10.12, BSD-userland processes weren't immune to being exec(2)-blocked by the quarantine xattr. But that may have been a partial implementation (e.g. exec(2) going through the MAC system while other syscalls don't.) It's kind of opaque from the outside. It was at least "more than nothing", though I'm not sure if it was "everything."
One thing that is clear is that, until 10.15, BSD processes with no capabilities manifest, still had the pretty much exactly the same default set of privileges that they had before capabilities, which means "almost everything" (and therefore they almost never needed to actually hit up the security system for more grants.) I guess all Apple really needed to have done in 10.15 to "break BSD", was to introduce some more capabilities, and then not put them in the default/implicit manifest.
I suppose what actually happened in 10.15 can be determined easily-enough from the OSS code that's been released. :)
> Is this not implemented in the kernel as an extension? // I am fairly sure you can just embed a profile in a section of your app's binary and call the sandboxing Mach call with that…
Yeah, sorry, you're right; updated my assertions above. I'm not a kernel dev; I've just picked up my understanding of this stuff from running head-first into it while trying to do other things!
It's a new behavior that doing 'find ~' will trigger a MacOS (GUI) permissions warning dialog when `find` tries to access your photos directory, contacts file, etc.
> For example, I can run "terraform apply" and it could take up to 5 minutes to start, leaving my computer almost unusable until it runs.
On a clean Catalina install this does not happen. Does “terraform version” have the same delay? If not, check your remote configuration - maybe run with TF_LOG=trace. Terraform Cloud will definitely highlight the inherent performance problems of using a VPN.
Nearly every article I see about macOS or Windows these days further confirms to me that switching entirely to Linux was the right call. Maybe 2020 will be the year of the Linux Desktop by default.
When you run "bash hello" you are calling exec() on bash, passing "hello" as an argument, which bash then reads; when you run "./hello" you are calling exec() on hello: the kernel then treats "hello" as an executable, but notes that "hello" starts with "#!" and then will run the specified interpreter for you, passing "./hello" as an argument. The kernel doesn't think of "hello" as a program when you run "bash hello".
For reasons of personal prejudice, I'll never install any Windows version on any hardware I own. Debian was always my first choice back in the desktop linux days, and still is for servers, but I haven't looked at the landscape recently. It seems to have become more consolidated, which is not surprising but still mildly disappointing.
I understand but for laptops it's pretty bad these days if you want all features your laptop is providing, and a good energy management.
On mobile it's much better with Android, but Android isn't adapted to laptops. I haven't tried ChromeOS but it's pretty restricted from what I understood. WSL2 on Windows is Linux and it works great for me but I understand if you don't want windows in your life.
Also my first choice for servers and have used it several times on desktop so Debian would also be my recommendation even for a desktop these days.
Plus, if you're already familiar with how Debian works it should be a no brainer. None of that Ubuntu or other Debian-derived distros with extra sugar and bloat and that many times differ from actual Debian in just the right way to keep you scratching your head.
Even Debian "stable" is pretty good for desktop these days which in the past was always notorious for having super outdated packages but has greatly improved in that regard. Obviously, "sid" is still also a good pick for a desktop if you really need to always run the latest of mostly everything.
Well, Debian does use systemd by default now unless you want to go through some hoops to remove it (which I believe is still possible but not sure).
I personally have really no issues with systemd and now even go as far as completely removing the ifupdown, isc-dhcp-client, resolvconf and ntpd packages in favor of having my entire network stack configured by systemd-networkd, systemd-resolved and systemd-timesyncd instead.
It's pretty much a standard now across the board and I can't really find any arguments against it besides old habits so I've embraced it. Although it's obviously a bit opinionated, there is a good deal of functionality and flexibility on that thing.
Ubuntu 20 has been a pleasant surprise, it seems to have turned a productivity and speed corner.. I've been getting lost in it for hours on end and forgetting to use my MacBook.
The feeling reminds me of the first Macbooks I used when switching away from Windows Vista.
That feels amazing to finally hear some good Ubuntu news. We need it. The only sleeker options for privacy (Windows and macOS) are horrendous. Thanks for sharing, might try out Ubuntu 20 then, might be as sleek at Linux Mint?
It’s funny you mention Linux Mint, it was the only other distraction I could get lost in for hours. I’d still be fine with Mintfor personal browsing. At the time, I was running mint in a vm on MacOS to try it out and Cinnamon was much more performant than Ubuntu 18. Ubuntu 19/20 however seems to have narrowed or closed that gap.
So far Ubuntu has been great as a default dev/staging workstation. It’s nice not to have to fight with homebrew or docker permissions or other issues on the Mac and spin up most anything.. and it just works.
I switched from MacOS to Linux years ago. For a developer workstation these days I'd probably either go with Ubuntu LTS or Fedora (my personal choice). Either runs fine on my XPS 13.
Note: I really wanted to like WSL, but it just didn't work for me.
GPU switching (NVIDIA Optimus and the like) seems to be a major headache to get working on Linux. My current laptop (XPS 13) only has an integrated GPU, so I ssh into a desktop for running CUDA stuff.
But no, haven't tried WSL2, I'm comfortable with my Linux setup so not to keen on messing with it at the moment :)
I used Arch on a server once (still running) but found the experience on Debian was more to my taste, and somehow never liked pacman. Maybe it's time to take another look. I never tried it on the desktop.
Interesting, I have opposite experience. Pacman looks so much simpler than aptitude, apt-get, apt-cache, dpkg. And makepkg - it just works. I have not managed to create packages on Ubuntu.
No outdated packages, no ppa. No upgrade. Install is rough but it nails how simple the system is.
Ubuntu is a good starting point. But there is so much more.
I've never lost a weekend to a Debian dist-upgrade. Just read the release notes carefully beforehand, take a full backup of your data (which you should be doing anyway), make a note of any non-Debian applications you're using on that machine (that's the stuff that will need the most extensive testing post-upgrade) and it should simply work.
Fedora "just works" and has the some of the more sane defaults. Only tweaks one typically needs to do is add the RPM Fusion repos and, at some point, disable/tune-down SELinux when it is a bit too paranoid.
I switched almost 2 years ago after 15 years on Macs.
Fedora 32 Workstation is pretty good if you want to see the best of what Linux can offer. It may not be the lightest and fastest distribution but it is easy to install and everything works. You'll get to experience Gnome which is the most original Linux desktop environment and the best one in terms of user experience in my opinion.
If you want something more traditional with the start menu or dock or desktop icons, perhaps something like KDE Neon is better place to start. It might feel more familiar. Will be lighter/faster too.
Put each of them on a USB and run them live on your machine for few minutes each and see which one makes more sense to you.
From the comments, roughly, are you running third party "security" tools?
> Is there any "security" software running on your Mac? I've seen this sort of thing caused by that, but not in general.
> I ran the two line test and it had no delay at all. The Mac doesn't check for notarization on shell scripts or any non-bundle executable. I just did it again with a new test2.sh and Wireshark capture and there is nothing.
> I do a lot of Keychain code and I've also never seen those delays. The reason I suspect they told you not to use that API is that it's in the "legacy" macOS keychain. They really want everyone to move to the modern keychain but lots of people, myself included, still need the older macOS specific features.
> I'm not saying you are crazy, but all of these things though are the trademark reek of kernel level security software that is intercepting and scanning every exec and file read on the system. We had an issue with Cisco AMP once that took Xcode builds from under 10 seconds to over 5 minutes until we were able to get it fixed.
The only kernel-level security software on my systems is Little Snitch, and I’m pretty sure it doesn’t do anything unless there’s network activity, so it doesn’t explain anything.
I experienced this one day while tethering in the train. I was coding and running `go build` multiple times.
I could not for the life of me understand why go build would take upwards to 30 seconds to run and sometimes 100ms. I finally realized it was related to my internet connection being extremely spotty. I went online and searched if anybody had the same experience with `go build` but couldn't find anything.
I finally know what happened. This is a pretty intolerable "feature".
All of these complaints are about security features.
Yes these features could be better implemented, but I'm happy they're there. It's very important to be able to opt out of them, but I like that they're the default.
Notarization needs a cleanup pass and the rest of it seems like it needs an optimization pass.
P.S. The rationale for notarization is to not distribute and thus advertise the filters and detection mechanisms Apple uses to detect malware. If these things were distributed then malware authors could analyze and evade them. Security through obscurity does make a certain amount of sense here as the Church-Turing thesis means there are an infinite number of ways to implement any given thing including malware and there is no single filter or analytical step that can detect all possible malware permutations.
Being able to run arbitrary software on the hardware Apple has graciously lent me is an annoying level of power that I'm not fully comfortable with either. I'm liable to shoot my foot off if Apple the all-seeing doesn't save me from myself.
Their "see!" shell script example is a bit rubbish because I get 0.012s, 0.005s on this Mac laptop whilst getting 0.022s, 0.023s on Linux box 1 and 0.006s, 0.006s on Linux box 2.
Changing the filename to test2.sh on the Mac (which should trigger the delay, right?) gets 0.006s, 0.006s.
I don't think the shell scripts are doing what they claim (and wouldn't the second run be faster anyway because of caching?)
Sorry, when I said "changing the filename to test2.sh", I meant in the commands run, not `mv test.sh test2.sh`. i.e. I have both `test.sh` and `test2.sh` in `/tmp` now.
I switched to a sleek amd based setup and ubuntu, 64 gigs of ram, tons of nvme storage and for a decent price. Sad to see macos go out my daily toolkit, but fortunately i no longer have to deal with this kind of crap. I still use mac occasionally but day by day it becomes less relevant.
Increasingly I find macOS only to be tolerable with iCloud (and Siri, location, suggestions, bug reporting, et c) entirely disabled, and Little Snitch’s built in/automatic whitelisting for Apple services disabled, and most of the background processes entirely denied networking access. It phones home constantly even with all of the services disabled/opted out.
It’s indeed a huge mess, from a privacy standpoint too, not just a performance one. It’s sad also to lose things like AirPlay or iMessage as collateral damage in the process. :/
I just can’t tolerate a machine that hits the network hundreds of times a day when doing normal computing tasks that do not involve the network. They even tolerate this sort of spyware in App Store apps, too.
Is it too much to ask for a polished workstation OS that lets me boot and edit a local text file of notes and save and quit without notifying 4 different parties that I did so?
1,021 comments
[ 3.3 ms ] story [ 387 ms ] thread> Apple’s most recent OS where it appears that low-level system API such as exec and getxattr now do synchronous network activity before returning to the caller.
Can anyone confirm this? Because honestly this is just terrifying. I don't think even Windows authorises every process from a server. This doesn't sound good for both privacy and speed.
Speed, definitely not, this is going to make things slowwwww
That's security, not privacy...
"Full Disk Access" to allow a program to access any place on your computer without a warning. A few programs requested this, so it looks like it's been around for a while.
The other one is "Developer Tools" and it looks pretty new. The only application requesting it is "Terminal". This "allows app to run software locally that do not meet the system's security policy". So, my reading of this is that in Terminal, you could run scripts that are unsigned and not be penalized speed-wise.
Are you running a beta build or something?
---
Update: Okay, I checked on my other machine and that one does have it (Terminal is listed but disabled by default). What in the actual fuck?!?
(I'm also on 10.15.4 (19E287))
Interestingly, I rebooted the machine without after some benchmarking and experimentation with syspolicyd (see https://news.ycombinator.com/item?id=23274903), and after the reboot the category has mysteriously surfaced... Not sure what triggered it. Launching Xcode? Xcode and CLT were both installed on the machine, but I'm not sure when I last launched Xcode on this machine. Another possible difference I can think of: the machine without was an in-place upgrade, while the other one IIRC was a clean install of 10.15.
In the worst case scenario, you can probably insert into the TCC database (just a SQLite3 database, located at ~/Library/Application Support/com.apple.TCC/TCC.db) directly:
(Should be pretty self-explanatory. The first entry is for Terminal.app, the second entry is for iTerm 2.)Back up, obviously. I'm not on the hook for any data loss or system bricking.
Does this not require disabling SIP?
sudo spctl developer-mode enable-terminal
Don't think so? Apple now theoretically has a centralized database of every Mac user who's ever used youtube-dl. Or Tor. Or TrueCrypt.
Not sure how a list of installed apps is going to be worse than that.
Either you have the ability to control the software, or it controls you
First, there was Apple scanning photos to check for child abuse[0] (that obviously got no attention on this site), then there was this one - Apple uploading hashes of all unsigned executables you run.
Do people really accept that company's "privacy" selling point?
[0] https://news.ycombinator.com/item?id=21180019, https://news.ycombinator.com/item?id=22008855
You can't remove or change this behavior because some people love it.
EDIT: FWIW the above statements are oversimplifying the situation of course: https://en.wikipedia.org/wiki/X_Window_selection
And more here: https://unix.stackexchange.com/questions/13585/how-can-i-use...
Most fans of Linux will claim the fact that you can choose any number of clipboard managers to customize things to your liking is a critical aspect that draws them to the platform.
Others among us (whether reformed or uninitiated) will commonly cite this same stuff as the reasons we avoid Linux on the desktop.
You should get a very nice experience out of the box with these, which can be reproduced quite easily with less "bloated" distributions such as Arch or Gentoo if you prefer to install things yourself
There is no actually good alternative to Photoshop. gIMP is not remotely in the same league. Pixelmator and Affinity Photo are brought up but they're also like nano vs emacs. Photoshop doesn't run on Linux AFAIK. I'm sure for a graphic designer the same is true for Illustrator. The cheaper alternative exist and you can maybe get by but there's missing so many features.
If you're into games there is really only Windows. Same for VR.
I'm sure there are other categories.
I did serious dev on Linux and that dev didn't require any games or apps so it was great and I loved it. It ran my editor of choice and otherwise I only needed a browser and a terminal. But as soon as I step out of that small subset it's pretty much MacOS or Windows only, at least for the things I want to do with my computer.
VirtualBox has a 'seamless mode' as well, I wonder how well it works on a Linux host and a macOS/Windows guest.
Now imagine the millions of other people in my situation and rethink your comment.
> Now imagine the millions of other people in my situation and rethink your comment.
The comment still holds. Linux should still be considered. I didn't proclaim that it would be a realistic alternative in every case, but I'd wager that for a large proportion of software engineering roles, it would be.
Is there software that may also be suitable for basic image and video editing work and therefore fine for a subset of these creative professionals you refer to? Absolutely. I've seen great results from folks using Blender, Inkscape, OpenShot, GIMP, Krita and others.
We shouldn't just dismiss an OS immediately, and that's what my comment was trying to get at.
Personally I'd need to run a VM for a bunch of software or fight Wine. That's assuming my machine has the right hardware support for everything and even then the trackpad support is likely to not be great.
It's really frustrating to see Apple make all these poor decisions and they almost never are willing to admit their mistakes and go back. In the rare case when they do (e.g. butterfly keyboard, Mac Pro), it takes them years to turn around.
or until they need something to throw out for investors. "dark mode" did not come about because of a technical breakthrough
The way to avoid this behavior is to staple the notarization ticket to your bundle (or dmg/pkg), i.e. "/usr/bin/stapler staple <path>." Otherwise, Gatekeeper will fetch the ticket and staple it for the user on the first run.
(I'm the author of xcnotary [1], a tool to make notarization way less painful, including uploading to Apple/polling for completion/stapling/troubleshooting various code signing issues.)
[1] https://github.com/akeru-inc/xcnotary
Here's my benchmarking script:
If your local terminal emulator is immune with "Developer Tools" access (interestingly, toggling it off doesn't bring back the delay for some reason), you should be able to reproduce the delay over ssh.Reached out about this to Apple dev support, hope to get more insight.
Noticed the same; it should come back if you disable it and reboot.
The "Developer Tool" pane in System Prefs, Security, Privacy is the same power. Drag anything into that list you'd like to grant the same privilege (such as xcodebuild). This is inherited by child processes as well.
The point of this is to avoid malware packing bits of Xcode with itself and silently compiling itself on the target machine, thus bypassing system security policy.
Isn't launchd Mac's ‘init’? I.e. run before anything else.
otherwise this macos notarisation, along with a possibly of cpu heating issues with left thunderbolt usage and corporate av scanning, makes my machine, next to useless
Maybe in some cases, but the article says "even if you write a one line shell script and run it in a terminal, you will get a delay!"
Shell scripts don't come in bundles. I don't think this kind of stapling is possible for them? I don't think it'd be reasonable to expect users to do this anyway.
Two posts from Apple dev support (Cmd+F "eskimo") describe this in more detail.
https://forums.developer.apple.com/thread/127709
https://forums.developer.apple.com/thread/127694
I don’t know why grand op is downvoted. DoD requirements literally require a timeout setting for screensavers to begin locking. This has caught systems which have a race condition where you can move your mouse quickly and gain desktop access before it locks.
The long term effects come from the required changes to the development security model to remain productive and profitable (took MSFT a few OOB hotfixes and service packs to fix that example above, look when gnome kde xscreensaver etc introduced that feature etc)
I fail to see how this is a race condition rather than how a screensaver is supposed to work?
What defines when a locking screen saver is “locked”? 10m? Or 10m1s? You are making assumptions and that is what DISA spells out. Which forces the OS design to change in subtle ways. Like xattrs on files as great grand op was alluding to.
Does that provide clarity into how development security models evolve over the lifetime of an application?
The article says the described problem isn't limited in this way:
> This is not just for files downloaded from the internet, nor is it only when you launch them via Finder, this is everything. So even if you write a one line shell script and run it in a terminal, you will get a delay!
His site (http://www.quinn.echidna.id.au/Quinn/WWW/) supports its claim “I'm not a great believer in web” :-)
Whatever problem you're having, it's a problem specific to your machine.
A few months ago I installed Rider (an IntelliJ-based IDE) on my Mac without toolbox, and upgrading it was a pain. I don't remember the details, but using JetBrains toolbox makes upgrading as simple as clicking a button and waiting until the download / install is complete.
Having to wait 5-10 seconds for a new terminal tab as Sophos churns (checking autoccomplete scripts, rbenv, etc) was infuriating. Oddly, there was fate sharing with Internet interception, so there was a good chance the browser was getting dragged down too, and vice versa.
Convincing corporate IT of how bad the problem was was maddening. Based on what this author says, 10.15 on rural internet sounds like hell.
This design seems to cement the trend at Apple to position their products as consumer appliances, not platforms useful for development.
The problem is, there's nothing else out there. Everything is going to shit in one way or another. Windows is now a disaster, Linux was always a disaster in terms of user experience and isn't improving.
Mac OS was the last bastion of somewhat good, thoughtful design, user experience and attention to detail and now they've gone to shit too.
Curious: what have you tried? People who use "Linux" as a catch-all in terms of UX usually have only tried a single distribution with a single desktop environment.
It's really hard for me to use non i3wm supporting OSes now, even though I have to use Windows from work, and have used Macs for the better part of the last 2 decades personally and in college.
I get a fair bit of weekly exposure to Windows 10 and well, it's not like heaps of fun, UX wise.
I'm reluctant to drop Apple mainly because I'm so 'tied up' with the rest of the ecosystem, iphone, Apple Music, iCloud etc.. They are not irreplaceable (for sure) but it always feels like moving away will cost way too much effort and be a pain... Well played, Apple.
This is why I don't want anything by Apple.
I had an ubuntu machine that took a while to boot even with an SSD. Later I installed arch linux on the same machine and boom! it would be to the desktop in seconds. It was night and day.
In which respects? Are you talking about apt vs pacman or something? Default DEs?
Rolling updates for me have not been problematic.
I've had a few updates that gave an error message, and they were easily fixed in one minute after searching the arch website.
I think one was a key expired - I had to manually update it and redo the update process.
The other I can recall was a package that had become obsolete/conflicting and a question had to be answered.
In general rolling updates are a tiny blip every few months.
In comparison, the several debian based distributions I've run have been a "lost weekend" type of upgrade for major updates.
Yup. You've just described a disaster. How many permutations of <hundreds of distros> x <dozens of DMs> must a user try before finding a good UX?
Because there are at least four BSDs, Mac therefore isn't good.
Do you see how ridiculous applying that logic to any operating system is?
Linux isn't a disaster. It's a kernel. There are Linux distributions with great user interfaces and great UX, developed by people who are great at it. There are also distributions that aren't.
Could you name some? No sarcasm, actually interested!
In terms of defaults:
I've heard really good things about Solus, and its use of AppArmor seems really cool. Never touched its package manager, so I won't recommend it, but it might be worth checking out. Its desktop environment is really snappy and has an interesting design philosophy.
Elementary is really cool as a boutique distribution; I don't personally feel any urge to use it seriously (I dislike apt as a package manager), but I always keep its live environment on a flash drive, because it works without any setup on basically anything I throw it at, painlessly, and without error. It's got a cool indie app store full of curated Elementary-centric free software, and overall just feels great. Using it, you'll probably notice a few areas that it clones Mac on, and a few that feel delightfully different.
Clear Linux (Intel's desktop distribution) is pretty popular right now because of how simple it is & how Intel seems to be going to great lengths to optimize it and make it a serious contender, but I don't like its desktop environment (vanilla GNOME 3 as far as I'm aware) all that much.
ChromiumOS is probably the best-designed desktop operating system on the planet right now technically, and I say that as a person who really hates Google. UI-wise it's so-so, but UX-wise it's really something special.
But more interesting are desktop environments in general, since they can be used with any variant of Linux you feel the urge to use. There's an exception there, though, in that Elementary's DE and Deepin's DE tend to not work so well or nicely on platforms that aren't Elementary or Deepin.
There are modern environments:
Plasma has hands-down the best UX of any sort of desktop operating system assuming you've got an Android smartphone; you say you're coming from Apple's environment, so imagine the interop between your Mac and your iPhone, but going both ways instead of just Mac -> iPhone. Texting, handling calls, taking advantage of the computing resources of connected devices, using your phone as an extra trackpad, notifications, unlocking your PC, painless file-sharing, pretty much anything you'd like. There are a bunch of distributions that ship with Plasma by default.
Solus's Budgie is kind of neat in that it takes the main benefit of GNOME 3 (ecosystem) with far fewer downsides.
There are also retro environments, if those are your thing. There's a pretty much perfect NeXTSTEP clone (including the programming environment, not just the UI), amiwm is still pretty interesting, there are clones of basically every UNIX UI under the sun, so on.
I'm not the best person to answer your question, because for the most part I don't go out of my way to use new desktop environments and distributions, and nothing above is my first choice. (In terms of window management, I usually stick with 9wm & E just because I have ridiculous ADHD and 9wm forces me to focus while E allows me to tile painlessly if I ever need it. I use three distributions overall, none of which are very popular at the moment, pretty much solely because I'm really picky with package managers & design philosophies.) That's a "me" issue rather than a Linux issue, though.
It sounds like the finding right combination of DE and package management solution plays a big role here. I don't remember much of my experience with Gentoo's package manager in the early 2000's other than finding it generally did its job (if a bit slowly)... Experience with package managers on Mac (brew, macports) hasn't been great so I'm eager to play around with modern ones on Linux. Same goes for the DE actually: stock, out-of-the-box, macOS is essentially unusable for me until I get my customization (scroll, trackpad, KeyboardMaestro) done exactly right, I can't imagine this not being better on Linux, if anything for the ability to switch among the various DE's.
I'm starting to contemplate this (fully untested) strategy: trying out a few distros and installing the one I like best on VMWare Fusion and then try to use it as much as possible, falling back to macOS if I get stuck or I'm short on time but gradually replacing Mac-specific stuff as I find suitable replacements.. TextMate, the masterpiece of Allan Odgaard (author of the article being discussed here) probably going to be the toughest one. If I'm successful, I should eventually be able to let Linux 'out of the box' and run it on real hardware..
PS: amiwm! This is going to be a must. I do miss the Amiga, a fair bit..
xbps
apk (terrible interface; wonderful technically)
pacman (wonderful interface; so-so technically; dislike the distro that uses it because of technical choices)
InstallPackage (GoboLinux is kind of cheating, because InstallPackage isn't a "real" package manager, but that's kind of the point)
I love TextMate, too! Something you might find nice is how easy it is to run Mac in a VM on Linux; there are scripts that manage the entire thing for you, and it's pretty painless (and so fast; I was surprised). Useful if you have a few packages you can't find replacements for.
You mention Apple Music elsewhere, which you might be interested to know has an Android client and a web client, and you can probably get a native client on Linux, though I'm not immediately aware of one.
That would be excellent! I like the idea of swapping host and guest with this VM strategy, sort of evolutionary platform switching.
https://github.com/foxlet/macOS-Simple-KVM
Really, really fast, and fairly painless.
The last few years I've run Linux VMs on a Macbook, but I'm transitioning to a Linux desktop probably running a macOS VM, which you mentioned in another comment - didn't know there was a practical solution.
It sounds like distros like Elementary and PopOS might suit me as a gentle transition from Macs.
Somehow, when you ask a person about PC or a Mac, the answer is: Windows or MacOS, and then the discussion is about their quirks, or advantages, or deficiencies.
You ask about Linux, and this is what you get:
> Linux isn't a disaster. It's a kernel. There are Linux distributions with great user interfaces and great UX
So, once again: which one of the hundreds of permutations of <distro> x <DM> has a great UX?
I'm sure there are other user-friendly distros that similarly let average users browse the internet, write documents, listen to music and watch movies painlessly.
The fact I can install Steam and play an AAA like Mad Max or Shadow of Mordor mostly seamlessly makes me wonder why people still claim Linux on the desktop is a no-go.
Because they and few others are exceptions? Can you play the latest CoD? GTA V? Assasin's Creed maybe?
> GTA V?
I honestly don't know, but it wouldn't surprise me if I could using WINE. A huge library of Windows AAA games work on WINE.
> Assasin's Creed
I don't know, but Mad Max and Shadow of Mordor are pretty much the same kind of game as Assassin's Creed, following the same kind of gameplay and using the same kind and complexity of 3D graphics/engine.
In any case, these are not exceptions. I forgot to mention the XCOM remake, Alien: Isolation (this is interesting because it has tons of graphics effects, including chroma aberration -- it looks awesome on Linux), SOMA, Victor Vran, Warhammer 40K Dawn of War II, L4D2, and many others. There are tons of Linux games on GOG and Steam, many of them AAA games. If you count indie games or 2D platformers there are literally thousands of them, but I guess that's not what you're after.
My point is that you can't run most AAA games actually, and many of those you can - will give you enough problems (like frame drop or some graphical features unavailable).
And I really don't understand what's the point of being able to run some games. I want to play the games I'm interested in, not the ones that 'are playable'.
>I don't know, but Mad Max and Shadow of Mordor are pretty much the same kind of game as Assassin's Creed, following the same kind of gameplay and using the same kind and complexity of 3D graphics/engine.
No sure what's your point here. You can't replace one with another just because they have similar mechanics.
Steam\GoG has many games that run on linux and macos (by the way), but most of them are indie platformers or things like that. People don't play random games just to kill some time (well, some do), they play TITLES.
> I forgot to mention
more exceptions. They will stop being exceptions when you will be able to run 80% of titles without any issues and not sooner than that.
Gaming is not important to be, I'm a PS4 guy ever since macos switch, just pointing out that games are still has little to do with linux unless we are talking about rare AAA titles and indie scene
> And I really don't understand what's the point of being able to run some games. I want to play the games I'm interested in, not the ones that 'are playable'.
With this definition neither Windows nor the PS4 are valid gaming platforms, since not every game can be played on them.
> They will stop being exceptions when you will be able to run 80% of titles without any issues and not sooner than that.
So now it's 80% when before it was "a few exceptions"? Sorry, I'm uninterested in discussing your arbitrary definitions with you. Nice try moving the goalpost.
PS: re: "without any issues", back when I used Windows for gaming, there was always some issue. The graphics card, drivers, config issues. I guess Windows is not a gaming platform either then?
Hardly. The existence of a distro I don't like doesn't degrade my experience using a distro I do like. You may as well be upset at an ice cream shop for having dozens of flavors when you only like strawberry. Choose the one you like and ignore the ones you don't. It's not rocket science, even children can figure that out.
The problem under discussion here is not that of using a distro you like, but finding a distro that you like.
- multi-language support requires a lot of work to get to the same point as macos.
In particular I use third party shortcut mappers to get language switching on left and right command keys (mimicking the JIS keyboards, but with an english international layout). That looks like something I’d have to give up on code myself.
- printer support is not at the same level.
Using a xerox printer, some options that appear by default on macos where not there on ubuntu. I’m sure there must be drivers somewhere, or I could hunt down more settings. But then my work office two other printers. It would be a PITA to hunt down drivers every time I want to use another printer.
- Hi DPI support is still flagged as experimental, and there’s a bunch of hoops to jump through to get a good setting in multi-monitor mode. Sure it’s doable, but still arcane.
- sleep/wake was weird. It would work most of the time, but randomly kept awake after closing the lid, or not waking up when opening. Not critical, but still not good (I’d ahte to have the battery depleted while traveling)
Overall if I had no choice that would be a fine environment. But as it is now, with all its quirks, I feel macos is still a smoother environment.
Portability is also a fair issue to raise, but it's simply not a problem for me. When I say Linux "on the desktop", I literally mean it: to me a laptop is simply a slightly more portable desktop computer. I sometimes take my work laptop to/from the office, and the battery lasts long enough for that. I'm not worried about longer trips, since I don't use laptops for that. Again, if you do care about this (which is completely fair), I'm aware many Linux distros still have issues with battery life. You certainly can't compete with a Macbook Pro, that's for sure!
I do note that my experience with printers is opposite to yours. Like I said, when trying to connect to an HP wireless printer, Ubuntu autodetected and self-downloaded the necessary drivers; however, it took a lot of patience to get it to work with a Macbook Pro. Today, that I have it configured for my Ubuntu laptop and my wife's Macbook Pro, the Mac will sometimes fail to print (the print job simply stuck in limbo) while my laptop prints reliably. Who knows?
And like I said in another comment, I game (or used to, anyway) a lot with Ubuntu, and many games are even AAA (though they tend to arrive later than on Windows).
So I really have a hard time believing Linux is not "ready for the desktop". It is, and has been for many years now.
edit: one last thing. You mentioned HDPi modes, multimonitor, multilanguage... none of those are for average users. My mom would be comfortable browsing the net, reading mail and watching movies on Ubuntu. She doesn't even know what HDPi is, nor does she want external monitors. (Spoiler: she still uses Windows because she can't learn anything else at this point... I've thought of tricking her by themeing Ubuntu to look like Windows, but that would just be mean).
For the printers, you are right in that it’s far from being a solved problem on macos. I had an EPSON all in one before, and it was also a pain to get everything working. If I remember correctly the generic driver could print, but we didn’t get “advanced” options without going through the EPSON pkg installer and all the garbage coming with it. I’d totally imagine the linux driver being done cleaner than that.
For the record I’ve worked with a decent number of devs using linux workstations, so I totally vouch for your use case. I’d just temper the niche nature of multi-language support; that’s an everyday need for basically all Asia. Granted my use of shortcuts is niche (I wouldn’t need them if I had enough keys), but looking at maintenance projects annual reports there seem to be a sizeable amount of quality of life fixes still on the way.
Have yet to see a distro do multi monitor hi dipi that results in readable fonts out of the box..
This gets updated yearly - https://itvision.altervista.org/why.linux.is.not.ready.for.t...
What do you mean by 'there goes your install'? There are multiple ways you could run bleeding-edge software before it's packaged for Arch. See for example every 'xxx-git' package in the AUR. Or Flatpak.
Linux sucks, but I use it becuase it sucks less than windows, for programming at least.
Try Pop_OS!. I switched from macOS and it's been a relatively painless experience with some tweaks.
I would recommend: Ubuntu, Linux Mint, Elementary OS, Pop!_OS
if you want: nice experience out of the box
I would recommend: Arch, Gentoo, Debian Net inst, Void
if you want a base system and install things you want on top of it
The (hopelessly unscientific) test plan was:
Challenge 1 - write live system ISO to USB drive and boot it on my 2015 MacBook Air (which, though old, still counts as exotic, I guess.)
Challenge 2 - make sure display, network, trackpad and keyboard (+ intl. layout) work correctly. Be able to SFTP to my Mac
Challenge 3 - with little to no docs reading (how is the package manager invoked from CLI?), use the terminal to set up the right environment for a couple of relatively portable hobby projects I've been recently working on (on Mac), compile and test them. This includes, among other things, installing clang or g++, SDL2, Wine (to run an ancient ARM assembler) and finding a usable GBA emulator.
Limitations:
Candidates: Ubuntu, Mint, Fedora, KDE Neon (which, if I'm not wrong, is Ubuntu LTS preconfigured as the latest KDE) and Void.Results:
Challenge 1: unremarkable. All worked right off the bat except for Void, which made it as far as showing the mouse pointer but then froze.
Challenge 2: well, boring ;) All distros were pretty much ready to use and required minimal tweaking. With the tweaking part ranging from effortless (Mint) to minor headscratching (Neon). Not sure whether /etc/X11/XF86Config still exists but I did not miss editing it today.
Challange 3: more interesting:
Neon: all worked as expected except some trial and error required to get Wine working: wine32 was required but it wasn't getting installed by default, apparently. (Not a whole lot easier on Mac anyway, with separate downloads & installs for Wine and XQuartz)
Ubuntu: I failed as apt refused to acknowledge the existence of the packages I needed. This is weird as I believe Neon relies on the same package database. Though undoubtedly my fault, not reading the manual, it is perhaps a bit interesting that I could not readily find my way around the problem.
Fedora: everything worked except for Wine, as the live system ran out memory (disk space) on installing it. Not a big deal, everything else worked very well. Aside: I'm an avid runner and "DNF" is not the most likeable of names for a program I have to use very frequently! j/k..
Mint: everything worked at take one.
I know this isn't even scratching the surface of the surface but I think for now I'm going to go ahead and play more with Mint and Fedora after installing them on MB Air hardware or MB Pro VMware.... with a mind of getting back to KDE/Neon eventually.
I haven't used Ubuntu much lately but I remember always having to add community repository to get some package I needed. (Also one of the reason I love Arch, a lot of packages there updated more quickly than most distro + the AUR for everything not present in official repo)
Each of them has something done better than the others, but all of them are delight to use.
If you want something more traditional with the start menu or dock or desktop icons, perhaps something like KDE Neon is better place to start. It might feel more familiar. Will be lighter/faster too.
Put each of them on a USB and run them live on your machine for few minutes each and see which one makes more sense to you.
This as true today as saying java is slow. Why not just try? You might get pleasantly surprised.
Yeah, but they're the ones who paid for their machines. So... you're saying they're not allowed to use them how they wish?
> Leaving a backdoor to real admin access for the experts just means laypeople will abuse those backdoors and mess up their machines again
Remembering the last 20 years of computer history, most of the critical fail wasn't caused by "laypeople abusing backdoors" but horrible security holes in popular, widely used software packages: Outlook, Flash, Acrobat Reader, Internet Explorer. Apple/Microsoft are not locking down their OSs to protect users from themselves, but rather from other developers. We, software engineers, seem to have completely failed our users as a profession.
Windows is a unfixable disaster, you can't fix it sorry.
Mac OS is now an unfixable disaster, you also can't fix it sorry.
Linux may be a UX disaster, but you can, uniquely, modify it. You can change your UI. You can attempt to fix the problem, and have a real shot at doing so.
Linux is the only one where you can do something about the problem - which is a strong reason to prefer it.
The biggest reason I enjoy elementary OS as a distro is that everything lives on GitHub, package releases happen through GitHub Actions, etc. Fixing a bug can be faster than merely filing a radar in the Apple ecosystem.
Nonsense, 'Linux' can be what you make it. You can have it as sleek as something straight out of the fruit factory or as spartan as a VT100 and anything in between. If you're new to the game the pre-packaged 'consumer' distributions might be a good starting point but for those with a bit of nix savvy - of which I assume there to be many on this board - those bells and whistles probably just get in the way.
If my 8yo daughter and my 82yo mother can use Linux - the latter through a remote X2go session from her kitchen table in the Netherlands to my server under the stairs in Sweden - I'd say people around here can be assumed to be able to handle it. The nice thing about 'Linux' is that you can change out those parts which you find disagreeable for whatever reason for those you like better, this in contrast to that last bastion of somewhat good, thoughtful design, user experience and attention to detail* which by your own statement has been changed into excrement. Just take out the shitty bits and replace them with something better... oh, no, not possible...
That is why the parent poster is right in this sense, things in 'Linux' land might not be perfect - and can never be 'perfect' since one person's perfection is another's nightmare - but at least you get to do something about it.
I'm honestly pretty baffled as to what keeps this meme alive, as KDE and GNOME are both very popular and provide simple, intuitive interfaces for the typical user. Plasma is only complex if you're the type that really wants to customize, but there its complexity is (mostly) necessary for its wide range of possible configuration. People have this idea that desktop Linux users are all a bunch of dorks playing around with Arch and tiling window managers all day and then posting their anime wallpaper setups on /r/unixporn, but that hasn't actually been true for a long time.
The settings UIs in Mint are easily way better than in Windows and Mac.
I use Debian, I like Debian. When I run Wireshark I don't see unknown requests destined to debian.com. That is the definition of simplicity for me. And yes, it doesn't always work out of the box, you have to install some drivers, change configurations but it's getting better and easier. Yet, I'm a software developer so I understand and like that stuff.
> Linux was always a disaster in terms of user experience and isn't improving.
No, you can't define it as a disaster, it's not. If you're an end-user that understands nothing of computers maybe you can but otherwise it's not a disaster. It's just harder and getting easier by day.
https://elementary.io/
I think it just skips the checks if internet isn't available. But doesn't that kind of defeats the point of notarization?
EDIT: how to staple: https://developer.apple.com/documentation/xcode/notarizing_m...
It waits 5 seconds while trying to connect, and then it gives up and caches the program as un-notarized, allowing it to run faster on later executions.
Notice that notarization seems to be disabled if the network is disabled from within the OS. To observe the 5 second delay you need to cut the connection outside (e.g., on your router), while the mac still thinks it is connected. I observed it by running catalina inside a virtualbox, and disabling its network.
Apple is the Father, Apple is the Mother.
After Apple has re-invented or re-written the MSFT playbook of the 90s, nothing surprises me anymore.
Yet I cling to these machines, that take away the freedom to do with my hardware as I please. It's odd.
First off the new apps (music, podcasts, etc) are terrible. They killed off iTunes but replaced it with much worse. These apps don't behave like standard macOS apps, the UI is full of inconsistencies and is just so empty. This website has nice examples of the failures of modern Mac OS: https://annoying.technology
For some reason after updating the "new updates" badge was stuck on the system preferences icon (and even on the preference pane itself) despite no updates being available. I ended up having to delete a plist and reboot to fix it, apparently a common issue.
The Mail app will now randomly play the "new mail" sound. I can't confirm it for sure but I'm assuming it's treating read, existing mails when they are moved to the trash/archive or newly created drafts. They screwed up the mail app, a problem that has been solved for decades. WTF? The worst is that I see no major changes in there, so why touch the mail client in the first place if you're not even going to give me additional features in exchange?
Xcode was stuck upgrading in the App Store. It would start the process and never make any progress. Cancelling it had no effect. Rebooting cancelled it but the second attempt, while making progress, ended up failing with a generic error message with no actual information. Logs are useless because they're being spammed by all the background processes even during normal operation making it impossible to find anything. Finally the third attempt succeeded.
1Password now takes 5 more seconds to unlock my password database. Somehow this disgrace of an OS slowed down the password hashing process by an order of magnitude.
Switching screen resolutions or connecting to an external screen takes a good 10 seconds of flickering and frozen UI before everything starts working again. This is now actually worse than both Windows and Linux. I dread moving the laptop or touching the USB-C cable (also because USB-C is so brittle) when it's connected to an external monitor out of fear that it'll disconnect/reconnect and I end up in a 30-second cycle of flickering.
I upgraded a couple of days ago, so those are not early bugs. Apple had a year to fix all of this. The Xcode thing might be an isolated issue but there's no excuse for the general performance penalty or the stuck update badge which has many hits on search engines suggesting it's a widespread issue.
I'm literally halfway there as I type this, Xcode 'installing components'. Having to upgrade essentially everything just to get the right dev tools for the current iOS is madness, feels like buying a new house to fit the new coffeemaker...
I use 1password and it doesn't take 5 seconds to open. Did I accidently install linux or something? because since it's the OS causing your delay it would be causing me to have the same delay.
xcode installs just fine for my entire team. Just did the update myself, worked just fine.
I plug into a dock and undock constantly during the day, and while it could be quickinger, 10 seconds and flickering is NOT my experience.
and what the fk are you doing to your connections that you consider usb-c brittle?!?
> you consider usb-c brittle?!?
It's much easier to unplug USB-C than HDMI or DisplayPort, for one. USB-C itself is a terrible mess that requires an engineering degree to figure out what's compatible and not, and maybe it's just me and I have a shit hub but I had an external hard drive crash midway through a file transfer due to power issues despite being powered by a Apple charger (the hub and all the peripherals went dark and the laptop stopped charging, then started cycling on and off where every time the drive tries to start up again it kills everything).
Just like Twitter's UI, app developers think they know what content is best for you with a 'feed' or 'featured'... they've completely abandoned chronological ordered lists of content unless you click 2-3 buttons.
[1] Catalina has been painless for me, not sure why my experience was different than everyone else
It’s not quite random: it plays the sounds as it gets new email, but then it takes anywhere between a couple of seconds to a minute for the new email to be visible in the UI. Infuriating.
> Xcode was stuck upgrading in the App Store. It would start the process and never make any progress. Cancelling it had no effect. Rebooting cancelled it but the second attempt, while making progress, ended up failing with a generic error message with no actual information.
I just normally kill the store-related daemons when that happens.
My one remaining serious annoyance is that my external monitor color settings are screwed up and there appears to be no fix. Reds are purple and everything is just a little washed out, which is a shame for a 4k monitor that was beautiful with Mojave.
Strangely, right before the computer restarts, or if booted in safe mode the color starts to look perfect again, but I can't seem to replicate that in normal operation.
Could it have something to do with Night Shift? Have you tried enabling and disabling it and see if it fixes that?
I have to disconnect and reconnect USB-C 3 times, turn off the second monitor, switch inputs, restart the €3000 machines twice or whatever. So annoying, how does this pass QA at all?
Also, don't setup and use multiple users at the same time. That's really messy as well.
So many recent things would have pissed him off.
There's no way the 'notch' would have appeared. Nor the fact that the iPhone camera design stopped the device sitting flat on a surface.
Teaching my daughter to program on a modern computer, we spend more time bootstrapping and in process, than we do in actual development.
Because that was the experience on those old machines. Switch it on, straight to BASIC prompt in a second or so. If you want to program it’s frictionless. And you can’t break it because BASIC is in ROM.
> Teaching my daughter to program on a modern computer, we spend more time bootstrapping and in process, than we do in actual development.
Arch Linux does not help with this, unless you make it boot into a VIC-20 emulator or something. Arch can help with boot speed, but once you're booted you're back in a full modern OS. So fine, install VSCode and Python... okay, now you get to figure out libraries. Manage terminals. Arrange a filesystem. This is not getting you closer to the VIC-20 or C64's "boot into BASIC".
Getting knowledgeable people costs money so we build more abstractions that lower the cost of development and pass the costs of development from the company to the user in the form of requiring more hardware to do the same thing.
How come I need 16Gb of RAM these days when 8Gb did it yesterday? How come my phone needs 4Gb of RAM while my 2012 tablet had 1Gb? Sure the hardware is cheaper but we're still not using the hardware to it's fullest.
Before that, my 64MB RAM 100mhz Pentium could usually have a couple things open before it'd hit swap too badly. I'm talking like Word and a web browser, not calc and notepad. None of the equivalent programs to those can even open all on their own in a footprint smaller than 64MB these days, let alone with other programs and the OS in the same space. Hell, how many operating systems fit in that with a GUI as capable and usable as, say, Win98se (let alone something really incredible on the performance front, like BeOS)?
I can now use simplenote, discord, slack, the jetbrains dev suite, visual studio code, and this is without including separate developments like Steam, which has made it effortless to switch between Windows, Linux and Mac.
That being said, I still consider Mac OS the superior OS (this call home issue from the article aside), mostly because the font rendering still works better after all these years, Windows and Mac still have better quality software available for them, and Mac still does not have the forced updates as Windows does. Also I have noticed that in Ubuntu, some electron apps like Simplenote, the copy and paste of text is funky at times, like not even letting me select stuff.
Being able to turn the computer on, type in my password and have it be just..ready is so incredibly refreshing. Having a terminal with 0 latency, where copy/paste is sane? Worth a zillion dollars to me right now.
Currently playing with opensuse tumbleweed, i'll probably get frustrated by something and move to arch, so I can fix that something and also be frustrated by a hundred other things.
I mean, I know it's happening, I (sadly) expect it to happen now. But seeing all the bits whizzing over the wire brought home just how much your machine is reporting about what you're up to.
I generally agree, but I sometimes ran Windows 3.0 on a 386SX-16 in the early 90s, and often wondered why it ran so slow on my admittedly underpowered but supported system.
At some point I read (perhaps in Compute! or BYTE) that Windows made something like 20 or 30 syscalls to draw one line of a window's border. That seemed exceptionally inefficient to me, so I stopped using Windows. I generally worked in DOS, but if I wanted a GUI, Geoworks provided an experience at least ten times better (subjectively) -- smooth UI, ability to multitask, a surprisingly good word processor and other well-designed software included.
https://retrocomputing.stackexchange.com/questions/11533/why...
Things finally improved with XP, but W3.1x and W95 were anything but fast - unless you were playing Solitaire.
https://www.youtube.com/watch?v=PwRR7-P-8fc
Yeah, what the heck is this? I use a win10 box solely for gaming, and every single time I wake from sleep, Antimalware Executable keeps my machine from doing anything for several minutes. It's infuriating.
Considering the built in one is pretty slow (and gives useless notifications), I expect it would be an improvement.
The web is much, much, much slower than it used to be.
care to elaborate a bit? what did you understand?
i just can't get my head around this idea that most non-mobile OSes have become such hostile environments...
yes, the population at large only uses their phones and tablets and doesn't care much. but they would be left without any entertainment if it wasn't for those of us who still need decent non-mobile environments.
Also, they are a threat to a free market for software, as they regulate their walled garden with arbitrary rules and skim off a lot of value.
I honestly don't understand why a large portion of developers have so much love for Apple. I'm personally a proud owner of a desktop PC with an ASUS motherboard. It serves me fine, and gives me full control over the software installed on it. I'm not a laptop-person but I believe there are many perfectly capable non-Apple laptops out there.
WTAF. If this is really true, this is a reason for me to leave the platform for good. This is just in-acceptable in so many ways.
I worked on the team in charge of improving iOS (13) perf at Apple and IIRC there was no dedicated macOS “task force” like the one on iOS.
Luckily some iOS changes permeated into macOS thanks to some shared codebases.
It's not surprising. Macs are less than 10% of Apple's revenue.
https://www.macrumors.com/2020/04/30/apple-2q-2020-earnings/
No. A special directory can be created at the root of the file system called /AppleInternal. Then, if you work at Apple, you can put some special files there that do stuff. I've read somewhere that they are able to easily disable all of this privacy protection crap and other annoying stuff.
Not to mention people defend and market their products for free.
If the Mac revenue was separated out on its own, it would be about Fortune 120, that is higher than Kraft Heinz. With plenty more space for growth. Apple only has 100M Active Mac users. There are 1.4B Windows PC.
Maybe it's not related to revenue per se, but clearly since iOS became their main thing the Mac has suffered tremendously.
Without Macs for developers and other content creators that other 90% doesn’t exist.
They are risking their entire empire because (apparently) someone at Apple has an axe to grind with macOS's Unix underpinnings. And until they start getting real consequences (developer's leaving in huge numbers), it doesn't seem like it's going to stop. The tragedy is, if they ever do reach that point, where developers are leaving in huge numbers, it'll be too late. Platforms are a momentum game, you're either going up, or you're going down. And once you're going down, you're as good as dead.
To me, the idea that an OS is mostly finished is completely bananas. There's so much room for improvement and hardly any of that potential was tapped into in what's starting to feel like a decade.
And if Apple had invested into a successor for Cocoa, there might be a larger gap between native apps and (Electron) web apps, leading to some lock-in. Instead most new stuff is not native and for good reasons (and I do dislike the way they don't adhere to Mac conventions, but still).
I think ultimately the problem is Tim Cook. He's too attached to Apple's stock price. I think that's the one metric that he believes rates his performance. But inertia is a bitch. Like in politics, the effects might hit hard only once he's out and it could be too late to fix by then.
If I think about how much this impacts the economy overall (i.e. make millions of knowledge workers a little bit less efficient) then I can only hope that I'll see more sophisticated organizational structures in my lifetime that prevent such erosion.
And I'd wager that some iOS games are released without the developer ever touching XCode: https://docs.unity3d.com/Manual/UnityCloudBuildiOS.html
It took longer than expected. I even intended to buy put options, but someone I trust told me otherwise and to invest in equity instead, which I did, because I know that most buy decisions are not made rationally.
But it looks like the time has come now? On the other hand, I have been off by several years before. People are crazier than you think, especially when it comes to status and association with brands and self-confirmation of past decisions. They might well put up with Apples moves for a few more years.
Less than 10% is no excuse.
The rest of the market is roughly $100B, and has net profit margins of 2-3%.
Perf changes are too numerous to mention, I’d recommend watching last year’s WWDC keynote describing the iOS 12 v/s 13 perf advancements.
Apple doesn't give a fuck about macOS since 2015.
For example, I can run "terraform apply" and it could take up to 5 minutes to start, leaving my computer almost unusable until it runs. The weird thing is that this only happens sometimes. In some cases, I restart the laptop and it starts working a little bit faster, but the issue comes back after some time.
It's already been a few months since I try to run every command from a VM in a remote location, since I am tired of waiting for my commands to start.
I have a macbook air from 2013 which never had this issue.
Any easy fix that I could test? Disconnecting from the internet is not an option. Disabling SIP could be tried, but I think I already did and didn't seem to fix it, plus it is not a good idea for a company laptop.
Don't we have some sort of hosts file or firewall that we can use to block or fake the connectivity to apple servers?
Certain BSD-syscall-ABI operations like fopen(2) and readdir(2) are now not-so-fast by default, because the OS has to do a synchronous check of the individual process binary's capabilities before letting the syscall through. But POSIX utilities were written to assume that these operations were fast-ish, and therefore they do tons of them, rather than doing any sort of batching.
That means that any CLI process that "walks" the filesystem is going to generate huge amounts of security-subsystem request traffic; which seemingly bottlenecks the security subsystem (OS-wide!); and so slows down the caller process and any other concurrent processes/threads that need capabilities-grants of their own.
To find a fix, it's important to understand the problem in fine detail. So: the CLI process has a set of process-local capabilities (kernel tokens/handles); and whenever it tries to do something, it first tries to use these. If it turns out none of those existing capabilities let it perform the operation, then it has to request the kernel look at it, build a firewall-like "capabilities-rules program" from the collected information, and run it, to determine whether it should grant the process that capability. (This means that anything that already has capabilities granted from its code-signed capabilities manifest doesn't need to sit around waiting for this capabilities-ruleset program to be built and run. Unless the app's capabilities manifest didn't grant the specific capability it's trying to use.)
Unlike macOS app-bundles, regular (i.e. freshly-compiled) BSD-userland executable binaries don't have a capabilities manifest of their own, so they don't start with any process-local capabilities. (You can embed one into them, but the process has to be "capabilities-aware" to actually make use of it, so e.g. GNU coreutils from Homebrew isn't gonna be helped by this. Oh, and it won't kick in if the program isn't also code-signed, IIRC.)
But all processes inherit their capabilities from their runtime ancestors, so there's a simple fix, for the case of running CLI software interactively: grant your terminal emulator the capabilities you need through Preferences. In this case, the "Full Disk Access" capability. Then, since all your all CLI processes have your terminal emulator as a runtime ancestor-process, all your CLI processes will inherit that capability, and thus not need to spend time requesting it from the security subsystem.
Note that this doesn't apply to BSD-userland executable binaries which run as LaunchDaemons, since those aren't being spawned by your terminal emulator. Those either need to learn to use capabilities for real; or, at least, they need to get exec(2)ed by a shim binary that knows how.
-----
tl;dr: I had this problem (slowness in numerous CLI apps, most obvious as `brew upgrade` suddenly taking forever) after upgrading to 10.15 as well. Granting "Full Disk Access" to iTerm fixed it for me.
They are definitely doing something way too slow.
[1] https://wiki.mozilla.org/Sandbox/OS_X_Rule_Set
[2] https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sand...
This capabilities-ruleset interpreter is what Apple uses the term "Gatekeeper" to refer to, mostly. It had already been put in charge of authorizing most Cocoa-land system interactions as of 10.12. But the capabilities-ruleset interpreter wasn't in the code-path for any BSD-land code until 10.15.
A capabilities-ruleset "program" for this interpreter can be very simple (and thus quick to execute), or arbitrarily complex. In terms of how complex a ruleset can get—i.e. what the interpreter's runtime allows it to take into consideration in a single grant evaluation—it knows about all the filesystem bitflags BSD used to, plus Gatekeeper-level grants (e.g. the things you do in Preferences; the "com.apple.quarantine" xattr), plus external system-level capabilities "hotfixes" (i.e. the same sort of "rewrite the deployed code after the fact" fixes that GPU makers deploy to make games run better, but for security instead of performance), plus some stuff (that I don't honestly know too much about) that can require it to contact Apple's servers during the ruleset execution. Much of this stuff can be cached between grant requests, but some of it will inevitably have to hit the disk (or the network!) for a lookup—in the middle of a blocking syscall.
I'm not sure whether it's the implementation (an in-kernel VM doesn't imply slowness; see eBPF) or the particular checks that need to be done, but either way, it adds up to a bit of synchronous slowness per call.
The real killer that makes you notice the problem, though, isn't the per-call overhead, but rather that the whole security subsystem seems to now have an OS-wide concurrency bottleneck in it for some reason. I'm not sure where it is, exactly; the "happy path" for capabilities-grants shouldn't make any Mach IPC calls at all. But it's bottlenecked anyway. (Maybe there's Mach IPC for audit logging?)
The security framework was pretty obviously structured to expect that applications would only send it O(1) capability-grant requests, since the idiomatic thing to do when writing a macOS Cocoa-userland application, if you want to work with a directory's contents, is to get a capability on a whole directory-tree from a folder-picker, and then use that capability to interact with the files.
Under such an approach, the sandbox system would never be asked too many questions at a time, and so you'd never really end up in a situation where the security system is going to be bottlenecked for very long. You'd mostly notice it as increased post-reboot startup latency, not as latency under regular steady-state use.
Under an approach where you've got many concurrent BSD "filesystem walker" processes, each spamming individual fopen(2)-triggered capability requests into the security system, though, a failure-to-scale becomes very apparent. Individual capabilities-grant requests go from taking 0.1s to resolve, to sometimes over 30s. (It's very much like the kind of process-inbox bottlenecks you see in Erlang, that are solved by using process pools or ETS tables.)
Either Apple should have rethought the IPC architecture of sandboxing in 10.15, but forgot/deprioritized this; or they should have made their BSD ...
I believe it is actually a Scheme dialect, and I would be very surprised if it is not compiled to some internal representation upon load.
> This capabilities-ruleset interpreter is what Apple uses the term "Gatekeeper" to refer to, mostly.
I am fairly sure Gatekeeper is mostly just Quarantine and other bits that prevent the execution of random things you download from the internet.
In the latter, Apple's sandbox rule set (custom profiles) is called SBPL - Sandbox Profile Language - and is described as a "Scheme embedded domain specific language".
It's evaluated by libSandbox, which contains TinyScheme! [3]
From what I could understand, the Scheme interpreter generates a blob suitable for passing to the kernel.
---
[1] https://reverse.put.as/wp-content/uploads/2011/09/Apple-Sand...
[2] https://media.blackhat.com/bh-dc-11/Blazakis/BlackHat_DC_201...
[3] http://tinyscheme.sourceforge.net/home.html
There is a bunch of new stuff in 10.15, mostly involving binary execs (and I don't understand all of it), but I'm pretty sure it doesn't match what you're describing.
Running any kind of I/O during a capability check is a broken design.
There is no reason to hit the disk (it should be preloaded), much less the network (such a design will never work if offline).
Is this actually new in macOS 10.15? I seem to recall this being a thing ever since sandboxing was a thing, even all the way back to when it was called Seatbelt.
> That means that any CLI process that "walks" the filesystem is going to generate huge amounts of sandboxd traffic, which bottlenecks sandboxd and so slows down the caller process.
Is this not implemented in the kernel as an extension? I thought the checks went through MAC framework hooks. Doesn't sandboxd just log access violations when told to do so by the Sandbox kernel extension?
> Unlike macOS app-bundles, regular BSD-userland executable binaries don't have a capabilities manifest of their own, so they don't start with any process-local capabilities (with some interesting exceptions, that I think involve the binary being embedded in the directory-structure of a system framework, where the binary inherits its capabilities from the enclosing framework.)
I am fairly sure you can just embed a profile in a section of your app's binary and call the sandboxing Mach call with that…
Maybe you're right; I'm not sure when they actually put the Seatbelt/TrustedBSD interpreter inline in the BSD syscall code-path. What I do know is that, until 10.15, Apple tried to ensure that the BSD-userland libc-syscall codepath retained mostly the same behavioral guarantees as it did before they updated it, in terms of worst-case time-complexities of syscalls. Not sure whether that was using a short-circuit path that went around Seatbelt or used a "mini-Seatbelt" fast path; or whether it was by hard-coding a pre-compiled MAC ruleset for libc calls that only relied upon the filesystem flag-bits, and so never had to do anything blocking during evaluation.
Certainly, even as of 10.12, BSD-userland processes weren't immune to being exec(2)-blocked by the quarantine xattr. But that may have been a partial implementation (e.g. exec(2) going through the MAC system while other syscalls don't.) It's kind of opaque from the outside. It was at least "more than nothing", though I'm not sure if it was "everything."
One thing that is clear is that, until 10.15, BSD processes with no capabilities manifest, still had the pretty much exactly the same default set of privileges that they had before capabilities, which means "almost everything" (and therefore they almost never needed to actually hit up the security system for more grants.) I guess all Apple really needed to have done in 10.15 to "break BSD", was to introduce some more capabilities, and then not put them in the default/implicit manifest.
I suppose what actually happened in 10.15 can be determined easily-enough from the OSS code that's been released. :)
> Is this not implemented in the kernel as an extension? // I am fairly sure you can just embed a profile in a section of your app's binary and call the sandboxing Mach call with that…
Yeah, sorry, you're right; updated my assertions above. I'm not a kernel dev; I've just picked up my understanding of this stuff from running head-first into it while trying to do other things!
On a clean Catalina install this does not happen. Does “terraform version” have the same delay? If not, check your remote configuration - maybe run with TF_LOG=trace. Terraform Cloud will definitely highlight the inherent performance problems of using a VPN.
% rm /tmp/test.sh ; echo $'#!/bin/sh\necho Hello' > /tmp/test.sh && chmod a+x /tmp/test.sh
% time bash /tmp/test.sh && time bash /tmp/test.sh
Hello
bash /tmp/test.sh 0.00s user 0.00s system 83% cpu 0.004 total
Hello
bash /tmp/test.sh 0.00s user 0.00s system 77% cpu 0.003 total
vs the one from the article:
% rm /tmp/test.sh ; echo $'#!/bin/sh\necho Hello' > /tmp/test.sh && chmod a+x /tmp/test.sh
% time /tmp/test.sh && time /tmp/test.sh
Hello
/tmp/test.sh 0.00s user 0.00s system 2% cpu 0.134 total
Hello
/tmp/test.sh 0.00s user 0.00s system 73% cpu 0.004 total
(edited for formating)
By far the best linux I've tried when trying to get feature parity with macOS.
https://www.youtube.com/watch?v=QGcvHMNaDd0
Debian or similar or ArchLinux if you have a desktop.
Edit: and WSL is not Linux
On mobile it's much better with Android, but Android isn't adapted to laptops. I haven't tried ChromeOS but it's pretty restricted from what I understood. WSL2 on Windows is Linux and it works great for me but I understand if you don't want windows in your life.
It is Linux as of WSL2, it's just also Windows, so you lose many of the advantages that would make a person recommend Linux in this thread.
Plus, if you're already familiar with how Debian works it should be a no brainer. None of that Ubuntu or other Debian-derived distros with extra sugar and bloat and that many times differ from actual Debian in just the right way to keep you scratching your head.
Even Debian "stable" is pretty good for desktop these days which in the past was always notorious for having super outdated packages but has greatly improved in that regard. Obviously, "sid" is still also a good pick for a desktop if you really need to always run the latest of mostly everything.
I personally have really no issues with systemd and now even go as far as completely removing the ifupdown, isc-dhcp-client, resolvconf and ntpd packages in favor of having my entire network stack configured by systemd-networkd, systemd-resolved and systemd-timesyncd instead.
It's pretty much a standard now across the board and I can't really find any arguments against it besides old habits so I've embraced it. Although it's obviously a bit opinionated, there is a good deal of functionality and flexibility on that thing.
That's also what seems worst about it. Unfortunately there seem to be few other choices these days.
The feeling reminds me of the first Macbooks I used when switching away from Windows Vista.
So far Ubuntu has been great as a default dev/staging workstation. It’s nice not to have to fight with homebrew or docker permissions or other issues on the Mac and spin up most anything.. and it just works.
Note: I really wanted to like WSL, but it just didn't work for me.
I just recently switched from Mac OS to windows and it really hasn’t been a bad experience.
I would go full Linux but the drivers for the GPU on my laptop seem to be a bit of a mess currently.
But no, haven't tried WSL2, I'm comfortable with my Linux setup so not to keen on messing with it at the moment :)
It's ubuntu without the bullshit monitization.
It is lightweight, since you choose everything that is installed, sort of opt-in.
It has all the latest software.
It has "rolling releases" which means there is never a giant lost-weekend distribution upgrade.
It has the AUR (arch user repository) for just about any software ever.
No outdated packages, no ppa. No upgrade. Install is rough but it nails how simple the system is.
Ubuntu is a good starting point. But there is so much more.
https://wiki.archlinux.org/index.php/PKGBUILD
For debian/ubuntu it is not as straightforward.
"it should simply work" is not a given on any linux.
I'm not denigrating those distributions, there are lots of reasons to have a stable release without a lot of things changing (especially development).
It's just that changing lots of assumptions at once is fragile.
if you want: nice experience out of the box
I would recommend: Arch, Gentoo, Debian Net inst, Void
if you want a base system and install things you want on top of it
Fedora 32 Workstation is pretty good if you want to see the best of what Linux can offer. It may not be the lightest and fastest distribution but it is easy to install and everything works. You'll get to experience Gnome which is the most original Linux desktop environment and the best one in terms of user experience in my opinion.
If you want something more traditional with the start menu or dock or desktop icons, perhaps something like KDE Neon is better place to start. It might feel more familiar. Will be lighter/faster too.
Put each of them on a USB and run them live on your machine for few minutes each and see which one makes more sense to you.
> Is there any "security" software running on your Mac? I've seen this sort of thing caused by that, but not in general.
> I ran the two line test and it had no delay at all. The Mac doesn't check for notarization on shell scripts or any non-bundle executable. I just did it again with a new test2.sh and Wireshark capture and there is nothing.
> I do a lot of Keychain code and I've also never seen those delays. The reason I suspect they told you not to use that API is that it's in the "legacy" macOS keychain. They really want everyone to move to the modern keychain but lots of people, myself included, still need the older macOS specific features.
> I'm not saying you are crazy, but all of these things though are the trademark reek of kernel level security software that is intercepting and scanning every exec and file read on the system. We had an issue with Cisco AMP once that took Xcode builds from under 10 seconds to over 5 minutes until we were able to get it fixed.
I could not for the life of me understand why go build would take upwards to 30 seconds to run and sometimes 100ms. I finally realized it was related to my internet connection being extremely spotty. I went online and searched if anybody had the same experience with `go build` but couldn't find anything.
I finally know what happened. This is a pretty intolerable "feature".
Yes these features could be better implemented, but I'm happy they're there. It's very important to be able to opt out of them, but I like that they're the default.
Notarization needs a cleanup pass and the rest of it seems like it needs an optimization pass.
P.S. The rationale for notarization is to not distribute and thus advertise the filters and detection mechanisms Apple uses to detect malware. If these things were distributed then malware authors could analyze and evade them. Security through obscurity does make a certain amount of sense here as the Church-Turing thesis means there are an infinite number of ways to implement any given thing including malware and there is no single filter or analytical step that can detect all possible malware permutations.
That's true (or else there are 0 ways), but it's not what the Church–Turing thesis says.
Changing the filename to test2.sh on the Mac (which should trigger the delay, right?) gets 0.006s, 0.006s.
I don't think the shell scripts are doing what they claim (and wouldn't the second run be faster anyway because of caching?)
It’s indeed a huge mess, from a privacy standpoint too, not just a performance one. It’s sad also to lose things like AirPlay or iMessage as collateral damage in the process. :/
I just can’t tolerate a machine that hits the network hundreds of times a day when doing normal computing tasks that do not involve the network. They even tolerate this sort of spyware in App Store apps, too.
Is it too much to ask for a polished workstation OS that lets me boot and edit a local text file of notes and save and quit without notifying 4 different parties that I did so?
running just firefox and terminal, ps -ef|wc -l is 198
and many of them have no reason to be on my system.