How to Check If Your Apple Silicon MAC Is Booting Securely

Posted5 months agoActive5 months ago

shorden

101 points

22 comments

eclecticlight.coTechstory

calmmixed

Debate

40/100

Apple SiliconMacos SecurityBoot Security

Key topics

Apple Silicon

Macos Security

Boot Security

The article discusses how to check if an Apple Silicon Mac is booting securely, with commenters sharing their experiences and concerns about security features and potential limitations.

Snapshot generated from the HN discussion

Discussion Activity

Moderate engagement

First comment

Peak period

3-4h

Avg / period

2.4

Comment distribution22 data points

Loading chart...

Based on 22 loaded comments

Key moments

01Story posted
Aug 24, 2025 at 7:44 PM EDT
5 months ago
Step 01
02First comment
Aug 24, 2025 at 9:38 PM EDT
2h after posting
Step 02
03Peak activity
9 comments in 3-4h
Hottest window of the conversation
Step 03
04Latest activity
Aug 25, 2025 at 11:18 AM EDT
5 months ago
Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (22 comments)

Showing 22 comments

userbinator

5 months ago

2 replies

s/booting securely/running only the code Apple approves of/g

bapak

5 months ago

2 replies

You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.

cyberax

5 months ago

1 reply

Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.

Barbing

5 months ago

1 reply

They respond to the begging as incredibly well as they respond to feedback/bug reports, right?

cyberax

5 months ago

To be fair, they _do_ respond well in this particular case. But you have to write an email to a developer somewhere in Apple, as there is no established process.

Gigachad

5 months ago

You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.

arcticbull

5 months ago

Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit

bduhan

5 months ago

2 replies

I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine.

https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

Barbing

5 months ago

1 reply

Interesting. They need that for lowest-possible latency? And it should be fairly safe?

arcticbull

5 months ago

1 reply

Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple drops the hammer.

nottorp

5 months ago

1 reply

How about file system drivers? If there is such a thing any more... fuse and friends...

_mlbt

5 months ago

1 reply

There is a port of FUSE for macOS, and Apple also has a first party API for this called FSKit…

https://developer.apple.com/documentation/fskit

nottorp

5 months ago

1 reply

I know there was a port of FUSE. But iirc it requires old style extensions. Has it changed?

_mlbt

5 months ago

Per the MacFUSE documentation…

> macFUSE 5.0 supports multiple APIs for mounting file systems.

> By default, macFUSE uses the VFS API to mount file systems. When specifying the mount-time option -o backend=fskit, macFUSE will use FSKit to mount the file system.

https://github.com/macfuse/macfuse/wiki/FUSE-Backends

SebFender

5 months ago

UAD drivers have always been very creative... lol

Barbing

5 months ago

2 replies

Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice

Citizen8396

5 months ago

His site is filled with gems like this one.

8ig8

5 months ago

Dr Howard Oakley. I think of him as an OG Mac guy.

saagarjha

5 months ago

1 reply

Note that checking anything in userspace on a compromised machine does not actually prove that the machine is not compromised. It is very easy to boot insecurely and then make everything lie that the boot was secure.

Citizen8396

5 months ago

Recovery exists in a separate partition protected by SIP; it's set up this way to so that 99.99% of scenarios require a local, physical attack. "recoveryOS" is also bound to the specific APFS volume of the device. There's more to it than that, but you can be reasonably sure that recoveryOS isn't lying to you.

Sure, you can make an argument someone gave you a special device with a fake OS... but anyone willing to do that has much more simple ways to fuck with you.

ostensible

5 months ago

`man csrutil`

daft_pink

5 months ago

The problem is if you enable filevault then you can’t ssh into the mac remotely until someone locally logs in.

Means I end up using filevault on my laptop, but not on my desktop.

View full discussion on Hacker News

ID: 45008832Type: storyLast synced: 11/20/2025, 2:27:16 PM

Want the full context?