Comment

Comment by mike_hearn

I'm gonna go out on a limb and suggest that this obfuscation scheme is legacy, and they keep it merely as defense in depth and because it's tested so why not.

Modern Macs can do remote attestations from a trusted boot chain all the way up to specific apps, which obviates the need for this sort of obfuscation. The memory spaces will be protected by the operating system as long as SIP is enabled, and if it's not enabled or has been disabled / the root partition has been modified, then that will be detectable by Apple remotely. Although code obfuscation is fun (I've built a virtualization based obfuscation in the past), a properly implemented remote attestation and security architecture does obsolete it. It's therefore mostly useful on Windows/Linux PCs where these schemes don't really hang together.

parent mike_hearn 3 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton