How to check if your Apple Silicon Mac is booting securely

https://eclecticlight.co/2025/08/21/how-to-check-if-your-apple-silicon-mac-is-booting-securely/

77•shorden•7h ago

Comments

userbinator•5h ago

s/booting securely/running only the code Apple approves of/g

bapak•5h ago

You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.

cyberax•4h ago

Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.

Barbing•4h ago

They respond to the begging as incredibly well as they respond to feedback/bug reports, right?

cyberax•3h ago

To be fair, they _do_ respond well in this particular case. But you have to write an email to a developer somewhere in Apple, as there is no established process.

Gigachad•3h ago

You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.

arcticbull•3h ago

Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit

bduhan•4h ago

I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine.

https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

Barbing•4h ago

Interesting. They need that for lowest-possible latency? And it should be fairly safe?

arcticbull•4h ago

Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple drops the hammer.

Barbing•4h ago

Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice

8ig8•4h ago

Dr Howard Oakley. I think of him as an OG Mac guy.

ostensible•3h ago

`man csrutil`

saagarjha•47m ago

Note that checking anything in userspace on a compromised machine does not actually prove that the machine is not compromised. It is very easy to boot insecurely and then make everything lie that the boot was secure.

On the Screen, Libyans Learned About Everything but Themselves (2021)

Phishing Emails Are Now Aimed at Users and AI

China mandates domestic firms source 50% of chips from Chinese producers

Exploring LLM Confidence in Code Completion

We Put Agentic AI Browsers to the Test – They Clicked, They Paid, They Failed

Which is better for vibe coding – Pycharm or Cursor

Are AI sermons ethical? Clergy consider where to draw the line

Spoon-Bending, a logical framework for analyzing GPT-5 alignment behavior

Show HN: Lekh – write-only, encrypted micro-journal at your own URL

Agency Is Eating the World

Owner of 'US 8964' licence plate faced police scrutiny and a year of harassment

VLF Plotter

I built a Task manager to prevent developer Burnout

Ask HN: How can I recover and run my old mobile game from the 2010s?

Zero Ethics AI [video]

The battle of Gaza City is beginning. Get ready for a barrage of Hamas lies

Google: Was 1995 30 years ago?

Founders of This New Development Say You Must Be White to Live There

What Are OKLCH Colors?

Show HN: Discover, share, and collaborate on effective coding prompts

A comprehensive list of 2025 tech layoffs

Buypass Discontinues Issuance of TLS/SSL Certificates

Joey Hess

Chinese property giant Evergrande delisted after fall

Violence and the Sacred: College as an incubator of Girardian terror (2017)

Guess the Pin

Next-generation JavaScript analysis tooling

Ban passengers playing loud music on public transport, say Tories

iDAI.field: software for the documentation of archaeological fieldwork

The First 1k Days

On the Screen, Libyans Learned About Everything but Themselves (2021)

Phishing Emails Are Now Aimed at Users and AI

China mandates domestic firms source 50% of chips from Chinese producers

Exploring LLM Confidence in Code Completion

We Put Agentic AI Browsers to the Test – They Clicked, They Paid, They Failed

Which is better for vibe coding – Pycharm or Cursor

Are AI sermons ethical? Clergy consider where to draw the line

Spoon-Bending, a logical framework for analyzing GPT-5 alignment behavior

Show HN: Lekh – write-only, encrypted micro-journal at your own URL

Agency Is Eating the World

Owner of 'US 8964' licence plate faced police scrutiny and a year of harassment

VLF Plotter

I built a Task manager to prevent developer Burnout

Ask HN: How can I recover and run my old mobile game from the 2010s?

Zero Ethics AI [video]

The battle of Gaza City is beginning. Get ready for a barrage of Hamas lies

Google: Was 1995 30 years ago?

Founders of This New Development Say You Must Be White to Live There

What Are OKLCH Colors?

Show HN: Discover, share, and collaborate on effective coding prompts

A comprehensive list of 2025 tech layoffs

Buypass Discontinues Issuance of TLS/SSL Certificates

Joey Hess

Chinese property giant Evergrande delisted after fall

Violence and the Sacred: College as an incubator of Girardian terror (2017)

Guess the Pin

Next-generation JavaScript analysis tooling

Ban passengers playing loud music on public transport, say Tories

iDAI.field: software for the documentation of archaeological fieldwork

The First 1k Days

How to check if your Apple Silicon Mac is booting securely

Comments