hckrnws

I really respect Apple's privacy focused engineering. They didn't roll out _any_ AI features until they were capable of running them locally, and before doing any cloud-based AI they designed and rolled out Private Cloud Compute.

You can argue about whether it's actually bulletproof or not but the fact is, nobody else is even trying, and have lost sight of all privacy-focused features in their rush to ship anything and everything on my device to OpenAI or Gemini.

I am thrilled to shell out thousands and thousands of dollars to purchase a machine that feels like it really belongs to me, from a company that respects my data and has aligned incentives.

> to purchase a machine that feels like it really belongs to me

How true is this when they devices are increasingly hostile to user repair and upgrades? MacOS also tightens the screws on what you can run and from where, or at least require more hoop jumping over time.

Of course I wish the hardware were somehow more open, but to a large extent, it's directly because of hardware based privacy features.

If you allowed third-party components without restraint, there'd be no way to prevent someone swapping out a component.

Lock-in and planned obsolescence are also factors, and ones I'm glad the EU (and others) are pushing back here. But it isn't as if there are no legitimate tradeoffs.

Regarding screw tightening... if they ever completely remove the ability to run untrusted code, yes, then I'll admit I was wrong. But I am more than happy to have devices be locked down by default. My life has gotten much easier since I got my elderly parents and non-technical siblings to move completely to the Apple ecosystem. That's the tradeoff here.

> to a large extent, it's directly because of hardware based privacy features.

First, this is 100% false. Second, security through obscurity is almost universally discouraged and considered bad practice.

Security though obscurity is highly effective.

Think of some common sense physical analogies: a hidden underground bunker is much less likely to be robbed than a safe full of valuables in your front yard. A bicycle buried deeply in bushes is less likely to be stolen than one locked to a bike rack.

Without obscurity it is straightforward to know exactly what resources will be required to break something- you can look for a flaw that makes it easy and/or calculate exactly what is required for enough brute force.

When you add the element of well executed obscurity on top of an also strong system, it becomes nearly impossible to even identify that there is something to attack, or to even start to form a plan to do so.

Combining both approaches is best, but in most cases I think simple obscurity is more powerful and requires less resources than non obscure strength based security.

I’ve managed public servers that stayed uncompromised without security updates for a decade or longer using obscurity: an archaic old Unix OS of some type that does not respond to pings or other queries, runs services on non-standard ports, and blocks routes to hosts that even attempt scanning the standard ports will not be compromised. Obviously also using a secure OS with updates on top of these techniques is better overall.

I think the scenario that security through obscurity fails is when the end user is reliant on guarantees that don't exist.

For example Intel's Management Engine, it was obscured very well. It wasn't found for years. Eventually people did find it, and you can't help but wonder how long it took for bad actors with deep pockets to find it. Its this obscured cubby hole in your CPU, but if someone could exploit it, it would be really difficult to find out because of intel's secrecy on top of the feature.

It seems like people are really talking about different things with obscurity. Some are referring to badly designed weak systems, where secrecy and marketing hype is used to attempt to conceal the flaws. Others, like my comment above, are talking about systems carefully engineered to have no predictable or identifiable attack surfaces- things like OpenBSDs memory allocation randomization, or the ancient method of simply hiding physical valuable things well and never mentioning them to anyone. I’ve found when it is impossible for an external bad actor to even tell what OS and services my server is running- or in some cases to even positively confirm that it really exists- they can’t really even begin to form a plan to compromise it.

> where secrecy and marketing hype is used to attempt to conceal the flaws.

That's literally the practical basis of security through obscurity.

> Others, like my comment above, are talking about systems carefully engineered to have no predictable or identifiable attack surfaces- things like OpenBSDs memory allocation randomization,

That's exactly the opposite of 'security through obscurity' - you're literally talking about a completely open security mitigation.

> I’ve found when it is impossible for an external bad actor to even tell what OS and services my server is running- or in some cases to even positively confirm that it really exists- they can’t really even begin to form a plan to compromise it.

If one of your mitigations is 'make the server inaccessible via public internet', for example - that is not security through obscurity - it's a mitigation which can be publicly disclosed and remain effective for the attack vectors it protects against. I don't think you quite understand what 'security through obscurity[0]' means. 'Security through obscurity' in this case would be you running a closed third-party firewall on this sever (or some other closed software, like macos for example) which has 100 different backdoors in it - the exact oppposite of actual security.

[0] https://en.wikipedia.org/wiki/Security_through_obscurity

You're mis-representing my examples by shifting the context, and quoting a wikipedia page that literally gives the same examples to two of the main ones I mentioned at the very top of the article as key examples of security through obscurity: "Examples of this practice include disguising sensitive information within commonplace items, like a piece of paper in a book, or altering digital footprints, such as spoofing a web browser's version number"

If you're not understanding how memory allocation randomization is security through obscurity- you are not understanding what the concept entails at the core. It does share a common method with, e.g. using a closed 3rd party firewall: in both cases direct flaws exist that could be overcome with methods other than brute force, yet identifying and specifying them enough to actually exploit is non-trivial.

The flaw in your firewall example is not using obscurity itself, but: (1) not also using traditional methods of hardening on top of it - obscurity should be an extra layer not an only layer, and (2) it's probably not really very obscure, e.g. if an external person could infer what software you are using by interacting remotely, and then obtain their own commercial copy to investigate for flaws.

> You're mis-representing my examples by shifting the context,

Specific example of where I did this?

> literally gives the same examples to two of the main ones I mentioned at the very top of the article as key examples of security through obscurity: "Examples of this practice include disguising sensitive information within commonplace items, like a piece of paper in a book, or altering digital footprints, such as spoofing a web browser's version number"

I mean, I don't disagree that what you said about changing port numbers, for example, is security through obscurity. My point is that this is not any kind of defense from a capable and motivated attacker. Other examples like the OpenBSD mitigation you mentioned are very obviously not security through obscurity though.

> If you're not understanding how memory allocation randomization is security through obscurity- you are not understanding what the concept entails at the core.

No, you still don't understand what 'security through obscurity' means. If I use an open asymmetric key algorithm - the fact that I can't guess a private key does not make it 'security through obscurity' it's the obscuring of the actual crypto algorithm that would make it 'security through obscurity'. Completely open security mitigations like the one you mentioned have nothing to do with security through obscurity.

> The flaw in your firewall example is not using obscurity itself, but: (1) not also using traditional methods of hardening on top of it

Sooo... you think adding more obscurity on top of a closed, insecure piece of software is going to make it secure?

> if an external person could infer what software you are using by interacting remotely,

There are soooo many ways for a capable and motivated attacker to figure out what software you're running. Trying to obscure that fact is not any kind of security mitigation whatsoever. Especially when you're dealing with completely closed software/hardware - all of your attempts at concealment are mostly moot - you have no idea what kind of signatures/signals that closed system exposes, you have no idea what backdoors exist, you have no idea what kind of vulnerable dependencies it has that expose their own signatures and have their own backdoors. Your suggestion is really laughable.

> not also using traditional methods of hardening on top of it

What 'traditional methods' do you use to 'harden' closed software/hardware? You literally have no idea what security holes and backdoors exist.

> if an external person could infer what software you are using by interacting remotely, and then obtain their own commercial copy to investigate for flaws.

Uhh yeah, now you're literally bringing up one of the most common arguments for why security through obscurity is bullshit. During WW1/WW2 security through obscurity was common in crypto - they relied on hiding their crypto algos instead of designing ones that would be secure even when publicly known. What happened is enough messages, crypto machines, etc were recovered by the other side to reverse these obscured algos and break them - since then crypro has pretty much entirely moved away from security through obscurity.

You are operating on a false dichotomy that the current best practices of cryptographic security, code auditing, etc. are somehow mutually exclusive with obscurity, and then arguing against obscurity by arguing for other good practices. They are absolutely complementary, and implementing a real world secure system will layer both- one starts with a mathematically secure heavily publicly audited system, and adds obscurity in their real world deployment of it.

If there are advantages to a closed source system, it is not in situations where the source is closed to you and contains bugs, but when closed to the attacker. If you have the resources and ability to, for example, develop your own internally used but externally unknown, but still heavily audited and cryptographically secure system, is going to be better than an open source tool.

> They are absolutely complementary, and implementing a real world secure system will layer both- one starts with a mathematically secure heavily publicly audited system, and adds obscurity in their real world deployment of it.

Ok, let's start with a 'mathematically secure heavily public audited system' - let's take ECDSA, for example - how will you use obscurity to improve security?

> If you have the resources and ability to, for example, develop your own internally used but externally unknown, but still heavily audited and cryptographically secure system, is going to be better than an open source tool.

Literally all of the evidence we have throughout the history of the planet says you're 100% wrong.

> Literally all of the evidence we have throughout the history of the planet says you're 100% wrong

You are so sure you’re right that you are not really thinking about what I am saying, and how it applies to real world situations- especially things like real life high stakes life or death situations.

I am satisfied that your perspective makes the most sense for low stakes broad deployments like software releases, but not for one off high stakes systems.

For things like ECDSA, like anything else you implement obscurity on a one off basis tailored to the specific use case- know your opponent and make them think you are using an entirely different method and protocol that they’ve already figured out and compromised. Hide the actual channel of communication so they are unable to notice it exists, and over that you simply use ECDSA properly.

Oh, and store your real private key in the geometric design of a giant mural in your living room, while your house and computers are littered with thousands of wrong private keys on ancient media that is expensive to extract. Subscribe to and own every key wallet product or device, but actually use none of them.

> You are so sure you’re right that you are not really thinking about what I am saying, and how it applies to real world situations- especially things like real life high stakes life or death situations.

Nah, you're just saying a lot of stuff that's factually incorrect and just terrible advice overall. You lack understanding what you're talking about. And the stakes are pretty irrelevant to whether a system is secure or not.

> For things like ECDSA, like anything else you implement obscurity on a one off basis tailored to the specific use case- know your opponent and make them think you are using an entirely different method and protocol that they’ve already figured out and compromised.

You're going to make ECDSA more secure by making people think you're not using ECDSA? That makes so little sense in so many ways. Ahahahahaha.

I very well may be wrong, but if so you are not aware of how, and I will need to find someone else to explain it to me. I’ve been interested for a while in having a serious debate with someone that understands and advocates for the position you claim to have- but if you understood it you would be able to meaningfully defend it rather than using dismissive statements.

You do you champ.

> Security though obscurity is highly effective.

If you say so.

> Think of some common sense physical analogies: a hidden underground bunker is much less likely to be robbed than a safe full of valuables in your front yard. A bicycle buried deeply in bushes is less likely to be stolen than one locked to a bike rack.

That's not what security through obscurity is. If you want to make an honest comparison - what is more likely to be a secure - an open system built based on the latest/most secure public standards, or a closed system built based on (unknown)? The open system is going to be more secure 99.999% of the time.

> Without obscurity it is straightforward to know exactly what resources will be required to break something- you can look for a flaw that makes it easy and/or calculate exactly what is required for enough brute force.

The whole point of not relying on obscurity is that you design an actually secure system even assuming the attacker has a full understanding of your system. That is how virtually all modern crypto that's actually secure works. Knowing your system is insecure and trying to hide that via obscurity is not security.

> it becomes nearly impossible to even identify that there is something to attack

That's called wishful thinking. You're conflating 'system that nobody knows about or wants to attack' with 'system that someone actually wants to attack and is defending via obscurity of its design'. If you want to make an honest comparison you have to assume the attacker knows about the system and has some motive for attacking it.

> but in most cases I think simple obscurity is more powerful and requires less resources than non obscure strength based security.

Except obscurity doesn't actually give you any security.

> I’ve managed public servers that stayed uncompromised without security updates for a decade or longer using obscurity: an archaic old Unix OS of some type that does not respond to pings or other queries, runs services on non-standard ports, and blocks routes to hosts that even attempt scanning the standard ports will not be compromised.

That's a laughably weak level of security and does approximately ~zero against a capable and motivated attacker. Also, your claim of 'stayed uncompromised' is seemingly based on nothing.

You are begging the question- insisting that obscurity isn't security by definition, instead of actually discussing it's strength and weaknesses. I didn't "say so"- I gave specific real world examples, and explained the underlying theory- that being unable to plan or quantify what is required to compromise a system makes it much harder.

Instead of, for example in your last example simply labeling something you seem to not like as "laughably weak"- do you have any specific reasoning? Again, I'd like to emphasize that I don't advocate obscurity in place of other methods, but on top of additional methods.

Let's try some silly extreme examples of obscurity. Say I put up a server running OpenBSD (because it is less popular)- obviously a recent version with all security updates-, and it has only one open port- SSH, reconfigured to run on port 64234, and attempting to scan all other ports immediately and permanently drop the route to your IP. The machine does not respond to pings, and does other weird things like only being physically connected for 10 minutes a day at seemingly random times only known by the users, with a new IP address each time that is never reused. On top of that, the code and all commands of the entire OS has been secretly translated into a dead ancient language so that even with root it would take a long time to figure out how to work anything. It is a custom secret hacked fork of SSH only used in this one spot that cannot be externally identified as SSH at all, and exhibits no timing or other similar behaviors to identify the OS or implementation. How exactly are you going to remotely figure out that this is OpenBSD and SSH, so you can then start to look for a flaw to exploit?

If you take the alternate model, and just install a mainstream open source OS and stay on top of all security updates the best you can, all a potential hacker needs to do is quickly exploit a new update before you actually get it installed, or review the code to find a new one.

Is it easier to rob a high security vault in a commercial bank on a major public street, or a high security vault buried in the sand on a remote island, where only one person alive knows its location?

> Instead of, for example in your last example simply labeling something you seem to not like as "laughably weak"- do you have any specific reasoning?

'without security updates for a decade or longer' - do I really need to go into detail on why this is hilariously terrible security?

'runs services on non-standard ports,' - ok, _maybe_ you mitigated some low-effort automated scans, does not address service signatures at all, the most basic nmap service detection scan bypasses this already.

'blocks routes to hosts that even attempt scanning the standard ports ' - what is 'attempt scanning the standard ports' and how are you detecting that- is it impossible for me to scan your server from multiple boxes? (No, it's not, it's trivially easy.)

> Say I put up a server running OpenBSD (because it is less popular)- obviously a recent version with all security updates-, and it has only one open port- SSH,

Ok, so already far more secure than what you said in your previous comment.

> only being physically connected for 10 minutes a day at seemingly random times only known by the users

Ok, so we're dealing with a server/service which is vastly different in its operation from almost any real-world server.

> only known by the users, with a new IP address each time that is never reused

Now you have to explain how you force a unique IP every time, and how users know about it.

> On top of that, the code and all commands of the entire OS has been secretly translated into a dead ancient language so that even with root it would take a long time to figure out how to work anything

Ok, so completely unrealistic BS.

> It is a custom secret hacked fork of SSH only used in this one spot that cannot be externally identified as SSH at all

It can't be identified, because you waved a magic wand and made it so?

> and exhibits no timing or other similar behaviors to identify the OS or implementation

Let's wave that wand again.

> How exactly are you going to remotely figure out that this is OpenBSD and SSH, so you can then start to look for a flaw to exploit?

Many ways. But let me use your magic wand and give you a much better/secure scenario - 'A server which runs fully secure software with no vulnerabilities or security holes whatsoever.' - Makes about as much sense as your example.

> Is it easier to rob a high security vault in a commercial bank on a major public street, or a high security vault buried in the sand on a remote island, where only one person alive knows its location?

The answer comes down to what 'high security' actually means in each situation. You don't seem to get it.

This is a common saying but in reality, security through obscurity is widely deployed and often effective.

More pragmatic advice would be to not rely solely on security through obscurity, but rather to practice defence in depth.

Security by insecurity is also 'widely deployed and often effective'.

Obfuscation is not security.. So there can't be "security through obscurity".

Widely deployed doesn't mean it's a positive action, and effective ? It just can't be as it's not a security. People really need to pay more attention to these things, or else we DO get nonsense rolled out as "effective".

Where did you come up with “ security through obscurity ” in that previous commment? It said nothing about using an obscurity measure. He was talking about hardware based privacy features.

> Second, security through obscurity is almost universally discouraged and considered bad practice.

This is stupid advice that is mindlessly repeated. Security by obscurity only is bad, sure. Adding obscurity to other layers of security is good.

Edit: formatting

No, that's just plain wrong in this case. It makes proper security research much harder and what's going on with your hardware less obvious.

Nah, you have no idea what you're talking about.

What do you mean by considered bad practice? By whom? I would think this is one of the reasons that my Macs since 2008 have just worked without any HW problems.

One of the most underrated macOS features is the screen sharing app - it’s great for seamless tech support with parents.

It works via your keychain and your contacts, and the recipient gets a little notification to allow you to view their screen.

That’s it - no downloads, no login, no 20 minutes getting a Remote Desktop screen share set up.

As fas as I see, it's not possible to connect to a device that uses the same Apple account, which is what I have done in my case. It has to be a different one.

Also, it only seems to work on a local network with hostnames.

Ahh - not sure about the same account, I’ve not tried that.

It 100% works across the internet: it works with contact names, not just host names.

I've used it with both machines signed into my Apple account for many years.

Is that just openssh with an obscured name? It would be nice to simply use the correct basic tool instead of some strange rebranding by a company of a much more well understood and trusted standard

This is the dumbest comment I’ve read in a long time.

The answer is no, fyi

You’re talking about through FaceTime, right? Or is there another native screen sharing app that I am unaware of?

A different one: it’s called “Screen Sharing.app” and it’s under Utilities.

After you open it, press “Connections -> New” and start typing a contact name.

They get a little notification if they are online, and if they accept you have a seamless screen sharing experience ready to go. It’s honestly magic for the “my parents have an error message and don’t know what to do” situation.

I assume they have you in their contacts as well for it to work.

For my parents: “under utilities” means it’s mostly impossible to use. What does under mean? What are utilities, are they different from apps? Can I Google search that? Where is connections? What is a connection, is that like a friend?

Glad to see your parents are tech savvy, but this reads like you live in a very different reality from mine.

Perhaps google the thing before jumping to conclusions, or saying I live in a different reality.

Your parents don’t need to run the app at all. You need to run the app.

Unless you really do live in a different reality where you want your parents to help you out when you see an error message you don’t understand?

> I wish the hardware were somehow more open

Some of us are old enough to remember the era of the officially authorised Apple clones in the 90's.

Some of us worked in hardware repair roles at the time.

Some of us remember the sort of shit the third-party vendors used to sell as clones.

Some of us were very happy the day Apple called time on the authorised clone industry.

The tight-knit integration between Apple OS and Apple Hardware is a big part of what makes their platform so good. I'm not saying perfect. I'm just saying if you look at it honestly as someone who's used their kit alongside PCs for many decades, you can see the difference.

Nobody is asking for Mac clones, I just want to be able to replace the SSD when it dies...

Or not have to pay $800 for a 2TB SSD that actually costs about $100.

Some of us remember that Franklin Computers never tried to monopolize and subsequently exploit a captive userbase for recurring service revenue.

Some of us might even be of the opinion that such a competition was beneficial to consumers that wanted more.

> My life has gotten much easier since I got my elderly parents and non-technical siblings to move completely to the Apple ecosystem. That's the tradeoff here.

Yeah, but this is hacker news.

“Hacker News” was always the arm of Valley startup mentality, not Slashdot-era Linux enthusiast privacy spook groupthink. It is unfortunate that this change has occurred.

Startups sometimes want to build hardware products, and in that case they mostly can't rely on __consumer__ products like Apple sells.

Apple gobbling up supply chains and production capacity is not something a hardware startup should be happy with.

Also, startup engineers don't necessarily like "alien technology", which is what Apple is becoming by developing everything behind closed doors and with little cooperation.

Startups don't like to pay 10-30% of their revenue just for running their software on a device someone has already paid for.

There are more reasons to dislike Apple than you can find on Slashdot.

> Apple gobbling up supply chains and production capacity is not something a hardware startup should be happy with.

You start with a very good and fair point.

> Also, startup engineers don't necessarily like "alien technology", which is what Apple is becoming by developing everything behind closed doors and with little cooperation. > Startups don't like to pay 10-30% of their revenue just for running their software on a device someone has already paid for.

You ended with one that is pretty much at odds with my experience. Startups value distribution channels, and the App Store has been fantastic for this.

Furthermore, it's one thing to dislike Apple. It's another thing for people to veer off into conspiracy theory, which is what half the threads on here have started to do.

> Slashdot-era Linux enthusiast privacy spook groupthink

This is what the vast majority of discourse on these topics has been dominated by on every platform, not just HN. I wonder if there's a shorter term for this, none of 4chan /g/'s crass terms cover this kind of depiction.

> I wonder if there's a shorter term for this

Competition-enabled rationalism: https://en.wikipedia.org/wiki/Xserve

Where do you think those Slashdot era Linux enthusiasts now work?

You can buy most parts officially from Apple - I just bought a new set of keycaps to replace some on my MacBook Air. Couldn't do that 5 years ago.

You can install whatever OS you want on your computer - Asahi Linux is the only one that's done the work to support that.

You can disable the system lockdowns that "tighten the screws" you refer to and unlock most things back to how they used to be.

> You can buy most parts officially from Apple

But very distinctly, not all. Apple deliberately makes customers buy more than what they need while refusing to sell board-level ICs or allow donor boards to be disassembled for parts. If a $0.03 Texas Instruments voltage controller melts on your Macbook, you have to buy and replace the whole $600 board if you want it working again. In Apple's eyes, third party repairs simply aren't viable and the waste is justified because it's "technically" repaired.

> You can install whatever OS you want on your computer

Just not your iPhone, iPad or Apple Watch. Because that would simply be a bridge too far - allowing real competition in a walled garden? Unheard of.

> You can disable the system lockdowns that "tighten the screws" you refer to and unlock most things back to how they used to be.

And watch as they break after regular system upgrades that force API regressions and new unjustified restrictions on your OS. Most importantly, none of this is a real an option on Apple's business-critical products.

Yeah, I know you can't buy every component. But five years ago you couldn't buy any.

We're clearly talking about Macs for the software parts so I'm not sure why you're bringing in iPhone/iPad/Apple Watch where the status quo has remained unchanged since they were introduced. I'd love those to be opened up but that's another conversation.

Regarding system restrictions on macOS (putting aside the fact it fully supports otehr operating systems on Apple hardware), the ability to disable the system restrictions hasn't changed for years. System Integrity Protection is still a toggle that most users never need to touch.

> Most importantly, none of this is a real an option on Apple's business-critical products.

I don't understand what this means?

> How true is this when they devices are increasingly hostile to user repair and upgrades?

Not sure what you mean exactly by this, but to me their Self Service Repair program is a step in the right direction.

It was mandated by right to repair laws, it provides the absolute minimum, and they've attempted the price out people wanting to do repairs. The only way it could be more hostile to users is by literally being illegal.

They could go out of their way to make things actually easy to work on and service, but that has never been the Apple Way. Compare to framework or building your own PC, or even repairing a laptop from another OEM.

What you see hostile to repair I see as not worth stealing. What you see as macOS dictating what you can run from where I see as an infiltration prevention.

They certainly are worth stealing. They get parted out and Apple's hostility towards making parts available means those stolen parts are worth more.

Except for when the valuable parts are software locked by activation lock and cannot be used in any other device.

What you see as anticompetitive payment processing on iOS, others may see friendly and harmless business model. HNers, be respectful when criticizing bigger companies like John Deere and Apple - it's important you don't hurt these customer's feelings and scare them off.

Your tractor doesn't (I would hope) contain your banking details and all your emails, contacts, browsing history, photos, etc. It deserves to be treated as the tool that it is.

Apple taking your data privacy seriously seems a worthy exception to me. You're free to disagree, and buy an Android.

Apple can take my privacy seriously while also allowing me to fix my hardware. You are promoting a false dichotomy that could be used to excuse almost any form of irrational behavior.

> MacOS also tightens the screws on what you can run and from where, or at least require more hoop jumping over time.

Can you explain what you mean by this? I have been doing software development on MacOS for the last couple of years and have found it incredibly easy to run anything I want on my computer from the terminal, whenever I want. Maybe I'm not the average user, but I use mostly open-source Unix tooling and have never had a problem with permissions or restrictions.

Are you talking about packaged applications that are made available on the App Store? If so, sure have rules to make sure the store is high-quality, kinda like how Costco doesn't let anyone just put garbage on their shelves

> Can you explain what you mean by this? I have been doing software development on MacOS for the last couple of years and have found it incredibly easy to run anything I want on my computer from the terminal, whenever I want.

Try sharing a binary that you built but didn't sign and Notarize and you'll see the problem.

It'll run on the machine that it was built on without a problem, the problems start when you move the binary to another machine.

My (very large US company) workplace has their own, branded app store for Mac users. One of our most popular apps is 'Gatekeeper disable'

Apple also left a very convenient hole in their boot loader to allow running another OS. Linux works pretty well these days

* on M1 and M2 variants.

Just to clarify, Asahi Linux is working on M3/M4 support. As far as I can tell nothing changed in the boot loader that makes this work more difficult, it just takes time to add the new hardware.

https://git.sudo.is/mirrors/AsahiLinux-docs/wiki/M3-Series-F...

The bootloader supports third-party operating systems on M3/M4 as well. Linux support just isn't there yet.

* As long as you don't want to use any external displays

Works with devices with HDMI ports

Really? I got a bunch of error upgrading my Arch-based Asahi and now chromium doesn't work anymore. Oh and no external display, or speaker.

You mean you have bugs on a system that isn’t announced as production ready yet ?

I tested Asahi and I genuinely love it and I’ll probably be happy to use it as my daily driver as soon as it will be mature enough. And I’m impressed by how it works well (outside of what still doesn’t work at all).

But buying a Mac ARM hopping to run Linux on it today without issue is just a wrong move. Just buy a classic PC if you want to be productive on Linux today.

I’m pretty confident it will happen though since the team itself looks pretty confident about supporting what is currently missing and in the past, achieved more than I hoped.

simply replying to (on ARM) "linux works pretty well these days"

Its amazing how far they have come, but it still lacks so much.

Considering you need an Apple ID to log into the hardware, id argue Apple gatekeeps that ownership pretty tightly.

This isn't true.

edit: also, unless you are the digital equivalent of "off the grid", I would argue most people are going to need some sort of cloud-based identity anyway for messaging, file-sharing, etc. iCloud is far and away the most secure of the options available to most users, and the only one that uses full end-to-end encryption across all services.

> edit: also, unless you are the digital equivalent of "off the grid", I would argue most people are going to need some sort of cloud-based identity anyway for messaging, file-sharing, etc. iCloud is far and away the most secure of the options available to most users, and the only one that uses full end-to-end encryption across all services.

"You need some cloud-based identity, and this is the best one," even granting its premises, doesn't make being forced into this one a good thing. I'm an Apple user, but there are plenty of people I need to message and share files with who aren't in the Apple ecosystem.

EDIT: As indicated in the reply (written before I added this edit), it sounds like I was ignoring the first part of the post, which pointed out that you aren't forced to use it. I agree that that is a sensible, and even natural and inevitable, reading. I actually wasn't ignoring that part, but I figured the only reason to include this edit was to say "that isn't true, but if it were true, then it would be OK." (Otherwise, what's the point? There's no more complete refutation needed of a false point than that it is false.) My argument is that, if it were true, then that wouldn't be OK, even if you need a cloud-based identity, and even if iCloud is the best one.

doesn't make being forced into this one a good thing

But you're not forced. You completely ignored the other response in order to continue grinding an axe.

It's optional and very easy to skip. Not like the requirement for a MS account on Windows 11, which is also skippable but not by the average user.

I had to set up a Windows computer for the first time in a decade recently, and holy shit did they make it difficult to figure out how to do it without a Microsoft account.

I have the same problem with graphics cards (not upgradable—and cost more than the pc they are in!)

Same with server parts using HBM—won’t let me upgrade memory there either.

That said, the apple ssd situation is abysmal. At least with memory they have reasons.

My MacBooks are built like a tank and outperform/outlive everything else easily for a decade. I don’t need more than 128GB of RAM or 2TB of storage… and I don’t need to repair what doesn’t break. It would be nice to have the option, but the time I save using an OS that just works like MacOS is worth more to me. And the best software in the world always runs on it. It’s a no brainier for me.

You can read the ifixit teardown before you buy it.

How true is this when they devices are increasingly hostile to user repair and upgrades?

I can neither repair nor upgrade my electric car, my furniture, or my plumbing. But they all still belong to me.

This is due to your capabilities as an individual, not the possibilities surrounding the items themselves.

You can also repair their devices yourself using their repair program, but only if you have the capabilities as an individual, so I don’t see your point.

> I am thrilled to shell out thousands and thousands of dollars to purchase a machine that feels like it really belongs to me, from a company that respects my data and has aligned incentives.

You either have have very low standards or very low understanding if you think a completely closed OS on top of completely closed hardware somehow means it 'really belongs' to you, or that your data/privacy is actually being respected.

"completely closed OS" is not accurate. apple releases a surprising amount of source code.

https://opensource.apple.com/releases/

The closed part has full control over your system, so the released code is useless for privacy/ownership.

Whats the alternative? Linux? Maybe OP likes that their OS doesnt crash when they close their laptop lid.

Crash? I understand people's gripes with ui, hardware compatibility, etc, but stability? All my Linux machines have always been very stable.

Me too. So stable that I'm becoming less and less tolerant for annoying issues in Windows, and further more motivated to make consumer linux even more available and reliable.

It's not that bad anymore (e.g. with system 76), but I understand the point.

I disagree with OP celebrating Apple to be the least evil of the evils. Yes, there are not many (if any) alternatives, but that doesn't make Apple great. It's just less shitty.

It feels like a lot of people in these threads form their opinions of what desktop Linux is like these days based on one poor experience from back in 2005.

This an Apple zealot thread. They aren’t reasonable or actually interested in computing outside of Apple. They will talk shit about Linux all day in this thread or any other one but if you criticize Apple it’s to the guillotine for your comment. I’m surprised yours is still standing.

yesterday I booted into my Kubuntu installation. it's on a rusty spinning disk on purpose. even after half of a century since the mother of all demos we still cannot preload the fucking "start menu" or whatever is the more correct technical term for that thing that _eventually_ shows the applications when you click on it.

There’s a bug for this? Or are you just complaining thinking someone in the software contributors world can here you?

I can’t even find how to open the Applications view in Finder 9/10 times on a Mac.

You hit the nail on the head. And it’s something virtually everyone else replying to you is completely missing.

Apple isn’t perfect. They’re not better at privacy than some absolutist position where you run Tails on RISC V, only connect to services over Tor, host your own email, and run your own NAS.

But of all the consumer focused hardware manufacturers and cloud services companies, they are the only ones even trying.

You miss the point. It's not that I enact authority over my system in every detail all the time, but I want the ability to choose authority on the aspects that matter to me in a given circumstance.

They just have really good marketing. You fell for their pandering. If you really care about privacy use Linux. But Apple ain't it. Closed source and proprietary will never be safe from corporate greed.

>https://archive.ph/Z9z0H

Linux doesn't give you privacy guy.

If you're using the web, your privacy is about your browser and your ISP, not your OS.

At times, it's even about how you use your browser. No browser will save you from telling google too much about yourself by using gmail, and viewing youtube videos, and using search. The AI's and algorithms collating all that information on the backend see right through "incognito" mode.

Telling people they can get security and privacy by using Linux, or windows, or mac just betrays a fundamental misunderstanding of the threat surface.

You missed the point completely. The problem with a user hostile closed OS like Windows is that they collect a lot of data from your computer even if you never open a web browser. You have no clue what they collect and what they do with the data

If you're so focused on privacy why don't you just use Linux? With Linux you'll actually get real privacy and you'll really truly own the system.

Apple takes a 30% tax on all applications running on their mobile devices. Just let that sink in. We are so incredibly lucky that never happened to PC.

As much as anyone can say otherwise, running Linux isn’t just a breeze. You will run into issues at some point, you will possibly have to make certain sacrifices regarding software or other choices. Yes it has gotten so much better over the past few years but I want my time spent on my work, not toying with the OS.

Another big selling point of Apple is the hardware. Their hardware and software are integrated so seamlessly. Things just work, and they work well. 99% of the time - there’s always edge cases.

There’s solutions to running Linux distros on some Apple hardware but again you have to make sacrifices.

Even on the machines most well-supported by Linux, which are Intel x86 PCs with only integrated graphics and Intel wifi/bluetooth, there are still issues that need to be tinkered away like getting hardware-accelerated video decoding working in Firefox (important for keeping heat and power consumption down on laptops).

I keep around a Linux laptop and it's improved immensely in the past several years, but the experience still has rough edges to smooth out.

> Even on the machines most well-supported by Linux, which are Intel x86 PCs with only integrated graphics and Intel wifi/bluetooth

Uhh, this is just untrue. I have it running on three different laptops from different vendors and Fedora, pop_OS!, and Ubuntu were all pretty much drop-in replacements for Windows, no problems.

You "keep around a Linux laptop" but I daily drive them and it's fine. Sure, there's the odd compatibility problem which could be dealbreaking, but it's not like MacOS is superior in that regard.

I'm just speaking from personal experience. That example was real, Firefox did not work with hardware accelerated video decode out of the box for me under Fedora, which was pretty high impact with that machine being used for studying. I got it working and it's kept working since, but like I said, it took some tinkering.

macOS has its own oddities of course, but they don't impede such basic usage as video playback.

Did you purchase Linux preinstalled?

I have used several distributions and daily driven linux for long periods of time (2-3 years) since 2008. Even today multimedia apps have issues, these can be solved by going through online forums, but it's always a frustrating start. Usually upgrades to software will re-introduce these issues and you will need to follow the same steps.

Which Linux?

> Private Cloud Compute

That's such a security theater. As long as nobody can look inside their ICs, nobody knows what's really happening there.

Oh? https://www.theregister.com/2024/10/25/apple_private_cloud_c...

> "Today we’re making these resources publicly available to invite all security and privacy researchers – or anyone with interest and a technical curiosity – to learn more about PCC and perform their own independent verification of our claims."

https://security.apple.com/documentation/private-cloud-compu...

There are also a million dollars of bounties to be had if you hack it

They mean that security researchers can look at the code, not the hardware at the transistor level.

They did say that people can come look at the hardware too, but we can all understand why that's not a fully open competition for logistical reasons if nothing else.

They've certainly engaged in a lot of privacy theater before. For example

> Apple oversells its differential privacy protections. "Apple’s privacy loss parameters exceed the levels typically considered acceptable by the differential privacy research community," says USC professor Aleksandra Korolova, a former Google research scientist who worked on Google's own implementation of differential privacy until 2014. She says the dialing down of Apple's privacy protections in iOS in particular represents an "immense increase in risk" compared to the uses most researchers in the field would recommend.

https://www.wired.com/story/apple-differential-privacy-short...

Does that mean you just don't bother encrypting any of your data, and just use unencrypted protocols? Since you can't inspect the ICs that are doing the work, encryption must all also be security theater.

Actually Apple has stated they are allowing security researchers to look at their infrastructure DIRECTLY.

They haven't done this.

That doesn't mean they get to know what happens inside the ICs.

Looking at a bunch of PCBs doesn't tell you much.

That's a fine bit of goalpost shifting. They state that they will make their _entire software stack_ for Private Cloud Compute public for research purposes.

Assuming they go through with that, this alone puts them leagues ahead of any other cloud service.

It also means that to mine your data the way everyone else does, they would need to deliberately insert _hardware_ backdoors into their own systems, which seems a bit too difficult to keep secret and a bit too damning a scandal should it be discovered...

Occam's razor here is that they're genuinely trying to use real security as a competitive differentiator.

The first release set should be downloadable now for inspection. (It's binaries only, source is released for select components)

That could be said of any device you own, ever.

I agree 100% with this.

Amongst all the big tech companies Apple is the closest you will get to if you want Privacy.

The approach that the big platforms have to producing their own versions of very successful apps cannibalizes their partners. This focus on consumer privacy by Apple is the company's killer competitive advantage in this particular area, IMO. If I felt they were mining me for my private business data I'd switch to Linux in heartbeat. This is what keeps me off Adobe, Microsoft Office, Google's app suite, and apps like Notion as much as possible.

Apple isn't privacy focused. It can't at this size with this leadership.

Privacy puts user interests first. Apple doesn't.

Try exporting your private data (e.g. photos) from any modern apple device (one that you paid for and you fully own) to a non apple device that is an industry standard like a usb stick, or another laptop. Monitor some network traffic going out from your laptop. Try getting replacement parts for your broken idevice.

Others aren't pretending to put your interests first, Apple though...

Think for yourself.

I don't comment here often anymore. Don't bother.

Couldn’t have picked a worse example. I can literally plug a USB stick into the iPad I’m typing on and export my photos directly onto it.

I can do all of those things, I do them regularly, except replace broken parts as that's not something I really have had to deal with much.

I purchased my first iPhone and Mac during Cook’s tenure, and strictly due to his serious stance on privacy.

>I am thrilled to shell out thousands and thousands of dollars to purchase a machine that feels like it really belongs to me, from a company that respects my data and has aligned incentives.

Build a desktop PC, yes like a nerdy gamer. ^_^

Install Linux

Been the way for years.

Gamer + Linux is asking for trouble though.

At least these days - it means asking for less trouble. It really is improving leaps and bounds. But I still dual boot on my gaming PC, but I run a lot of games on Linux in compatibility mode and it works well a reasonable amount of the time.

When is the last time you tried it? I did yesterday and outside of Activision and some EA games it’s great.

You can build a workstation with Ryzen Threadripper.

What I meant is it been more popular to build your own PC for gamers due to price and customization.

Or for laptops, Thinkpad and Linux :)

Of late I have been imagining tears of joy rolling down the face of the person who decides to take it upon themself to sing the paeans of Apple Privacy Theatre on a given day. While Apple has been gleefully diluting privacy on their platforms (along with quality and stability of course). They are the masters at selling dystopian control, lock in, and software incompetence as something positive.

It's most dangerous that they own the closed hardware and they own the closed software and then they also get away with being "privacy champions". It's worse than irony.

Nowadays, the only way to have a computer belonging to you is using Linux.

> actually bulletproof

Its only 'bulletproof' in PR and Ad copy, because for as long as the US is capable of undermining any tech company that operates within its purview with NSL's, the 'perception of security' is a total fallacy.

In other words, the technology is not bulletproof, no matter how hard the marketing people work to make it appear so - only the society within which the provider operates can provide that safety.

For some, this is an intolerable state of affairs - for others, perfectly tolerable.

"10:24 – Flushed the toilet" is certainly more easy to transmit than an audio file which then must be analyzed in a datacenter.

Let's see if they really care so much about privacy in 10 years, once LLM/AI has settled. But they do seem to respect it a lot more than Microsoft.

I understand we will be able to disable that just in case? I don't want a Microsoft Windows telemetry dejavu.

> I really respect Apple's privacy focused engineering.

Everytime you launch an app, Mac OS dials home.

This is flatly incorrect.

Before you reply that it’s definitely true, I encourage you to actually look up the details of the thing you think you’re upset about.

Mac OS calls home every time you execute an application. Apple is well on its way to ensure you can only run things they allow via app store, they would probably already be there if it wasn't for the pesky EU. If you send your computer/phone to Apple for repair you may get back different physical hardware. Those things very much highlight that "your" Apple hardware is not yours and that privacy on Apple hardware does not actually exist, sure they may not share that data with other parties but they definitely do not respect your privacy or act like you own the hardware you purchased. Apple marketing seems to have reached the level indoctrination where everyone just keeps parroting what Apple says as an absolute truth.

They send a hash of the binaries/libraries, and generate a cache locally so it's not sent again. That helps stop you from running tampered-with binaries and frameworks. No user-personal data is sent.

There is no evidence at all that they are trying to ensure you can only run things from the App Store - I run a whole bunch of non-app-store binaries every single day. To make that claim is baseless and makes me de-rate the rest of what you write.

There is always a trade-off between privacy and security. This still falls well under the Google/Android/Chrome level, or indeed the Microsoft/Windows level with its targeted ads, IMHO.

Choose your poison, but this works for me.

> They send a hash

My understanding is that they keep a local file with known malware signatures, just like the malware scanners on every other platform.

> macOS includes built-in antivirus technology called XProtect for the signature-based detection and removal of malware. The system uses YARA signatures, a tool used to conduct signature-based detection of malware, which Apple updates regularly

https://support.apple.com/guide/security/protecting-against-...

Xprotect is a blacklist that runs locally and is rarely used.

The phone home functionality is notarization, where apple does a network call to check that the signature on an executable actually came from apple’s notarization process. It is in essence a reputation system, where developers must be on good terms with apple to have the ability to notarize and get a smooth install experience.

Are you sure about your point?

From what I had in mind, notarization is only done developer side before publishing. Client side it's just a check against Apple certificates to verify that the binary haven't been tampered since notarization, no phoning home should be involved. (Or maybe just to update Apple certificates).

According to this article macOS does do a network request to check the notarization ticket:

https://eclecticlight.co/2023/03/09/how-does-ventura-check-a...

They also check the developer certificate in the OCSP stage.

Both of these are mechanisms where apple can effectively lock out developers from having a smooth install experience for their software at their discretion.

Isn’t this how certificate revocation flows work?

Doesn't Windows do the exact same thing?

I agree and want to emphasize a few things:

1. Most users are not capable of using general purpose computing technology in a wild, networked environment safely.

2. Too many people who matter to ignore insist, "something must be done."

3. And so something shall be done.

4. Apple is navigating difficult waters. As much as I disapprove of how they have chosen a path for iOS, the fact is many people find those choices are high value.

5. I do, for the most part, approve of their choices for Mac OS. I am not sure how they prevent malicious code without maintaining some sort of information for that purpose.

6. We are arriving at a crossroads many of us have been talking about for a long time. And that means we will have to make some hard choices going forward. And how we all navigate this will impact others in the future for a long time.

Look at Microsoft! They are collecting everything! And they absolutely will work with law enforcement anytime, any day, almost any way!

I sure as hell want nothing to do with Windows 11. Most technical people I know feel the same way.

Screenies every 3 to 5 seconds? Are they high? Good grief! Almost feels like raw rape. Metaphorically, of course.

Then we have Linux. Boy am I glad I took the time way back in the 90's to learn about OSS, Stallman, read words from interesting people, Raymond, Perkins, Searles, Lessig, Doctorow, many others!

Linus did all of tech one hell of a solid and here we are able to literally dumpster dive and build whatever we want just because we can. Awesome sauce in a jar right there

, but!

(And this really matters)

...Linux just is not going to be the general answer for ordinary people. At least not yet. Maybe it will be soon.

It is an answer in the form of a crude check and balance against those in power. Remember the "something shall be done" people? Yeah, those guys.

And here we are back to Apple.

Now, given the context I put here, Apple has ended up really important. Working professionals stand something of a chance choosing Mac OS rather than be forced into Windows 11, transparent edition!

And Apple does not appear willing to work against their users best interests, unless they are both compelled to by law, and have lost important challenges to said law.

If you want that, your choices are Apple and Linux!

7. Open, general purpose computing is under threat. Just watch what happens with Arm PC devices and the locked bootloaders to follow just like mobile devices.

Strangely, I find myself wanting to build a really nice Intel PC while I still can do that and actually own it and stand some basic chance of knowing most of what it doing for me. Or TO ME.

No Joke!

As I move off Win 10, it will be onto Linux and Mac OS. Yeah, hardware costs a bit more, and yeah it needs to be further reverse engineered for Linux to run on it too, but Apple does not appear to get in the way of all that. They also do not need to help and generally don't. Otherwise, the Linux work is getting done by great people we all really should recognize and be thankful for.

That dynamic is OK with me too. It is a sort of harsh mutual respect. Apple gets to be Apple and we all get to be who we are and do what we all do with general purpose computers as originally envisioned long ago.

We all can live pretty easily with that.

So, onward we go! This interesting time will prove to be more dangerous than it needs to be.

If it were not for Apple carving out a clear alternative things would look considerably more draconian, I could and maybe almost should say fascist and to me completely unacceptable.

As someone who cut his teeth on computing in the era you refer to, I have a small disagreement about Linux (especially Ubuntu) in your statement.

Apple is priced beyond the reach of many "ordinary people" especially outside the western markets. A cheap (perhaps after market) laptop with Ubuntu on it (often installed by the seller) is something that has been getting a lot of traction among regular users. Most of the things they do are via. a browser so as long as Chrome/FF works, they're good. They often install software that undermines the security that the platform natively offers but still, it's a pretty decent compromise.

Is it this part?

>Linux just is not going to be the general answer for ordinary people.

It so, I hear you. A decade or more ago, I had Ubuntu running as a general use machine for family and friends use.

It seemed almost there back then, and I saw some success.

Today it would be better, yes? I think so

Fact is, it often takes someone doing support to have it work well, and when that is gone, the software slips behind leaving users to get help.

Today, the numbers are much better. That happens less, but still does happen.

Your point on browser apps is solid. I agree, but those come with their own problems.

I see the most success when I set one up, including Void Tools, many visits to FossHUB...

When done, no network needed and one has a GREAT machine, ready for many tasks!

Both ways have merit and the more the merrier!

Yeah. It's a mixed bag for sure. However, the situation on the ground, where I am, looks like it's becoming a semi-mainstream platform.

Well, perhaps we are not so far apart on this.

Your news bolsters the "soon" in my comment above.

I am quite happy to be proven wrong.

> Apple is priced beyond the reach of many "ordinary people" especially outside the western markets.

Used, great condition M1 Airs go for ~$450 around here and will last longer than anything Intel or AMD-based for that price, whether new or used.

I was under the impression most of the “global poor” have a smart phone as their main computing device.

Indeed.

You know I decided to take my old note 8 for a test drive as a PC of sorts. Went ahead and purchased one of those USB 3 port bricks so I could hook up a nice display, keyboard, mouse, removable storage.

Samsung Dex popped up and it works mostly!

I found one could do quite a lot.

That is not the way I would go, but if I had to? Bring it! Plenty can be done, good skills learned.

I agree with you about Apple hardware, BTW.

Fact is, large numbers of people will just end up on Windows 11 :(

Cheap IBM compatibles and pirated DOS were the entry points to computing for many people back in the day. History repeats itself. :)

Thank you, this crystallized a lot for me.

It is nice when that happens. Of course, you are welcome.

If you don't mind sharing your take, what firmed up, I would read it with great interest!

>safely

There is that word again. Favorite tool of tyrants.

Yes. I agree with you, just so we are clear.

> I run a whole bunch of non-app-store binaries every single day

if you are in the US, you need to either register as a developer, or register an apple id and register your app to run it for a week. that's how you run non-app store code. Both of those require permission from apple.

EDIT: Sorry, ios.

This is completely incorrect. You can download a random binary and execute it. You will get a warning dialog saying it’s not signed by a known developer. You are free to ignore that though.

I'm sorry, I was thinking phone in previous comment. Yes, you can run binaries on macos with fiddling (but my comment does apply to ios)

Not ‘with fiddling’ — you can run any software you want on MacOS without altering or adjusting anything.

Depends what you mean by fiddling. But I'm in the process of switching to mac from Linux because my new job has forced it upon me.

I tried installing "Flameshot" via homebrew and it wouldn't run until I went into Finder, right clicked it and clicked open. Luckily it's mentioned in their docs [0] or I would have never guessed to do this.

[0] https://flameshot.org/docs/installation/installation-osx/

I use homebrew every day and have never encountered this. Sounds like an issue with how the software has been packaged.

I also notice two other installation options in your link that do not come with those additional instructions — which to me suggests with whatever they’re doing on homebrew.

That is not the same thing

If I were you, I would relax. At least you are not being shoved onto Win 11.

And then think about that. Seriously. I did. Have a few times off and on over the years as we sink into this mess.

I bet you find an OS that does a bit more than you may otherwise prefer to prevent trouble. If so, fair call in my book.

Just how big of a deal is that?

Compared to Android, Windows 10 and tons of network services and such and what they do not do FOR you, and instead do TO you.

And you can run a respectable and useful installation of Linux on that spiffy Apple hardware when it gets old. So make sure it gets old, know what I mean?

It could all be way worse.

> At least you are not being shoved onto Win 11.

As someone that just got out of a gig where I had to run Docker on MacOS - for the love of god, I would have done almost anything to use Windows 11.

Look - if I'm going to be treated like garbage, advertised to and patronized, at least let me use the system that can run Linux shells without turning into a nuclear reactor.

Re nuclear reactor: higher tier virtualization products work flawlessly. It is a shame what a garbage virtual box turned into over the years.

Lol, nothing is ever easy, is it?

If I did not love computing, I would have bagged on all this long ago.

Nope. A user can just run them if they want to. It is not a big deal.

It’s not “a big deal” if the user knows about, but the phrasing in macOS is maliciously bad - I sent a build from my machine to a coworker and when they “naively” ran it, the pop up that came up didn’t say “this program is unsigned” it said “this program is damaged and will now be deleted” (I don’t remember the exact phrasing but it made it sound like a virus or damaged download, not like an unsigned program).

I don't know about that. Or at least, I won't say they are bad

There are sets of deep roots in play here.

Phrasing struggles are rooted in the differences in these systems, and unless we have spent time in each, struggle seems likely.

That said, I spent time on the Apple side of the computing house early on... I know it helps.

> If you send your computer/phone to Apple for repair you may get back different physical hardware.

I happen to be in the midst of a repair with Apple right now. And for me, the idea that they might replace my aging phone with a newer unit, is a big plus. As I think it would be for almost everyone. Aside from the occasional sticker, I don't have any custom hardware mods to my phone or laptop, and nor do 99.99% of people.

Can Apple please every single tech nerd 100% of the time? No. Those people should stick to Linux, so that they can have a terrible usability experience ALL the time, but feel more "in control," or something.

Why not both? Why can’t we have a good usability experience AND control? In fact, we used to have that via the Mac hardware and software of the 1990s and 2000s, as well as NeXT’s software and hardware.

There was a time when Apple’s hardware was user-serviceable; I fondly remember my 2006 MacBook, with easily-upgradable RAM and storage. I also remember a time when Mac OS X didn’t have notarization and when the App Store didn’t exist. I would gladly use a patched version of Snow Leopard or even Tiger running on my Framework 13 if this were an option and if a modern web browser were available.

NeXT was great and Mac OS X was also nice and had a lovely indie and boutique app ecosystem during the mid-to-late 2000s. Sadly, iOS stole the focus. However, the OP argues Linux usability is bad, which I think is an outdated POV. It really depends on your setup and usecases. For many development usecases, Linux is superior to macOS.

I run NixOS on a plain X11 environment with a browser, an editor and a terminal. It's really boring. For my favorite development stacks, everything works. Flakes make workflow easy to reproduce, and it's also easy to make dramatic setup changes at OS level thanks to declarativeness and immutability.

If you're interacting with other humans, or with the consumer internet, you'll run into thousands of situations where my default setup (macOS, Chrome) "just works," and your setup will require some extra effort.

You may be smart enough to figure it out, but most people (even many smart tech people) get tired of these constant battles.

Here's an example from earlier this evening: I was buying a plane ticket from Japan Air Lines. Chrome automagically translates their website from Japanese to English. Other browsers, e.g. Firefox, and even Safari, do not - I checked. Is there a workaround or a fix? I'm sure you could find one, given time and effort. But who wants to constantly deal with these hassles?

Another very common example is communication apps. Or any time you're exchanging data in some proprietary format. Would it be great if no one used proprietary formats? Yes! Is that the world we live in? No. Can I force the rest of the world to adopt open standards, by refusing to communicate with them? No.

The world has moved on from desktop environments to multi-device integration like Watch, Phone, AirTags, Speakers, TV and in that way Linux usability is certainly worse than MacOS.

Oh sort of. That is for sure a thing, but not THE thing.

I would argue people are being tugged in that direction more than it being simply better.

You can bet when people start to get to work building things --all sorts of things, not just software, they find out pretty quickly just how important a simple desktop running on a general purpose computer really is!

It could help to compare to other makers for a minute: if you need to repair your Surface Pro, you can easily remove the SSD from the tray, send your machine and stick it back when it comes repaired (new or not)

And most laptops at this point have removable/exchangeable storage. Except for Apple.

> remove the SSD from the tray, send your machine and stick it back when it comes repaired

Apple has full-disk encryption backed by the secure enclave so its not by-passable.

Sure their standard question-set asks you for your password when you submit it for repair.

But you don't have to give it to them. They will happily repair your machine without it because they can boot their hardware-test suite off an external device.

I get your point, but we can also agree "send us your data, we can't access it anyway, right ?" is a completely different proposition from physically removing the data.

In particular if a flaw was to be revealed on the secure enclave or encryption, it would be too late to act on it after the machines have been sent in for years.

To be clear, I'm reacting on the "Apple is privacy focused" part. I wouldn't care if they snoop my bank statements on disk, but as a system I see them as behind what other players are doing in the market.

> if a flaw was ...

I hear the point you're making and I respect the angle, its fair-enough, but ...

The trouble with venturing into what-if territory is the same applies to you...

What if the disk you took out was subjected to an evil-maid attack ?

What if the crypto implementation used on the disk you took out was poor ?

What if someone had infiltrated your OS already and been quietly exfiltrating your data over the years ?

The trouble with IT security is you have you trust someone and something because even with open-source, you're never going to sit and read the code (of the program AND its dependency tree), and even with open-hardware you still need to trust all those parts you bought that were made in China unless you're planning to open your own chip-fab and motherboard plant ?

Its the same with Let's Encrypt certs, every man and his dog are happy to use them these days. But there's still a lot of underlying trust going on there, no ?

So all things considered, if you did a risk-assessment, being able to trust Apple ? Most people would say that's a reasonable assumption ?

> even with open-source, you're never going to sit and read the code (of the program AND its dependency tree)

You don't have to. The fact that it's possible for you to do so, and the fact that there are many other people in the open source community able to do so and share their findings, already makes it much more trust-worthy than any closed apple product.

THIS!

Back when I was new to all of this, the idea of people evaluating their computing environment seemed crazy!

Who does that?

Almost nobody by percentage, but making sure any of us CAN is where the real value is.

Jia Tan has entered the chat.

I hope you bring that up as an example in favor on open-source, as an example that open-source works. In a closed-source situation it would either not be detected or reach the light of day.

In a closed source situation people using a pseudonym don't just randomly approach a company and say "hey can I help out with that?"

It was caught by sheer luck and chance, at the last minute - the project explicitly didn't have a bunch of eyeballs looking at it and providing a crowd-sourced verification of what it does.

I am all for open source - everything I produce through my company to make client work easier is open, and I've contributed to dozens of third party packages.

But let's not pretend that it's a magical wand which fixes all issues related to software development - open source means anyone could audit the code. Not that anyone necessarily does.

> What if the disk you took out was subjected to an evil-maid attack ?

Well, have fun with my encrypted data. Then I get my laptop back, and it's either a) running the unmodified, signed and encrypted system I set before or b) obviously tampered with to a comical degree.

> What if the crypto implementation used on the disk you took out was poor ?

I feel like that is 100x more likely to be a concern when you can't control disc cryptography in any meaningful way. The same question applies to literally all encryption schemes ever made, and if feds blow a zero day to crack my laptop that's a victory through attrition in anyone's book.

> What if someone had infiltrated your OS already and been quietly exfiltrating your data over the years ?

What if aliens did it?

Openness is a response to a desire for accountability, not perfect security (because that's foolish to assume from anyone, Apple or otherwise). People promote Linux and BSD-like models not because they cherry-pick every exploit like Microsoft and Apple does but because deliberate backdoors must accept that they are being submit to a hostile environment. Small patches will be scrutinized line-by-line - large patches will be delayed until they are tested and verified by maintainers. Maybe my trust is misplaced in the maintainers, but no serious exploit developer is foolish enough to assume they'll never be found. They are publishing themselves to the world, irrevocably.

What if the disk could be removed, put inside a thunderbolt enclosure, and worked on another machine while waiting for the other? That's what I did with my Framework.

Framework has demonstrated in more than one way that Apple's soldered/glued-in hardware strategy is not necessary.

> Apple has full-disk encryption backed by the secure enclave so its not by-passable.

Any claims about security of apple hardware or software are meaningless. If you actually need a secure device, apple is not an option.

> Any claims about security of apple hardware or software are meaningless. If you actually need a secure device, apple is not an option.

I don't think this is precise, but the constraints seem a bit vague to me. What do you consider to be in the list of secure devices?

I'm not even here to troll, if you can give details on the list and why that'd be awesome

Seconded

It's also possible to say "nothing" and just leave it at that. A lot of people are desperate to defend Apple by looking at security from a relative perspective, but today's threats are so widespread that arguably Apple is both accomplice and adversary to many of them. Additionally, their security stance relies on publishing Whitepapers that have never been independently verified to my knowledge, and perpetuating a lack of software transparency on every platform they manage. Apple has also attempted to sue security researchers for enabling novel investigation of iOS and iPadOS, something Google is radically comfortable with on Android.

The fact that Apple refuses to let users bring their own keys, choose their disc encryption, and verify that they are secure makes their platforms no more "safe" than Bitlocker, in a relative sense.

I do not believe I understand your comment.

Early, you mention people defending Apple security in a relative sense.

Later, you mentioned Apple refusing user actions to verify security makes them no more safe in a relative sense.

Are you just talking about Apple employing security by obscurity?

I just want to understand your point better, or confirm my take is reasonable.

And for anyone reading, for the record I suppose, I do not consider much of anything secure right now. And yes, there are degrees. Fair enough.

I take steps in my own life to manage risk and keep that which needs to be really secure and or private off electronics or at the least off networks.

Using fully open hardware and software I guess ?

So why the hell do they ask for it then.

> So why the hell do they ask for it then.

I suppose so they can do a boot test post-repair or something like that. I have only used their repair process like twice in my life and both times I've just automatically said "no" and didn't bother asking the question. :)

With Apple FDE, you get nowhere without the password. The boot process doesn't pass go. Which catches people out when they reboot a headless Mac, the password comes before, not after boot even if the GUI experience makes you feel otherwise.

The counterpoint is wiping the device and restoring from local backups when it is returned.

You need to trust the erasure system, which is software. This also requires you to have write access to the disk whatever the issues are, otherwise your trust is left in the encryption and nobody having the key.

That's good enough for most consumers, but a lot more sensitive for enterprises IMHO. It usually gets a pass by having the contractual relation with the repair shop cover the risks, but I know some roles that don't get macbooks for that reason alone.

>And for me, the idea that they might replace my aging phone with a newer unit, is a big plus. As I think it would be for almost everyone.

except that isn't generally how factory repairs are handled.

I don't know about Apple specifically, but other groups (Samsung, Microsoft, Lenovo) will happily swap your unit with a factory refurbished or warranty-repaired unit as long as it was sufficiently qualified before hand -- so the 'replaced with a newer unit' concept might be fantasy.

What makes you think it would be a new one as opposed to a refurbished used one.

If the parts show no signs of wear and tear, what is the difference? Theseus' iPhone.

I've seen a few Rossman streams with officially "refurbished" macbooks that were absolutely foul inside. Boards that looked like they had been left on a preheater over lunch, rubber wedges to "cure" a cracked joint, all sorts of awful shit. The leaked stories from the sweatshop that did the work were 100% consistent with the awful quality.

Admittedly this was a few years ago. Has apple mended their ways or are they still on the "used car salesman" grindset?

Are these Apple refurbished, or bought from a third party like Best Buy or Amazon? I’ve bought plenty of Apple refurbished products (directly from Apple) over the years and they always look like new (including 100% battery health).

Third parties and resellers though I’m convinced just call their returns/open box units that appear to be in decent condition “refurbished.”

The problem is no-fault-found returns.

You have a phone with a real, but subtle fault. Something not caught by the normal set of tests. You return it for repair, get sent a new one, they replace the battery in your old one and put into stock as 'reconditioned'.

My phone is perfect, save for a worn out battery. I send it in for battery replacement, they send me yours. Now I've swapped my perfect phone for your faulty phone - and paid $70 to do so.

It makes me uncomfortable. No particular rational reason, I just don't like it.

Thanks. That is fair. Your truth, and I respect that.

> What makes you think it would be a new one

Did I say it would be a "new one"?

Yes, unless this was edited later on.

> 'might replace my aging phone with a newer unit, '

unless you just want to argue about the semantics and differences between 'aging', 'newer' , and 'new'.

You think the difference between "newer than ... aging phone" and "NEW" is "semantics"???

HN really has turned into reddit.

Reddit-style pedantry time!

Semantics is literally the meaning of things. So, yes the difference between those phrases is semantics.

But your use of 'semantics' meant something subtly different. Ain't language weird?

What makes you think it would be a new one as opposed to a refurbished used one.

Because Apple got sued for doing that once, and people including myself are in line to get checks from it.

It would depend on a countries consumer laws. I used to work for AASP's in Australia and they definitely used refurished phones for replacements and refurished parts for the Mac repairs. Not everyone who uses this site lives in America...

It's also the rule in the EU.

> And for me, the idea that they might replace my aging phone with a newer unit, is a big plus.

It's called a warranty and not at all exclusive to apple whatsoever?

> Those people should stick to Linux, so that they can have a terrible usability experience ALL the time, but feel more "in control," or something.

Maybe you should stick to reading and not commenting, if this is the best you can do.

> Mac OS calls home every time you execute an application

Consulting a certificate revocation list is a standard security feature, not a privacy issue.

Further, there is a CRL/OCSP cache — which means that if you're running a program frequently, Apple are not receiving a fine-grained log of your executions, just a coarse-grained log of the checks from the cache's TTL timeouts.

Also, a CRL/OCSP check isn't a gating check — i.e. it doesn't "fail safe" by disallowing execution if the check doesn't go through. (If it did, you wouldn't be able to run anything without an internet connection!) Instead, these checks can pass, fail, or error out; and erroring out is the same as passing. (Or rather, technically, erroring out falls back to the last cached verification state, even if it's expired; but if there is no previous verification state — e.g. if it's your first time running third-party app and you're doing so offline — then the fallback-to-the-fallback is allowing the app to run.)

Remember that CRLs/OCSP function as blacklists, not whitelists — they don't ask the question "is this certificate still valid?", but rather "has anyone specifically invalidated this certificate?" It is by default assumed that no, nobody has invalidated the certificate.

> i.e. it doesn't "fail safe" by disallowing execution if the check doesn't go through. (If it did, you wouldn't be able to run anything without an internet connection!) Instead, these checks can pass, fail, or error out; and erroring out is the same as passing. (Or rather, technically, erroring out falls back to the last cached verification state, even if it's expired; but if there is no previous verification state — e.g. if it's your first time running third-party app and you're doing so offline — then the fallback-to-the-fallback is allowing the app to run.)

https://www.sentinelone.com/blog/what-happened-to-my-mac-app...

> Last week, just after we covered the release of Big Sur, many macOS users around the world experienced something unprecedented on the platform: a widespread outage of an obscure Apple service caused users worldwide to be unable to launch 3rd party applications.

Scroll down a little further on your link for confirmation of what the parent said:

> As was well-documented over the weekend, trustd employs a “fail-soft” call to Apple’s OCSP service: If the service is unavailable or the device itself is offline, trustd (to put it simply) goes ahead and “trusts” the app.

Even at the time people quickly figured out you could just disconnect from the internet as a workaround until the issue was fixed.

Why is it that non app store apps refuse to run until I explicitly allow it in settings then?

Presumably because you have Gatekeeper set to "Allow applications from: App Store" rather than "Allow applications from: App Store & Known Developers".

This is just Gatekeeper asking you which code-signing CA certs you want to mark as trusted in its kernel-internal trust store (which is, FYI, a separate thing from the OS trust store): do you want just the App Store CA to be trusted? Or do you also want the Apple Developer Program's "Self-Published App" Notarization CA to be trusted?

Choosing which code-signing CA-certs to trust will, obviously, determine which code-signed binaries pass certificate validation. Just like choosing which TLS CAs to trust, determines which websites pass certificate validation.

Code-signing certificate validation doesn't happen online, though. Just like TLS certificate validation doesn't happen online. It's just a check that the cert you have has a signing path back to some CA cert in the local trust store.

I have the latter Gatekeeper option, and I often have to click "Allow anyway". I don't see how being forced to click an extra button in a preference pane makes things more secure.

If you're getting the Gatekeeper dialog with the "Open anyway" button (the "Apple cannot verify that this app is free of malware" alert), then this is a specific case: you're on Catalina or later, and the app you're using has a valid code-signature but hasn't been notarized.

This warning only triggers for legacy releases of apps, published before notarization existed. Since Catalina, notarization has been part-and-parcel of the same flow that gets the self-published app bundle code-signed by Apple. AFAIK it is no longer possible to create a code-signed but non-notarized app bundle through XCode. (It's probably still possible by invoking `codesign` directly, and third-party build systems might still be doing that... but they really shouldn't be! They've had years to change at this point! Catalina was 2019!)

Thus, the "Open anyway" option in this dialog is likely transitional. This warning is, for now, intended to not overly frighten regular users, while also indicating to developers (esp. the developer of the app) that they should really get out a new, notarized release of their app, because maybe, one day, this non-notarized release of the app won't be considered acceptable by Gatekeeper any more.

I'm guessing that once a sufficient percentage of apps have been notarized, such that macOS instrumentation reports this dialog being rarely triggered, the "Open anyway" option will be removed, and the dialog will merge back into the non-code-signed-app version of the dialog that only has "Cancel" and "Move to Trash" options. Though maybe in this instance, the dialog would have the additional text "Please contact the app developer for a newer release of this app" (because, unlike with an invalid digital signature, macOS wouldn't assume the app is infected with malware per se, but rather just that it might do low-level things [like calling private OS frameworks] that Apple doesn't permit notarized apps to do.)

Both Windows and MacOS require that developers digitally sign their software, if you want users to be able to run that software without jumping through additional hoops on their computer.

You can't distribute software through the Apple or Microsoft app stores without the software being signed.

You can sign and distribute software yourself without having anything to do with the app stores of either platform, although getting a signing certificate that Windows will accept is more expensive for the little guys than getting a signing certificate that Macs will accept.

On Windows, allowing users to run your software without jumping through additional hoops requires you to purchase an Extended Validation Code Signing Certificate from a third party. Prices vary, but it's going to be at least several hundred dollars a year.

https://www.reddit.com/r/electronjs/comments/17sizjf/a_guide...

Apple includes a software signing certificate with a basic developer account, which runs $100 a year.

You can ignore that on either platform, but users will have to take additional actions before they can run your unsigned software.

I have literally never experienced that and I use homebrew apps a lot

Perhaps you turned some "make things ultra-secure" setting on at some point ?

I suspect they're referring to changes to Gatekeeper in recent macOS versions: https://arstechnica.com/gadgets/2024/08/macos-15-sequoia-mak...

It used to be that you could run any third-party application you downloaded. And then for a while you'd have to right-click and select Open the first time you ran an application you'd downloaded, and then click through a confirmation prompt. And macOS 15, you have to attempt to open the application, be told it is unsafe, and then manually approve it via system settings.

Looks like a clear trend then.

That's just your extremely limited experience (2 stores): homebrew runs a special command clearing up a bit so you don't get that notification, which does exist if yout download apps directly

This reply is very informative and should be much more visible given the extent of general ignorance about the "zomg it phones home" feature.

There was a since fixed bug in a prior MacOS release that did fail to launch an app on the local machine if the CRL data was unreachable.

Huh? It hashes the binary and phones home doesn’t it? Go compile anything with gcc and watch that it takes one extra second for the first run of that executable. It’s not verifying any certificates

When I first run locally-built software I tend to notice XProtect scanning each binary when it is launched. I know that XProtect matches the executable against a pre-downloaded list of malware signatures rather than sending data to the internet, but I haven't monitored network traffic to be sure it is purely local. You can see the malware signatures it uses at /private/var/protected/xprotect/XProtect.bundle/Contents/Resources/XProtect.yara if you're curious.

> phones home

Nope.

It has a built in malware scanner, but that just requires a downloaded list of known malware signatures.

With the sheer number of devs who use Macs, there is a 0% chance they’re going to outright prevent running arbitrary executables. Warn / make difficult, sure, but prevent? No.

The strategy is to funnel most users onto an ipad-like platform at most where they have basic productivity apps like word or excel but no ability to run general purpose programs.

Meanwhile you have a minimal set of developers with the ability to run arbitrary programs, and you can go from there with surveillance on MacOS like having every executable tagged with the developer's ID.

The greater the distance between the developer and the user, the more you can charge people to use programs instead of just copying them. But you can go much further under the guise of "quality control".

> The strategy is to funnel most users onto an ipad-like platform at most where they have basic productivity apps like word or excel but no ability to run general purpose programs.

And you know this how?

This reads like every macOS fan’s worst nightmare, but there’s zero actual evidence that Apple is going in this direction.

Please share sources if you disagree.

> The strategy is to funnel most users onto an ipad-like platform

They make the best selling laptop in the world, and other most-popular-in-class laptops. If their strategy is to have people not use laptops, they are going about it funny.

If so, they are executing it badly.

As for every executable being tagged, that is not required. People can build binaries with open tools and other people can run them.

A hash gets created for Apple to play same or different with binaries found to be nefarious somehow. Seems like a reasonable proposition.

> not share that data with other parties but they definitely do not respect your privacy

not sharing my data with other parties, or using it to sell me stuff or show me ads, is what I would define as respecting my privacy; Apple checks those boxes where few other tech companies do

Their repair policy, from what I can see, is a thinly veiled attempt to get you to either pay for Apple Care or to upgrade. I got a quote to repair a colleague's MacBook Pro, less than 2 years old, which has apparent 'water damage' and which they want AUD $2,500 to repair! Of course that makes no sense, so we're buying a new one ...

> to get you to either pay for Apple Care

The problem with many self-repair people is they effectively value their time at zero.

I value my time realistically, i.e. above zero and above minimum wage. It is therefore a no brainer for me to buy AppleCare every ... single ..time. It means I can just drop it off and let someone else deal with messing around.

I also know how much hassle it is. Like many techies, I spent part of my early career repairing people's PCs. Even in big PC tower cases with easy accessibility to all parts its still a fucking horrific waste of time. Hence these days I'm very happy to let some junior at Apple do it for the cost of an AppleCare contract.

> The problem with many self-repair people is they effectively value their time at zero.

Back in 2010 Apple quoted me €700 for a topcase replacement because of shattered display glass. Instead I paid €50 for a third party replacement pane and did 15 minutes of work with a heat gun.

What's more, they fold most of the cost of the repair into the price of parts. So you can either get a replacement screen for €499 and install it yourself, or have it officially repaired for €559. This effectively subsidizes official repairs and makes DIY repairs more expensive.

Apple does extreme gouging with repairs, its hogwash to claim anything else.

That is not why I didn’t buy Apple Care.

My hope is that the machine will work for a long while, like most of them do. In my case it’s a ~$1200 machine so I prefer to self-insure. I’m taking the chance that if it goes bad, I’ll pay to fix or replace it.

This makes sense, for me, when I do it on everything that I buy.

A big problem with Apple Care is here in Thailand anyway you need to give them your computer for a few weeks. You have to wait a week for them to look at it. They won't even allow you to use it and then bring it back in a week.

How often do you actually need a repair from Apple? I used to buy AppleCare but stopped in the last few years and have yet to need any repairs done except a battery replacement on a 14 Pro that I was giving to family.

There are three kinds of people

1. people who arguably fall under the definition of careless, or have small children, need repair plans

2. people who are fastidious and nothing ever breaks, don't need repair plans

3. people who are fastidious, have small children, need repair plans

I was a #2 and I'm slowly transitioning into a #3 for specific purchases.

Even with small children, I haven’t really found a need for AppleCare. They don’t touch my devices, and their devices are older iPads that aren’t worth that much to begin with, sheathed with big chonky cases that have survived a few trips down stairs unscathed.

Insurance is always a gamble. Up to you to do your own math on the risks..

Why not pay for apple care? In the US it covers water damage

Because it feels like extortion. There was almost certainly no water damage caused by external factors: the user didn't spill anything on it and has literally no idea where the so-called water damage could have come from. I have heard anecdotally that this is their go-to for denying claims and it is difficult to argue against.

Humidity in the air can eventually trigger whatever they use to report wet damage.

Yes, that's what I've heard, which seems crazy.

It’s a hygroscopic sticker made by 3m.

Agree. I recently went to an Apple store in Tokyo to buy an accessory. The Apple employee pulled up their store iPhone to take my payment (apple pay) and then asked me to fill out a form with my email address and there was a message about how my info would be shared with some company. I thought about going back and pretending to buy something else so I could film it. I questioned the store person, "It's apple supposed to be "Privacy first"". If it was privacy first they wouldn't have asked for the info in the first place and they certainly wouldn't be sharing it with a 3rd party.

At the very least Apple are better than Microsoft, Windows and the vendors that sell Windows laptops when it comes to respecting user experience and privacy.

I switched to iPhone after they added the tracker blocking to the OS.

Everything is a tradeoff.

I’d love to live in the F droid alt tech land, but everything really comes down to utility. Messaging my friends is more important than using the right IM protocol.

Much as I wish I could convince everyone I know and have yet to meet to message me on Signal or whatever, that simply isn’t possible. Try explaining that I am not on Whatsapp or insta to a girl I’ve just met…

Also it is nice to spend basically no time maintaining the device, and have everything work together coherently. Time is ever more valuable past a certain point.

But why do we have to choose between convenient and open? Why are these companies allowed to continue having these protected "gardens"? I don't believe a free and truly open ecosystem for mobile devices would actually be less convenient than iOS or Android. If anything it would be vastly better.

Has it occurred to you that the stronger control of the ecosystem is a feature that supports the convenience and integration that's possible?

This is just the "Why not Linux desktop" argument from the past two decades. Sure, in theory it can be configured to do a lot of different things. But you're probably gonna have to work out the details yourself because the downside of theoretically supporting everything is that it's impossible to just have it work out of the box with every single scenario.

They have big numbers. Big numbers tell that 95% of people would need to be in closed protected gardens rather than getting slaughtered by open source wolves.

That's a low bar for girls IMO (not being able to grasp that someone might not want to use Whatsapp or Instagram).

[dead]

> Apple is well on its way to ensure you can only run things they allow via app store, they would probably already be there if it wasn't for the pesky EU.

People have been saying this ever since Apple added the App Store to the Mac in 2010. It’s been 14 years. I wonder how much time has to go by for people to believe it’s not on Apple’s todo list.

If there was a time Apple was going to do it, it would have been when they switched to Apple Silicon. And they didn't.

Even if I have analytics disabled?

Genuinely asking: are there any specifics on this? I understand that blocking at the firewall level is an option, but I recall someone here mentioning an issue where certain local machine rules don’t work effectively. I believe this is the issue [1]. Has it been “fixed”?

[1] https://appleinsider.com/articles/21/01/14/apple-drops-exclu...

They're probably referring to the certificate verification that happens when you open any notarized application. Unless something changed recently, the system phones home to ensure its certificate wasn't revoked.

It doesn't do that on every app launch; there's a cache. It does it on the first launch of a binary from a new team.

(So multiple binaries with the same team don't check either.)

And I'd expect all logging is disabled on the CDN.

It does kind of suck if the binary is frequently updated, big and you have a slow internet connection. So some program which normally takes seconds to open can take 20 or more seconds to open after an update. Or if you don't use that program frequently, you always get a very slow start of a program.

I have no reason to expect that it is.

> Even if I have analytics disabled?

Yeah because what’s being sent is not analytics but related to notarizarion, verifying the app’s integrity (aka is it signed by a certificate known to Apple?)

This came to light a few years ago when the server went down and launching apps became impossible to slow…

https://www.macrumors.com/2020/11/12/mac-apps-not-opening/

> where everyone just keeps parroting what Apple says as an absolute truth.

You are free to verify.

> Apple is well on its way to ensure you can only run things they allow via app store

I don't think Apple's behavior actually reflects this if you look closely (although I can certainly see how someone could form that opinion):

As a counter example, Apple assisted with their own engineers to help port Blender to Metal (https://code.blender.org/2023/01/introducing-the-blender-met...):

> Around one year ago, after joining the Blender Development Fund and seeding hardware to Blender developers, Apple empowered a few of its developers to directly contribute to the Blender source code.

I'm assuming similar support goes to other key pieces of software, e.g., from Adobe, Maxon, etc... but they don't talk about it for obvious reasons.

The point being Apple considers these key applications to their ecosystem, and (in my estimation at least) these are applications that will probably never be included in the App Store. (The counterargument would be the Office Suite, which is in the App Store, but the key Office application, Excel, is a totally different beast than the flagship Windows version, that kind of split isn't possible with the Adobe suite for example.)

Now what I actually think is happening is the following:

1. Apple believes the architecture around security and process management that they developed for iOS is fundamentally superior to the architecture of the Mac. This is debatable, but personally I think it's true as well for every reason, except for what I'll go into in #2 below. E.g., a device like the Vision Pro would be impossible with macOS architecture (too much absolute total complete utter trash is allowed to run unfettered on a Mac for a size-constrained device like that to ever be practical, e.g., all that trash consumes too much battery).

2. The open computing model has been instrumental in driving computing forward. E.g., going back to the Adobe example, After Effects plugins are just dynamically linked right into the After Effects executable. Third party plugins for other categories often work similarly, e.g., check out this absolutely wild video on how you install X-Particles on Cinema 4D (https://insydium.ltd/support-home/manuals/x-particles-video-...).

I'm not sure if anyone on the planet even knows why, deep down, #2 is important, I've never seen anyone write about it. But all the boundary pushing computing fields I'm interested in, which is mainly around media creation (i.e., historically Apple's bread-and-butter), seems to depend on it (notably they are all also local first, i.e., can't really be handled by a cloud service that opens up other architecture options).

So the way I view it is that Apple would love to move macOS to the fundamentally superior architecture model from iOS, but it's just impossible to do so without hindering too many use cases that depend on that open architecture. Apple is willing to go as close to that line as they can (in making the uses cases more difficult, e.g., the X-Particles video above), but not actually willing to cross it.

> Apple is well on its way to ensure you can only run things they allow via app store, they would probably already be there if it wasn't for the pesky EU

What has the EU done to stop Apple doing this? Are Apple currently rolling it out to everywhere but the EU?

You’re way off base. Paranoid.

>Apple is well on its way to ensure you can only run things they allow via app store

that ship has well and truly sailed, this conspiracy might once have held water but Apple's machines are far too commercially ubiquitous for them to have any designs on ringfencing all the software used by all the industries that have taken a liking to the hardware.

> Apple is well on its way to ensure you can only run things they allow via app store,

What are you talking about? I don’t run a single app from the app store and have never felt a need to.

The EU is center-right-wing, and laughs all the way to the bank whenever someone like you falls for their "we externally pretend to be the good guys" trope. Leyen is pretty much the worst leadership ever, but they still manage to convince the politically naiv that everything is fine, because of GDPR, AI laws and huge penalties for big tech. Its sad how simple it is to confuse people.

I mean, the security features are pretty well documented. The FBI can't crack a modern iPhone even with Apple's help. A lot of the lockdowns are in service of that.

I'm curious: what hardware and software stack do you use?

Cellebrite Premium 7.69.5 iOS Support Matrix from July 2024.

https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju...

Doesn't AFU here mean the phone had to be already unlocked? Which is most of the entries?

AFU means the phone was unlocked and then relocked.

Right, so not the use case involving the police up thread.

Police do often want to get into phones in that state. This is why Cellebrite sells that product.

FBI and Apple „can't”, but 3rd party do and they do it cheaper every day.

They do not.

Edit: I have not posted a source for this claim, because what sort of source would be acceptable for a claim of the form "X has not occurred"?

If you are going to claim Apple's security model has been compromised, you need not only evidence of such a compromise but also an explanation for why such an "obvious" and "cheap" vulnerability has not been disclosed by any number of white or grey-hat hackers.

Yes they do.

If you're going to claim that random hacking groups routinely do something the FBI and NSA claim to be unable to do... citation needed.

Ok [1]

"Since then, technologies like Grayshift’s GrayKey—a device capable of breaking into modern iPhones—have become staples in forensic investigations across federal, state, and local levels."

"In other cases where the FBI demanded access to data stored in a locked phone, like the San Bernardino and Pensacola shootings, the FBI unlocked devices without Apple’s help, often by purchasing hacking tools from foreign entities like Cellebrite."

1 - https://www.firstpost.com/tech/the-fbi-was-able-to-hack-into...

An issue with taking their claim at face value is they have no incentive to say they can:

- they can keep asking for backdoors to "stop terrorists"

- they're not on the hook if for whatever reason they can't access a particular phone in a very mediatized case

- most targets (the not so sophisticated ones at least) keep using a device the agencies have proper access to

Regardless of their actual technical means, I don't expect we ever get a "we sure can!" kind of public boasting any time soon.

Jesus, just post a source.

the burden on proof is not on him to prove a negative

Is there evidence of this. I’d be interested to know more.

> Apple is well on its way to ensure you can only run things they allow via app store

I'm very happy to only run stuff approved on Apple's app store... ESPECIALLY following their introduction of privacy labels for all apps so you know what shit the developer will try to collect from you without wasting your time downloading it.

Also have you seen the amount of dodgy shit on the more open app stores ?

It's a reasonable choice to do so and you can do it now. The problem starts when Apple forbid it for people who want to install on their computer what they want.

> Apple is well on its way to ensure you can only run things they allow via app store

I am totally ok with this. I have personally seen apple reject an app update and delist the app because a tiny library used within it had a recent security concerns. Forced the company to fix it.

No one is stopping you from using only the app store if you value its protection, so you need a more relevant justification to ok forcing everyone else to do so

If I had 1.4B active users I would want to mitigate the ability of almost all of them to accidentally fuck up their devices instead of worrying about irritating a few tech folk because they can’t load broken apps on it.

Your stat is an order of magnitude type of fantasy, the apps aren't broken, and the inability to install also affects everyone, not a few folks, so again you're left with nothing but your personal desire for controlling other people

> Your personal desire for controlling other people.

Well that’s just childish, pouty, and not a very well thought out train of thought on the subject.

The control isn’t over people, it’s about finding a solution to creating and preserving market share via device reliability on the platform. There are 1.4B iPhone users (and that’s a real number, not a fantasy), and not every one of those people is savvy enough to vet their applications before installation. If installation of any app was wide open you would have a large portion of those 1.4B accidentally installing crap. They may have 100 apps on their phone but if 1 is a piece of shit and broken (and yes conservatively at least 1% of apps out there probably have a bug bad enough to wreck some havoc) and it renders the reliability of the phone to shit that’s bad. If the market perceives that the reliability of the device is shit, Apple loses either in increasing or preserving market share for the device. Apple needs those devices need to work reliably and it feels that one way to do that is vetting the apps that will be running on it. The hardware is great, the OS does its job making the hardware platform operational, but the one place where there is the opportunity to introduce instability is in the apps. So you do your best to control that area of instability opportunity on your platform.

Here is the beautiful thing for you…there plenty of other phones out there that will allow you to install whatever the hell you want. Apple only has 16% of the worldwide smartphone market share.

https://backlinko.com/iphone-users#iphone-key-stats

Man, talking about crashing trains of thought: you fail to grasp the fact that the conversation is about MacOS, not iOS, that there is no contradiction between "blah platform" and control over people, and even that the fact that other phones exist doesn't negate the deficiencies of this specific phone

> conservatively at least 1% of apps

That's another made up number of yours, with a similarly made up qualifier

> the market perceives that the reliability of the device is shit

Since the vast majority of devices aren't so locked down, isn't "the market" yelling at yout that you're wrong?

I was talking about iOS so yes, I missed that the conversation was about Mac. Shame on me. In a sense the use case for a Mac is less ubiquitous than a smartphone, so the need for vetting may not be as great because users of the device don’t perceive the apps running on it as the device itself.

However, I stand firm in my argument about why the iPhone is locked down and why it’s a good thing. Even if you spread into other smartphone manufacturers like Samsung, you still find similar attempts to control the lay users ability to install unvetted apps on the devices. It may even be more important for them to do that too since they don’t fully control the OS on their devices.

> That's another made up number of yours, with a similarly made up qualifier

Obvious it was made up and obviously it was set as an intentionally low bar for software quality because who would argue (especially on HN) that 100% of available software out there is bug free, but if you want to believe that all available software is 100% safe to use, I encourage you to download and install everything you come across no matter whether the device is a smartphone, a Mac, or any other device you use and rely upon. I am sure you will be fine.

> you still find similar attempts to control

Sure, though it doesn't mean what you want it to mean since you just ignore the $$$ elephant in the room that explains the desire for more control. For the same reason, you "stand firm" in ignorance as to "why the iPhone is locked down"

> Obvious it was made up

Glad you realise that.

> intentionally low bar

Intentionally appearing like one

> if you want to believe ... software is 100% safe to use

Again with your fantasies. I believe the justification should be grounded in reality, both in terms of the % estimate as well as in terms of the severity (so no, "bug free" is irrelevant, you need severe billions-afecting bugs that can only be eliminated by hard-forcing the app store, which you can't have since the reality doesn't align with you).

And as to your standing firm in your argument "why it’s a good thing", well, you don't really have an argument, just a desire for one with made up stats and corporate motivations

Alrighty, so I guess what we have learned that apparently some number at 100% or perhaps less of all software is apparently released bug free. However, we don’t know for sure “the perhaps less”, despite all of the numerous historical examples of shit software being released that has wrecked havoc that we or others have experienced. And since we don’t know that precise number we are not allowed to state any estimate no matter how modest that is below that 100% of software perfection. Therefore, a device manufacturer would never need or should do anything that attempts to protect the consumer and their market share by protecting the device’s perceived reliability by preventing buggy software from being installed, because buggy software doesn’t exist.

Thanks for the education in the importance of precision and the rejection of experience in determining reality. I’ll ignore my decades of having to clean up all the messes that apparently non-existent buggy shit software managed to do to novice and lay users who willy-nilly installed it…or maybe didn’t install it, since it was imaginary.

By the way…before you respond again you might read up a bit on situational irony. You seemed to have missed it on my prior comment…and this one is dripping with it.

Your drips don't land because you can't make up a valid argument, ignore what I said and resort back to your fantasy land again fighting your imaginary 100%s and do-nothings

Yeah that’s it. I am in awe of your reality.

What about all those libs and executables you likely install via brew, npm, cargo etc? Those are all applications

Sure – Apple are trying to stop people who don't know what they're doing from getting hurt. Hence the strong scrutiny on what is allowed on the App Store (whether it's reasonable to charge 30% of revenue is an entirely different question).

People who are installing things using a terminal are probably (a) slightly computer savvy and (b) therefore aware that this might not be a totally safe operation.

And, despite being an avid homebrew user, I've never had a problem there.

All of us having this discussion are outliers.

The things we talk about here which annoy us are for the much larger set of people who need them!

Put another way, it is all about the set of us who cannot really participate in this discussion.

You are just joking right?

From a skill and trust point of view, Google is doing a lot better than apple will ever.

Including ondevice AI

Privacy is the new obscenity. What does privacy even mean to you concretely? Answer the question with no additional drama, and I guarantee you either Apple doesn’t deliver what you are asking for, or you are using services from another company, like Google, in a way that the actions speak that you don’t really care about what you are asking for.

End to end encryption by default, such that the cloud provider cannot access my data.

Easy.

> End to end encryption by default, such that the cloud provider cannot access my data.

The App Store stores a lot of sensitive data about you and is not end-to-end encrypted. They operate it just like everyone else. You also use Gmail, which is just as sensitive as your iMessages, and Gmail is not end-to-end encrypted, so it's not clear you value that as much as you say.

I think "could a creepy admin see my nudes" or "can my messages be mined to create a profile of my preferences" are much more practical working definitions of privacy than "can someone see that I've installed an app".

End-to-end encryption is certainly the most relevant feature for these scenarios.

App store DRM is a red herring, as a developer I can still run as much untrusted code on my MBP as I want and I don't see that going away any time soon.

Apple can create a profile of your preferences, for preferences in the sense of things you want to buy. It has your App Store data!

> "can someone see that I've installed an app"

You say preferences and you didn't say what you mean. One meaning of the word preferences: what if you installed Grindr?

You are saying a lot of words but none of them negate the point that Apple has a better security posture for users than any of the other big tech cos. For any meaningful definition of the word "security."

Sure I use gmail, I've been locked in for 15 years. Someday I'll get fed up enough to bite the bullet and move off it.

> Apple has a better security posture for users than any of the other big tech cos. For any meaningful definition of the word "security."

Apple can push updates and change the rules on your device at any time. Rooted Android works better in that regard: you can still use Google stuff on rooted devices. Also I don't think Apple's security posture for users in China is better than every "other big tech co."

The takeaway for me is that Apple's storytelling is really good. They are doing a good job on taking leadership on a limited set of privacy issues that you can convince busy people to feel strongly about. Whether or not that objectively matters is an open question.

It’s honestly not worth engaging with the privacy fundamentalists. They are not arguing in good faith.

Apple doesn’t run open hardware, and supports features users want that involve opening a network connection back home? Hard privacy fail.

There's some weird[1] laws around privacy in Australia, where government departments are blocked from a bunch of things by law. From my perspective as a citizen, this just results in annoyance such as having to fill out forms over and over to give the government data that they already have.

I heard a good definition from my dad: "Privacy for me is pedestrians walking past my window not seeing me step out of the shower naked, or my neighbours not overhearing our domestic arguments."

Basically, if the nude photos you're taking on your mobile phone can be seen by random people, then you don't have privacy.

Apple encrypts my photos so that the IT guy managing the storage servers can't see them. Samsung is the type of company that includes a screen-capture "feature" in their TVs so that they can profile you for ad-targeting. I guarantee you that they've collected and can see the pictures of naked children in the bathtub from when someone used screen mirroring from their phone to show their relatives pictures of their grandkids. That's not privacy.

Sure, I use Google services, but I don't upload naked kid pictures to anything owned by Alphabet corp, so no problem.

However, I will never buy any Samsung product for any purpose because they laugh and point at customer expectations of privacy.

[1] Actually not that weird. Now that I've worked in government departments, I "get" the need for these regulations. Large organisations are made up of individuals, and both the org and the individual people will abuse their access to data for their own benefit. Many such people will even think they're doing the "right thing" while destroying freedom in the process, like people that keep trying to make voting systems traceable... so that vote buying will become easy again.

The most famous leak of nude images that ever "happened" was from iCloud Photos.

That was the result of social engineering though, not iCloud being compromised. AFAIK it was a phishing scam, asking the victims for their usernames and passwords.

> asking the victims for their usernames and passwords.

This should illuminate for you that there is nothing special about iCloud privacy or security, in any sense. It has the same real weaknesses as any other service that is UIs for normal people.

Never said there was. No system is foolproof, and a lot of today's security is so good that the users usually are the weakest links in a system. Still, some are more secure than others and there's a difference between a person being tricked to give up their credentlials and a zero day.

I don't believe you should be downvoted for your original comment. Not sure why you are.

> there's a difference between a person being tricked to give up their credentlials and a zero day.

Only if you work at Apple.

We have mass conversational and voice cloning technology. It's not a question of if but when.

The single core performance looks really fast.

  Chip | Geekbench Score (Process)  
  ---- | ------------------------  
  M1   | 2,419 (5nm)  
  M2   | 2,658 (5nm)  
  M3   | 3,076 (3nm)  
  M4*  | 3,810 (3nm)

M4 benchmark source: https://browser.geekbench.com/v6/cpu/8171874

These numbers are misleading (as in not apples to apples comparison). M4 has a matrix multiply hardware extension which can accelerate code written (or compiled) specifically for this extension.

Also: https://news.ycombinator.com/item?id=40339248

Technically it is Apples to Apples

So you're saying Apple added something to the design to make it do things faster...which is literally the definition of improvement.

When a company adds a supercharger to a car does it not count as faster?

When I add more solar panels to my roof does it not count as more power?

Surely doing this kind of thing is exactly what we want companies to be doing to make their products faster/better.

It will be faster only for code that uses/is optimized for that specific extension. And the examples you give are not really correct.

If you add a supercharger you will get more power, but if the car's transmission is not upgraded, you might just get some broken gears and shafts.

If you add more solar panels to your roof, you might exceed the inverter power, and the panels will not bring benefits.

It's true that you will benefit from the changes above, but not just by themselves - something else needs to change so you can benefit. And in the case of the M4 and these extensions, the software needs do be changed and also to have an use case for these extensions.

That is an example of the kind of hardware and software synergy that gives good performance on Apple Silicon for apps in iOS and Mac OS. Apple execs have given interviews where they talk about this kind of thing. They look at code in the OS and in their application libraries that can benefit from hardware optimization and they build in hardware support for it to improve performance overall. This helps all kinds of app running on the OS and using the standard libraries.

Are you implying there are no use cases for matrix multiply?

In any case, the two main deep learning packages have already been updated so for the place this change was almost certainly targeted for, your complaint is answered. I'm just stunned that anyone would complain about hardware matrix multiplication? I've wondered why that hasn't been ubiquitous for the past 20 years.

Everyone should make that improvement in their hardware. Everyone should get rid of code implementing matrix mult and make the hardware call instead. It's common sense. Not to put too fine a point on it, but your complaint assumes that GeekBench is based on code that has implemented all those changes.

> Are you implying there are no use cases for matrix multiply?

The whole point is that these highly specialized scenarios are only featured in very specialized usecases, and don't reflect in overall performance.

We've been dealing with the regular release of specialized processor operations for a couple of decades. This story is not new. You see cherry-picked microbenchmarks used to plot impressive bar charts, immediately followed by the realization that a) in general this sort of operator is rarely invoked with enough frequency to be noticeable, b) you need to build code with specialized flags to get software to actually leverage this feature, c) even then it's only noticeable in very specialized workloads that already run on the background.

I still recall when fused multiply-add was such a game changer because everyone used polynomials and these operations would triple performance. Not the case.

And more to the point, do you believe that matrix multiplication is a breakthrough discovery that is only now surfacing? Computers were being designed around matrix operations way before they were even considered to be in a household.

I'm not complaining, I'm just saying that the higher numbers of that benchmark result do not translate directly to better performance for all software you run. Deep learning as it is right now is probably the main application that benefits from this extension (and probably the reason why it was added in hardware at this point in time).

Well you're really just describing benchmarks- if the benchmark doesn't represent your standard workflow then it probably isn't a good reference for you. But Geekbench includes a bunch of components based on real-world applications like file compression, web browsing, and PDF rendering. So it probably isn't perfect, but it's likely that the M4 will feel a bit faster in regular use compared to an older generation MacBook Pro.

> So you're saying Apple added something to the design to make it do things faster...

I think the whole point is that microbenchmarks provide no data in overall performance. They just test very specific and by no means common use case.

Yes, that’s always been the case, and would be regardless of apple (or any other manufacturer) adding new features

Beware that some of the Geekbench number are the result of them suddenly gaining support for streaming SVE and SME just when Apple implements it.

I'm not doubting the number represent real peak throughput on M4. There is just a taste to the timing lining up so well. Also they don't take advantage of fully SVE2 capable ARM cores to compare how much a full SVE2 implementation would help especially at accelerating more algorithms than those that neatly map to streaming SVE and SME.

The single core performance gains of M4 variants over their predecessors are distorted, because the streaming SVE and SME are apparently implemented by combining what used to be them AMX units of four cores.

Processor roadmaps a multi year plans, I doubt Apple aligned their roadmap to geekbench supporting SVE. More likely a happy alignment of plan(et)s.

> I feel like Apple kind of buried this in their press release

The press release describes the single core performance as the fastest ever made, full stop:

"The M4 family features phenomenal single-threaded CPU performance with the world’s fastest CPU core"

The same statement is made repeatedly across most the new M4 line up marketing materials. I think thats enough to get the point across that its a pretty quick machine.

Exactly my point. Saying something is the fastest ever is marketing code (at least to me) for minor improvement over the previous generation.

If you're 30% faster than the previous generation, I'd rather see that because my assumption is it's 5%.

The article has all of the "x times faster than M1" notes but the video shows graphs with the M3 whenever they do that and it is usually ~1.2x in the CPU on that. I think it's probably a smart move this page (and the video) focused so much on 2x or greater performance increases from the M1 generation. After all, so what if it's 20% faster than the M3? As in: how many customers that weren't already interested in just buying the latest thing before reading your marketing material are you going to convince to upgrade from the M3 just because the M4 is ~20% faster vs trying to convince M1 users to upgrade because it's over twice as fast.

Yeah, better than the glaring, 10x better than i7 Intel Mac. Like that's even a valid point of reference.

I think the point is to try to convince MacBook users who haven't looked to upgrade yet rather than something trying to make a comparison to other non-mac models you could buy today. From that perspective it's perfectly valid, even if it doesn't tick the boxes of what others might want from a different comparison perspective.

Not really fair to the absolutely ancient i7 Intel Macs.

6 years ago isn't that old.

Not even, they are referring to the 2020 model:

> Results are compared to previous-generation 1.7GHz quad-core Intel Core i7-based 13-inch MacBook Pro systems with Intel Iris Plus Graphics 645, 16GB of RAM, and 2TB SSD.

Matches https://support.apple.com/en-us/111339

For cpus? Yes?

Not really. Intel CPU performance hasn't changed by orders of magnitude in the last ten years. My ten year old Windoze 10 desktop keeps chugging along fine. My newer 2022 i7 Windows machine works similarly well.

However, attention to keeping Intel Macs performant has taken a dive. My 2019 16" MBP died last week so I fell back to my standby 2014 MBP and it's much more responsive. No login jank pause . But it also hasn't been eligible for OS updates for 2 or 3 years.

My new M3 MBP is "screaming fast" with Apple's latest patched OS.

My god, it's ridiculous. I really prefer Linux desktops. They've been snappy for the past 30 years, and don't typically get slow UI's after a year or two of updates.

Core i7 6700K was released in August 2015. 4c/8t 4.2GHz.

https://ark.intel.com/content/www/us/en/ark/products/88195/i...

Core i7 14700K was released in Q4 2023. 8 P-core, 12 E-core, 28 threads. ~5.5GHz for Performance-core max frequency.

https://ark.intel.com/content/www/us/en/ark/products/236783/...

This is the same CPU tier, just a later generation.

Passmark scores:

6700K: 8,929

14700K: 53,263

Yeah, that's practically the same performance.

But hey, that newer i7 has way more cores. Let's pick something with a closer core count for a fairer comparison. Let's pick the Core i3-14100 with its 4C/8T with a turbo of 4.7GHz. Even then, its Passmark benchmark 15,050.

https://ark.intel.com/content/www/us/en/ark/products/236783/...

https://www.cpubenchmark.net/compare/2565vs5719vs5831/Intel-...

I get it, an old CPU can still be useful. I'm still using an Ivy Bridge CPU for a server in my closet hosting various services for my home, but it is vastly slower than my Ryzen 7 3700x on my current gaming desktop and was even slower than the previous Ryzen 5 2600 I had before and sold to a friend.

> Yeah, better than the glaring, 10x better than i7 Intel Mac. Like that's even a valid point of reference.

The last Intel macbook pros were released 4 years ago. Their owners are starting to shop around for replacements. Their question will be "will the expense be worth it?"

I maybe don't understand but isn't an intel at 5.5ghz faster in terms of bits processed then the 4.4ghz m4? wouldn't that be fastest as more data can be processed?

GHz represents the number of cycles per second, not the number of bits actually processed per second. On different CPUs the same instruction can take a different number of cycles, a different number of the instruction can be in flight at the same time, a different number of several different instructions can be issued at once, a different amount of data can be pulled from cache to feed these instructions, a different quality of instruction reordering and branch prediction, and so on.

As an example a single thread on an x64 core of an old Pentium 4 661 @ 3.6 GHz benchmarks at 315 with PassMark while a single x64 core of a current 285k @ 5.7 GHz turbo benchmarks at 5195. Some of that also comes down to things like newer RAM to feed the CPU but the vast majority comes down to the CPU calculating more bits per clock cycle.

Thank you for a great comment and answer

lol

After decades of Apple, people still believe them.

I don't know much about modern Geekbench scores, but it that chart seems to show that M1s are still pretty good? It appears that M4 is only about 50% faster. Somehow I would expect more like 100% improvement.

Flameproof suit donned. Please correct me because I'm pretty ignorant about modern hardware. My main interest is playing lots of tracks live in Logic Pro.

Some of it depends on which variant fits you best. But yeah, in general the M1 is still very good--if you hear of someone in your circle selling one for cheap because they're upgrading, nab it.

On the variants: An M1 Max is 10 CPU cores with 8 power and 2 efficiency cores.

M4 Max is 16 cores, 12 + 4. So each power core is 50% faster, but it also has 50% more of them. Add in twice as many efficiency cores, that are also faster for less power, plus more memory bandwidth, and it snowballs together.

One nice pseudo-feature of the M1 is that the thermal design of the current MacBook Pro really hasn't changed since then. It was designed with a few generations of headroom in mind, but that means it's very, very hard to make the fans spin on a 16" M1 Max. You have to utilize all CPU/GPU/NPU cores together to even make them move, while an M3 Max is easier to make (slightly) audible.

> it's very, very hard to make the fans spin on a 16" M1 Max. You have to utilize all CPU/GPU/NPU cores together to even make them move,

I routinely get my M1 fans spinning from compiling big projects. You don’t have to get the GPU involved, but when you do it definitely goes up a notch.

I read so much about the M1 Pros being completely silent that I thought something was wrong with mine at first. Nope, it just turns out that most people don’t use the CPU long enough for the fans to kick in. There’s a decent thermal capacity buffer in the system before they ramp up.

Huh! I regularly max CPU for long stretches (game development), but I found I could only get the fans to move if I engaged the neural cores on top of everything else. Something like a 20+ minute video export that's using all available compute for heavy stabilization or something could do it.

The M3 is much more typical behavior, but I guess it's just dumping more watts into the same thermal mass...

Apple claim up to 1.8x in the press release. They're cherry picking so 50% in a benchmark seems about right.

Appreciate the sanity check.

The M1 was pretty fast when it debuted. If you own an M1 Mac its CPU has not gotten any slower over the years. While newer M-series might be faster, the old one is no slower.

The M1s are likely to remain pretty usable machines for a few years yet, assuming your workload has not or does not significantly change.

No CPU gets slow after any amount of years. That's not how it works. I think what you're trying to say is: Software gets more resource-intensive.

That's only single core. I think Logic is pretty optimized to use multiple cores (Apple demoed it on the 20 core Xeon Mac Pro back in 2019).

But if the M1 isn't the bottleneck, no reason to upgrade.

Very good to know, thanks.

Those kinds of improvements are way of the past. Modern hardware is just too good.

Absolutely incredible to see Apple pushing performance like this.

I can't wait to buy one and finally be able to open more than 20 Chrome tabs.

For a year, maybe. Web apps will use the opportunity and get slower enough so that you'll get old experience on new hardware soon.

I wonder how reliable geekbench tests are. Afaik it's the most common benchmark run on apple devices, so apple has a great interest in making sure their newest chips perform great on the test.

I wouldn't be surprised to hear that the geekbench developers are heavily supported by apple's own performance engineers and that testing might not be as objective or indicative of real world perf as one would hope.

Wouldn't it be more surprising to you Apple has been selling 4 generations of the M series to great acclaim on the performance but it all turned out to be a smoke and mirrors show because the hardware is optimized for one particular benchmark they didn't even reference in their comparisons?

From the data side: the M4 hasn't made it to the charts yet but the M3 already holds the 4th place in PassMark's single thread chart as well https://www.cpubenchmark.net/singleThread.html as well as tops Cinebench 2024 https://www.cpu-monkey.com/en/cpu_benchmark-cinebench_2024_s...

The only areas the M series "lags" is in the high end workstation/server segment where they don't really have a 96+ core option or in spaces where you pop in beefy high end GPUs. Everything else the M4 tends to lead in right now.

Okay, the linked benchmarks proved me wrong. I trust cinebench numbers a whole lot more than a geekbench score.

My bad.

And just to be clear: I didn't speculate that Apple tune's its chip to Geekbench, I speculated that geekbench was overly optimized towards apple's latest chip.

> (...) but it all turned out to be a smoke and mirrors show because the hardware is optimized for one particular benchmark they didn't even reference in their comparisons?

I know iOS developers who recently upgraded their MacBooks and they claim they now feel more sluggish. I wouldn't be surprised if it was due to RAM constraints instead of CPU though.

So, take those artificial bencmarks with a grain of salt. They are so optimized that they are optimized out of the real world.

Always look the benches of the actual workload types you'll be using. Some of the above, e.g. cinebench, are actually production rendering programs. Doesn't mean dick if you aren't going to use it that way.

It's kinda true but also not at all. In general, having better single thread performance means a more reactive UI and snappier feeling because blocking operation gets executed more quickly. On the other hand, many modern software having been extremely optimized for multi-threading and not all categories of software benefit that much from faster UI thread. If parallelization isn't too expansive, throwing more core at something can make it actually faster.

And the big thing you leave out is that it all depends on how well the software is optimise, how much animations it use and things like that. My iPhone has MUCH better single-thread performance than my old PC, yet it feels much slower for almost everything.

And this is exactly how I feel about Apple Silicon Macs. On paper, impressive performance. In actual practice it doesn't feel that fast.

They also explicitly called it out in their announcement videos that the M4 has the fastest CPU cores on the market.

It's not really buried... their headline stat is that it's 1.8x faster than the M1, which is actually a bigger improvement than the actual Geekbench score shows (it would be a score of 4354).

Call me cynical, but when I see headlines like "up to 2x faster", I assume it's a cherry-picked result on some workload where they added a dedicated accelerator.

There's a massive difference between "pretty much every app is 80% faster" and "if you render a 4K ProRes video in Final Cut Pro it's 3x faster."

that's interesting, the scores are accelerating? 9.8% better, 15.7% better, 23.8% better

Conversely, the M3 supposedly has better multi core performance? How is that possible?

It doesn't.

Mx is such a incredible achievement by apple.

Sadly installing Linux is a no unless you use some budu.

Installing Linux is easy...

> "up to 1.8x faster when compared to the 16-inch MacBook Pro with M1 Pro"

I insist my 2020 Macbook M1 was the best purchase I ever made

Yep.

I've never kept any laptop as long as I've kept the M1. I was more or less upgrading yearly in the past because the speed increases (both in the G4 and then Intel generations) were so significant. This M1 has exceeded my expectations in every category, it's faster quieter and cooler than any laptop i've ever owned.

I've had this laptop since release in 2020 and I have nearly 0 complaints with it.

I wouldn't upgrade except the increase in memory is great, I don't want to have to shut down apps to be able to load some huge LLMs, and, I ding'ed the top case a few months ago and now there's a shadow on the screen in that spot in some lighting conditions which is very annoying.

I hope (and expect) the M4 to last just as long as my M1 did.

> I've never kept any laptop as long as I've kept the M1.

My 2015 MBP would like to have a word.

It’s the only laptop purchase I’ve made. I still use it to this day, though not as regularly.

I will likely get a new MBP one of these days.

You'll be glad you did. I loved my 2015 MBP. I even drove 3 hours to the nearest Best Buy to snag one. That display was glorious. A fantastic machine. I eventually gave it to my sister, who continued using it until a few years ago. The battery was gone, but it still worked great.

When you upgrade, prepare to be astonished.

The performance improvement is difficult to convey. It's akin to traveling by horse and buggy. And then hopping into a modern jetliner, flying first class.

It's not just speed. Display quality, build quality, sound quality, keyboard quality, trackpad, ports, etc., have all improved considerably.

The performance jump between a top-of-the-line intel MBP (I don't remember the year, probably 2019) and the m1 max I got to replace it.. was rather like the perf jump between spinning disks and SSDs.

When I migrated all my laptops to SSDs (lenovos at the time, so it was drop-dead simple), I thought to myself, "this is a once-in-a-generation feeling". I didn't think I would ever be impressed by a laptop's speed ever again. It was nice to be wrong.

> The battery was gone, but it still worked great.

A family 2018 Macbook Air got a second life with a battery replacement. Cheap kit from Amazon, screwdrivers included, extremely easy to do. Still in use, no problems.

My 2015 15" MBP is also still kickin, is/was an absolutely fabulous unit. Was my work machine for 3-4 years, and now another almost-6 years as my personal laptop. My personal use case is obviously not very demanding but it's only now starting to really show its age.

I also have a M1 from work that is absolutely wonderful, but I think it's time for me to upgrade the 2015 with one of these new M4s.

The longevity of Macbooks is insanely good.

Honestly, my Thinkpad from 2015 was still used in my family until recently. The battery was pretty bad, same as on my 2015 MBP, but other than that, I put Fedora on it, and it was still really fast.

Longevity is not only a thing of MBPs. OTOH, IIRC, some 2017-2019 MBPs (before the Mx switch) were terrible for longevity, given their problematic keyboard.

If we are going this way… I still use a mid-2012 MBP as my main workstation.

Last one with upgrade capabilities, now it has two fast SSDs and maximum Ram. I changed the battery once.

Only shame is that it doesn’t get major MacOS upgrades anymore.

Still good enough to browse the web, do office productivity and web development.

12 years of good use, I am not sure I can get so much value anywhere now

Same setup here except I use Opencore Legacy Patcher so I’m on the latest OS as well. Works amazingly well.

I never questioned the limitations for these upgrades…

Thanks for reminding me that everything is possible, I may try Opencore to keep it even longer !

How’s the performance? I have 2013 MBP with 16GB RAM, and am curious if the newer OS are more RAM hungry.

I was also a mid-2012 MBP user. I eventually got the M2 MBA because I was investing in my eyesight (modern displays are significantly better). I was never impressed with the touchbar-era macs, they didn't appeal to me and their keyboards were terrible.

I think this M-series macbook airs are a worthy successor to the 2012 MBP. I fully intend to use this laptop for at least the same amount of time, ideally more. The lack of replaceable battery will probably be the eventual killer, which is a shame.

That is amazing. Mine lasted for a super long time as well, and like you, I upgraded everything to its max. I think it was the last model with a 17 inch screen.

Sold mine last year for $100 to some dude who claimed to have some software that only runs on that specific laptop. I didn't question it.

I still have my 2015, and it lived just long enough to keep me going until the death of the touch bar and horrible keyboard, which went away when I immediately bought the M1 Pro on release day.

Exactly same story here.

For it's time, the 2015 model was a fantastic package: reliable and robust in form and function.

Would've kept going on it had Apple silicon and 14 inch not come around.

Barring super niche LLM use cases, I don't see why one would need to upgrade.

I loved my 2015 MBP, probably the best machine Apple made, overall, until arguably the 2019 16" (read: after the butterfly keyboard debacle)

Traded it for an M1 Air in 2021 and was astonished at how much faster it was. It even blew away my 2019 16" from work.

You're going to be even more blown away!

My wife still uses my 2012 MBP 15 retina as her daily driver. The battery's terrible but everything else works fine.

It's extremely easy to replace the battery.

Anything you can buy online ships with all required screw drivers and dozen of Youtube videos or ifixit will give you step by step instructions.

10-15 minutes and you'll have the old battery replaced all by yourself.

It's that simple.

I used that same model for 5 years until I finally upgraded in 2017 and totally regretted it, the upgrade was not worth it at all, I would have been just as happy with the 2012. I quickly replaced it again with the "Mea Culpa" 2019 where they added back in ports, etc, would have been just about worth the upgrade over the 2012, 7 years later, but again, not by a big margin.

The 2012 MBP 15" Retina was probably the only machine I bought where the performance actually got better over the years, as the OS got more optimized for it (the early OS revisions had very slow graphics drivers dealing with the retina display)

The M1 Pro on the other hand, that was a true upgrade. Just a completely different experience to any Apple Intel laptop.

2017 and 2019 had the same ports?

Ah you're right, it was only the keyboard and battery they fixed.

It's been too long, I guess I had blocked out just just how terrible those Intel MacBooks were.

The 2015 MacBook Pro is the Nokia 3310 of our generation.

My 2015 MBP would probably have been totally fine for development... except for the Docker-based workflows that everybody uses now.

Rebuilding a bunch of Docker images on an older intel mac is quite the slow experience if you're doing it multiple times per day.

I loved my 2015 MBP too.

I recently replaced it with a used MBA M1, 16GB, 2TB.

It's insane how much faster it is, how long the battery lasts and how cool and silent it is. Completely different worlds.

The 2015 keeps going!

I was considering upgrading to an M3 up until about a month ago when Apple replaced my battery, keyboard, top case, and trackpad completely for free. An upgrade would be nice as it no longer supports the latest MacOS, but at this point, I may just load Ubuntu on the thing and keep using it for another few years. What a machine.

I've just replaced a 2012 i5 mbp, and used it for Dev work and presentations into 2018.

It has gotten significantly slower the last 2 years, but the more obvious issue is the sound, inability to virtual background, and now lack of software updates.

But if you had told me I'd need to replace it in 2022 I wouldn't believe you

2015 MBP here too, even got a new topcase and a battery replaced for free because it had some issues according to Apple.

Can't get the latest macOS on it though, but otherwise it still works perfectly well.

Kinda considering upgrading it to a used M1/M2 one at some point.

Ah my 2013 mbp died in 2019. It was the gpu. No way to repair it for cheap enough so I had to replace it with a 2019 mbp which was the computer I kept the shortest (I hated the keyboard).

My 2011 MBP died in 2023, it was used daily but very slow at the end of its life.

How do you justify this kind of recurring purchases, even with selling your old device? I don't get the behaviour or the driving decision factor past the obvious "I need the latest shiny toy" (I can't find the exact words to describe it, so apologies for the reductive description).

I have either assembled my own desktop computers or purchased ex corporate Lenovo over the years with a mix of Windows (for gaming obviously) and Linux and only recently (4 years ago) been given a MBP by work as they (IT) cannot manage Linux machines like they do with MacOS and Windows.

I have moved from an intel i5 MBP to a M3 Pro (?) and it makes me want to throw away my dependable ThinkPad/Fedora machine I still uses for personal projects.

It's really very easy, honestly.

My laptop is my work life and my personal life.

I spend easily 100 hours a week using it not-as-balanced-as-it-should-be between the two.

I don't buy them because I need something new, I buy them because in the G4/Intel era, the iterations were massive and even a 20 or 30% increase in speed (which could be memory, CPU, disk -- they all make things faster) results in me being more productive. It's worth it for me to upgrade immediately when apple releases something new, as long as I have issues with my current device and the upgrade is enough of a delta.

M1 -> M2 wasn't much of a delta and my M1 was fine. M1 -> M3 was a decent delta, but, my M1 was still fine. M1 -> M4 is a huge delta (almost double) and my screen is dented to where it's annoying to sit outside and use the laptop (bright sun makes the defect worse), so, I'm upgrading. If I hadn't dented the screen the choice would be /a lot/ harder.

I love ThinkPads too. Really can take a beating and keep on going. The post-IBM era ones are even better in some regards too. I keep one around running Debian for Linux-emergencies.

There are 2 things I was always spending money on, if I felt is not the almost best achievable: my bed and my laptop. Even the phone can be 4 years old iPhone, but the laptop must be best and fast. My sleep is also pretty important. Everything else is just "eco".

In my country you can buy a device and write off in 2 years, VAT reimbursed, then scrap it from the books and you sell it to people without tax payed to people who otherwise would pay a pretty hefty VAT. This decreases your loss of value to like half.

I don't think tax evasion is something one should recommend people do.

It's tax avoidance, not evasion. If it's fully legal then I don't know why wouldn't you recommend it. If you are against it, you can easily pay more in taxes than required yourself.

Consuming... for some people, is done for it's own sake.

Apple has a pretty good trade-in program. If you have an Apple card, it's even better (e.g. the trade-in value is deducted immediately, zero interest, etc.).

Could you get more money by selling it? Sure. But it's hard to be the convenience. They ship you a box. You seal up the old device and drop it off at UPS.

I also build my desktop computers with a mix of Windows and Linux. But those are upgraded over the years, not regularly.

You’re better off taking it to the Apple Store for trade-in. There are a lot of easy-to-miss reasons the mail-in one might reject it.

>I've never kept any laptop as long as I've kept the M1

What different lives we live. This first M1 was in November 2020. Not even four years old. I’ve never had a [personal] computer for _less_ time than that. (Work, yes, due to changing jobs or company-dictated changes/upgrades)

My work computer is my personal computer. I easily spend 100+ hours a week using it.

Same here, but I'm still using a mid 2012 Macbook Pro. It's got an SSD and 32GB of ram, but it still works great.

I feel like just running teams on that would make it cry.

Exactly my thoughts. I don't understand whether I'm really spoiled, or is the crowd here weird about upgrading for some reason - if you have a laptop from 4-5 years ago, the new one would be 2-5x faster in vast majority of things - even if not critical for your workflow, it would feel SO MUCH nicer - so if it's something you use for 100h / week, shouldn't you try to make it as enjoyable as reasonably possible?

Other example - I'm by no means rich, but I have a $300 mechanical keyboard - it doesn't make me type faster and it doesn't have additional functionality to a regular $30 Logitech one - but typing on it feels so nice and I spend so much of my life doing it, that to me it's completely justified and needed to have this one then.

I also bet it sounds like a Harrier jet when doing most things, at the temperature of a hot plate.

>at the temperature of a hot plate

That’s a feature, not a bug, for some. When I upgraded to an M series chip MacBook, I had to turn up the heat because I no longer had my mini space heater.

> I've never kept any laptop as long as I've kept the M1.

I still have a running Thinkpad R60 from 2007, a running Thinkpad T510 from 2012, and a modified running Thinkpad X61 (which I re-built as an X62 using the kit from 51nb in 2017 with a i7-5600U processor, 32 GB of RAM and a new display) in regular use. The latter required new batteries every 2 years, but was my main machine until 2 weeks ago when I replaced it with a ThinkCentre. During their time as my main machine, each of these laptops was actively used around 100 hours per week, and was often running for weeks without shutdown or reboot. The only thing that every broke was the display of the R60 which started to show several green vertical bars after 6 years, but replacement was easy.

"I've had this laptop since release in 2020 and I have nearly 0 complaints with it."

Me too. Only one complaint. After I accidentally spilled a cup of water into it on an airplane, it didn't work.

(However AppleCare fixed it for $300 and I had a very recent backup. :) )

If you don’t have AppleCare, it costs $1400+. M2 Pro here that I’m waiting to fix or upgrade because of that.

What’s more annoying is that I’d jus to get a new one and recycle this one, but the SSD is soldered on. Good on you for having a backup.

Do not own a Mac unless you bought it used or have AppleCare.

I've been using portable macs for the last 25 years.

Never had AppleCare or any other extended warranty program.

Did just fine up to now.

I've spilled liquid on my MacBook's once every 10 years on average. Last in 2014, then again last month. Accidents happen.

As I've noted in a sibling comment, I'll probably stop purchasing mobile Macs until the repair story on Macbooks is improved -- the risk for accidents and repairs is simply much higher on portable machines. That's only going to happen through third-party repair (which I think would simultaneously lead Apple to lower their first-party repair costs, too).

Interesting. I have found occasion to use it for pretty much every Mac I've owned since the 1980s! I'm not sure how much money it's saved compared to just paying for repairs when needed, but I suspect it may come out to:

1) a slight overall savings, though I'm not sure about that. 2) a lack of stress when something breaks. Even if there isn't an overall savings, for me it's been worth it because of that.

Certainly, my recent Mac repair would have cost $1500 and I only paid $300, and I think I've had the machine for about 3 years, so there's a savings there but considerably less recent stress. That's similar to the experience I've had all along, although this recent expense would have probably been my most-expensive repair ever.

Same here. AppleCare is just an app insurance policy. Nothing more.

I’ve underwritten my own Mac ownership since the very first Intel MacBook Pro and just like you I’ve been just fine.

"SSD is soldered on" is a bit of glossing over of the issue with the M-series Macs.

Apple is putting raw NAND chips on the board (and yes soldering them) and the controller for the SSD is part of the M-series chip. Yes, apple could use NVMe here if you ignore the physical constraints and ignore fact that it wouldn't be quite as fast and ignore the fact that it would increase their BOM cost.

I'm not saying Apple is definitively correct here, but, it's good to have choice and Apple is the only company with this kind of deeply integrated design. If you want a fully modular laptop, go buy a framework (they are great too!) and if you want something semi-modular, go buy a ThinkPad (also great!).

I need macOS for work. Now that the writing is on the wall for Hackintosh (which I used to do regularly while purchasing a Mac every few years, most recently in 2023 and 2018, because I love that choice), I don't have a choice. I used to spend 10-20 hours per third party machine for that choice.

I don't truly mind that they solder on the SSD, embed the controller into the processor -- you're right that it's great we have choice here. I mind the exuberant repair cost _on top of_ Apple's war on third party repair. Apple is the one preventing me to have choice here, I have to do the repair through them, or wait until schematics are smuggled out of China and used/broken logic boards are available so that the repair costs what it should: $300 to replace 2 chips on my logic board (still mostly labor, but totally a fair price).

I love Apple for their privacy focus and will continue to support them because I need to do Mac and iOS development, but I will likely stop buying mobile workstations from them for this reason, the risk of repair is simply much higher and not worth this situation.

I haven't had "chip failures" like that for 15+ years. Has hardware gotten more stable?

The problem is those other options won't run macOS. If the OS is a given then there's no choice.

Day to day I don't mind but when needs change or something breaks it's unfortunate to have to replace the whole machine to fix it.

I'm sure a little hot air rework can fix this right up.

Yeah, I always have AppleCare. I view it as part of the cost of a mac (or iPhone).

And yeah, this incident reminded me of why it's important to back up as close to daily as you can, or even more often during periods when you're doing important work and want to be sure you have the intermediate steps.

Mine fell off from the roof of a moving car at highway speeds and subsequently spent 30 mins being run over by cars until it was picked back up. Otherwise no complaints.

My 2019 i9 going strong as ever. With 64gb ram, really don’t need to upgrade for at least a couple more years.

I had the 2019 i9. The power difference and the cooling difference is astounding from the 2019 to the M1 (and the M1 is faster).

I actually use my laptop on my lap commonly and I think the i9 was going to sterilize me.

I had an 2019 i9 for a work laptop. It was absolutely awful, especially with the corporate anti-virus / spyware on it that brought it to a crawl. Fans would run constantly. Any sort of Node JS build would make it sound like a jet engine.

yeah I had the 8-core i9 and I was shocked at how much faster my M1 Air was when I got it. No fan and still acing the old MBP!

Now on M2 MBP and will probably be using it for a very long time.

That was the worst laptop I've ever had. Not only was it turning the jet engines on when you tried to do something more demanding that moving mouse around, it throttled thermally so much that you literally could not move that mouse around.

I mean, before the i9, I had a shitty XPS 13" so it's been a huge relative upgrade to me.

I have the OG 13" MBP M1, and it's been great; I only have two real reasons I'm considering jumping to the 14" MBP M4 Pro finally:

- More RAM, primarily for local LLM usage through Ollama (a bit more overhead for bigger models would be nice)

- A bit niche, but I often run multiple external displays. DisplayLink works fine for this, but I also use live captions heavily and Apple's live captions don't work when any form of screen sharing/recording is enabled... which is how Displaylink works. :(

Not quite sold yet, but definitely thinking about it.

The M1 Max supports more than one external display natively, which is also an option.

I don't think it's niche. It's the reason why I and multiple of my coworkers waited till M1 Pro with buying one.

I'm definitely still happy with it, but job offers upgrade to M4 so... why not?

Yep. That's roughly 20% per generation improvement which ain't half-bad these days, but the really huge cliff was going from Intel to the M1 generation.

M1 series machines are going to be fine for years to come.

It feels like M1 was the revolution, subsequent ones evolution - smaller fabrication process for improved energy efficiency, more cores for more power, higher memory (storage?) bandwidth, more displays (that was a major and valid criticism for the M1 even though in practice >1 external screens is a relatively rare use case for <5% of users).

Actually wasn't M1 itself an evolution / upscale of their A series CPUS that by now they've been working on since... before 2010, the iPhone 4 was the first one with their own CPU, although the design was from Samsung + Intrinsity, it was only the A6 that they claimed was custom designed by Apple.

And my 2020 Intel Macbook Air was a bad purchase. Cruelly, the Intel and M1 Macbook Air released within 6 months of each other.

In early 2020, I had an aging 2011 Air that was still struggling after a battery replacement. Even though I "knew" the Apple Silicon chips would be better, I figured a 2020 Intel Air would last me a long time anyway, since my computing needs from that device are light, and who knows how many years the Apple Silicon transition will take take anyway?

Bought a reasonably well-specced Intel Air for $1700ish. The M1s came out a few months later. I briefly thought about the implication of taking a hit on my "investment", figured I might as well cry once rather than suffer endlessly. Sold my $1700 Intel Air for $1200ish on craigslist (if I recall correctly), picked up an M1 Air for about that same $1200 pricepoint, and I'm typing this on that machine now.

That money was lost as soon as I made the wrong decision, I'm glad I just recognized the loss up front rather than stewing about it.

Exact same boat here. A friend and I both bought the 2020 Intel MBA thinking that the M1 version was at least a year out. It dropped a few months later. I immediately resold my Intel MBA seeing the writing on the wall and bought a launch M1 (which I still use to this day). Ended up losing $200 on that mis-step, but no way the Intel version would still get me through the day.

That said...scummy move by Apple. They tend to be a little more thoughtful in their refresh schedule, so I was caught off guard.

When I saw the M1s come out, I thought that dev tooling would take a while to work for M1, which was correct. It probably took a year for most everything to be compiled for arm64. However I had too little faith in Rosetta and just the speed upgrade M1 really brought. So what I mean to say is, I still have that deadweight MBA that I only use for web browsing :)

Oh yes, my wife bought a new Intel MBA in summer 2020... I told her at the time Apple planned its own chip, but it couldn't be much better than the Intel one and surely Apple will increase prices too... I was so wrong.

Yeah I’m in the same boat. I had my old mid 2013 Air for 7 years before I pulled the trigger on that too. I’ll be grabbing myself an M4 Pro this time

Amen. I got a crazy deal on a brand new 2020 M1 Max MBP with 64GB/2TB in 2023.

This is the best machine I have ever owned. It is so completely perfect in every way. I can't imagine replacing it for many many years.

Congratulations, just curious what is the deal?

At the end of 2023 BH Photo Video was selling the M1 Max 16” 64G/2TB for 2,499. It’s the lowest I’ve ever seen it anywhere and I got one myself.

Bought the same machine from the same store last December, been using it ever since with a big grin on my face. I'll probably consider upgrading in 2028 or later.

Thanks! Looks like obscure retailers sometimes have good deals.

BHPohotoVideo is huge, they've been around for like 20 years!

Best way I've discovered to find those sorts of deals is to use Slickdeals and set up alerts.

I still use my MacBook Air M1 and given my current workloads (a bit of web development, general home office use and occasional video editing and encoding) I doubt I’ll need to replace it in the coming 5 years. That’ll be an almost 10 year lifespan.

It's a very robust and capable small laptop. I'm typing this to a M1 Macbook Air.

The only thing to keep in mind, is that the M1 was the first CPU in the transition from Intel CPUs (+ AMD GPUs) to Apple Silicon. The M1 was still missing a bunch of things from earlier CPUs, which Apple over time added via the M1 Pro and other CPUs. Especially the graphics part was sufficient for a small laptop, but not for much beyond. Better GPUs and media engines were developed later. Today, the M3 in a Macbook Air or the M4 in the Macbook Pro have all of that.

For me the biggest surprise was how well the M1 Macbook Air actually worked. Apple did an outstanding job in the software & hardware transition.

I switched from a 2014 MacBook pro to a 2020 M1 MacBook Air, yeah the CPU is much faster, but the build quality and software is a huge step backwards. The trackpad is feels fake, not nearly as responsive, keyboard also feel not as solid. But now I'm already used to it.

They also feel very bulky/innelegant while still being fragile for the most part and not really hitting workstation level territory.

I don't understand how people are enamored with those things, sure it's better in some way than what it was before but it's also very compromised for the price.

Agree, even without whisky (this whisky: https://getwhisky.app).

With whisky i feel like id never need anything else. That said, the benchmark jump in the m4 has me thinking i should save up and grab a refurb in a year or two

Same. My MBP and M1 Air are amazing machines. But I’m now also excited that any future M chip replacement will be faster and just as nice.

The battery performance is incredible too.

M1 Pro compared to Intel was so big step ahead that I suppose we all are still surprised and excited. Quiet, long battery life and better performance. By a lot! I wonder if M4 really feels that much faster and better - having M1 Pro I'm not going to change quickly, but maybe Mac Mini will land some day.

Honestly it was a game changer. Before I'd never leave the house without a charger, nowadays I rarely bring it with me on office days, even with JS / front-end workloads.

(of course, everyone else has a macbook too, there's always someone that can lend me a charger. Bonus points that the newer macbooks support both magsafe and USB-C charging. Added bonus points that they brought back magsafe and HDMI ports)

There are so many ports that would be far more useful than MagSafe at a similar hardware cost

I still have my base model M1 MacBook Air, and I never felt the need to upgrade. It never felt slow.

reading this for my late 2013 MBP. It is so old that I can't install the latest of Darktable on it.

Yep. Bought an M1 Max in 2021 and it still feels fast, battery lasts forever. I’m sure the M4 would be even quicker (Lightroom, for example) but there’s little reason to consider an upgrade any time soon.

I have the same one, but everyone I know with an M series Mac says the same thing. These are the first machines in a long time built to not only last a decade but be used for it.

I got a refurbed M1 iPad Pro 12.9” for $900 a couple years ago and have been quite pleased. I still have a couple of years life in it I estimate.

I don't like my M1. It's really good for using Lightroom at the coffee shop, but absolutely sucks for developing software

It's annoyingly good! I want to upgrade, but especially having splurged on 64Gb RAM, I have very little justifiable reason.

I upgraded to the M2 Air and I could have just kept the M1 Air this whole time. It was a perfect laptop.

Yes, I got mine for 900 Euros (16, 256). Still working perfectly. What a bargain that was.

Except for the usb c charge port - magcharge was the best invention and I’ll never understand why it was removed.

I have the M1 MacBook Pro with MagSafe and I still charge it via USB C simply because I can't be bothered to carry around another cable when all of my other peripherals are USB C.

I have the same. I would much rather have a different port, like USB-A, than something I have never used

That's interesting, I don't use USB A at all whatsoever anymore, and frankly I don't use the SD card reader or HDMI port either. Maybe I should just get a MacBook Air 15" but I do like the 120 hz screen of the Pro models, that's the main reason I'm holding out.

There are lots of other laptops that have 120Hz+ refresh rates and have the massive benefit of not being stuck with MacOS

That's a con not a benefit for me, and I suspect many other people.

It's the other way around, isn't it? MagSafe was removed in the 2016-2019 model years (not sure why; maybe to shave off another bit of thickness?), and then brought back in 2020 to MacBook Pro and 2022 to MacBook Air.

Personally, I practically never use MagSafe, because the convenience of USB C charging cables all over the house outweighs the advantages of MagSafe for me.

Pro tip, USB c magnetic adapter is cheap and works well enough

I too bought a 2020 MBA M1, it was great initially, but now seems like its getting throttled, same goes with my iPhoneX, I used to love Apple, but its just pathetic that they throttle older devices just to get users to upgrade.

No one is throttling your M1 MBA.

8GB or 16GB?

The M4 Max goes up to 128GB RAM, and "over half a terabyte per second of unified memory bandwidth" - LLM users rejoice.

The M3 Max was 400GBps, this is 540GBps. Truly an outstanding case for unified memory. DDR5 doesn't come anywhere near.

Apple is using LPDDR5 for M3. The bandwidth doesn't come from unified memory - it comes from using many channels. You could get the same bandwidth or more with normal DDR5 modules if you could use 8 or more channels, but in the PC space you don't usually see more than 2 or 4 channels (only common for servers).

Unrelated but unified memory is a strange buzzword being used by Apple. Their memory is no different than other computers. In fact, every computer without a discrete GPU uses a unified memory model these days!

> (only common for servers).

On PC desktops I always recommend getting a mid-range tower server precisely for that reason. My oldest one is about 8 years old and only now it's showing signs of age (as in not being faster than the average laptop).

> In fact, every computer without a discrete GPU uses a unified memory model these days!

On PCs some other hardware (notably the SSD) comes with its own memory. But here it's shared with the main DRAM too.

This is not necessarily a performance improvement, it can avoid copies but also means less is available to the CPU.

DRAM-less NVMe (utilizing HMB) is also common on PCs, but it's seen as a slower budget alternative rather than a good thing.

I read all that marketing stuff and my brain just sees APU. I guess at some level, that’s just marketing stuff too, but it’s not a new idea.

The new idea is having 512 bit wide memory instead of PC limitation of 128 bit wide. Normal CPU cores running normal codes are not particularly bandwidth limited. However APUs/iGPUs are severely bandwidth limited, thus the huge number of slow iGPUs that are fine for browsing but terrible for anything more intensive.

So apple manages decent GPU performance, a tiny package, and great battery life. It's much harder on the PC side because every laptop/desktop chip from Intel and AMD use a 128 bit memory bus. You have to take a huge step up in price, power, and size with something like a thread ripper, xeon, or epyc to get more than 128 bit wide memory, none of which are available in a laptop or mac mini size SFF.

> The new idea is having 512 bit wide memory instead of PC limitation of 128 bit wide.

It's not really a new idea, just unusual in computers. The custom SOCs that AMD makes for Playstation and Xbox have wide (up to 384-bit) unified memory buses, very similar to what Apple is doing, with the main distinction being Apples use of low-power LPDDR instead of the faster but power hungrier GDDR used in the consoles.

Yeah, a lot of it is just market forces. I guess going to four channels is costly for the desktop PC space and that's why that didn't happen, and laptops just kind of followed suite. But now that Apple is putting pressure on the market, perhaps we'll finally see quad channel becoming the norm in desktop PCs? Would be nice...

> instead of PC limitation of 128 bit wide

Memory interface width of modern CPUs is 64-bit (DDR4) and 32+32 (DDR5).

No CPU uses 128b memory bus as it results in overfetch of data, i.e., 128B per access, or two cache lines.

AFAIK Apple uses 128B cache lines, so they can do much better design and customization of memory subsystem as they do not have to use DIMMs -- they simply solder DRAM to the motherboard, hence memory interface is whatever they want.

> Memory interface width of modern CPUs is 64-bit (DDR4) and 32+32 (DDR5).

Sure, per channel. PCs have 2x64 bit or 4x32 bit memory channels.

Not sure I get your point, yes PCs have 64 bit cache lines and apple uses 128. I wouldn't expect any noticeable difference because of this. Generally cache miss is sent to a single memory channel and result in a wait of 50-100ns, then you get 4 or 8 bytes per cycle at whatever memory clock speed you have. So apple gets twice the bytes per cache line miss, but the value of those extra bytes is low in most cases.

Other bigger differences is that apple has a larger page size (16KB vs 4KB) and arm supports a looser memory model, which makes it easier to reach a large fraction of peak memory bandwidth.

However, I don't see any relationship between Apple and PCs as far as DIMMS. Both Apple and PCs can (and do) solder dram chips directly to the motherboard, normally on thin/light laptops. The big difference between Apple and PC is that apple supports 128, 256, and 512 bit wide memory on laptops and 1024 bit on the studio (a bit bigger than most SFFs). To get more than 128 bits with a PC that means no laptops, no SFFs, generally large workstations with Xeon, Threadrippers, or Epyc with substantial airflow and power requirements

FYI cache lines are 64 bytes, not bits. So Apple is using 128 bytes.

Also important to consider that the RTX 4090 has a relatively tiny 384-bit memory bus. Smaller than the M1 Max's 512-bit bus. But the RTX 4090 has 1 TB/s bandwidth and significantly more compute power available to make use of that bandwidth.

Ugh, should have caught the bit vs byte, thanks.

The M4 max is definitely not a 4090 killer, does not match it in any way. It can however work on larger models than the 4090 and have a battery that can last all day.

My memory is a bit fuzzy, but I believe the m3 max did decent on some games compared to the laptop Nvidia 4070 (which is not the same as the desktop 4070). But highly depended on if the game was x86-64 (requiring emulation) and if it was DX11 or apple native. I believe apple claims improvements in metal (the Apple's GPU lib) and that the m4 GPUs have better FP for ray tracing, but no significant changes in rasterized performance.

I look forward to the 3rd party benchmarks for LLM and gaming on the m4 max.

What I was trying to say is that there is no 128b limitation for PCs.

Eh… not quite. Maybe on an Instinct. Unified memory means the CPU and CPU means they can do zero copy to use the same memory buffer.

Many integrated graphics segregate the memory into CPU owned and GPU owned, so that even if data is on the same DIMM, a copy still needs to be performed for one side to use what the other side already has.

This means that the drivers, etc, all have to understand the unified memory model, etc. it’s not just hardware sharing DIMMs.

I was under the impression PS4’s APU implemented unified memory, and it was even referred to by that name[1].

APUs with shared everything are not a new concept, they are actually older than programmable graphics coprocessors…

https://www.heise.de/news/Gamescom-Playstation-4-bietet-Unif...

I believe that at least on Linux you get zero-copy these days. https://www.phoronix.com/news/AMD-AOMP-19.0-2-Compiler

Yes, it's just easier to call it that without having to sprinkle asterisks at each mention of it :)

And yes, the impressive part is that this kind of bandwidth is hard to get on laptops. I suppose I should have been a bit more specific in my remark.

High end servers now have 12 ddr5 channels.

Yes, you could buy a brand new (announced weeks ago) AMD Turin. 12 channels of DDR5-6000, $11,048 and 320 watts (for the CPU) and get 576GB/sec peak.

Or you could buy a M3 max laptop for $4k, get 10+ hour battery life, have it fit in a thin/light laptop, and still get 546GB/sec. However those are peak numbers. Apple uses longer cache lines (double), large page sizes (quadruple), and a looser memory model. Generally I'd expect nearly every memory bandwidth measure to win on Apple over AMD's turin.

AnandTech did bandwidth benchmarks for the M1 Max and was only able to utilize about half of it from the CPU, and the GPU used even less in 3D workloads because it wasn't bandwidth limited. It's not all about bandwidth. https://www.anandtech.com/show/17024/apple-m1-max-performanc...

Indeed. RIP Anandtech. I've seen bandwidth tests since then that showed similar for newer generations, but not the m4. Not sure if the common LLM tools on mac can use CPU (vector instructions), AMX, and Neural engine in parallel to make use of the full bandwidth.

You lose out on things like expandability (more storage, more PCIe lanes) and repairability though. You are also (on M4 for probably a few years) compelled to use macOS, for better or worse.

There are, in my experience, professionals who want to use the best tools someone else builds for them, and professionals who want to keep iterating on their tools to make them the best they can be. It's the difference between, say, a violin and a Eurorack. Neither's better or worse, they're just different kinds of tools.

Agreed.

I was sorely tempted by the Mac studio, but ended up with a 96GB ram Ryzen 7900 (12 core) + Radeon 7800 XT (16GB vram). It was a fraction of the price and easy to add storage. The Mac M2 studio was tempting, but wasn't refreshed for the M3 generation. It really bothered me that the storage was A) expensive, B) proprietary, C) tightly controlled, and D) you can't boot without internal storage.

Even moving storage between Apple studios can be iffy. Would I be able to replace the storage if it died in 5 years? Or expand it?

As tempting as the size, efficiency, and bandwidth were I just couldn't justify top $ without knowing how long it would be useful. Sad they just didn't add two NVMe ports or make some kind of raw storage (NVMe flash, but without the smarts).

> Even moving storage between Apple studios can be iffy.

This was really driven home to me by my recent purchase of an Optane 905p, a drive that is both very fast and has an MTBF measured in the hundreds of years. Short of a power surge or (in California) an earthquake, it's not going to die in my lifetime -- why should I not keep using it for a long time?

Many kinds of professionals are completely fine with having their Optanes and what not only be plugged in externally, though, even though it may mean their boot drive will likely die at some point. That's completely okay I think.

I doubt you'll get 10+ hours on battery if you utilize it at max. I don't even know if it can really sustain the maximum load for more than a couple of minutes because of thermal or some other limits.

The 14" MBP has a 72 watt-hour battery and the 16" has a 100 watt-hour battery.

At full tilt an M3 Max will consume 50 to 75 watts, meaning you get 1 to 2 hours of runtime at best, if you use the thing full tilt.

That's the thing I find funny about the Apple Silicon MBP craze, sure they are efficient but if you use the thing as a workstation, battery life is still not good enough to really use unplugged.

Most claiming insane battery life are using the thing effectively as an information appliance or a media machine. At this game the PC laptops might not be as efficient but the runtime is not THAT different provided the same battery capacity.

FWIW I ran a quick test of gemma.cpp on M3 Pro with 8 threads. Similar PaliGemma inference speed to an older AMD (Rome or Milan) with 8 threads. But the AMD has more cores than that, and more headroom :)

CXL memory is also a thing.

Isn't unified memory* a crucial part in avoiding signal integrity problems?

Servers do have many channels but they run relatively slower memory

* Specifically, it being on-die

"Unified memory" doesn't really imply anything about the memory being located on-package, just that it's a shared pool that the CPU, GPU, etc. all have fast access to.

Also, DRAM is never on-die. On-package, yes, for Apple's SoCs and various other products throughout the industry, but DRAM manufacturing happens in entirely different fabs than those used for logic chips.

System memory DRAM never is, but sometimes DRAM is technically included on CPU dies as a cache

https://en.wikipedia.org/wiki/EDRAM

It's mostly an IBM thing. In the consumer space, it's been in game consoles with IBM-fabbed chips. Intel's use of eDRAM was on a separate die (there was a lot that was odd about those parts).

Yeah memory bandwidth is one of the really unfortunate things about the consumer stuff. Even the 9950x/7950x, which are comfortably workstation-level in terms of compute, are bound by their 2 channel limits. The other day I was pricing out a basic Threadripper setup with a 7960x (not just for this reason but also for more PCIe lanes), and it would cost around $3000 -- somewhat out of my budget.

This is one of the reasons the "3D vcache" stuff with the giant L3 cache is so effective.

For comparison, a Threadripper Pro 5000 workstation with 8x DDR4 3200 has 204.8GB/s of memory bandwidth. The Threadripper Pro 7000 with DDR5-5200 can achieve 325GB/s.

And no, manaskarekar, the M4 Max does 546 GB/s not GBps (which would be 8x less!).

> And no, manaskarekar, the M4 Max does 546 GB/s not GBps (which would be 8x less!).

GB/s and GBps mean the same thing, though GB/s is the more common way to express it. Gb/s and Gbps are the units that are 8x less: bits vs Bytes.

B = Bytes, b = bits.

GB/s is the same thing as GBps

The "ps" means "per second"

Thanks for the numbers. Someone here on hackernews got me convinced that a Threadripper would be a better investment for inference than a MacBook Pro with a M3 Max.

I was curious so I looked it up:

https://en.wikipedia.org/wiki/DDR5_SDRAM (info from the first section):

> DDR5 is capable of 8GT/s which translates to 64 GB/s (8 gigatransfers/second * 64-bit width / 8 bits/byte = 64 GB/s) of bandwidth per DIMM.

So for example if you have a server with 16 DDR5 DIMMs (sticks) it equates to 1,024 GB/s of total bandwidth.

DDR4 clocks in at 3.2GT/s and the fastest DDR3 at 2.1GT/s.

DDR5 is an impressive jump. HBM is totally bonkers at 128GB/s per DIMM (HBM is the memory used in the top end Nvidia datacenter cards).

Cheers.

> So for example if you have a server with 16 DDR5 DIMMs (sticks) it equates to 1,024 GB/s of total bandwidth.

Not quite as it depends on number of channels and not on the number of DIMMs. An extreme example: put all 16 DIMMs on single channel, you will get performance of a single channel.

Thanks for your reply. Are you up for updating the Wikipedia page?, because as of now the canonical reference is wrong.

If you're referring to the line you quoted, then no, it's not wrong. Each DIMM is perfectly capable of 64GiB/s, just as the article says. Where it might be confusing is that this article seems to only be concerning itself with the DIMM itself and not with the memory controller on the other end. As the other reply said, the actual bandwidth available also depends on the number of memory channels provided by the CPU, where each channel provides one DIMM worth of bandwidth.

This means that in practice, consumer x86 CPUs have only 128GiB/s of DDR5 memory bandwidth available (regardless of the number of DIMM slots in the system), because the vast majority of them only offer two memory channels. Server CPUs can offer 4, 8, 12, or even more channels, but you can't just install 16 DIMMs and expect to get 1024GiB/s of bandwidth, unless you've verified that your CPU has 16 memory channels.

Got it, thanks for clarifying.

Happy Halloween!

Yes, and wouldn’t it be bonkers if the M4 Max supported HBM on desktops?

It's not the memory being unified that makes it fast, it's the combination of the memory bus being extremely wide and the memory being extremely close to the processor. It's the same principle that discrete GPUs or server CPUs with onboard HBM memory use to make their non-unified memory go ultra fast.

I thought “unified memory” was just a marketing term for the memory being extremely close to the processor?

No, unified memory usually means the CPU and GPU (and miscellaneous things like the NPU) all use the same physical pool of RAM and moving data between them is essentially zero-cost. That's in contrast to the usual PC setup where the CPU has its own pool of RAM, which is unified with the iGPU if it has one, but the discrete GPU has its own independent pool of VRAM and moving data between the two pools is a relatively slow operation.

An RTX4090 or H100 has memory extremely close to the processor but I don't think you would call it unified memory.

I don't quite understand one of the finer points of this, under caffeinated :) - if GPU memory is extremely close to the CPU memory, what sort of memory would not be extremely close to the CPU?

I think you misunderstood what I meant by "processor", the memory on a discrete GPU is very close to the GPUs processor die, but very far away from the CPU. The GPU may be able to read and write its own memory at 1TB/sec but the CPU trying to read or write that same memory will be limited by the PCIe bus, which is glacially slow by comparison, usually somewhere around 16-32GB/sec.

A huge part of optimizing code for discrete GPUs is making sure that data is streamed into GPU memory before the GPU actually needs it, because pushing or pulling data over PCIe on-demand decimates performance.

> CPU trying to read or write that same memory will be limited by the PCIe bus, which is glacially slow by comparison, usually somewhere around 16-32GB/sec.

If you’re forking out for H100’s you’ll usually be putting them on a bus with much higher throughput, 200GB/s or more.

I see, TL;DR == none; and processor switches from {CPU,GPU} to {GPU} in the 2nd paragraph. Thanks!

I thought it meant that both the GPU and the CPU can access it. In most systems, GPU memory cannot be accessed by the CPU (without going through the GPU); and vice versa.

CPUs access GPU memory via MMIO (though usually only a small portion), and GPUs can in principle access main memory via DMA. Meaning, both can share an address space and access each other’s memory. However, that wouldn’t be called Unified Memory, because it’s still mediated by an external bus (PCIe) and thus relatively slower.

Are they cache coherent these days? I feel like any unified memories should be.

It's not "DDR5" on its own, it's a few factors.

Bandwidth (GB/s) = (Data Rate (MT/s) * Channel Width (bits) * Number of Channels) / 8 / 1000

(8800 MT/s * 64 bits * 8 channels) / 8 / 1000 = 563.2 GB/s

This is still half the speed of a consumer NVidia card, but the large amounts of memory is great, if you don't mind running things more slowly and with fewer libraries.

> (8800 MT/s * 64 bits * 8 channels) / 8 / 1000 = 563.2 GB/s

Was this example intended to describe any particular device? Because I'm not aware of anything that operates at 8800 MT/s, especially not with 64-bit channels.

M4 max in the MBP (today) and in the Studio at some later date.

That seems unlikely given the mismatched memory speed (see the parent comment) and the fact that Apple uses LPDDR which is typically 16 bits per channel. 8800MT/s seems to be a number pulled out of thin air or bad arithmetic.

Heh, ok, maybe slightly different. But apple spec claims 546GB/sec which works out to 512 bits (64 bytes) * 8533. I didn't think the point was 8533 vs 8800.

I believe I saw somewhere that the actual chips used are LPDDR5X-8533.

Effectively the parents formula describes the M4 max, give or take 5%.

Fewer libraries? Any that a normal LLM user would care about? Pytorch, ollama, and others seem to have the normal use cases covered. Whenever I hear about a new LLM seems like the next post is some mac user reporting the token/sec. Often about 5 tokens/sec for 70B models which seems reasonable for a single user.

Is there a normal LLM user yet? Most people would want their options to be as wide as possible. The big ones usually get covered (eventually), and there are distinct good libraries emerging for Mac only (sigh), but last I checked the experience of running every kit (stable diffusion, server-class, etc) involved overhead for the Mac world.

Right, the nvidia card maxes out at 24GB.

A 24gb model is fast and ranks 3. A 70b model is slow and 8.

A top tier hosted model is fast and 100.

Past what specialized models can do, it's about a mixture/agentic approach and next level, nuclear power scale. Having a computer with lots of relatively fast RAM is not magic.

Thanks, but just to put things into perspective, this calculation has counted 8 channels which is 4 DIMMs and that's mostly desktops (not dismissing desktops, just highlighting that it's a different beast).

Most laptops will be 2 DIMMS (probably soldered).

Desktops are two channels of 64 bits, or with DDR5 now four (sub)channels of 32 bits; either way, mainstream desktop platforms have had a total bus width of 128 bits for decades. 8x64 bit channels is only available from server platforms. (Some high-end GPUs have used 512-bit bus widths, and Apple's Max level of processors, but those are with memory types where the individual channels are typically 16 bits.)

I think you are confusing channels and dimms.

The vast majority of any x86 laptop or desktops are 128 bits wide. Often 2x64 bit channels up till last year or so, now 4x32 bit DDR5 in the last year or so. There are some benefits to 4 channels over 2, but generally you are still limited by 128 bits unless you buy a Xeon, Epyc, or Threadripper (or Intel equiv) that are expensive, hot, and don't fit in SFFs or laptops.

So basically the PC world is crazy behind the 256, 512, and 1024 bit wide memory busses apple has offered since the M1 arrived.

> This is still half the speed of a consumer NVidia card, but the large amounts of memory is great, if you don't mind running things more slowly and with fewer libraries.

But it has more than 2x longer battery life and a better keyboard than a GPU card ;)

Is it GBps or Gbps?

GB per second

This is a case for on-package memory, not for unified memory... Laptops have had unified memory forever

EDIT: wtf what's so bad about this comment that it deserves being downvoted so much

Intel typically calls their iGPU architecture "shared memory"

Hm it seems like they call it unified memory too, at least in some places, have a look at 5.7.1 "Unified Memory Architecture" in this document: https://www.intel.com/content/dam/develop/external/us/en/doc...

    Intel processor graphics architecture has long pioneered
    sharing DRAM physical memory with the CPU.
    This unified memory architecture offers [...]

I think "Unified" vs "shared" is just something Apple marketing department came up with.

Calling something "shared" makes you think: "there's not enough of it, so it has to be shared".

Calling something "unified" makes you think: "they are good engineers, they managed to unify two previously separate things, for my benefit".

I don't think so? That PDF I linked is from 2015, way before Apple put focus on it through their M-series chips... And the Wikipedia article on "Glossary of computer graphics" has had an entry for unified memory since 2016: https://en.wikipedia.org/w/index.php?title=Glossary_of_compu...

For Apple to have come up with using the term "unified memory" to describe this kind of architecture, they would've needed to come up with it at least before 2016, meaning A9 chip or earlier. I have paid some attention to Apple's SoC launches through the years and can't recall them touting it as a feature in marketing materials before the M1. Do you have something which shows them using the term before 2016?

To be clear, it wouldn't surprise me if it has been used by others before Intel did in 2015 as well, but it's a starting point: if Apple hasn't used the term before then, we know for sure that they didn't come up with it, while if Apple did use it to describe A9 or earlier, we'll have to go digging for older documents to determine whether Apple came up with it

There are actual differences but they're mostly up to the drivers. "Shared" memory typically means it's the same DRAM but part of it is carved out and can only be used by the GPU. "Unified" means the GPU/CPU can freely allocate individual pages as needed.

We run our LLM workloads on a M2 Ultra because of this. 2x the VRAM; one-time cost at $5350 was the same as, at the time, 1 month of 80GB VRAM GPU in GCP. Works well for us.

Can you elaborate, are those workflows in queue or can they serve multiple users in parallel ?

I think it’s super interesting to know real life workflows and performance of different LLMs and hardware, in case you can direct me to other resources. Thanks !

Our use case is atypical, based on what others seem to require. While we serve multiple requests in parallel, our workloads are not 'chat'.

About 10-20% of my companies gpu usage is inference dev. Yes horribly not efficient usage of resources. We could upgrade the 100ish devs who do this dev work to M4 mbp and free up gpu resources

Smart move by Apple

If the 2x multiplier holds up, the Ultra update should bring it up to 1080GBps. Amazing.

There isn't even an M3 Ultra. Will there be an M4 Ultra?

At some point there should be an upgrade to the M2 Ultra. It might be an M4 Ultra, it might be this year or next year. It might even be after the M5 comes out. Or it could be skipped in favour of the M5 Ultra. If anyone here knows they are definitely under NDA.

M3 was built on an expensive process node, I don’t think it was ever meant to be around long.

That would make the most sense for the next Mac Studio version.

There were rumors that the next Mac Studio will top out at 512Gb RAM, too.

Good news for anyone who wants to run 405B LMs locally...

And the week isn't over...

They announced earlier in the week that there will only be three days of announcements

comparing a laptop to a A100 (312 teraFLOPS) or H100 (~1P FLOPS) server is a stretch to say the least.

An M2 is according to a reddit post around 27 tflops

So < 1/10 the performance of just computation. let alone the memory.

What workflow would use something like this?

They aren't going to be using fp32 for inferencing, so those FP numbers are meaningless.

Memory and memory bandwidth matters most for inferencing. 819.2 GB/s for M2 Ultra is less than half that of A100, but having 192GB of RAM instead of 80gb means they can run inference on models that would require THREE of those A100s and the only real cost is that it takes longer for the AI to respond.

3 A100 at $5300/mo each for the past 2 years is over $380,000. Considering it worked for them, I'd consider it a massive success.

From another perspective though, they could have bought 72 of those Ultra machines for that much money and had most devs on their own private instance.

The simple fact is that Nvidia GPUs are massively overpriced. Nvidia should worry a LOT that Apple's private AI cloud is going to eat their lunch.

> comparing a laptop

Small correction: the M2 Ultra isn't found in laptops, its in the Studio.

Right now, there are 0.90$ per hour H100 80gbs that you can rent.

You have another one with a network gateway to provide hot failover?

Right?

High availability story for AI workloads will be a problem for another decade. From what I can see the current pressing problem is to get stuff working quickly and iterate quickly.

I'm curious about getting one of these to run LLM models locally, but I don't understand the cost benefit very well. Even 128GB can't run, like, a state of the art Claude 3.5 or GPT 4o model right? Conversely, even 16GB can (I think?) run a smaller, quantized Llama model. What's the sweet spot for running a capable model locally (and likely future local-scale models)?

You'll be able to run 72B models w/ large context, lightly quantized with decent'ish performance, like 20-25 tok/sec. The best of the bunch are maybe 90% of a Claude 3.5.

If you need to do some work offline, or for some reason the place you work blocks access to cloud providers, it's not a bad way to go, really. Note that if you're on battery, heavy LLM use can kill your battery in an hour.

Lots of discussion and testing of that over on https://www.reddit.com/r/LocalLLaMA/, worth following if you're not already.

Claude 3.5 and GPT 4o are huge models. They don't run on consumer hardware.

Well it's more like pick your poison, cause all options have caveats:

- Apple: all the capacity and bandwidth, but no compute to utilize it

- AMD/Nvidia: all the compute and bandwidth, but no capacity to load anything

- DDR5: all the capacity, but no compute or bandwidth (cheap tho)

Why was this downvoted?

To quote an old meme, "They hated Jesus because he told them the truth."

For context, the 4090 has 1,008 GB/s of bandwidth.

... but only 1/4 of the actual memory, right ?

The M4-Max I just ordered comes with 128GB of RAM.

I have M3 Max with 128GB of ram, it's really liberating.

I have 32gb and I've never felt like I needed more.

Having 128GB is really nice if you want to regularly run different full OSes as VMs simultaneously (and if those OSes might in turn have memory-intensive workloads running on them).

Somewhat niche case, I know.

Obviously you're not a golfer.

https://www.youtube.com/watch?v=YzhKEHDR_rc :-) Thanks for that, I think I will watch The Big Lebowski tonight!

Far out, man

:P

No one needs more than 640kB.

At least in the recent past, a hindrance was that MacOS limited how much of that unified memory could be assigned as VRAM. Those who wanted to exceed the limits had to tinker with kernel settings.

I wonder if that has changed or is about to change as Apple pivots their devices to better serve AI workflows as well.

you'd probably save money just paying for a VPS. And you wouldn't cook your personal laptop as fast. Not that people nowadays keep their electronics for long enough for that to matter :/

This is definitely tempting me to upgrade my M1 macbook pro. I think I have 400GB/s of memory bandwidth. I am wondering what the specific number "over half a terabyte" means.

540

I am always wondering if one shouldn't be doing the resource intensive LLM stuff in the cloud. I don't know enough to know the advantages of doing it locally.

Curious, what are others using local LLMs on a MBP for? Hobby?

Need more memory, 256GB will be nice. MistralLarge is 123B. Can't even give a quantized Llama405B a drive. LLM users rejoice. LLM power users, weep.

The weird thing about these Apple product videos in the last few years is that there are all these beautiful shots of Apple's campus with nobody there other than the presenter. It's a beautiful stage for these videos, but it's eerie and disconcerting, particularly given Apple's RTO approach.

Incidentally, when I passed through the hellscape that is Cupertino/San Jose a few years, I was a little shocked that as a visitor you can't even see the campus; it's literally a walled garden. I guess when I was initially curious about the campus design during its build, I assumed that even a single part, maybe the orchard, would be accessible to the public. I guess based on the surrounding urban development though, the city isn't exactly interested in being livable.

I used to think the videos with all of the drone fly-bys was cool. But in the last year or so, I've started to feel the same as you. Where are all the people? It's starting to look like Apple spent a billion dollars building a technology ghost town.

Surely the entire staff can't be out rock climbing, surfing, eating at trendy Asian-inspired restaurants at twilight, and having catered children's birthday parties in immaculately manicured parks.

Oh I think they're very well done and very pretty! But lately this discomfort has started to creep in, as you note. Like something you'd see in a WALL-E spinoff: everyone has left the planet already but Buy n Large is still putting out these glorious promo videos using stock footage. Or, like, post-AI apocalypse, all the humans are confined to storage bins, but the proto-AI marketing programs are still churning out content.

The neighboring city charges $100k per newly constructed unit for park maintenance fees. So there actually are a lot of nice parks.

https://x.com/maxdubler/status/1778841932141408432

I think it’s usually filmed on weekends

You would just think that with a brand so intrinsically wrapped around the concept of technology working for and with the people that use it, you'd want to show the people who made it if you're going to show the apple campus at all.

It kind of just comes off as one of those YouTube liminal space horror videos when it's that empty.

The Apple brand is - foundationally - pretty solitary.

Think about the early ipod ads, just individuals dancing to music by themselves. https://www.youtube.com/watch?v=_dSgBsCVpqo

You can even go back to 1983 "Two kinds of people": a solitary man walks into an empty office, works by himself on the computer and then goes home for breakfast. https://youtu.be/4xmMYeFmc2Q

It's a strange conflict. So much of their other stuff is about togetherness mediated by technology (eg, facetime). And their Jobs-era presentations always ended with a note of appreciation for the folks who worked so hard to make the launch happen. But you're right that much of the brand imagery is solitary, right up to the whole "Here's to the crazy ones" vibe.

It's weirdly dystopian. I didn't realize it bothered me until moments before my comment, but now I can't get it out of my head.

"Here's to the crazy ones" is weirdly dystopian? :)

In a strange way, yes, with the premise that the world is otherwise the realm of uncreative, uninspired people. But the comment was addressed more at the odd lifelessness of the imagery.

If only in some shots, but they are such a valuable company that they simply cannot afford the risk of e.g. criticism for the choice of people they display, or inappropriate outfits or behaviour. One blip from a shareholder can cost them billions in value, which pisses off other shareholders. All of their published media, from videos like this to their conferences, are highly polished, rehearsed, and designed by committee. Microsoft and Google are the same, although at least with Google there's still room for some comedy in some of their departments: https://youtu.be/EHqPrHTN1dU

> You would just think that with a brand so intrinsically wrapped around the concept of technology working for and with the people that use it, you'd want to show the people who made it if you're going to show the apple campus at all.

I would think that a brand that is at least trying to put some emphasis on privacy in their products would also extend the same principle to their workforce. I don’t work for Apple, but I doubt that most of their employees would be thrilled about just being filmed at work for a public promo video.

There are legal issues with it too, or at least they think there are. They take down developer presentations after a few years partly so they won't have videos of random (ex-)employees up forever.

What legal issues could arise from a recording of an employee publicly representing the company?

Privacy and likeness rights, that kind of thing. And licenses expiring on stock photos or whatever's in the background.

> the concept of technology working for and with the people that use it

> liminal space horror

reminds me of that god awful crush commercial

I had not seen that one, so I looked it up.

This was reminder to me that art is subjective. I don’t get the outrage. I kinda like it.

they apologized for that one.

Easier to track continuity between takes if you don't have people in the background.

I interviewed there in 2017 and honestly even back then the interior of their campus was kind of creepy in some places. The conference rooms had this flat, bland beige that reminded me of exactly the kind of computers the G3 era was trying to get away from, but the size of a room, and you were inside it.

The Mac mini video from yesterday has employees: https://www.apple.com/105/media/us/mac-mini/2024/58e5921e-f4...

That by itself raises an interesting editorial question. Apple (like most big companies) doesn't do things randomly re: high impact public communications like this. I'm curious what made the Mac mini a product that merited showing people doing things, with a computer that is tied to one location, vs. a Macbook Pro's comparative emptiness, for a computer that can go anywhere and be with anyone. It could be as simple as fun vs focus.

I imagine the Mac mini is really small now if it could be powered via USB PD then I think it’s no problem to put it in a backpack with a kb and touchpad then bring it home then to the office. This is because I notice there are many people just bring their MBP to the office then plug it to a big screen. The downside is just you can’t work anywhere like with a MBP, but the usability is mostly the same (to me)

   > MacBook Pro with M4 Pro is up to 3x faster than M1 Pro (13)
   > (13) Testing conducted by Apple from August to October 2024 using preproduction 16-inch MacBook Pro systems with Apple M4 Pro, 14-core CPU, 20-core GPU, 48GB of RAM and 4TB SSD, and production 16-inch MacBook Pro systems with Apple M1 Pro, 10-core CPU, 16-core GPU, 32GB of RAM and 8TB SSD. Prerelease Redshift v2025.0.0 tested using a 29.2MB scene utilising hardware-accelerated ray tracing on systems with M4 Pro. Performance tests are conducted using specific computer systems and reflect the approximate performance of MacBook Pro.
 

Edit: If you click on the "go deeper on M4 chips", you'll get some comparisons that are less inflated, for example, code compilation on pro:

    14-inch MacBook Pro with M4  4.5x
    14-inch MacBook Pro with M3  3.8x
    13-inch MacBook Pro with M1  2.7x

No benchmarks yet, but this article gives some tables of comparative core counts, max RAM and RAM bandwidths: https://arstechnica.com/apple/2024/10/apples-m4-m4-pro-and-m...

I'm pleased that the Pro's base memory starts at 16 GB, but surprised they top out at 32 GB:

> ...the new MacBook Pro starts with 16GB of faster unified memory with support for up to 32GB, along with 120GB/s of memory bandwidth...

I haven't been an Apple user since 2012 when I graduated from college and retired my first computer, a mid-2007 Core2 Duo Macbook Pro, which I'd upgraded with a 2.5" SSD and 6GB of RAM with DDR2 SODIMMs. I switched to Dell Precision and Lenovo P-series workstations with user-upgradeable storage and memory... but I've got 64GB of RAM in the old 2019 Thinkpad P53 I'm using right now. A unified memory space is neat, but is it worth sacrificing that much space? I typically have a VM or two running, and in the host OS and VMs, today's software is hungry for RAM and it's typically cheap and upgradeable outside of the Apple ecosystem.

> I'm pleased that the Pro's base memory starts at 16 GB, but surprised they top out at 32 GB:

That's an architectural limitation of the base M4 chip, if you go up to the M4 Pro version you can get up to 48GB, and the M4 Max goes up to 128GB.

The "base level" Max is limited at 36GB. You have to get the bigger Max to get more.

The new mac mini also has an M4 Pro that goes up to 64GB.

The M4 tops off at 32 GB

The M4 Pro goes up to 48 GB

The M4 Max can have up to 128 GB

It seems you need the M4 Max with the 40-core GPU to go over 36GB.

The M4 Pro with 14‑core CPU & 20‑core GPU can do 48GB.

If you're looking for ~>36-48GB memory, here's the options:

$2,800 = 48GB, Apple M4 Pro chip with 14‑core CPU, 20‑core GPU

$3,200 = 36GB, Apple M4 Max chip with 14‑core CPU, 32‑core GPU

$3,600 = 48GB, Apple M4 Max chip with 16‑core CPU, 40‑core GPU

So the M4 Pro could get you a lot of memory, but less GPU cores. Not sure how much those GPU cores factor in to performance, I only really hear complaints about the memory limits... Something to consider if looking to buy in this range of memory.

Of course, a lot of people here probably consider it not a big deal to throw an extra 3 grand on hardware, but I'm a hobbyist in academia when it comes to AI, I don't big 6-figure salaries :-)