Security for OCLP (OpenCore Legacy Patcher)

[JustAnExpat]

I have worked hard to make sure that my posts are not opinions and are backed by facts. You have provided the quote "For many machines, you're just as secure as a supported Mac." It is only logical to ask that you (or someone) provide this list of OCLP-patched Mac models that are just as secure as supported Macs.

Is this the main problem you're having, is the verbiage that OCLP is using on their website?

Apple's machines have to be used by a wide range of people. From common people, like you and I, to presidents of companies, to people in government, to people who live in military dictatorships and are politically active against the existing government. Because of this, Apple needs to fix and remove any potential exploits that can be used against these people.

OCLP, on the other hand, is used by common people to extend the life of their computers. It's true, it's less secure, but you and I and OCLP's users won't need that degree of security. If we are important people, then we would always use the latest version of MacOS - unless we want to use OCLP on our "fun" machine.

I believe OCLP is secure enough for most people. For anything production related, or where the person is a target by an attacker, it is not.

 

[deeveedee]

Apple's machines have to be used by a wide range of people. From common people, like you and I, to presidents of companies, to people in government, to people who live in military dictatorships and are politically active against the existing government. Because of this, Apple needs to fix and remove any potential exploits that can be used against these people.

Have we met? Do you know me? Read this and please stop making assumptions and judgments about who is important and who is not. We're all important and our data, identity and private credentials are just as important as any other. And that is not subject to the judgment of you or of anyone else.

Is this the main problem you're having, is the verbiage that OCLP is using on their website?

One of them. You read this?

OCLP, on the other hand, is used by common people to extend the life of their computers. It's true, it's less secure, but you and I and OCLP's users won't need that degree of security. If we are important people, then we would always use the latest version of MacOS - unless we want to use OCLP on our "fun" machine.

I believe OCLP is secure enough for most people. For anything production related, or where the person is a target by an attacker, it is not.

There is nothing in the OCLP documentation or messaging that states the intended audience as "common people" (whatever that means). There are statements like "Built with security in mind," "Experience macOS just like before" and now, with your quote "For many machines, you're just as secure as a supported Mac."

I think we're in violent agreement, but maybe not for the same reasons, in that we both agree that OCLP messaging should clearly state the lack of security relative to a fully-supported Mac. Let's allow the end user to make an informed decision with factual statements that don't assume the end user's importance (or lack thereof).

 

[JustAnExpat]

I think we're in violent agreement, but maybe not for the same reasons, in that we both agree that OCLP messaging should clearly state the lack of security relative to a fully-supported Mac. Let's allow the end user to make an informed decision with factual statements that don't assume the end user's importance (or lack thereof).

I have read a lot of posts on Macrumors. This post, and this complaint, by far, is the most strangest complaint I have ever read. I do not tolerate sarcasm, snark, or other type of "humorous conversations". I 100% DO NOT, under any circumstances, tolerate any type of violence.

I wish you the best of luck getting whatever this problem resolved.

 

[deeveedee]

I have read a lot of posts on Macrumors. This post, and this complaint, by far, is the most strangest complaint I have ever read. I do not tolerate sarcasm, snark, or other type of "humorous conversations". I 100% DO NOT, under any circumstances, tolerate any type of violence.

I wish you the best of luck getting whatever this problem resolved.

Thank you for your kind wishes. I'm going to give you the benefit of the doubt and assume that our communication is complicated by a language barrier. When you have some free time in your busy schedule, look-up the meaning of "violent agreement."

 

[plunger]

Thank you for your kind wishes. I'm going to give you the benefit of the doubt and assume that our communication is complicated by a language barrier. When you have some free time in your busy schedule, look-up the meaning of "violent agreement."

I think the VIOLENT reference was a joke!

 

[deeveedee]

I think the VIOLENT reference was a joke!

Not a joke. The term "violent agreement" has a very real (and non-violent) meaning in the English language. Look it up.

EDIT: If you are suggesting that JustAnExpat was making a joke and intentionally confusing the term "violent agreement" with actual violence, I missed it. I was hoping that the misunderstanding of this common English term would explain the rest of our conversation.

 

[plunger]

I did...

Violent Agreement -- "Parties who argue strongly against each other when they actually view the issue in the same way are said to be in violent agreement. "

Go and have a scotch and cool off!!

 

[deeveedee]

One of the primary intents of this thread continues to be to request changes to OCLP documentation and the addition of OCLP warnings (see requests here), so that unsuspecting users do not assume that while OCLP may initially have been "Built with security in mind," it is NOT "Just as secure as a supported Mac" (statements currently found in OCLP documentation at the time of this post). This thread is NOT advising anyone to avoid OCLP. This thread is NOT criticizing the Devs or anyone for OCLP security shortcomings that cannot be avoided due to the nature of patches required to run macOS on unsupported Macs. This thread IS simply requesting OCLP Developer transparency so that OCLP users are aware of the security limitations and vulnerabilities of unsupported, OCLP-patched Macs relative to fully-supported Macs.

We have these statements by dhinakg (here), which could be the basis for new statements in the OCLP documentation:

"Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."

"the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

 

[LanceMahe]

My concerns with my OCLP-patched Mac started here , here, here and here after I started analyzing the nature of the root-patching to fix Broadcom Wi-Fi in Sonoma. Like most everyone else, prior to my Wi-Fi patching concerns, I was a huge OCLP/Dev cheerleader, advocate and supporter (including a donation). My concerns were not because I assumed that the Devs had malicious intent, but because software mistakes can be made and are likely. Without 3rd-party computer security verification and testing, there is no way to be assured of OCLP's (or any software's) data security. No way - I don't care what anyone says or how much you like the developer who created the solution for you.

Most of the biggest computer security exploits (ransomware, stolen identities, hacked e-mails...) are not because of intentional software hacks but because of software bugs that leave exploitable vulnerabilities. And if you watch the news, I don't have to tell you that there are plenty of malicious hackers who are eagerly looking to exploit those unintended vulnerabilities in your home PC or Mac. Even Apple has security-related bugs in their macOS releases, which is why they implemented RSRs (Rapid Security Responses) to provide quick security patches for macOS. If a company like Apple can make mistakes, then so can any software developer or development team. And depending on which Mac you own, if it's patched with OCLP, you can't receive Apple's RSRs - another security issue with OCLP.

At significant risk to relationships with Devs and MacRumors peers, I decided to voice my concerns. I appreciate the professional and courteous responses from Ball of Neon (an OCLP Dev) here , here , here , here , here and here.

Until the OCLP GUI supports selectively enabling/disabling Wi-Fi post install patches, I have posted one method that can be used to manually disable the Wi-Fi patches here. *

NOTE: If you decide to allow OCLP to inject Wi-Fi post install patches, understand that you are accepting the following risks:

• Your Mac is rooted and you are allowing uncertified 3rd-party software (OCLP's patches) to be installed at the most sensitive layers of your macOS. If there are any software bugs in the root-patch, these bugs could expose your data, your private credentials and your digital identity to hackers.
• The OCLP post-install patches for Wi-Fi are derived/extracted from an older version of macOS where Broadcom Wi-Fi framework was still supported by Apple. This means that the older Wi-Fi framework being used to patch your modern macOS is "frozen in time" and is not receiving any Apple updates. There will be no attempt by Apple to maintain the security of the Wi-Fi framework, because it is no longer supported by Apple. If hackers discover a security vulnerability in the Wi-Fi Framework, Apple will not be fixing it.
• If a vulnerability is discovered by OCLP Devs and they are able to patch it, it is unreasonable to expect the Devs to communicate the vulnerability and then to patch it in a timely manner (even though they are software gods). They are unpaid volunteers doing this on their own time and at their own expense (despite donations). During the response time (time for Devs to learn about the bug and then the time for it to be fixed and then the time for you to apply the OCLP update), your OCLP-patched Mac may be vulnerable to exploits, allowing a hacker enough time to learn about and exploit the vulnerability. And I want Devs to be able to take vacations as much as anyone (they deserve it!), but not when I'm waiting for a security patch to OCLP.
  BTW: I get that one could argue that, since the Wi-Fi framework is extracted from Ventura, it is still getting updates from Apple. Ok - we still have to wait for OCLP Devs to extract the framework from Ventura and release an OCLP update with the new framework. And that only lasts as long as Apple is still supporting Ventura.

*Credit: I can't take credit for the modern wireless patch. I discovered the legacy_wifi patch on my own, but credit to acquarius13 at InsanelyMac for identifying the correct sonoma-development source and finding the modern_wifi code.

I read your long description with your concerns regarding possible software mistakes and safety. Rest assured that OCLP 1.2.1 is working perfectly and safely. I have updated my old MBP 10.1 mid 2012 with 2 graphic cards to Big Sur 11.7.10 with the help of OCLP 1.2.1 and it works fine. Arguable faster than Mojave. SIP is enabled, dynamic card switching works fine, in short it is a great machine. However now I wanted to upgrade to Sonoma and that seems to be impossible bc of the compatibility of the graphic cards Intel HD Graphics 4000 and NVIDIA GeForce GT 650M. The resolution is far too high, text is even unreadable and the resolution is not adjustable. Even the OCLP root patch did not resolve the issue. This implies that my machine is at the end of the upgrade and will not work with a higher macOS version. Pity but it is what it is.

 

[LanceMahe]

One of the primary intents of this thread continues to be to request changes to OCLP documentation and the addition of OCLP warnings (see requests here), so that unsuspecting users do not assume that while OCLP may initially have been "Built with security in mind," it is NOT "Just as secure as a supported Mac" (statements currently found in OCLP documentation at the time of this post). This thread is NOT advising anyone to avoid OCLP. This thread is NOT criticizing the Devs or anyone for OCLP security shortcomings that cannot be avoided due to the nature of patches required to run macOS on unsupported Macs. This thread IS simply requesting OCLP Developer transparency so that OCLP users are aware of the security limitations and vulnerabilities of unsupported, OCLP-patched Macs relative to fully-supported Macs.

We have these statements by dhinakg (here), which could be the basis for new statements in the OCLP documentation:

"Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."

"the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

Hi Deeveedee,
I can assure that OCLP has been built with security in mind. It is professional tool and works great. Many things have been improved since the first version rolleed out. These developers have done a tremendous job! Furthermore the documentation is very good and precise and on top of that there is a great help-function. Therefore I suggest that you have a second look at it all and change your opinion.

 

[deeveedee]

@LanceMahe Thank you for your opinions. What makes you think I am not regularly testing OCLP? And yes, I have donated to OCLP Devs. OCLP is well designed and the Devs have done an excellent job. That doesn't change the developer statements made in this thread (made by dhinakg, one of the primary developers):

• "Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."
• "the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

Which is why I'm requesting warnings and documentation changes.

 

[bogdanw]

Which is why I'm requesting warnings and documentation changes.

There are currently 943 forks of OCLP. Fork your own version, you could call it HOCLP (Honest OCLP), write whatever you want, then make a pull request.
Forks · dortania/OpenCore-Legacy-Patcher · GitHub
https://github.com/dortania/OpenCor...=active&page=1&period=5y&sort_by=last_updated
Creating a pull request from a fork https://docs.github.com/en/pull-req...-requests/creating-a-pull-request-from-a-fork

This is the proper way to request changes to such a project.

 

[deeveedee]

This is the proper way to request changes to such a project.

Thank you again for your opinions. Developers are monitoring this thread as evidenced by their contributions. But I do appreciate your advice for the proper way to do things.

This thread is intentionally self-documenting. Until OCLP docs are modified and warnings are implemented, users can review this thread. The use of this thread as an improper way (your opinion) is very intentional.

Because of developer statements made in this thread (made by dhinakg, one of the primary developers):

• "Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."
• "the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

I'm requesting warnings and documentation changes. It really is that simple. Nothing more.

EDIT: I just looked at the Mac Apps forum of which this thread is a member and see that this thread now has 14K views at the time of this writing. I appreciate the occasional contributions which help to keep this thread near the top of the Mac Apps thread listing. Thank you to all who contribute and help to keep this thread active.

 

[deeveedee]

As mentioned earlier in this thread, a separate thread has been created for non-OCLP Sonoma Wi-Fi / Bluetooth replacement solutions. This other thread offers suggestions for those who do not want to inject 802.11 framework root patches via OCLP. The Open Wireless project mentioned by @perez987 in this thread looks very promising. Open Wireless enables Intel Wi-Fi and Bluetooth in macOS. The alternatives offered in this thread may require some compromises, since they don't provide all of the Broadcom Wi-Fi functionality of a fully-supported Mac, but they may be sufficient for and appealing to those who don't want to use the OCLP Wi-Fi framework root patches. You may recognize zxystd, who developed itlwm, as zxystd provided necessary changes to the BluetoolFixup.kext that OCLP uses for fix Broadcom Bluetooth on unsupported Macs.

I am only mentioning this other thread to keep this thread's visitors informed. Please try to keep comments about Brcm Wi-Fi/BT alteratives in the other thread. Thank you.

 

[bogdanw]

Developers are monitoring this thread as evidenced by their contributions.

You probably missed the spoiler

Spoiler: Note about (OCLP) developers, MacRumors, and official statements

The lead developers of OCLP are Mykola (khronokernel) and I. We do not monitor MacRumors; I only look (at a sum total of 5 threads) when I am bored or if I am told to look (which I was for this thread), I post even more rarely, and I don't think Mykola looks at MR at all anymore. So MR is not the best way to get ahold of us.

This generally isn't an issue, but I do want to clarify that Mykola and I are also the only ones who can officially speak for OCLP. Anything official needs to be endorsed by one of us. The viewpoints of contributors are not official viewpoints, and they do not speak for the project.

 

[deeveedee]

You probably missed the spoiler

No, I did not miss it. If it makes you feel better about your position, how about if I admit that my way of commenting here in this thread is wrong, you are right and the Devs like dhinakg who have contributed to this thread found this thread purely by accident since they couldn't possibly be monitoring it. Thank you for your concern, for continuing to police this topic and for continuing to bump this thread to the top of the forum list.

Because of developer statements made in this thread (made by dhinakg, one of the primary developers):

• "Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."
• "the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

I'm requesting warnings and documentation changes. It really is that simple. Nothing more.

 

[bogdanw]

No, I did not miss it. If it makes you feel better about your position, how about if I admit that my way of commenting here in this thread is wrong, you are right and the Devs like dhinakg who have contributed to this thread found this thread purely by accident since they couldn't possibly be monitoring it. Thank you for your concern, for continuing to police this topic and for continuing to bump this thread to the top of the forum list.

Because of developer statements made in this thread (made by dhinakg, one of the primary developers):

• "Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."
• "the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

I'm requesting warnings and documentation changes. It really is that simple. Nothing more.

It’s not my place to “police”, I just pointed out the proper way to solicit changes to OCLP and what the alleged developer said.
The forum has moderators and rules:
“Things Not to Do
Overposting. Making the same post many times, making multiple pointless posts in the same thread, making numerous posts with no real content, or posting for the purpose of gaining a higher post count.”
https://macrumors.zendesk.com/hc/en-us/articles/201265337-Forum-Rules

 

[deeveedee]

It’s not my place to “police”, I just pointed out the proper way to solicit changes to OCLP and what the alleged developer said.
The forum has moderators and rules:
“Things Not to Do
Overposting. Making the same post many times, making multiple pointless posts in the same thread, making numerous posts with no real content, or posting for the purpose of gaining a higher post count.”
https://macrumors.zendesk.com/hc/en-us/articles/201265337-Forum-Rules

Agreed. Imagine if someone were to violate posting rules by repeatedly telling someone else that their thread was wrong. Thanks for making me aware of the rules and pointing out my violation of said rules without actually "policing."

As long as you continue to derail this thread with your posts, I'll redirect to the original intent:

Because of developer statements made in this thread (made by dhinakg, one of the primary developers):

• "Because of everything mentioned above (security is already compromised to begin with), updating kexts/frameworks has not been a priority for us."
• "the likelihood that we can bring things up to the level of security that unpatched Macs have is slim"

I'm requesting warnings and documentation changes. It really is that simple. Nothing more.

 

[erikkfi]

As a longtime OCLP user myself, I know that I'm assuming all kinds of risks. I expect not everything will work. I expect I'm making the device less secure (although I'm not sure how to weigh that against staying one, two, three, five macOS releases behind). I expect that the whole thing may just stop working at some point.

I take the point that the project could be a bit clearer that all sorts of security elements have to be switched off or worked around in order to get this working on various machines, but fundamentally I feel that if security is your primary concern, you should stay on the golden path of Apple's approved software releases and nothing else.

I read the thread and I admire the verbose documentation of, and elaboration on, the security issues and risks with using OCLP, but it all feels a bit unnecessary to me. It looks like whatever OCLP devs may have been active in this thread have decamped, and I can't really say I blame them. If I were an OCLP dev, I'd see this as a lot of kicking at a very valuable project for not being "secure enough" when the entire process of installing OCLP kind of a monument to the fact that you're going around Apple's restrictions. "Here, take this macOS installer, but first let's modify it." I fundamentally agree with @JustAnExpat that OCLP is for workaday schlubs who loathe the idea of tossing out "old" hardware more than they loathe the idea of assuming some extra security risks.

I hope this all amounts to some useful changes to end-user docs when needed, and possibly changing references to OCLP being "just as secure" -- these are useful suggestions -- but my main message is to concur with @deeveedee in their overall praise for the project early on in this thread. It's a wonderful project that has probably saved tons of unnecessary eWaste from ending up in landfills.

 

[deeveedee]

@erikkfi I wholeheartedly agree that OCLP is a valuable project that is extending the life of old, unsupported Macs (and keeping them out of the landfill). I'm a long-time OCLP user, supporter and donator. The challenge I have with OCLP messaging/documentation is that it misleads by stating that your OCLP-patched Mac is just as secure as a Mac that is still fully supported by Apple (the documentation actually says "For many machines, you're just as secure as a supported Mac." when there are no OCLP-patched, unsupported machines that are as secure as a real Mac).

Based on the Developer comments in this thread, it seems that OCLP started as a small hobby (the donation page specifically stated that OCLP is a hobby project until the "hobby" wording was removed in a commit) and the Devs indicated that they did not anticipate the extent of the adoption or the magnitude of the project.

I understand why Devs would not want to highlight the security limitations of an OCLP-patched Mac (it would curtail adoption and donations), but the Devs have a responsibility to be honest in the documentation in the same way that dhinakg was honest in this thread: an OCLP-patched Mac can never be as secure as a fully supported Mac.

At the very least, OCLP should provide a security alert in documentation and during application of post-install patches and "building and installing Open Core" similar to the following:

By using OCLP, you understand that your unsupported Mac will not receive Apple Rapid Security Responses, your APFS seal is broken to permit installation of uncertified root patches and SIP has been partially disabled. These security downgrades may expose you to computer security vulnerabilities that may not be present when using a Mac that is still fully supported by Apple.

 

[MacNB2]

I read your long description with your concerns regarding possible software mistakes and safety. Rest assured that OCLP 1.2.1 is working perfectly and safely. I have updated my old MBP 10.1 mid 2012 with 2 graphic cards to Big Sur 11.7.10 with the help of OCLP 1.2.1 and it works fine. Arguable faster than Mojave. SIP is enabled, dynamic card switching works fine, in short it is a great machine. However now I wanted to upgrade to Sonoma and that seems to be impossible bc of the compatibility of the graphic cards Intel HD Graphics 4000 and NVIDIA GeForce GT 650M. The resolution is far too high, text is even unreadable and the resolution is not adjustable. Even the OCLP root patch did not resolve the issue. This implies that my machine is at the end of the upgrade and will not work with a higher macOS version. Pity but it is what it is.

I have the MPB10,1 running Sonoma 14.1.1 via OCLP 1.2.1 and have no issues with the graphics.
Retina works very well. Though I would not recommend running the fancy Sonoma video playback screen savers as the the temperature hits 90 Deg C !
Initial boot up also runs the CPU hard for a few minutes and temps hitting 90+.
I will be downgrading to Ventura.

Big Sur runs very well (much better than Sonoma) and does not require OCLP.

 

[LanceMahe]

Have we met? Do you know me? Read this and please stop making assumptions and judgments about who is important and who is not. We're all important and our data, identity and private credentials are just as important as any other. And that is not subject to the judgment of you or of anyone else.


One of them. You read this?


There is nothing in the OCLP documentation or messaging that states the intended audience as "common people" (whatever that means). There are statements like "Built with security in mind," "Experience macOS just like before" and now, with your quote "For many machines, you're just as secure as a supported Mac."

I think we're in violent agreement, but maybe not for the same reasons, in that we both agree that OCLP messaging should clearly state the lack of security relative to a fully-supported Mac. Let's allow the end user to make an informed decision with factual statements that don't assume the end user's importance (or lack thereof).

Well, to my humble opinion you should stop arguing about OCLP. I am using it on 2 Macs and it is great. All security in place, firmware updated. In short, there is no support from Apple but it works really like an official version. There was one hiccup however, I have a MBP mid 2012 and it runs 11.7.10 arguable as good as before the upgrading. But it seems too difficult to upgrade to Sonoma. Because of the 2 graphic cards. They are not supported by Sonoma. I tried but the resolution is too high which makes the text unreadable small. That besides, OCLP is a great help in upgrading the new version is gui and upgrading is a breeze.

 

[deeveedee]

@LanceMahe I am posting this on my Mac patched with OCLP 1.3.0. I'm still an OCLP supporter, OCLP user and OCLP donator. If responding to your posts is arguing ... Since I don't want to repeat myself, please read this.

 

[deeveedee]

Thank you, OCLP Devs. The security claims in OCLP documentation are being changed. This is a good start. Happy New Year!

 

[cyberdevs]

Hey guys,
Just wanted to give you a heads up on a malicious website that was impersonating the OpenCore Patcher's.

Thankfully the issue with the site is resolved now but it is an example of how people might get the wrong version of the OCLP which might have been tampered with form a malicious site.


For more information read this:

Malicious Site Representing OpenCore Legacy Patcher · Issue #1120 · dortania/OpenCore-Legacy-Patcher

It has come to our attention that a malicious site is attempting to impersonate OpenCore Legacy Patcher, and potentially harm users. As this site is becoming more aggressive in their attempts to sp...

github.com