ProfileCreator
Web-Environment-Integrity
ProfileCreator | Web-Environment-Integrity | |
---|---|---|
30 | 54 | |
1,251 | 536 | |
0.9% | - | |
0.0 | 10.0 | |
13 days ago | 6 months ago | |
Swift | ||
MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ProfileCreator
-
The Right to Lie and Google’s “Web Environment Integrity”
> How many users have devices that they are really administrators of? Fewer and fewer.
As long as nobody has forced you to join your computer to a domain and accept the installation of group-policy overrides, you're still fundamentally an administrator of that machine.
You might not ever feel the need to administrate it, because the OS vendor is often co-administering the machine (see: Windows or macOS when you use a local account rooted in their cloud SSO) but the OS vendor hasn't restricted you from doing your own administration in the way that a corporation or institution administering the domain your device belongs to would restrict you. You still have the ambient authority to administer your machine, whether you ever bother to elevate yourself or not.
You can still install your own X.509 roots of trust. Even on, say, iOS! (You must administer the iOS device using tools — e.g. https://github.com/ProfileCreator/ProfileCreator — that run outside of the device on a "real computer"; but that's just a fact of history, to do with how system administrators generally prefer to interact with computers, not a property of the target device's security. A config profile is just a file format; if someone ever wanted to make a profile editor that ran on iOS itself, they could.)
(And if we're talking about a machine that is corporate or institutionally controlled? Well, then it's the responsibility of the people who manage your device — your IT department — to decide whether a given cert should be given trust.)
> What is the technical challenge of setting up your own HTTP server that can be browsed with an off the shelf browser on your local computer?
The approach where you run a proxy that wraps untrusted connections into trusted ones is fully general, but yes, only really applicable to the most advanced users. But then, only the most advanced users really need the full power of this approach. Only someone with a lot of experience in network security should consider themselves capable of vouchsafing a non-TLS HTTP connection as worth being trusted. You have to basically come up with an "attestation heuristic" for the remote yourself — that it stays on the same IP, that its DNS records haven't changed owner, that the server is still sending the same Server response header, etc.
If your needs are slightly weaker — if you can assume that every remote is at least using self-signed TLS certs rather than not using TLS at all — then the problem is vastly simplified: you can directly trust any cert by putting it that cert directly into your X.509 trust store (in effect making it a root-of-trust — though it doesn't have the X.509 property that enables other certs signed by the cert to be trusted transitively, so it's a leaf-node root-of-trust. A "stump of trust", if you will.) You don't need to run any local servers to do this.
-
Users using their own Icloud.
I don't have much experience with Jamf specifically so I don't know if they have a tool for this, but you can you software like iMazingand ProfileCreator to create the profiles from a GUI and then push the profiles from to devices using Jamf. Using either of these apps, under "Restrictions", you'll be able to deselect whatever iCloud service you want to be blocked and then save it to a profile.
-
Custom JSON Configuration Profiles
In Mosyle in the management profiles section you have an option called Certificates/Custom Profiles, there you can upload a .mobileconfig created with for example Profile creator: https://github.com/ProfileCreator/ProfileCreator which nicely includes the Nudge schema and other common used apps :-), this should be the same effect than in the JAMF video, its almost the same thing instead of cut an paste from the AJMF article, upload de .mobileconfig created by the App.
- How can I have a user account which absolutely CANNOT access the internet?
- Need assistance building .mobileconfig files for 3rd Party apps?
-
Is there a bash command for a device to give permissions for remote session control apps like Zoom/LogMeIn?
There are many examples and several ways to generate a profile that will grant the appropriate perms, personally I have used ProfileCreator: https://github.com/ProfileCreator/ProfileCreator
- How do I edit plists using Xcode?
- How do I allow non admins to Screen-share from payload/profile in macOS via MDM (workspace one in my case)?
-
Custom MacOS configuration profiles
On a side note, you might try this for manually creating profiles. https://github.com/ProfileCreator/ProfileCreator
-
iOS supervised device settings possibility question
If you have a Mac available ProfileCreator works well as an alternative to Apple Configurator, and it has a few more options.
Web-Environment-Integrity
-
Google apparently backs off on WEI
Repo has be archived - "NOTE: This proposal is no longer pursued."
https://github.com/RupertBenWiser/Web-Environment-Integrity
-
The boiling frog of digital freedom
[2] - https://github.com/RupertBenWiser/Web-Environment-Integrity/...
-
It's time we do a uno reverse to Web Integrity API
I think the best issue raised is: Why would I, as a user, want this?
https://github.com/RupertBenWiser/Web-Environment-Integrity/...
- Issues / Web-Environment-Integrity
-
EFF denounces Google's WEI proposal
There were proposals for protecting against this in the WEI explainer under "Open Questions" https://github.com/RupertBenWiser/Web-Environment-Integrity/...
-
Web Environment Integrity: Google strikes again
The Web Environment Integrity is yet another Google proposal for making the web worse for everyone but them.
-
Google’s Plan to DRM the Web Goes Against Everything Google Once Stood For
Point me to anything which would give websites access to that information via WEI. There is nothing. I have seen nothing except FUD. Aside from that, this only attests for the device. Ad-blockers can be external. This does nothing for external ad-blockers.
Explicit non-goals for WEI:
"Enforce or interfere with browser functionality, including plugins and extensions."
https://github.com/RupertBenWiser/Web-Environment-Integrity/...
-
With merge of this pull request, Brave Browser disables WebEnvironmentIntegrity
That also applies to Javascript, or being forced to use some form of an up-to-date browser. What is different with WEI?
I didn't see many people debating the actual text of the WEI explainer[0] on the HN posts about WEI, and that's probably because they were links to articles about WEI. The HN post for the explainer with the most upvotes only has 89[1], likely because most of HN treats the upvote as "I agree/like this" instead of "boost this topic for discussion".
0: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
1: https://news.ycombinator.com/item?id=36785516
-
Adtech is built on a privacy fault line
> If you don't want my browser to render content as it sees fit, don't serve the content over a protocol where that dynamic is inherent.
to play the devil's advocate, this is why google proposed the WEI (https://github.com/RupertBenWiser/Web-Environment-Integrity/...). Be careful what you wish for...
-
The Right to Lie and Google’s “Web Environment Integrity”
https://github.com/RupertBenWiser/Web-Environment-Integrity/...
I stopped reading after the explainer’s intro section. The first example is making it easier for websites to sell adds (lmao) and the other 3 are extremely questionable whether if the proposed remedy even helps. And it’s presented as a benevolent alternative to browser fingerprinting, as if we must choose between these two awful choices. It’s an absolute joke of a proposal.
What are some alternatives?
PPPC-Utility - Privacy Preferences Policy Control (PPPC) Utility
use-cases - Uses Cases for the Anti-Fraud CG
Installomator - Installation script to deploy standard software on Macs
dillo-plus - A lightweight web browser based on Dillo but with many improvements, such as: support for http, https, gemini, gopher, epub, reader mode and more...
openhaystack - Build your own 'AirTags' 🏷 today! Framework for tracking personal Bluetooth devices via Apple's massive Find My network.
SupplyChainAttacks
ProfileManifestsMirror - Jamf JSON schema manifests automatically generated from ProfileCreator manifests (https://github.com/ProfileCreator/ProfileManifests)
BrowserBoxPro - :cyclone: BrowserBox is Web application virtualization via zero trust remote browser isolation and secure document gateway technology. Embed secure unrestricted webviews on any device in a regular webpage. Multiplayer embeddable browsers, open source! [Moved to: https://github.com/BrowserBox/BrowserBox]
mcxToProfile - Convert macOS property lists, defaults and MCX into Configuration Profiles with Custom Settings payloads
bikeshed - :bike: A preprocessor for anyone writing specifications that converts source files into actual specs.
outset - Automatically process packages, profiles, and scripts during boot, login, or on demand.
encrypted-media - Encrypted Media Extensions