Just Say No to Kernel Extensions

I’m generally a fan of Google products. Recent developments in Google Drive have me worried. I’m hoping that Google can fix these issues. Specifically I have talking about the musical chairs game that Google is playing with their cloud storage app. Google Drive is now called Backup and Sync from Google Drive and Google Drive Stream is now Google Drive for Desktop. Confused? The Backup and Sync app works the way it always has, as a folder in your home directory. A background daemon keeps the files up to day with those in the cloud. This is the same way that competitors DropBox and OneDrive work. Drive Stream is different. It appears to be based on the old FUSE project though I am not certain. Your Stream volume is mounted like network resource. This allows for more real-time file locking and atomic updates. I applaud the intent but it comes at a cost: a kernel extension.

Whenever you try to get the operating system to do something that it never intended to do, you have to extending the core OS with something called a Kernel Extension (kext). Historically kexts were preferable to having to recompile the operating system with the additional functionality. They are risky because code in a kext has direct access to the lowest levels of the system. Malicious code can hide here from the system in some cases. Often software comes with a kext to bypass the system to do things like virus scanning. In some really bad cases like Cisco WebEx, a kext was used just for a video conferencing app. Good luck getting that removed after the meeting. No thanks, I don’t need to see your slides that badly.

Now with macOS 11, the operating system is making it a little harder for users to allow kexts accidentally. If you are in a managed environment, you may not be able to allow them at all. Kudos to Apple for essentially putting a stop to this bad behavior. If an app needs kext just to run, think twice to make sure it is something you really need. Be prepared to re-enabled it with each system update. The procedure to enable kext requires powering on your mac and using the Startup Security Utility.

Personally, I will stay with the Backup and Sync app until such time as Drive Stream can be used without kexts.