4 ms·

This guide has some useful tips (enable filevault2, disable mdns advertise), but recommends wholly disabling most of the usable functions of applications like c

This guide has some useful tips (enable filevault2, disable mdns advertise), but recommends wholly disabling most of the usable functions of applications like calendar, finder, spotlight, etc in the name of "security", which is futile considering every single security update for OSX addresses tons of userland and kernel remote-code execution or local r00t privilege escalations[1][2][3], as well as the well publicized thunderstrike[4] family of vulnerabilities which allow for osx hw/sw compromise. Every major/minor system update (IE 10.10.x, 10.11) will require these tweaks be reapplied as well. Lets not call using ruby to run curl to install homebrew secure either. Just because homebrew doesn't need sudo doesn't mean it's inherently secure, and the dependency tree of some of the software the guide recommends you install come with their own set of security issues which need to be manually maintained outside of OSX update procedures. I'm typing this from an OSX machine with a few of these tweaks applied already, and I love using it for my desktop OS -- but if you really need to be this paranoid about security, you shouldn't be using OSX. There are several security-or-paranoia oriented linux distros you can run. [1] - https://support.apple.com/en-us/HT205031 https://support.apple.com/en-us/HT205031 [2] - https://support.apple.com/en-us/HT204942 https://support.apple.com/en-us/HT204942 [3] - https://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659 [4] - https://trmm.net/Thunderstrike https://trmm.net/Thunderstrike & https://trmm.net/Thunderstrike_2 https://trmm.net/Thunderstrike_2

armitron 11y ago
100% agree. OSX is not an OS one should be running if one cares about security (but then neither is unhardened Linux). Guides such as these are meaningless at best and can give people the illusion of security or worse, you can't build a fortress on top of shifting foundations.
grrowl 11y ago
It's definitely a comprehensive guide, and disabling "phone home" services is the heaviest-hitting bit — but it's not a single large script for a reason, and as the guide mentions you should at least scan the list before blindly disabling agents named "CoreLocationAgent" and "notificationcenterui" and "TMCacheDelete".
- newman314 11y ago
  Which "phone home" services would you suggest as being safe to disable in general?
  - grrowl 11y ago
    If you'd prefer being harder to track over having Time Machine, push notifications, and several sync services work, then you can disable most of them; if you'd prefer services to work and usability of your applications, none of them. If you're not sure of the nuances (or the pros/cons of using a "secure" Mac OSX install vs a secure Linux distro), you should research each of the services you're disabling to at least appreciate the attack surface each surface adds to your machine.
simonebrunozzi 11y ago
What's the best guide you know for SE Linux as a desktop?
- noja 11y ago
  You don't need a guide, it just works. If you're installing stuff from rpm (and not from a weird backalley repo) then it all just works.
  - kochthesecond 11y ago
    Hah. I'm a linux user and even I dont believe it's that simple.
    - JupiterMoon 11y ago
      For GNU/Linux I find that if you stick with the commonly used packages things in your distributions repositories (on supported hardware) things do just work and it is that simple. However, (and it is a big however!) the moment you go try something slightly different good luck to you...
  - simoncion 11y ago
    > You don't need a guide, it just works. It "just works" if the package you're installing has a corresponding SELinux profile. If it doesn't, you're in for a world of "fun" trying to come up with a correct profile. (I've played with both SELinux and Grsecurity MAC systems in the past. I know that it's not impossible to create these profiles. I also know that it's not infrequently an enormous pain in the ass, and a thing that even experts sometimes get wrong.)
    - noja 11y ago
      If something doesn't have a profile then it runs unconfined. That's simplified, but really does work out of the box unless you do something weird (then you flip a boolean) or very weird (then you create a custom module). But for a normal desktop user, it does just work.
eatmyshorts 11y ago
I think you may have missed part of the title. The author isn't aiming only for security, but also privacy. Disabling calendar & spotlight seem to be aimed at privacy, not security. I'm not sure I follow you when you claim the author has disabled "applications like...finder"--I didn't get that from the article. It sounds like the author really doesn't like apps that phone home to Apple, though. It might have been nice for the author to state explicitly which steps are aimed at security and which for privacy.

armitron 11y ago

100% agree. OSX is not an OS one should be running if one cares about security (but then neither is unhardened Linux). Guides such as these are meaningless at best and can give people the illusion of security or worse, you can't build a fortress on top of shifting foundations.

grrowl 11y ago

It's definitely a comprehensive guide, and disabling "phone home" services is the heaviest-hitting bit — but it's not a single large script for a reason, and as the guide mentions you should at least scan the list before blindly disabling agents named "CoreLocationAgent" and "notificationcenterui" and "TMCacheDelete".

newman314 11y ago
Which "phone home" services would you suggest as being safe to disable in general?
- grrowl 11y ago
  If you'd prefer being harder to track over having Time Machine, push notifications, and several sync services work, then you can disable most of them; if you'd prefer services to work and usability of your applications, none of them. If you're not sure of the nuances (or the pros/cons of using a "secure" Mac OSX install vs a secure Linux distro), you should research each of the services you're disabling to at least appreciate the attack surface each surface adds to your machine.

simonebrunozzi 11y ago

What's the best guide you know for SE Linux as a desktop?

noja 11y ago
You don't need a guide, it just works. If you're installing stuff from rpm (and not from a weird backalley repo) then it all just works.
- kochthesecond 11y ago
  Hah. I'm a linux user and even I dont believe it's that simple.
  - JupiterMoon 11y ago
    For GNU/Linux I find that if you stick with the commonly used packages things in your distributions repositories (on supported hardware) things do just work and it is that simple. However, (and it is a big however!) the moment you go try something slightly different good luck to you...
- simoncion 11y ago
  > You don't need a guide, it just works. It "just works" if the package you're installing has a corresponding SELinux profile. If it doesn't, you're in for a world of "fun" trying to come up with a correct profile. (I've played with both SELinux and Grsecurity MAC systems in the past. I know that it's not impossible to create these profiles. I also know that it's not infrequently an enormous pain in the ass, and a thing that even experts sometimes get wrong.)
  - noja 11y ago
    If something doesn't have a profile then it runs unconfined. That's simplified, but really does work out of the box unless you do something weird (then you flip a boolean) or very weird (then you create a custom module). But for a normal desktop user, it does just work.

eatmyshorts 11y ago

I think you may have missed part of the title. The author isn't aiming only for security, but also privacy. Disabling calendar & spotlight seem to be aimed at privacy, not security. I'm not sure I follow you when you claim the author has disabled "applications like...finder"--I didn't get that from the article. It sounds like the author really doesn't like apps that phone home to Apple, though. It might have been nice for the author to state explicitly which steps are aimed at security and which for privacy.