5 ms·

Most Mac users will never need to do this, and the short reboot cycle is, to many, worth the extra security rootless brings. It's hardly WTF.

lsaferite 11y ago
Being required to reboot my computer into recovery mode just to add a directory is certainly a WTF worthy situation. BTW, thanks for the down vote?
- oddevan 11y ago
  To add a directory to a system-protected directory. It's all about protecting the integrity of the installed system. If you don't like/want it, you can reboot into recovery, disable it, and leave it that way.
  - Karunamon 11y ago
    The integrity of the installed system could be violated by creating a directory? My system was plenty protected already - it had a root account with a password only I knew. This is just more annoying Apple gatekeeping.
    - _Ogre 11y ago
      Your system is much more secure with SIP in place because it makes big parts of your system immune to trojans and privilege escalation attacks, the two biggest ways malware creeps into your filesystem. It's not very difficult to disable (even permanently if you are inclined), and offers a big security boost. And yes, it is Apple "Gatekeeping"... the same gatekeeping that's kept OS X almost completely free of major hacks for over a decade. I don't consider that annoying but to each his own.
  - aianus 11y ago
    > It's all about protecting the integrity of the installed system Why is this important? It's trivial to reformat my drive and have a fresh install. The stuff I have that's actually sensitive is in my home directory and still unprotected =/
- ghshephard 11y ago
  99.99% of users will never need to touch those system directories, (They aren't even required for homebrew), and, at the same time, writing to them poses a huge gaping security hole for all OS X users. Locking them down (particularly in a way that can be trivially reversed with a user who has physical possession of the device and the password) is the right thing to do. For the 0.01% who need to screw around with the operating system directories, they can take the 90 seconds to hop into recovery mode. This is a situation where 100% of the user community has a reasonable solution, 99.99% aren't inconvenienced in the slightest, and the security situation goes up significantly. It's like hiding ~/Library by default - 99% of users probably don't need to mess around there, and hiding it probably reduced a lot of failure modes. (and, once again, for the 1%, chflags solves the problem in 5 seconds) Honestly - I've always been terrified whenever I've been asked for my password during installation (I do a gut check every time an ARQ upgrades asks me for my password - "Do I trust them one more time? Well, they are my backup software, so, ...) - What if it's dropping something in my system directory? I usually follow up with a cd /; sudo find -cmin -5 to see if things look reasonable - but I'm guess not all users do that. Also - with all the extended attr stuff on OS X, it's not even clear that a find -cmin -5 would be sufficient. So - count me in the group that is really, really pleased that Apple is locking down those system directories by default.
  - JadeNB 11y ago
    > cd /; sudo find -cmin -5 Sorry, but I can't resist mentioning that there's no need for that `cd /`; `sudo find / -cmin -5` would work just fine.
- rattray 11y ago
  From the hn guidelines: > Please resist commenting about being downvoted. It never does any good, and it makes boring reading. (though personally I'm not sure why you were downvoted originally)
  - lsaferite 11y ago
    Yeah, I couldn't resist. I never understand down-voting something you disagree with so I'm shocked each time it happens to me as I rarely down-vote people myself. I just wish someone would require you enter a reason for down-voting.
- s73v3r 11y ago
  No, it's not. Mainly because it's not just "adding a directory"
  - lsaferite 11y ago
    "mkdir /usr/local" is just making a directory. It's not like that suddenly triggers your battery to overheat and explode.
    - s73v3r 11y ago
      Again, no it's not. Unless you just want to ignore everything about where you're making that directory.

lsaferite 11y ago

Being required to reboot my computer into recovery mode just to add a directory is certainly a WTF worthy situation. BTW, thanks for the down vote?

oddevan 11y ago
To add a directory to a system-protected directory. It's all about protecting the integrity of the installed system. If you don't like/want it, you can reboot into recovery, disable it, and leave it that way.
- Karunamon 11y ago
  The integrity of the installed system could be violated by creating a directory? My system was plenty protected already - it had a root account with a password only I knew. This is just more annoying Apple gatekeeping.
  - _Ogre 11y ago
    Your system is much more secure with SIP in place because it makes big parts of your system immune to trojans and privilege escalation attacks, the two biggest ways malware creeps into your filesystem. It's not very difficult to disable (even permanently if you are inclined), and offers a big security boost. And yes, it is Apple "Gatekeeping"... the same gatekeeping that's kept OS X almost completely free of major hacks for over a decade. I don't consider that annoying but to each his own.
- aianus 11y ago
  > It's all about protecting the integrity of the installed system Why is this important? It's trivial to reformat my drive and have a fresh install. The stuff I have that's actually sensitive is in my home directory and still unprotected =/
ghshephard 11y ago
99.99% of users will never need to touch those system directories, (They aren't even required for homebrew), and, at the same time, writing to them poses a huge gaping security hole for all OS X users. Locking them down (particularly in a way that can be trivially reversed with a user who has physical possession of the device and the password) is the right thing to do. For the 0.01% who need to screw around with the operating system directories, they can take the 90 seconds to hop into recovery mode. This is a situation where 100% of the user community has a reasonable solution, 99.99% aren't inconvenienced in the slightest, and the security situation goes up significantly. It's like hiding ~/Library by default - 99% of users probably don't need to mess around there, and hiding it probably reduced a lot of failure modes. (and, once again, for the 1%, chflags solves the problem in 5 seconds) Honestly - I've always been terrified whenever I've been asked for my password during installation (I do a gut check every time an ARQ upgrades asks me for my password - "Do I trust them one more time? Well, they are my backup software, so, ...) - What if it's dropping something in my system directory? I usually follow up with a cd /; sudo find -cmin -5 to see if things look reasonable - but I'm guess not all users do that. Also - with all the extended attr stuff on OS X, it's not even clear that a find -cmin -5 would be sufficient. So - count me in the group that is really, really pleased that Apple is locking down those system directories by default.
- JadeNB 11y ago
  > cd /; sudo find -cmin -5 Sorry, but I can't resist mentioning that there's no need for that `cd /`; `sudo find / -cmin -5` would work just fine.
rattray 11y ago
From the hn guidelines: > Please resist commenting about being downvoted. It never does any good, and it makes boring reading. (though personally I'm not sure why you were downvoted originally)
- lsaferite 11y ago
  Yeah, I couldn't resist. I never understand down-voting something you disagree with so I'm shocked each time it happens to me as I rarely down-vote people myself. I just wish someone would require you enter a reason for down-voting.
s73v3r 11y ago
No, it's not. Mainly because it's not just "adding a directory"
- lsaferite 11y ago
  "mkdir /usr/local" is just making a directory. It's not like that suddenly triggers your battery to overheat and explode.
  - s73v3r 11y ago
    Again, no it's not. Unless you just want to ignore everything about where you're making that directory.