Personally I think I like having SIP. It means a webkit zero-day can't as easily load a kernel extension or edit firmware. I guess DTrace works by putting prob

Personally I think I like having SIP. It means a webkit zero-day can't as easily load a kernel extension or edit firmware. I guess DTrace works by putting probes into other processes, so even though it is only "reading" system information, it's only able to instrument the data it reads in the first place by mutating other running processes.