4 ms·

I don't get that point. "Normal" users won't (and shouldn't) disable SIP. Those who do need to for security research won't really care that Apple knows they're

by yifanlu 11y ago

I don't get that point. "Normal" users won't (and shouldn't) disable SIP. Those who do need to for security research won't really care that Apple knows they're poking into the system (when you disclose a vulnerability, they'll know who you are) and for the very paranoid, you can disable network or block connections to Apple or etc. It's a strawman argument because for security researchers, there is never a problem of "we can't let them know we're looking". There's also no evidence that Apple phones home the status either. And re:"barrier of entry". Who should we be protecting? Amateur security researchers or mass users? As an amateur security researcher I'd happily allow my job to be 10x harder if it makes users even 2x safer.

Buge 11y ago
We might want to hide our activity from malware. The malware might delete itself as soon as SIP is disabled.
- ryannielsen 11y ago
  If you're looking to hide your activity from malware, you should be incredibly excited by SIP. With SIP enabled, you have more protection from malware introspecting other processes or monitoring activity on the system. Hell, if you're a researcher building tools to detect and analyze OS X malware, you'd likely benefit from SIP by opting-in your tools to SIP's restrictions. (Tangential example: Chrome is taking this step; Canary is currently SIP restricted.) Malware can only introspect SIP-protected activity by employing kernel exploits. If malware can compromise the kernel, it's game over. You're not going to hide anything, ever. If anything, it sounds like you want SIP's purview expanded to encompass more of OS X.
userbinator 11y ago
I'd happily allow my job to be 10x harder if it makes users even 2x safer. How did you become a security researcher? If it was 10x harder to get started, perhaps you might've never started, or given up long ago. A future with fewer security researchers is not a good thing, wouldn't you agree? And by your argument the safest user is one who cannot do anything even remotely unsafe, which is a deeply disturbing dystopian thought. SIP is just another step toward an environment in which users are not longer users - they're the ones being used.
- coldtea 11y ago
  >A future with fewer security researchers is not a good thing, wouldn't you agree? Depends. If it also means fewer malware, then I'm all ok for SIP and similar things to put security researchers out of business. Where you sad when a while booming business for security tools and antivirus slowed down when people moved away from Windows 9x?

by yifanlu 11y ago

Buge 11y ago

We might want to hide our activity from malware. The malware might delete itself as soon as SIP is disabled.

ryannielsen 11y ago
If you're looking to hide your activity from malware, you should be incredibly excited by SIP. With SIP enabled, you have more protection from malware introspecting other processes or monitoring activity on the system. Hell, if you're a researcher building tools to detect and analyze OS X malware, you'd likely benefit from SIP by opting-in your tools to SIP's restrictions. (Tangential example: Chrome is taking this step; Canary is currently SIP restricted.) Malware can only introspect SIP-protected activity by employing kernel exploits. If malware can compromise the kernel, it's game over. You're not going to hide anything, ever. If anything, it sounds like you want SIP's purview expanded to encompass more of OS X.

userbinator 11y ago

I'd happily allow my job to be 10x harder if it makes users even 2x safer. How did you become a security researcher? If it was 10x harder to get started, perhaps you might've never started, or given up long ago. A future with fewer security researchers is not a good thing, wouldn't you agree? And by your argument the safest user is one who cannot do anything even remotely unsafe, which is a deeply disturbing dystopian thought. SIP is just another step toward an environment in which users are not longer users - they're the ones being used.

coldtea 11y ago
>A future with fewer security researchers is not a good thing, wouldn't you agree? Depends. If it also means fewer malware, then I'm all ok for SIP and similar things to put security researchers out of business. Where you sad when a while booming business for security tools and antivirus slowed down when people moved away from Windows 9x?