6 ms·

If a user can't turn off SIP they probably shouldn't turn off SIP, SIP is great for the vast majority of users ie normal users, and for those who don't want SIP

If a user can't turn off SIP they probably shouldn't turn off SIP, SIP is great for the vast majority of users ie normal users, and for those who don't want SIP it's easy to turn off. Basically I'm saying only technical people should be turning SIP off. Note, that I'm biased for SIP because I'm implementing it for FreeBSD, even though I know I will be turning it off because SIP impedes my fuzzer development.

pdkl95 11y ago
> Basically I'm saying only technical people should be turning SIP off. No, you're saying only technical people are allowed to use a General Purpose Computer, and everyone should use an appliance. You might want to consider what side you're fighting for in the War On General Purpose Computing.
- 2trill2spill 11y ago
  Why would a person turn off a feature they don't understand? Besides the only people who have issues with or even know what SIP is, are technical people. The average mac osx user doesn't even know about the hidden directories that SIP is protecting or what dtrace even is. If apple made it so SIP could not be turned off I would be with you on this, but you can turn off SIP. Also what war on general computing? If a person want's full control of their operating system they can use one of the free open source ones like FreeBSD, one of the thousands of Linux distros, illumos, OpenBSD, NetBSD, etc, etc.
  - pdkl95 11y ago
    This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Assumptions you're making: * That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. (see previous [5]) * That SIP will continue, forever into the future, to protect only those hidden directories. * That Apple always knows what is better for the user, and won't exploit that power. > turned off Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. As an analogy, you might say that I'm warning you that someone seems to be placing some gas cans around your property, and you might want to stop them before they decide to light a match. Meanwhile, you (and quite a few other people) are saying it's no big deal because you can just step over those gas cans - they aren't blocking the walkway much. Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. > Also what war on general computing? I'm somewhat shocked. All I can say is you have quite a bit of catching up to do. For the answer to that question, see my previous [1] and [2]. For [1], I linked to Doctorow's essay, but he links to his original lecture at 28C3 if you prefer. That lecture introduces the War, while [2] continues with a discussion of why we need to solve this problem now, as the ramifications extend much further than Apple and the ability to gain root. Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple.
    - AlphaSite 11y ago
      They don't assert ownership, they set a default setting to prohibit a potential security hole. This is the same principal as a master key, if there is a hole you can exploit, there exists a hole which someone else may exploit.
    - 2trill2spill 11y ago
      > This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Dtrace is one of the features that is limited by SIP so yes this has something to do with dtrace. > That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. Yes apple could get rid of the ability to turn off SIP, I don't believe they will. Doing so would anger developers and technical users, these people have a huge amount of say on what technology get used in their organization. > That SIP will continue, forever into the future, to protect only those hidden directories. I don't assume that it will only protect those hidden directories, because it protects other system resources as well. I also hope apple keeps adding to the list of protected resources, to continue securing Mac OSX and IOS. > Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. This is not a power grab, this is a company securing their products for their users. Even if this somehow is a power grab by apple, so what. No one is forced to buy apple's products, and if apple wants to do things that make there products less desirable, again so what, people might start switching to a competitor. It's not like apple is the government, nor is it a monopoly. > Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. Apple has not taken root access from me, I can still do whatever I want on my Mac Pro. > Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple. Again I still have root on my laptop, yes I had to boot into recovery mode first, but afterwards I can sudo away. To me it seems like you haven't heard of Mandatory Access Controls, Operating systems have had the ability to reduce the privileges of root for a long time. Thats all SIP is a application of Mandatory Access Controls, SIP is built on top of the TrustedBSD MAC framework that FreeBSD, IOS, and MAC OSX all share. The MAC framework has been in IOS and Mac for a decade and apple have been slowly using it to hardened there operating systems and SIP is just a progression of this. You would think you would be happy that apple is trying to improve the security of their products.
- deleted 11y ago
  [deleted]

pdkl95 11y ago

> Basically I'm saying only technical people should be turning SIP off. No, you're saying only technical people are allowed to use a General Purpose Computer, and everyone should use an appliance. You might want to consider what side you're fighting for in the War On General Purpose Computing.

2trill2spill 11y ago
Why would a person turn off a feature they don't understand? Besides the only people who have issues with or even know what SIP is, are technical people. The average mac osx user doesn't even know about the hidden directories that SIP is protecting or what dtrace even is. If apple made it so SIP could not be turned off I would be with you on this, but you can turn off SIP. Also what war on general computing? If a person want's full control of their operating system they can use one of the free open source ones like FreeBSD, one of the thousands of Linux distros, illumos, OpenBSD, NetBSD, etc, etc.
- pdkl95 11y ago
  This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Assumptions you're making: * That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. (see previous [5]) * That SIP will continue, forever into the future, to protect only those hidden directories. * That Apple always knows what is better for the user, and won't exploit that power. > turned off Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. As an analogy, you might say that I'm warning you that someone seems to be placing some gas cans around your property, and you might want to stop them before they decide to light a match. Meanwhile, you (and quite a few other people) are saying it's no big deal because you can just step over those gas cans - they aren't blocking the walkway much. Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. > Also what war on general computing? I'm somewhat shocked. All I can say is you have quite a bit of catching up to do. For the answer to that question, see my previous [1] and [2]. For [1], I linked to Doctorow's essay, but he links to his original lecture at 28C3 if you prefer. That lecture introduces the War, while [2] continues with a discussion of why we need to solve this problem now, as the ramifications extend much further than Apple and the ability to gain root. Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple.
  - AlphaSite 11y ago
    They don't assert ownership, they set a default setting to prohibit a potential security hole. This is the same principal as a master key, if there is a hole you can exploit, there exists a hole which someone else may exploit.
  - 2trill2spill 11y ago
    > This doesn't have a damn thing to do with dtrace. This is about Apple asserting that they own your computer, de facto, not you. Dtrace is one of the features that is limited by SIP so yes this has something to do with dtrace. > That the ability to disable SIP will always be available, forever, even though Apple has incentives to continue making their products more an "applicance" and less a "computer". I already said there are hardware features in new CPUs that are specifically designed to make that impossible. Yes apple could get rid of the ability to turn off SIP, I don't believe they will. Doing so would anger developers and technical users, these people have a huge amount of say on what technology get used in their organization. > That SIP will continue, forever into the future, to protect only those hidden directories. I don't assume that it will only protect those hidden directories, because it protects other system resources as well. I also hope apple keeps adding to the list of protected resources, to continue securing Mac OSX and IOS. > Why is it that any time someone starts grabbing for power, there are always people that say we should ignore it because there is some workaround, or it's only an insignificant amount of power? Power is accumulated in small steps, with the hope that nobody notices until iti is too late. This is not a power grab, this is a company securing their products for their users. Even if this somehow is a power grab by apple, so what. No one is forced to buy apple's products, and if apple wants to do things that make there products less desirable, again so what, people might start switching to a competitor. It's not like apple is the government, nor is it a monopoly. > Apple is taking your root access away, and you're fine with it. They are saying that they de facto own your computer, not you. Yet you're fine with it. Apple has not taken root access from me, I can still do whatever I want on my Mac Pro. > Again, you might want to think long and hard about the long-term consequences of giving up root access to Apple. Security can be provided for the user without handing control over to Apple. Again I still have root on my laptop, yes I had to boot into recovery mode first, but afterwards I can sudo away. To me it seems like you haven't heard of Mandatory Access Controls, Operating systems have had the ability to reduce the privileges of root for a long time. Thats all SIP is a application of Mandatory Access Controls, SIP is built on top of the TrustedBSD MAC framework that FreeBSD, IOS, and MAC OSX all share. The MAC framework has been in IOS and Mac for a decade and apple have been slowly using it to hardened there operating systems and SIP is just a progression of this. You would think you would be happy that apple is trying to improve the security of their products.
deleted 11y ago
[deleted]