> The office worker running VMWare Fusion to run an old Windows program or any Dropbox user with the Smart Sync feature are all semi-technical audiences that ne

> The office worker running VMWare Fusion to run an old Windows program or any Dropbox user with the Smart Sync feature are all semi-technical audiences that need kernel extensions for their programs to work VMWare Fusion's .kext is signed with a certificate that's signed by Apple's Kernel signing key, so there is no need to change SIP for Fusion to run. Besides, since, I believe Maveriks, macOS includes a hypervisor by default that could be used without requiring a kernel module to be loaded (Veertu is in the App Store and does essentially the same thing as VMWare). Userspace-only apps don't even require a signature to launch them - you can just right-click and select "Open" on the first launch. That's a totally workable compromise. With regards to apps that require a kernel extension, apple offers three options: 1) if you're a professional software company with a good reputation, you can negotiate to get a signing certificate that can be used to sign your kernel module. This isn't only awarded to big companies either - the makers of Little Snitch certainly don't seem to be a big enterprise and they still got that certificate. 2) For all others, Apple is starting to add more and more knobs in order to allow things that previously needed to run in kernel-space to now run in user-space (see Veertu). 3) If the thing you want to do doesn't (yet) have an official hook and if you are not a company to be trusted with a kernel module signing certificate, then, yes, you will have to force your users to disable SIP, but maybe, that application is fulfilling a very specific need so that this is ok. Even for me as a moderately advanced user, this is an excellent compromise that provides me with a huge security benefit because even if I am tricked into giving malware my root password, it won't be able to hide its tracks. With regards to kernel modules, btw, this is even less restrictive than Microsoft who basically only offer you option 1) on 64bit platforms. There is some sort of option 3), but it only persists for one single boot and resets itself back once you reboot the machine - plus, it's nagging you with a warning on the desktop.