6 ms·

Honestly, this may as well have been titled "Disable security to speed up macOS," which afaik is a fairly well-known tradeoff in just about any piece of softwar

by notamy 6y ago

Honestly, this may as well have been titled "Disable security to speed up macOS," which afaik is a fairly well-known tradeoff in just about any piece of software. The article even explicitly says this: > First, ask yourself, would you like to undo a decade of security protections painstakingly created by Apple, protecting your Mac from malware, spyware, and ransomware? [...] > [...] Speed and convenience over security any day! Let us march on boldly ! The steps listed below will give you a short description of each protection we disable, [...]

Wowfunhappy 6y ago
When Apple's ocsp server went down yesterday, people kept talking about how they were going to switch away from macOS, now that they knew launching apps was (semi) dependent on an external server. And if you want to switch, that's fine—but, if there are other things you like about macOS, you could also just set it to not make these checks.
- lxgr 6y ago
  There was also plenty of "helpful" advice making the rounds that more or less amounted to permanently blocking Apple's OCSP server. It's a real shame that it's usually not the same people suggesting/applying these "pro hacks" to other people's computers that will end up spending hours on the phone with less tech savvy friends and family members trying to get their things back into a secure (or just working) state.
  - Wowfunhappy 6y ago
    Your less tech savvy friends and family members aren't reading hacker news. People will always be able to make a mess of things. Personally, when I'm trying to fix someone's computer and I notice weird things have been done, I immediately recommend backing up files and doing a full reinstall. (And I'll offer to do the reinstall—which is easy—provided they do the work of backing up important files.)
    - lxgr 6y ago
      They definitely will, but I think it's always worth keeping in mind before firing off a "how to be more clever than your computer/OS manufacturer" piece.
EduardoBautista 6y ago
I honestly don't mind the slightly longer startup times for apps since I keep most of them open until I restart my computer. I would like to know, however, if this tradeoff has been worth it. Does anyone have any statistics on whether this has helped reduce the amount of malware ran by users?
- ithkuil 6y ago
  For some reason these high startup times apply also to any shell script I write, any binary I compiler from the command line. I read somewhere that xcode can bypass that because it's registered as a developer tool. There were some instructions saying that adding terminal.app to the developer tools pane in security preferences would solve my problem but it didn't. Butchering ocsp by fiddling with /etc/hosts still didn't fully solve the problem: it still takes 200-300ms to start any new binary the first time. But at least it's no longer up to several seconds in case of bad networks.

by notamy 6y ago

Wowfunhappy 6y ago

When Apple's ocsp server went down yesterday, people kept talking about how they were going to switch away from macOS, now that they knew launching apps was (semi) dependent on an external server. And if you want to switch, that's fine—but, if there are other things you like about macOS, you could also just set it to not make these checks.

lxgr 6y ago
There was also plenty of "helpful" advice making the rounds that more or less amounted to permanently blocking Apple's OCSP server. It's a real shame that it's usually not the same people suggesting/applying these "pro hacks" to other people's computers that will end up spending hours on the phone with less tech savvy friends and family members trying to get their things back into a secure (or just working) state.
- Wowfunhappy 6y ago
  Your less tech savvy friends and family members aren't reading hacker news. People will always be able to make a mess of things. Personally, when I'm trying to fix someone's computer and I notice weird things have been done, I immediately recommend backing up files and doing a full reinstall. (And I'll offer to do the reinstall—which is easy—provided they do the work of backing up important files.)
  - lxgr 6y ago
    They definitely will, but I think it's always worth keeping in mind before firing off a "how to be more clever than your computer/OS manufacturer" piece.

EduardoBautista 6y ago

I honestly don't mind the slightly longer startup times for apps since I keep most of them open until I restart my computer. I would like to know, however, if this tradeoff has been worth it. Does anyone have any statistics on whether this has helped reduce the amount of malware ran by users?

ithkuil 6y ago
For some reason these high startup times apply also to any shell script I write, any binary I compiler from the command line. I read somewhere that xcode can bypass that because it's registered as a developer tool. There were some instructions saying that adding terminal.app to the developer tools pane in security preferences would solve my problem but it didn't. Butchering ocsp by fiddling with /etc/hosts still didn't fully solve the problem: it still takes 200-300ms to start any new binary the first time. But at least it's no longer up to several seconds in case of bad networks.