3 ms·
My own personal experience with `sudo spctl --master-disable` (which is narrowly-focused on large numbers of new script executables, not full apps) suggests tha
by abathur 6y ago
My own personal experience with `sudo spctl --master-disable` (which is narrowly-focused on large numbers of new script executables, not full apps) suggests that it only stops syspolicyd from using the networked assessment's return, not from performing the assessment.
In a narrow test it seems like it may very slightly improve performance, but I did a fairly large multi-project test with this setting in CI and saw no real impact.
By contrast, a narrow test with the "Developer Tools" security exemption added to my terminal, unambiguously demonstrates the large potential performance improvement of actually skipping the assessments.
Unfortunately, the exemption only seemed to work for apps, so I never identified a way to turn the assessments off in CI. Also, it causes my laptop to hang until I hard cycle or watchdogd kills it (after 5 minutes) on shutdown (I did all of this in Catalina, though I verified this was still the case midway through Big Sur beta; have not verified on final release).
- boardwaalk 6y agoSo I suppose the question is, what is that best way to actually get the stability/performance increase? Is blackhole-ing the DNS request the best way?
- abathur 6y agoI didn't try any networking approach myself so I can't attest to the best. I was on a narrow search for any cheap ~reasonable solution I could recommend for Nix to mitigate the performance hit at install or run time--while avoiding any security/config/functionality splash damage that might end up on the front page of HN some day :)