3 ms·
Poor security design. App installers should definitely be sandboxed, "sip" or not. Preventing the local admin from making any changes due to lack of that, is
by digisign 5y ago
Poor security design. App installers should definitely be sandboxed, "sip" or not. Preventing the local admin from making any changes due to lack of that, is fixing the wrong problem. Or perhaps not in a granular enough way.
- scarface74 5y agoSo it’s “poor security design” when a user with root access specifically disables the security and bad things happen?
- digisign 5y agoYes, useful and destructive/fatal configuration should be separated. If you have to remove a load-bearing pillar to install a light-switch, the design is poor, to say the least.
- scarface74 5y agoThere are two separate levels - root access - doesn’t disable SIP - Disabling SIP requires you to go through many contortions. People didn’t need to disable SIP to install Chrome. They were doing it for other reasons.
- digisign 5y agoYes, and those reasons are why I mentioned poor design. This morning I was reminded, my work Mac has a dozen daemons trying to contact things I don't want, such as icloud, itunes, google, etc. A fraction of these are ostensibly useful, but I had to resort to Little Snitch to block them because the OS is read-only, i.e. insanity. Even the user-hostile mess of Windows allows me to turn off the worse services... although even that is dwindling.
- scarface74 5y agoThe OS is not “read only” if you go through contortions. But if you can write anything to the OS, so can anything you run