3 ms·

Yes but that's all or nothing then. And you lose out on some functionality. There is no way for me to put my own configuration in the system and still have it

Yes but that's all or nothing then. And you lose out on some functionality. There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. This is not OK, there should be a way for me to sign files so they are marked as valid. I don't think the read-only OS partition or the SIP is a bad idea. The bad part is that Apple is the only one who controls it.

jen20 4y ago
What about editing `/private/etc/ssh/sshd_config` does not persist for you?
- yamtaddle 4y ago
  That file is overwritten on OS updates. At least, it used to be.
  - GekkePrutser 4y ago
    This yes. It even used to put it on the desktop in a passive aggressive way of saying "keep your shit to yourself" :)
yamtaddle 4y ago
> There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. Does putting your custom options in something like: /etc/ssh/sshd_config.d/disable-passwords.conf no longer allow custom sshd config to survive updates? It's like if you're configuring daemons on, say, Ubuntu the "right way" so you don't get a ton of those prompts during apt-updates asking you if you want to accept the maintainer's config file or roll the dice and keep your own.
- GekkePrutser 4y ago
  Good point, I have not tried that. Pretty sure when I still used macOS this didn't work. I think Mojave or Catalina was the last one. In the end I just had enough of macOS, this was only one of the many reasons. The lack of choice in UX configuration is another one. Opinionated software is great if your opinion is aligned with the vendor's but Apple has been moving away from mine ever so slowly since peak macOS which was around snow leopard for me. I really love how KDE gave me all the options back that I missed for so long. Finally virtual desktops in a grid again. And choosing what I want my UI to look like (and not forced changes on me every year)
alwillis 4y ago
I don't think the read-only OS partition or the SIP is a bad idea. The bad part is that Apple is the only one who controls it. Not true. Most of Apple's features are for keeping newbies and users who think they know what they're doing from shooting themselves in the foot. Apple documents how to disable SIP [1]. [1]: https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection https://developer.apple.com/documentation/security/disabling...
- saagarjha 4y ago
  You cannot re-enable SIP with a different root of trust, it’s Apple or nothing. That’s unfortunate.
  - Angostura 4y ago
    If you are smart enough to to turn off the SIP training-wheels, you are smart enough to figure out fir yourself which software you trust to install
    - alwillis 4y ago
      With all due respect, a person doesn't have to be that smart to cut and paste something from a Google search while not completely understanding the consequences.
egypturnash 4y ago
The problem is that any way for you to sign files is also a way for malware to convince a less technically-adept user to sign it. Even if the dialogue that pops up for this says “Never ever do this unless you know exactly what you are doing, if a program you are running brought this up then it is probably trying to HACK you!”, people will click through it on autopilot and then maybe go ask what it meant afterwards.
- GekkePrutser 4y ago
  But then they get exactly what they deserve. I have a feeling it's not only that though. Apple is rapidly expanding from a hardware to a media content vendor and they have reasons to want to protect their own content as much as possible.
AceJohnny2 4y ago
> here is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. This is now possible for SSH, btw. They finally support /etc/ssh/ssh[d]_config.d/ where you can add your customization files, and they won't be squashed by an OS update. So they finally picked up on the technique Linux has been using forever.

jen20 4y ago

What about editing `/private/etc/ssh/sshd_config` does not persist for you?

yamtaddle 4y ago
That file is overwritten on OS updates. At least, it used to be.
- GekkePrutser 4y ago
  This yes. It even used to put it on the desktop in a passive aggressive way of saying "keep your shit to yourself" :)

yamtaddle 4y ago

> There is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. Does putting your custom options in something like: /etc/ssh/sshd_config.d/disable-passwords.conf no longer allow custom sshd config to survive updates? It's like if you're configuring daemons on, say, Ubuntu the "right way" so you don't get a ton of those prompts during apt-updates asking you if you want to accept the maintainer's config file or roll the dice and keep your own.

GekkePrutser 4y ago
Good point, I have not tried that. Pretty sure when I still used macOS this didn't work. I think Mojave or Catalina was the last one. In the end I just had enough of macOS, this was only one of the many reasons. The lack of choice in UX configuration is another one. Opinionated software is great if your opinion is aligned with the vendor's but Apple has been moving away from mine ever so slowly since peak macOS which was around snow leopard for me. I really love how KDE gave me all the options back that I missed for so long. Finally virtual desktops in a grid again. And choosing what I want my UI to look like (and not forced changes on me every year)

alwillis 4y ago

I don't think the read-only OS partition or the SIP is a bad idea. The bad part is that Apple is the only one who controls it. Not true. Most of Apple's features are for keeping newbies and users who think they know what they're doing from shooting themselves in the foot. Apple documents how to disable SIP [1]. [1]: https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection https://developer.apple.com/documentation/security/disabling...

saagarjha 4y ago
You cannot re-enable SIP with a different root of trust, it’s Apple or nothing. That’s unfortunate.
- Angostura 4y ago
  If you are smart enough to to turn off the SIP training-wheels, you are smart enough to figure out fir yourself which software you trust to install
  - alwillis 4y ago
    With all due respect, a person doesn't have to be that smart to cut and paste something from a Google search while not completely understanding the consequences.

egypturnash 4y ago

The problem is that any way for you to sign files is also a way for malware to convince a less technically-adept user to sign it. Even if the dialogue that pops up for this says “Never ever do this unless you know exactly what you are doing, if a program you are running brought this up then it is probably trying to HACK you!”, people will click through it on autopilot and then maybe go ask what it meant afterwards.

GekkePrutser 4y ago
But then they get exactly what they deserve. I have a feeling it's not only that though. Apple is rapidly expanding from a hardware to a media content vendor and they have reasons to want to protect their own content as much as possible.

AceJohnny2 4y ago

> here is no way for me to put my own configuration in the system and still have it persist. For example I change things in sshd_config (to turn off password auth), and PAM. This is now possible for SSH, btw. They finally support /etc/ssh/ssh[d]_config.d/ where you can add your customization files, and they won't be squashed by an OS update. So they finally picked up on the technique Linux has been using forever.