5 ms·

> I would strongly recommend anyone who thinks their system is sluggish to [disable SIP] I’m very glad this advice has been as niche as it has been. It’s awful

> I would strongly recommend anyone who thinks their system is sluggish to [disable SIP] I’m very glad this advice has been as niche as it has been. It’s awful advice unless you really know what you’re doing and why you’re doing it. Anyway, I still run 10.15 daily and the only thing that I’d call slow by design is the thermal design of the laptop it runs on. Even so I think just thoroughly clearing dust out of it gave it at least another few more years of being a pretty decent laptop.

capableweb 4y ago
That is truly horrible advice, particularly since the tradeoff is not being mentioned at all, or otherwise what the implications are. However, seems SIP can only be disabled temporarily (until next reboot?), at least according to https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection https://developer.apple.com/documentation/security/disabling... but it's unclear for how long it is disabled.
- comex 4y ago
  It's disabled until you manually re-enable it. That documentation page's wording suggests otherwise, but that seems to just be an artifact of trying to really hammer in the advice that you should only keep it disabled temporarily.
- zarzavat 4y ago
  Why is it horrible advice? It’s equivalent to telling someone to use Linux, which doesn’t have SIP either. SIP is personal preference. Personally I find that Mac OS is too buggy with SIP enabled. I had an issue where disk space was disappearing into a directory that was hidden by SIP, because the OS was leaking update images.
  - Closi 4y ago
    > Why is it horrible advice? It’s equivalent to telling someone to use Linux, which doesn’t have SIP either. These two OS’s have very different types of user and attacker (speaking in generalities), and thus different security trade-offs during design. The main risk with Mac is that someone downloads a “Mac cleaner” or something similar which installs malware, or that malware is hidden in a legitimate looking app, and this is what SIP protects against. Even informed power users can make these mistakes - it only takes downloading one compromised utility! IMO for most ‘home’ use where it is used as a main OS by a person without too much familiarity with computers, Ubuntu and many Linux distros are probably less secure than Mac - for instance the average user is conditioned to run random terminal commands they find on the internet and give them sudo permission. Obviously I’m excluding the majority of use-cases such as routers, consoles, tvs, servers where users access to the underlying OS is heavily restricted.
    - alexeiz 4y ago
      Measures like SIP force application developers to create workarounds that compromise system security even more. Remember the recent Zoom vulnerability where they created a special service to autoupdate Zoom? If the system is too restrictive, developers will try to punch holes in it to accomplish what they need.
      - buildbot 4y ago
        I for one am really really glad zoom is unable to mess with the rest of the macos system…
      - Closi 4y ago
        > Measures like SIP force application developers to create workarounds that compromise system security even more. Remember the recent Zoom vulnerability where they created a special service to autoupdate Zoom? If the system is too restrictive, developers will try to punch holes in it to accomplish what they need. That wasn't related to SIP, so I don't think we can just throw random unrelated security issues against SIP to justify it being a bad thing. Bedsides, is the moral of the Zoom story really that application Developers should be given unfettered access to the OS and the freedom to do whatever they want? It sounds like the opposite - an example of exactly why security has to be built into the OS and can't be left to companies like Zoom.
        wetpaws 4y ago
        Those who want security over performance will get neither security nor performance.
    - zarzavat 4y ago
      Okay sure I agree that my parents shouldn’t turn off SIP, not that they would know how to. But in this case the advice comes from Allan Odgaard, the author of TextMate, on a blog called SIGPIPE. A certain amount of technical expertise can be assumed from the audience.
      - 4y ago
  - alexeiz 4y ago
    This is exactly why I use Linux. There is nothing subversive going on behind the scenes. My system trusts that I know what I'm doing and that's why I like it. Also on Windows, the first thing I do is disable the Windows Defender. And believe it or not, I haven't had any viruses for as long as I can remember using computers. On the other hand, half a year ago I've investigated a compromised macOS system at work where the user clicked a wrong button on some innocently looking dialog and ended up with a rogue extension in Google Chrome which was not possible to uninstall. Why didn't SIP prevent that from happening?
    - buildbot 4y ago
      Because Chrome is not part of the MacOS operating system?
    - highwaylights 4y ago
      > Also on Windows, the first thing I do is disable the Windows Defender. And believe it or not, I haven't had any viruses for as long as I can remember using computers. Prove it.
      - depr 4y ago
        You prove Windows Defender will keep you virus free first
        highwaylights 4y ago
        Well, you can easily find out if it's detected anything by checking it's history, as opposed to having no idea if you have any malware whatsoever - which is what you're advocating for with this stance.
        ubercow13 4y ago
        Right, so check it first, and if it hasn't ever found anything, I guess you're good to disable it.
  - highwaylights 4y ago
    It's not at all the same. Linux doesn't have SIP, or Gatekeeper, or XProtect, but you know it doesn't have any of those features. The developers know it doesn't have any of those features, so the absence of those features are part of the attack surface that the vendor (in this case the Linux OSS community) is aware of in the threat model. If you have SIP disabled, no-one is trying to solve any problems that this causes for you. Anyone writing malware to target a SIP-disabled system knows Apple isn't trying to patch those issues because having SIP disabled is not a valid system state they're trying to protect. There won't be patches for you, and given that it's closed source, it's not like you can fix it yourself.
    - vbezhenar 4y ago
      SIP does not solve any problems. SIP only breaks some programs, that's the whole reason of its existence. I don't think that running malware on your computer is a good idea. Just don't do it.
      - tmoravec 4y ago
        > I don't think that running malware on your computer is a good idea. Just don't do it. I don't think that having vulnerabilities on your computer is a good idea. Just don't do it. /s > SIP does not solve any problems. Of course it does. We might disagree with the tradeoffs it's making, it might not be worth it at all, it might be a wrong approach from the start. But saying it does not solve any problems is disingenuous at best.
      - highwaylights 4y ago
        I don't think dying from cancer is a good idea. Just don't do it. SIP absolutely solves a specific problem. It prevents rogue software from writing to protected areas. Whether that matters to you is your business, but to suggest no-one else should want to prevent any old homebrew package or DMG installing a keylogger is a bit silly.
- lapcat 4y ago
  > However, seems SIP can only be disabled temporarily (until next reboot?), at least according to https://developer.apple.com/documentation/security/disabling https://developer.apple.com/documentation/security/disabling... but it's unclear for how long it is disabled. This is a misreading of the linked document. Disabling SIP is permanent until re-enabled. That's why the document is warning you to only disable it temporarily and then re-enable it. The warning wouldn't be necessary if it automatically re-enabled. "Warning Disable SIP only temporarily to perform necessary tasks, and reenable it as soon as possible. Failure to reenable SIP when you are done testing leaves your computer vulnerable to malicious code."
Synaesthesia 4y ago
By the way with OCLP you can install Monterey onto any Mac dating back to 2012. It’s a great project, and the MacOS runs great.
DMell 4y ago
For those like me who were unaware: > The main task of SIP on Mac is to protect the safety and integrity of the system files and directories, preventing them from modifications or attacks from unauthenticated processes. It brings a high level of security to the entire system.
- Gigachad 4y ago
  I’m not sure id say disabling it is terrible advice, but the feature is useful. These files are still protected by standard root access, but I suppose the issue was people getting tricked in to copy pasting things in to bash and typing their password in. Or maybe GUI apps asking for admin and doing bad things. The feature has only existed for around 7 years and macOS wasn’t horribly broken before that time.
flohofwoe 4y ago
Apple really needs to do something about the slow-start problem though. Even on my shiny M1 Mac with Monterey it sometimes takes several seconds to start a tiny executable . What's the point of developing new faster CPUs if it takes the software guys just a few months to undo all the hardware progress?
- deleted 4y ago
  [deleted]
- avnigo 4y ago
  I guess it's a form of lifestyle inflation. Under limited resources, you tend to be more careful with overheads.
- illys 4y ago
  "What's the point of developing new faster CPUs if it takes the software guys just a few months to undo all the hardware progress?" Nice you found out and mention it here. It has been like that since new generation x86 CPUs provide compatibility with the previous generation with more speed... Pushing an uncalculable number of tons of perfectly working hardware to the trash, most of the time to keep executing the same tasks with an updated software. When the software performance/optimization declines, the hardware is accused of being too old. Even if hardware speed never declines with age. I understand we need new hardware for new usage; but not for a new version of Windows, Office or MacOS. Just check https://en.wikipedia.org/wiki/Andy_and_Bill%27s_law https://en.wikipedia.org/wiki/Andy_and_Bill%27s_law It goes the same with webpages load, library number and sizes... always a declining optimization with faster hardware.
- deleted 4y ago
  [deleted]
- jakemauer 4y ago
  I wonder if you’re encountering MacOS’ Gatekeeper malware checking being slow to communicate with Apple’s servers. My understanding is it checks the app every time you launch.

capableweb 4y ago

That is truly horrible advice, particularly since the tradeoff is not being mentioned at all, or otherwise what the implications are. However, seems SIP can only be disabled temporarily (until next reboot?), at least according to https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection https://developer.apple.com/documentation/security/disabling... but it's unclear for how long it is disabled.

comex 4y ago
It's disabled until you manually re-enable it. That documentation page's wording suggests otherwise, but that seems to just be an artifact of trying to really hammer in the advice that you should only keep it disabled temporarily.
zarzavat 4y ago
Why is it horrible advice? It’s equivalent to telling someone to use Linux, which doesn’t have SIP either. SIP is personal preference. Personally I find that Mac OS is too buggy with SIP enabled. I had an issue where disk space was disappearing into a directory that was hidden by SIP, because the OS was leaking update images.
- Closi 4y ago
  > Why is it horrible advice? It’s equivalent to telling someone to use Linux, which doesn’t have SIP either. These two OS’s have very different types of user and attacker (speaking in generalities), and thus different security trade-offs during design. The main risk with Mac is that someone downloads a “Mac cleaner” or something similar which installs malware, or that malware is hidden in a legitimate looking app, and this is what SIP protects against. Even informed power users can make these mistakes - it only takes downloading one compromised utility! IMO for most ‘home’ use where it is used as a main OS by a person without too much familiarity with computers, Ubuntu and many Linux distros are probably less secure than Mac - for instance the average user is conditioned to run random terminal commands they find on the internet and give them sudo permission. Obviously I’m excluding the majority of use-cases such as routers, consoles, tvs, servers where users access to the underlying OS is heavily restricted.
  - alexeiz 4y ago
    Measures like SIP force application developers to create workarounds that compromise system security even more. Remember the recent Zoom vulnerability where they created a special service to autoupdate Zoom? If the system is too restrictive, developers will try to punch holes in it to accomplish what they need.
    - buildbot 4y ago
      I for one am really really glad zoom is unable to mess with the rest of the macos system…
    - Closi 4y ago
      > Measures like SIP force application developers to create workarounds that compromise system security even more. Remember the recent Zoom vulnerability where they created a special service to autoupdate Zoom? If the system is too restrictive, developers will try to punch holes in it to accomplish what they need. That wasn't related to SIP, so I don't think we can just throw random unrelated security issues against SIP to justify it being a bad thing. Bedsides, is the moral of the Zoom story really that application Developers should be given unfettered access to the OS and the freedom to do whatever they want? It sounds like the opposite - an example of exactly why security has to be built into the OS and can't be left to companies like Zoom.
      - wetpaws 4y ago
        Those who want security over performance will get neither security nor performance.
  - zarzavat 4y ago
    Okay sure I agree that my parents shouldn’t turn off SIP, not that they would know how to. But in this case the advice comes from Allan Odgaard, the author of TextMate, on a blog called SIGPIPE. A certain amount of technical expertise can be assumed from the audience.
    - 4y ago
- alexeiz 4y ago
  This is exactly why I use Linux. There is nothing subversive going on behind the scenes. My system trusts that I know what I'm doing and that's why I like it. Also on Windows, the first thing I do is disable the Windows Defender. And believe it or not, I haven't had any viruses for as long as I can remember using computers. On the other hand, half a year ago I've investigated a compromised macOS system at work where the user clicked a wrong button on some innocently looking dialog and ended up with a rogue extension in Google Chrome which was not possible to uninstall. Why didn't SIP prevent that from happening?
  - buildbot 4y ago
    Because Chrome is not part of the MacOS operating system?
  - highwaylights 4y ago
    > Also on Windows, the first thing I do is disable the Windows Defender. And believe it or not, I haven't had any viruses for as long as I can remember using computers. Prove it.
    - depr 4y ago
      You prove Windows Defender will keep you virus free first
      - highwaylights 4y ago
        Well, you can easily find out if it's detected anything by checking it's history, as opposed to having no idea if you have any malware whatsoever - which is what you're advocating for with this stance.
        ubercow13 4y ago
        Right, so check it first, and if it hasn't ever found anything, I guess you're good to disable it.
- highwaylights 4y ago
  It's not at all the same. Linux doesn't have SIP, or Gatekeeper, or XProtect, but you know it doesn't have any of those features. The developers know it doesn't have any of those features, so the absence of those features are part of the attack surface that the vendor (in this case the Linux OSS community) is aware of in the threat model. If you have SIP disabled, no-one is trying to solve any problems that this causes for you. Anyone writing malware to target a SIP-disabled system knows Apple isn't trying to patch those issues because having SIP disabled is not a valid system state they're trying to protect. There won't be patches for you, and given that it's closed source, it's not like you can fix it yourself.
  - vbezhenar 4y ago
    SIP does not solve any problems. SIP only breaks some programs, that's the whole reason of its existence. I don't think that running malware on your computer is a good idea. Just don't do it.
    - tmoravec 4y ago
      > I don't think that running malware on your computer is a good idea. Just don't do it. I don't think that having vulnerabilities on your computer is a good idea. Just don't do it. /s > SIP does not solve any problems. Of course it does. We might disagree with the tradeoffs it's making, it might not be worth it at all, it might be a wrong approach from the start. But saying it does not solve any problems is disingenuous at best.
    - highwaylights 4y ago
      I don't think dying from cancer is a good idea. Just don't do it. SIP absolutely solves a specific problem. It prevents rogue software from writing to protected areas. Whether that matters to you is your business, but to suggest no-one else should want to prevent any old homebrew package or DMG installing a keylogger is a bit silly.
lapcat 4y ago
> However, seems SIP can only be disabled temporarily (until next reboot?), at least according to https://developer.apple.com/documentation/security/disabling https://developer.apple.com/documentation/security/disabling... but it's unclear for how long it is disabled. This is a misreading of the linked document. Disabling SIP is permanent until re-enabled. That's why the document is warning you to only disable it temporarily and then re-enable it. The warning wouldn't be necessary if it automatically re-enabled. "Warning Disable SIP only temporarily to perform necessary tasks, and reenable it as soon as possible. Failure to reenable SIP when you are done testing leaves your computer vulnerable to malicious code."

Synaesthesia 4y ago

By the way with OCLP you can install Monterey onto any Mac dating back to 2012. It’s a great project, and the MacOS runs great.

DMell 4y ago

For those like me who were unaware: > The main task of SIP on Mac is to protect the safety and integrity of the system files and directories, preventing them from modifications or attacks from unauthenticated processes. It brings a high level of security to the entire system.

Gigachad 4y ago
I’m not sure id say disabling it is terrible advice, but the feature is useful. These files are still protected by standard root access, but I suppose the issue was people getting tricked in to copy pasting things in to bash and typing their password in. Or maybe GUI apps asking for admin and doing bad things. The feature has only existed for around 7 years and macOS wasn’t horribly broken before that time.

flohofwoe 4y ago

Apple really needs to do something about the slow-start problem though. Even on my shiny M1 Mac with Monterey it sometimes takes several seconds to start a tiny executable . What's the point of developing new faster CPUs if it takes the software guys just a few months to undo all the hardware progress?

deleted 4y ago
[deleted]
avnigo 4y ago
I guess it's a form of lifestyle inflation. Under limited resources, you tend to be more careful with overheads.
illys 4y ago
"What's the point of developing new faster CPUs if it takes the software guys just a few months to undo all the hardware progress?" Nice you found out and mention it here. It has been like that since new generation x86 CPUs provide compatibility with the previous generation with more speed... Pushing an uncalculable number of tons of perfectly working hardware to the trash, most of the time to keep executing the same tasks with an updated software. When the software performance/optimization declines, the hardware is accused of being too old. Even if hardware speed never declines with age. I understand we need new hardware for new usage; but not for a new version of Windows, Office or MacOS. Just check https://en.wikipedia.org/wiki/Andy_and_Bill%27s_law https://en.wikipedia.org/wiki/Andy_and_Bill%27s_law It goes the same with webpages load, library number and sizes... always a declining optimization with faster hardware.
deleted 4y ago
[deleted]
jakemauer 4y ago
I wonder if you’re encountering MacOS’ Gatekeeper malware checking being slow to communicate with Apple’s servers. My understanding is it checks the app every time you launch.