3 ms·

> you are only allowed to install software on it that Apple says you are allowed to This isn't accurate. macOS' default security settings (System > Security &

> you are only allowed to install software on it that Apple says you are allowed to This isn't accurate. macOS' default security settings (System > Security & Privacy) have "Allow apps downloaded from:" set to "App Store" by default. Selecting "App Store and identified developers" allows you to install anything from the App store, or anything that's been code signed. If you want to execute unsigned code, you can disable SIP (System Integrity Protection) and relive all your 8088 glory days. > You can only pay for software on their own store. Also entirely inaccurate. Almost all of the macOS software I've purchased was done so outside of the App store, paying developers directly.

WaitWaitWha 4y ago
I am not intimately familiar with the Apple ecosystem. This still reads like all or nothing. All as in "App Store and identified developers", or user can turn off "System Integrity Protection" completely. Turning off SIP eliminates any protection. Is that what it means to disable SIP?
- virtualritz 4y ago
  If you want run an unsigned installer you just right click in Finder and select 'Open' instead of double clicking. I'm not aware of any Mac user among my friends who isn't aware of this. Most OSS installers but even many commerical ones aren't code signed because devs don't want to pay the Apple tax.
  - shepherdjerred 4y ago
    > I'm not aware of any Mac user among my friends who isn't aware of this. I don't think any of my non-tech friends would know this.
    - billti 4y ago
      I think that's the point though. Our non-tech friends are exactly the people who shouldn't be downloading and installing random (unsigned) binaries. As much as I love to hack and tinker with my OS, I also appreciate the safety inherent in the Apple ecosystem. That's why even as a life-long Windows user, I bought my Dad an iPad - I know the chance of him getting p0wned via some social engineering attack and having his banking password stolen are a lot lower than with a Windows or Android tablet.
- klodolph 4y ago
  My understanding is that SIP makes certain locations read-only, like /System, /usr, applications bundled with the OS, etc. You’d turn it off if you had a bunch of wacky Unix packages from the old days that expected to run from specific paths. I think if you want to just run any code you want, you sudo spctl --master-disable. I’ve never had to use it.
- shepherdjerred 4y ago
  SIP is a collection of protection features. You can disable bits and pieces, or all of it. Disabling SIP is generally a bad idea, but there are times when it can be useful, e.g. modifying stock applications like Dock.app. You don't need to disable SIP to run unsigned code. If a binary is unsigned all you need to do is hold a key down while clicking the program. macOS will show a warning popup and let you continue. This isn't super user friends, but then again the majority of Apple's customers are not going to (or want to) run untrusted code, and if you do want to run untrusted code it is not that big of an inconvenience.

WaitWaitWha 4y ago

I am not intimately familiar with the Apple ecosystem. This still reads like all or nothing. All as in "App Store and identified developers", or user can turn off "System Integrity Protection" completely. Turning off SIP eliminates any protection. Is that what it means to disable SIP?

virtualritz 4y ago
If you want run an unsigned installer you just right click in Finder and select 'Open' instead of double clicking. I'm not aware of any Mac user among my friends who isn't aware of this. Most OSS installers but even many commerical ones aren't code signed because devs don't want to pay the Apple tax.
- shepherdjerred 4y ago
  > I'm not aware of any Mac user among my friends who isn't aware of this. I don't think any of my non-tech friends would know this.
  - billti 4y ago
    I think that's the point though. Our non-tech friends are exactly the people who shouldn't be downloading and installing random (unsigned) binaries. As much as I love to hack and tinker with my OS, I also appreciate the safety inherent in the Apple ecosystem. That's why even as a life-long Windows user, I bought my Dad an iPad - I know the chance of him getting p0wned via some social engineering attack and having his banking password stolen are a lot lower than with a Windows or Android tablet.
klodolph 4y ago
My understanding is that SIP makes certain locations read-only, like /System, /usr, applications bundled with the OS, etc. You’d turn it off if you had a bunch of wacky Unix packages from the old days that expected to run from specific paths. I think if you want to just run any code you want, you sudo spctl --master-disable. I’ve never had to use it.
shepherdjerred 4y ago
SIP is a collection of protection features. You can disable bits and pieces, or all of it. Disabling SIP is generally a bad idea, but there are times when it can be useful, e.g. modifying stock applications like Dock.app. You don't need to disable SIP to run unsigned code. If a binary is unsigned all you need to do is hold a key down while clicking the program. macOS will show a warning popup and let you continue. This isn't super user friends, but then again the majority of Apple's customers are not going to (or want to) run untrusted code, and if you do want to run untrusted code it is not that big of an inconvenience.