4 ms·

SIP really helps protect people from themselves, and it’s easily disabled for those who need it (but it’s definitely a red flag). A couple years ago many edit

by dagmx 4y ago

SIP really helps protect people from themselves, and it’s easily disabled for those who need it (but it’s definitely a red flag). A couple years ago many edit houses in LA suddenly had boot issues because a Chrome update was over writing system files when the updater was run with elevated privileges. The issue was that these studios used Avid which required disabling sip at the time. Other houses that didn’t disable sip were unaffected because it protects against exactly this kind of scenario.

GekkePrutser 4y ago
I don't want to be protected from myself. As the admin I should have full access to the stuff I buy. Disabling it is ok but the problem with that is that you lose all security. There should be a way to add our own signing keys to persist changes to the SSV (Signed System Volume) and SIP protected folders. It shouldn't be trust only Apple or nothing.
- dagmx 4y ago
  You do have full access to what you buy. While it would be nice to both have full access AND the security, that’s still not denying you full access.
- pjmlp 4y ago
  This is not for you, rather for the kind of people that get Ask Jeeves installed when clicking on popups while browsing the Web.
  - counttheforks 4y ago
    They shouldn't have the same rights? Just because someone is less technologically aware today, you think it's OK to start stripping away their rights? That's like saying poor people shouldn't be allowed to own a house because they won't be able to afford the maintenance.
    - dagmx 4y ago
      The more accurate version of your analogy is that they can choose to do their maintenance, they just won’t be covered by insurance (their own or that of a tradesman) if something goes wrong. That is actually how it is in reality, and maps very well to as analogies to the two levels of SIP.
    - pjmlp 4y ago
      Many insurances don't cover house repairs if not done by companies specialised on the repair domain....
- Aaron2222 4y ago
  The new cryptex mechanism could be used to allow persistent modifications to the SSV (that's how it's done on the iOS Security Research Devices), but no idea if Apple will actually implement that.

by dagmx 4y ago

GekkePrutser 4y ago

I don't want to be protected from myself. As the admin I should have full access to the stuff I buy. Disabling it is ok but the problem with that is that you lose all security. There should be a way to add our own signing keys to persist changes to the SSV (Signed System Volume) and SIP protected folders. It shouldn't be trust only Apple or nothing.

dagmx 4y ago
You do have full access to what you buy. While it would be nice to both have full access AND the security, that’s still not denying you full access.
pjmlp 4y ago
This is not for you, rather for the kind of people that get Ask Jeeves installed when clicking on popups while browsing the Web.
- counttheforks 4y ago
  They shouldn't have the same rights? Just because someone is less technologically aware today, you think it's OK to start stripping away their rights? That's like saying poor people shouldn't be allowed to own a house because they won't be able to afford the maintenance.
  - dagmx 4y ago
    The more accurate version of your analogy is that they can choose to do their maintenance, they just won’t be covered by insurance (their own or that of a tradesman) if something goes wrong. That is actually how it is in reality, and maps very well to as analogies to the two levels of SIP.
  - pjmlp 4y ago
    Many insurances don't cover house repairs if not done by companies specialised on the repair domain....
Aaron2222 4y ago
The new cryptex mechanism could be used to allow persistent modifications to the SSV (that's how it's done on the iOS Security Research Devices), but no idea if Apple will actually implement that.