3 ms·

Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "not

Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" or leaving the platform. Not everyone faces the same risks. Something like (just typing this out, haven't thought it through): Having Apple associate your hardware with an apple id. Logging into apple id and registering a key. Apple signs key and you can install key on the specific hardware. You can then use said key to sign a security policy. The key can be removed by install Apple's default key by anyone, increasing the security level back to normal.

threeseed 4y ago
Apple is not building laptops primarily for technical people. If you want to disable specific security mechanisms then disable SIP. But making that an option that developers will use to exploit less technical people is not good for the platform or frankly anyone.
Wowfunhappy 4y ago
> Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" But is that so bad? For technically-inclined users, I'm still largely unconvinced of the value of SIP. Either you want Apple to be in control of your computer—and I think that's a perfectly reasonable default, if it can be changed—or you want to take control. If you take control, you must by definition also take responsibility for delegating those privileges to locally-installed software—which you can do via the standard UNIX permissions model. Apple added an extra layer on top of UNIX permissions in order to limit the users' maximum privilege level. If the user tells Apple to GTFO, there's no need for an extra layer.
- Terretta 4y ago
  > For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.
  - TheNewsIsHere 4y ago
    I find that I fall somewhere in between. I tend to turn on (or leave on, or configure) every security feature available that doesn’t create an immovable obstacle to my needs. Lockdown mode does that, so I partially counteract that by running SAP Privileges and also creating a separate, dedicated admin account that I almost never end up signing into directly. Turning SIP off just doesn’t make sense to me without a compelling reason. Those reasons aren’t as common as they used to be. I seem to remember early in the life of SIP, the Steam client didn’t work well so you’d end up disabling SIP on some personal devices. I don’t think that’s been the case for a long while.
rgovostes 4y ago
Apple already engineered SIP to let the user disable it with csrutil. It is unsupported but you can selectively disable parts of SIP. (You cannot Apple Pay if any flag is disabled.) https://twitter.com/theevilbit/status/1400071405207760904 https://twitter.com/theevilbit/status/1400071405207760904
tinus_hn 4y ago
Apple doesn’t need to do this at all. You want them to do this.

threeseed 4y ago

Apple is not building laptops primarily for technical people. If you want to disable specific security mechanisms then disable SIP. But making that an option that developers will use to exploit less technical people is not good for the platform or frankly anyone.

Wowfunhappy 4y ago

> Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" But is that so bad? For technically-inclined users, I'm still largely unconvinced of the value of SIP. Either you want Apple to be in control of your computer—and I think that's a perfectly reasonable default, if it can be changed—or you want to take control. If you take control, you must by definition also take responsibility for delegating those privileges to locally-installed software—which you can do via the standard UNIX permissions model. Apple added an extra layer on top of UNIX permissions in order to limit the users' maximum privilege level. If the user tells Apple to GTFO, there's no need for an extra layer.

Terretta 4y ago
> For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.
- TheNewsIsHere 4y ago
  I find that I fall somewhere in between. I tend to turn on (or leave on, or configure) every security feature available that doesn’t create an immovable obstacle to my needs. Lockdown mode does that, so I partially counteract that by running SAP Privileges and also creating a separate, dedicated admin account that I almost never end up signing into directly. Turning SIP off just doesn’t make sense to me without a compelling reason. Those reasons aren’t as common as they used to be. I seem to remember early in the life of SIP, the Steam client didn’t work well so you’d end up disabling SIP on some personal devices. I don’t think that’s been the case for a long while.

rgovostes 4y ago

Apple already engineered SIP to let the user disable it with csrutil. It is unsupported but you can selectively disable parts of SIP. (You cannot Apple Pay if any flag is disabled.) https://twitter.com/theevilbit/status/1400071405207760904 https://twitter.com/theevilbit/status/1400071405207760904

tinus_hn 4y ago

Apple doesn’t need to do this at all. You want them to do this.