2 ms·

> Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "n

> Apple needs to allow users to defeat certain security mechanism without disabling SIP. The "all or nothing" approach will end up with a lot of people going "nothing" But is that so bad? For technically-inclined users, I'm still largely unconvinced of the value of SIP. Either you want Apple to be in control of your computer—and I think that's a perfectly reasonable default, if it can be changed—or you want to take control. If you take control, you must by definition also take responsibility for delegating those privileges to locally-installed software—which you can do via the standard UNIX permissions model. Apple added an extra layer on top of UNIX permissions in order to limit the users' maximum privilege level. If the user tells Apple to GTFO, there's no need for an extra layer.

Terretta 4y ago
> For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.
- TheNewsIsHere 4y ago
  I find that I fall somewhere in between. I tend to turn on (or leave on, or configure) every security feature available that doesn’t create an immovable obstacle to my needs. Lockdown mode does that, so I partially counteract that by running SAP Privileges and also creating a separate, dedicated admin account that I almost never end up signing into directly. Turning SIP off just doesn’t make sense to me without a compelling reason. Those reasons aren’t as common as they used to be. I seem to remember early in the life of SIP, the Steam client didn’t work well so you’d end up disabling SIP on some personal devices. I don’t think that’s been the case for a long while.

Terretta 4y ago

> For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.

TheNewsIsHere 4y ago
I find that I fall somewhere in between. I tend to turn on (or leave on, or configure) every security feature available that doesn’t create an immovable obstacle to my needs. Lockdown mode does that, so I partially counteract that by running SAP Privileges and also creating a separate, dedicated admin account that I almost never end up signing into directly. Turning SIP off just doesn’t make sense to me without a compelling reason. Those reasons aren’t as common as they used to be. I seem to remember early in the life of SIP, the Steam client didn’t work well so you’d end up disabling SIP on some personal devices. I don’t think that’s been the case for a long while.