3 ms·
> For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be r
by Terretta 4y ago
> For technically-inclined users, I'm still largely unconvinced of the value of SIP.
Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week.
Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator.
https://github.com/SAP/macOS-enterprise-privileges https://github.com/SAP/macOS-enterprise-privileges
This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.
- TheNewsIsHere 4y agoI find that I fall somewhere in between. I tend to turn on (or leave on, or configure) every security feature available that doesn’t create an immovable obstacle to my needs. Lockdown mode does that, so I partially counteract that by running SAP Privileges and also creating a separate, dedicated admin account that I almost never end up signing into directly. Turning SIP off just doesn’t make sense to me without a compelling reason. Those reasons aren’t as common as they used to be. I seem to remember early in the life of SIP, the Steam client didn’t work well so you’d end up disabling SIP on some personal devices. I don’t think that’s been the case for a long while.