3 ms·

Just turn off SIP. SIP is for regular users who don’t know what a ulimit is, the whole point of SIP is to lock down the OS as much as possible. If you’re a dev

Just turn off SIP. SIP is for regular users who don’t know what a ulimit is, the whole point of SIP is to lock down the OS as much as possible. If you’re a developer, you live in the Terminal, you obviously need full control over your OS. edit: I appreciate the irony of being downvoted for suggesting having control over your OS on Hacker News, so keep it coming please. Mo’ downvotes mo’ irony.

baq 3y ago
laughs in corporate IT
sspiff 3y ago
I'm a software developer at a company where ~50% of the staff is a developer and our IT fleet management enforces SIP. This simply isn't an option for us because of security requirements from our customers.
- zarzavat 3y ago
  OK, but this is not macOS’s fault.
  - sspiff 3y ago
    SIP is the default though. Turning it off is an option for some, for now. But Apple has clearly indicated they're moving towards a more restrictive ecosystem through there actions for a long time now.
  - DannyBee 3y ago
    It turns out you get to take responsibility for the downstream consequences of your actions, whether you expected them or others help you or not. That is true in most social, legal, etc settings. (in law, it's known as but-for causation) So yes, this is MacOS's fault.
    - tinus_hn 3y ago
      Try moving to Windows and seeing how free you are to setup things in an enterprise environment.
saagarjha 3y ago
Turning off SIP allows for any user process to immediately gain root privileges. This is surprising to most people, so I generally would not recommend it without fully understanding the risks behind it.
- zarzavat 3y ago
  Citation needed. Turning off SIP does not give everything root. It just restores a normal root user, like you would have in Linux. Are you perhaps thinking of single user mode instead?
  - ransackdev 3y ago
    ~You can have a root user with SIP enabled. SIP protects core OS files from being modified while it’s enabled. This prevents processes, even root processes, from swapping out core libs with modified ones, installing root kits, back doors, etc.~ I misspoke > System Integrity Protection (SIP) in macOS protects the entire system by preventing the execution of unauthorized code. The system automatically authorizes apps that the user downloads from the App Store. The system also authorizes apps that a developer notarizes and distributes directly to users. The system prevents the launching of all other apps by default. https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection https://developer.apple.com/documentation/security/disabling... I was thinking of this https://eclecticlight.co/2020/06/25/big-surs-signed-system-volume-added-security-protection/ https://eclecticlight.co/2020/06/25/big-surs-signed-system-v...
  - saagarjha 3y ago
    Uh, this being a repeated problem in the past? Apple puts some sort of god mode behind an entitlement, only checks the entitlement rather than the actual permissions, disabling SIP allows for anyone to steal the entitlement and assume root. Apple does not consider this to be a legitimate security issue because they do not think systems with SIP disabled deserve security.
_sojh 3y ago
You aren’t being downvoted for telling people to have full control over the OS. You can do that with SIP enabled, or boot to recovery, disable, modify, enable, and have full control over your OS. How often are you needing to modify low level OS config that you’d rather make your entire machine vulnerable to root exploits than dance around SIP a couple times a year if that? That’s why you’re being downvoted, for advocating folks make their machine way less secure to save 3 minutes worth of reboot time a year, if that. Bump the hard limit once and you never need to touch it again.
- hashhar 3y ago
  That doesn't work now. The change in limits doesn't persist across restarts anymore like it used to in the past.
- dandellion 3y ago
  3 minutes worth of reboot time a year for this, 2 minutes worth of reboot time for that, 1 for something else and 2 extra for no apparent reason. My previous company switched everyone to Mac and the second biggest reason I quit that job was that Mac was a horrible OS to work on. Constant reboots, crashes, no configuration for basic things like scrolling or window placement. Apple builds great hardware but the OS is only good to make presentations and edit video, not for software development.
  - ransackdev 3y ago
    A large number of extremely talented engineers might beg to differ. Everything you listed as an issue has a solution. Like any operating system, you have to spend the time to learn the intricacies of how it works and to customize it to your liking. For me, must haves are Alfred to replace spotlight, my dotfiles which change a ton of defaults in various apps like finder, the dock, etc, setup key repeat, iterm2 colors and profile, etc. divvy and magnet for window management. Caffeine to prevent sleep. Stats open source menu monitors to replace istatmenus I’m sure there are newer equivalents to what I’ve listed. I’ve been using those programs for years. Some jumping off points https://github.com/jaywcjlove/awesome-mac https://github.com/jaywcjlove/awesome-mac https://formulae.brew.sh/analytics/cask-install/30d/ https://formulae.brew.sh/analytics/cask-install/30d/
CodesInChaos 3y ago
A user who understands fd limits will not raise it above FD_SETSIZE globally.
DannyBee 3y ago
I would suggest you likely aren't being downvote because you suggest having control, instead, you are being downvoted because you seem to believe that turning off SIP is like a normal thing that people should be doing regularly. I think you are finding strong disagreement with that. People probably don't believe they should have to do that to perform regular development work.

baq 3y ago

laughs in corporate IT

sspiff 3y ago

I'm a software developer at a company where ~50% of the staff is a developer and our IT fleet management enforces SIP. This simply isn't an option for us because of security requirements from our customers.

zarzavat 3y ago
OK, but this is not macOS’s fault.
- sspiff 3y ago
  SIP is the default though. Turning it off is an option for some, for now. But Apple has clearly indicated they're moving towards a more restrictive ecosystem through there actions for a long time now.
- DannyBee 3y ago
  It turns out you get to take responsibility for the downstream consequences of your actions, whether you expected them or others help you or not. That is true in most social, legal, etc settings. (in law, it's known as but-for causation) So yes, this is MacOS's fault.
  - tinus_hn 3y ago
    Try moving to Windows and seeing how free you are to setup things in an enterprise environment.

saagarjha 3y ago

Turning off SIP allows for any user process to immediately gain root privileges. This is surprising to most people, so I generally would not recommend it without fully understanding the risks behind it.

zarzavat 3y ago
Citation needed. Turning off SIP does not give everything root. It just restores a normal root user, like you would have in Linux. Are you perhaps thinking of single user mode instead?
- ransackdev 3y ago
  ~You can have a root user with SIP enabled. SIP protects core OS files from being modified while it’s enabled. This prevents processes, even root processes, from swapping out core libs with modified ones, installing root kits, back doors, etc.~ I misspoke > System Integrity Protection (SIP) in macOS protects the entire system by preventing the execution of unauthorized code. The system automatically authorizes apps that the user downloads from the App Store. The system also authorizes apps that a developer notarizes and distributes directly to users. The system prevents the launching of all other apps by default. https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection https://developer.apple.com/documentation/security/disabling... I was thinking of this https://eclecticlight.co/2020/06/25/big-surs-signed-system-volume-added-security-protection/ https://eclecticlight.co/2020/06/25/big-surs-signed-system-v...
- saagarjha 3y ago
  Uh, this being a repeated problem in the past? Apple puts some sort of god mode behind an entitlement, only checks the entitlement rather than the actual permissions, disabling SIP allows for anyone to steal the entitlement and assume root. Apple does not consider this to be a legitimate security issue because they do not think systems with SIP disabled deserve security.

_sojh 3y ago

You aren’t being downvoted for telling people to have full control over the OS. You can do that with SIP enabled, or boot to recovery, disable, modify, enable, and have full control over your OS. How often are you needing to modify low level OS config that you’d rather make your entire machine vulnerable to root exploits than dance around SIP a couple times a year if that? That’s why you’re being downvoted, for advocating folks make their machine way less secure to save 3 minutes worth of reboot time a year, if that. Bump the hard limit once and you never need to touch it again.

hashhar 3y ago
That doesn't work now. The change in limits doesn't persist across restarts anymore like it used to in the past.
dandellion 3y ago
3 minutes worth of reboot time a year for this, 2 minutes worth of reboot time for that, 1 for something else and 2 extra for no apparent reason. My previous company switched everyone to Mac and the second biggest reason I quit that job was that Mac was a horrible OS to work on. Constant reboots, crashes, no configuration for basic things like scrolling or window placement. Apple builds great hardware but the OS is only good to make presentations and edit video, not for software development.
- ransackdev 3y ago
  A large number of extremely talented engineers might beg to differ. Everything you listed as an issue has a solution. Like any operating system, you have to spend the time to learn the intricacies of how it works and to customize it to your liking. For me, must haves are Alfred to replace spotlight, my dotfiles which change a ton of defaults in various apps like finder, the dock, etc, setup key repeat, iterm2 colors and profile, etc. divvy and magnet for window management. Caffeine to prevent sleep. Stats open source menu monitors to replace istatmenus I’m sure there are newer equivalents to what I’ve listed. I’ve been using those programs for years. Some jumping off points https://github.com/jaywcjlove/awesome-mac https://github.com/jaywcjlove/awesome-mac https://formulae.brew.sh/analytics/cask-install/30d/ https://formulae.brew.sh/analytics/cask-install/30d/

CodesInChaos 3y ago

A user who understands fd limits will not raise it above FD_SETSIZE globally.

DannyBee 3y ago

I would suggest you likely aren't being downvote because you suggest having control, instead, you are being downvoted because you seem to believe that turning off SIP is like a normal thing that people should be doing regularly. I think you are finding strong disagreement with that. People probably don't believe they should have to do that to perform regular development work.