Hacker News Reader

Comment by on_ | Hacker News Reader

Thanks. I will disable it. Not to be rude, as I appreciate the advice, but what would you consider:

> a really good reason?

I think access to my own filesystem is good enough. I admit when I looked at the reviews, I made sure there were no major issues before upgrade but missed this "sys integrity" thing.

View on HN

With SIP off it's pretty easy to social engineer your way into the user's system, especially on dev machines - we all install all kinds of stuff that requires sudo, but until now sudo will let you at literally anything - including replacing core OS files with malware replacements, and most installers are pretty opaque (not that you have the time or inclination to closely examine all installers anyway).

The current state of affairs means that users - even non-technical ones - are routinely asked for their admin pwds in everyday use, but every time they enter it they are susceptible to be totally and utterly pwned.

Even expert users fall victim when they turn off system safeguards - XcodeGhost being only the most recent example, where only users who actively disabled Gatekeeper/codesign checking were susceptible.

It's kind of annoying for power users, but time and time again I think we've proven that power users aren't in any way immune to social engineering or simple blanket malware attack.

> but what would you consider:

> > a really good reason?

Honestly, as devs, we're more susceptible to this kind of attack than the average user, not less (e.g. see XcodeGhost). System integrity protection is great for us, yet I see a great deal of hubris when it's mentioned–as if we're somehow immune, or that we audit all the code we run.

I download all manner of tools for development work, and use sudo as and when necessary, and I'm thankful there's now an extra layer of security. If I needed to modify the filesystem (e.g. if I wanted to delete an app like another poster did), I'd disable SIP temporarily to do so, and I think that's fine, but I think it would be unwise to disable it permanently, especially on a whim. I would hope that modification of these sorts of files would be rare enough that it's not a big inconvenience anyway.

It is your filesystem, but these are system files. Is it really important to you to be able to muck around the OS? If it is, then you go find a way to disable the protections.

Windows also has the System Integrity Protection equivalent.

Yes. I am disabling/removing shitty bloatware and removing apple phone home gor privacy.

So you're compromising security to do it?

Game Center is ~4MB, and you'll never remove all the potential "phone home" hooks without rewriting the OS. Your approach is akin to taking wheels off a car to reduce weight so it goes faster.

I was simply asking if this was a GM issue or something else. I needed access to my filesystem to make some changes and was providing a bit of feedback to others upgrading. I didn't think this was stack overflow. I had internet disabled and was loading applications from my USB, that I keep for these purposes and running config scripts. I only had mobile anyway so it was difficult to find answers. I still do not know if SIP can be turned back on, but if it can (which would be reasonable) I faced little risk on fresh install with internet disabled. If possible, I will turn it back on after my env is set up.

I share your sentiment towards privacy, I guard mine fiercely as well.

If I may say so though, I think you're coming at this the wrong way.

Trying to disable every component in the OS that phones home simply doesn't scale, may I suggest you explore gateway firewall devices such as PFSense, or the free version of Sophos' UTM if you prefer a more polished UI?

I use a Sophos UTM at home and I can see (and block) every request that my Macs use to try to phone home, with HTTP, HTTPS or regular network traffic.

I also use the Always-On VPN on my phone to apply ad blocking at the firewall level which protects my phone as well.

Very much worth checking out. Gateway protections are the only way to go these days IMO.

Edit: Just to add, at first glance I find the SIP system to be rather anti-user, but people in this thread are right. It's valuable protection to have in place. If I used a Mac at home I would only disable this to make the changes I needed before turning it back on again.

Edit to clarify: I use a Mac, but only has a HTPC and not as a desktop or workstation, and all outbound traffic is blocked by default.

Thanks, this was a helpful response unlike the SOish answers which I found unneccesarily hostile. If you see my comment below I was fairly protected.

I will look into those suggestions. Do to the differences and additions in caputan little snitch does not work. I havent connected to internet yet whoch ice floor needs to be configured properly. Does SOPHOS UTM work well even as a free version. It is annoying when snitch lets traffic out after 3grs.

As sad as this will sound, I cant afford a VPN. I set one up myself using OpenDNS and tunnelblick, which I should probably spin back up. Any other security suggestions? I can only use free stuff ATM .

The only limitation on the free version of the utm that I found so far is that you can't have more than 10 IPs active, but nothing stops you from using nat to get around that.

The utm itself actually hosts and serves the VPN connection by the way. My phone connects directly to the VPN on my UTM. You'll see a speed hit because of the extra hop unless you put your utm in the cloud.

I hope that's helpful :)

Disabling it would increase the attack area for a malicious app that could somehow gain elevated access.

Since it is possible to disable, why not disable it as-needed rather than always?

> why not disable it as needed

i am. ;)

Reply on news.ycombinator.com