Hacker News Reader

Comment by yifanlu | Hacker News Reader

I don't get that point. "Normal" users won't (and shouldn't) disable SIP. Those who do need to for security research won't really care that Apple knows they're poking into the system (when you disclose a vulnerability, they'll know who you are) and for the very paranoid, you can disable network or block connections to Apple or etc.

It's a strawman argument because for security researchers, there is never a problem of "we can't let them know we're looking". There's also no evidence that Apple phones home the status either.

And re:"barrier of entry". Who should we be protecting? Amateur security researchers or mass users? As an amateur security researcher I'd happily allow my job to be 10x harder if it makes users even 2x safer.

View on HN

We might want to hide our activity from malware. The malware might delete itself as soon as SIP is disabled.

If you're looking to hide your activity from malware, you should be incredibly excited by SIP. With SIP enabled, you have more protection from malware introspecting other processes or monitoring activity on the system. Hell, if you're a researcher building tools to detect and analyze OS X malware, you'd likely benefit from SIP by opting-in your tools to SIP's restrictions. (Tangential example: Chrome is taking this step; Canary is currently SIP restricted.)

Malware can only introspect SIP-protected activity by employing kernel exploits. If malware can compromise the kernel, it's game over. You're not going to hide anything, ever.

If anything, it sounds like you want SIP's purview expanded to encompass more of OS X.

I'd happily allow my job to be 10x harder if it makes users even 2x safer.

How did you become a security researcher? If it was 10x harder to get started, perhaps you might've never started, or given up long ago. A future with fewer security researchers is not a good thing, wouldn't you agree?

And by your argument the safest user is one who cannot do anything even remotely unsafe, which is a deeply disturbing dystopian thought. SIP is just another step toward an environment in which users are not longer users - they're the ones being used.

>A future with fewer security researchers is not a good thing, wouldn't you agree?

Depends. If it also means fewer malware, then I'm all ok for SIP and similar things to put security researchers out of business.

Where you sad when a while booming business for security tools and antivirus slowed down when people moved away from Windows 9x?

Reply on news.ycombinator.com