Hacker News Reader

I expect Macs in enterprise/education are locked down so that Gatekeeper and SIP can't be turned off by normal users.

But preventing ALL Macs from turning off Gatekeeper and SIP? I think that would be unpopular.

A company or school can already do this easily, by the way, by setting a boot-loader password and restricting admin access. Notably, this are normal macOS functions, you don't need a fancy mtm setup.

That would violate GPLv3, wouldn't it?

IANAL, but I really don't think so. On a company laptop, the company owns the laptop, and the company can lock it down as much or as little as they want.

Reply on news.ycombinator.com