Hacker News Reader

Comment by lapcat | Hacker News Reader

> Install and configure Google’s Santa.

Interesting, I'd never heard of this before. "A binary authorization system for macOS". Open source.

I've set this up once. It is a mammoth and ongoing effort to tune it for your org. Ended up dropping it for all but the most locked down machines.

Can you say how the setup compares to Little Snitch, for example?

That is like comparing apples to oranges.

> That is like comparing apples to oranges.

That doesn't seem like helpful reply.

I was asking about the time/complexity/difficulty of setup. It can be somewhat painful to setup and train Little Snitch, but it's ok after that.

Little Snitch seems to be a consumer-focused product while Santa is more for org-wide policy management, although I didn't check if LS had a business product available.

Is it just application whitelisting / blacklisting basically? Sounds like Applocker which is used extensively and not THAT much work to really tune. Bit of upfront work and then its pretty smooth sailing from there - especially of course if you just run it in the monitoring mode without any enforcements.

I love it as a way to prevent Apple Music and other default apps from ever running, which happens from time to time for some reason I can never figure out.

Or some Apple TV app that constantly starts up for some reason that I can not figure out at all

If you never use those apps, you can also remove the executable flag with `chmod -x` and they won’t open anymore.

You cannot touch system apps when SIP is engaged.

Only time I've seen that is when I connected an AppleTV remote to the Mac to charge it. Pressing the buttons launches the Music app.

Do you own AirPods? When removing them from your ears, it’s easy to accidentally click the stems. The system interprets that as a Play command and will often launch Apple Music in response.

Reply on news.ycombinator.com