ricardbejarano

It's due to Night Shift, set it to a custom schedule (or enable location services but only for time zone settings)

I was inspired in part by this guide, it's very full-featured, but I wanted to give the community a simplified version of it, it contains too much text/bloat/detail which, don't get me wrong, it's awesome for those who want to learn about macOS security, but the everyday user would rather have a simple checklist.

Thanks for the kind words!

IIRC, Google DNS and Cloudflare DNS both support "DNS over TLS" and "DNS over HTTPS", that's the reason I recommend them in the first place.

The sources I recall while writing this:

- https://github.com/drduh/macOS-Security-and-Privacy-Guide

- https://github.com/CISOfy/lynis

- https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.s...

- https://help.apple.com/machelp/mac/10.12/index.html#/mh11389

- http://newosxbook.com/files/moxii3/AppendixA.pdf

Hope it helps!

Thanks for the feedback!

Standard accounts are recommended by Apple itself as a best practice in lieu of administrator accounts. Also, sudo is not available in standard accounts which protects against any would-be vulnerability.

I updated the post regarding application sources.

I changed Google DNS with Cloudflare's 1.0.0.1. Others also mentioned the fact that suggesting a VPN provider is risky, so I also removed it.

I know some steps are redundant coming from a brand new installation, but not everyone is willing to format their drive right now, so those steps are included as well.

Again, thanks for the feedback!

I don't think he meant "failure" so much but rather criticise the fact that operating systems sometimes deliver not-the-greatest defaults. To be fair, macOS has a very strong default set, this just takes it the extra mile.

One of my sources was this guide, it's great.

> An attacker could trigger the utility and direct a Mac to a site with malware without user interaction, so it's best to disable this feature and log in to captive portals using your regular Web browser, provided you have first disable any custom dns and/or proxy settings.

See https://github.com/drduh/macOS-Security-and-Privacy-Guide#ca...

Thanks for your feedback!

I agree with your points and I updated the post so.

macOS is pretty secure by default but there are some extra steps you can take towards improving on that regard, Apple itself has a bunch of very basic steps listed here: https://help.apple.com/machelp/mac/10.12/index.html#/mh11389

True.

I put it as a failover for Cloudflare's 1.1.1.1 because they both support DNS over TLS and DNS over HTTPS and even though DNS servers are rarely down, I didn't want to recommend a single point of failure with Cloudflare's 1.1.1.1 and 1.0.0.1, but you are free to choose whatever resolvers you want.

Thanks for the feedback!

I agree that "secure by default" should be, well, the default.

I envy OpenBSD's way of delivering a secure system out-of-the-box, instead of everyone else's "pretty much secure but...".

Command Line Heroes: https://www.redhat.com/en/command-line-heroes

Podcast by RedHat on tech history, systems, open source, cloud...

Very well produced (like, really well produced) but few episodes.

Season 2 is airing right now on what looks like a biweekly schedule.

VirualBox does not work: https://www.virtualbox.org/ticket/17805

tl;dr: Mojave blocks the VBoxDrv.kext <5.3 kernel extension from loading because "it will panic the machine if allowed to load", and it's up to Oracle to patch on version >=5.3 (current latest is 5.2.18)

Systems that depend on VirtualBox such as Vagrant don't work either.

Some guy has posted a workaround but it involves disabling the SIP, proceed at your own risk: https://silvae86.github.io/sysadmin/mojave/beta/vagrant/virt...

So they want users to ditch one centralized service provider with another?

I have no Google/Microsoft/iCloud account, ProtonMail has been covering my (pretty basic) email needs for well over three years now, and now I'm leaving them.

Proton has been talking about adding calendar for years (unreleased), then they started working on ProtonDrive (unreleased), now they talk about an office suite... Then then flirted with the idea of doing an ICO to fund themselves, at which point I decided to leave. I don't want to be in a ship that sails in circles and doesn't have a clear direction.

ProtonMail free has 500MB, no IMAP, and max of 3 folders and 150 emails a day, versus Google's free, familiar, full-featured set of well-integrated services. Will they convince the average Google user to leave productivity behind, and pay in the process?

And again, they are a for-profit. What will happen the day they realize they can't pay the bills at the Alps with free users?

They can promise whatever they want, Google's motto was "Don't be evil".