Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OS X El Capitan on the Mac App Store

itunes.apple.com

Post reply on HN
Print view View original

81–90 of 158 posts

Re: OS X El Capitan on the Mac App Store

#81

Post by Someone »

falcolas wrote: post #14
alexbock wrote: post #9

Earlier quoted context omitted.

I think you misunderstand how "rootless" works. Nothing is stopping you from using "sudo su" if you want to be root for some reason. The new security features prevent certain system files from being modified even if you are logged in as root. This can be disabled if you boot into recovery mode and use the terminal. More info: https://developer.apple.com/library/prerelease/ios/documenta...

> The new security features prevent certain system files from being modified even if you are logged in as root. As a superuser, this annoys me. As a security conscious sysadmin, I'm mostly OK with this, though the lack of access except via recovery mode makes for a potential aggravation (makes remote assistance hard).

On the plus side, this makes it even less likely that your users manage to mess up their system so much that remote assistance doesn't work anymore.

Re: OS X El Capitan on the Mac App Store

#83

Post by spudlyo »

astrange wrote: post #60
spudlyo wrote: post #54

Earlier quoted context omitted.

Thanks for bringing this up, I just cancelled my download. There is no way I'm going to run an OS that attempts to limit my power to delete or modify applications. I think this may be the final straw for me and OSX. I very recently had to attack GarageBand with a hex editor to disable app sandboxing so I could use third party VST plugins. I realize System Integrity Protection can be disabled by a kernel boot param, b…

You already couldn't modify most system applications or they would fail code-signing checks. This is merely preventing malware from modifying them.

By that logic malware presumably couldn't modify them either, right?

Re: OS X El Capitan on the Mac App Store

#84

Post by RexRollman »

falcolas wrote: post #14
alexbock wrote: post #9

Earlier quoted context omitted.

I think you misunderstand how "rootless" works. Nothing is stopping you from using "sudo su" if you want to be root for some reason. The new security features prevent certain system files from being modified even if you are logged in as root. This can be disabled if you boot into recovery mode and use the terminal. More info: https://developer.apple.com/library/prerelease/ios/documenta...

> The new security features prevent certain system files from being modified even if you are logged in as root. As a superuser, this annoys me. As a security conscious sysadmin, I'm mostly OK with this, though the lack of access except via recovery mode makes for a potential aggravation (makes remote assistance hard).

I believe you turn off protection via recovery mode and then reboot, after which the system behaves like it did before.

Re: OS X El Capitan on the Mac App Store

#85

Post by Osmium »

on_ wrote: post #53
kitsunesoba wrote: post #38

Earlier quoted context omitted.

That’s System Integrity Protection. Under it, system files cannot be deleted or modified, even with sudo. It protects down to the block level, so even if you try to bypass the file system and write to blocks composing system files directly you’ll get an error. This can be disabled but I wouldn’t advise doing so unless you have a really good reason to.

Thanks. I will disable it. Not to be rude, as I appreciate the advice, but what would you consider: > a really good reason? I think access to my own filesystem is good enough. I admit when I looked at the reviews, I made sure there were no major issues before upgrade but missed this "sys integrity" thing.

> but what would you consider:

> > a really good reason?

Honestly, as devs, we're more susceptible to this kind of attack than the average user, not less (e.g. see XcodeGhost). System integrity protection is great for us, yet I see a great deal of hubris when it's mentioned–as if we're somehow immune, or that we audit all the code we run.

I download all manner of tools for development work, and use sudo as and when necessary, and I'm thankful there's now an extra layer of security. If I needed to modify the filesystem (e.g. if I wanted to delete an app like another poster did), I'd disable SIP temporarily to do so, and I think that's fine, but I think it would be unwise to disable it permanently, especially on a whim. I would hope that modification of these sorts of files would be rare enough that it's not a big inconvenience anyway.

Re: OS X El Capitan on the Mac App Store

#86

Post by Domenic_S »

teej wrote: post #48
kitsunesoba wrote: post #38

Earlier quoted context omitted.

That’s System Integrity Protection. Under it, system files cannot be deleted or modified, even with sudo. It protects down to the block level, so even if you try to bypass the file system and write to blocks composing system files directly you’ll get an error. This can be disabled but I wouldn’t advise doing so unless you have a really good reason to.

I'm glad game center.app is so well protected.

mv malware.app game\ center.app

what happens when you assume apps that came with the OS are legit?

Re: OS X El Capitan on the Mac App Store

#87

Post by x0rg »

S_A_P wrote: post #79
x0rg wrote: post #66

Earlier quoted context omitted.

Wait, feeling that this update is better is OK, but I don't really understand how formatting could improve thing is such a significant way.

perception is reality. I've no doubt there are cases that upgrade in place doesnt work as well as fresh install, but I am skeptical that there is dramatic demonstrable differences between the two most of the time.

For yosemite, I have a macbook pro that came with the OS and another macbook pro (nearly identical) upgraded from mavericks. No significant differences. I don't see why it should be like that this time and I would love to read a technical explanation.

Re: OS X El Capitan on the Mac App Store

#88

Post by mhurron »

Domenic_S wrote: post #86
teej wrote: post #48

Earlier quoted context omitted.

I'm glad game center.app is so well protected.

mv malware.app game\ center.app what happens when you assume apps that came with the OS are legit?

> mv malware.app game\ center.app

You can't do that unless you turned it off in the first place. And if you did, you're on your own anyway.

Re: OS X El Capitan on the Mac App Store

#89

Post by Laaw »

bdcravens wrote: post #21

If time is an issue, consider doing a wipe and fresh install then upgrade instead of upgrade in place. Apparently if you have Homebrew it gets stuck at 2 minutes, potentially for several hours.

User with Homebrew here! No problems upgrading this time (took ~15 minutes), had ~2hr upgrade last time.

Re: OS X El Capitan on the Mac App Store

#90

Post by on_ »

outworlder wrote: post #57
on_ wrote: post #53

Earlier quoted context omitted.

Thanks. I will disable it. Not to be rude, as I appreciate the advice, but what would you consider: > a really good reason? I think access to my own filesystem is good enough. I admit when I looked at the reviews, I made sure there were no major issues before upgrade but missed this "sys integrity" thing.

It is your filesystem, but these are system files. Is it really important to you to be able to muck around the OS? If it is, then you go find a way to disable the protections. Windows also has the System Integrity Protection equivalent.

Yes. I am disabling/removing shitty bloatware and removing apple phone home gor privacy.
Post reply on HN