Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ‘app’ you can’t trash: how SIP is broken in High Sierra

eclecticlight.co

Post reply on HN
Print view View original

91–100 of 100 posts

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#91

Post by Twisell »

romwell wrote: post #86
Twisell wrote: post #83

Earlier quoted context omitted.

Meanwhile on my office PC Windows 10 seem still struggling with the concept of a meaningful progress bar or a readable list of system update (BEFORE triggering a 2 hours WTF update for obscure reasons). Apple do know how to manage packet for system update and provide a dumb-customer-prof one « The AppStore » for paying developers. If developers write messy scripts how come you would it be fair to blame apple. And you…

Well, while your rant is true, I haven't had to deal with BAT files (or even Powershell scripts) in Windows installs for a very long time. (One reason for that may be NSIS, bequeathed onto us by Justin Frankel of Winamp, Gnutella and Reaper fame, which allows for streamlined (un)installers).

A .bat is the worst case but does NSIS prevent a badly written script? I don’t think so, it’s still up to the developer to care. Adding an UI on top of a badly written script will do as much harm as a .bat. (I might be wrong I’m not familiar with NSIS on the dev side while I confess I used it a lot)

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#92

Post by thethirdone »

spiralganglion wrote: post #60
ctrl-j wrote: post #54

Earlier quoted context omitted.

Isn't that standard in both APA and MLA?

Sorry — I don't know what those acronyms mean. I assume they're writing style guides? (Associated Press.. Acronym? Metropolitan Literature... Acronym?) Also, is this an example of irony?

> Sorry — I don't know what those acronyms mean. I assume they're writing style guides?

Yes, the guides from American Psychological Association (APA) and Modern Language Association (MLA)

They are both the main results that appear when you google the acronyms and are quite common acronyms.

I am surprised you aren't familiar; I would expect that anyone who graduated from the US (United States of America) school system in the past 20 years would have heard of them. Are you not from the US?

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#93

Post by blowski »

AnIdiotOnTheNet wrote: post #35
blowski wrote: post #17

Earlier quoted context omitted.

How does that work in parallel with "It's my device, I'll do what I want with it"?

It doesn't. We've had user-based permissions in the mainstream on personal devices ever since XP, and they have totally failed to protect us from anything. It is an utterly broken, worse than useless, backwards model of security for this class of device. If you think I'm wrong, by all means tell me why instead of just downvoting like some reddit user. I'll happily provide you with a list of all the ransomware that di…

From the guidelines:

> Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

Better to provide that list without complaining about the downvotes. Even better would be suggesting how you would improve the system.

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#94

Post by acdha »

AnIdiotOnTheNet wrote: post #87
acdha wrote: post #70

Earlier quoted context omitted.

> It's the user's device, they should be able to use it any way they want. Your mistake is conflating what the user authorizing with what the user wants. Nobody wants to install malware but millions of people manage every day. If blaming the user for mistakes was going to be a successful strategy we’d have evidence of that by now but since the opposite is true it’s no surprise that everyone is doing things which actu…

> Your mistake is conflating what the user authorizing with what the user wants. Unless you are arrogant enough to believe that you can read the user's mind to know what they actually want, then the only alternative is that you end up with a system that can only be used for the narrow use case you imagine. This is probably why the Linux Desktop is only really useful as a web kiosk. >If blaming the user for mistakes w…

> Unless you are arrogant enough to believe that you can read the user's mind

Hint: reading the next sentence will reveal that you are not arguing against a point I made.

> because some idiot was so concerned with protecting the OS from the user they forgot to protect the user's data

Similarly, this is bizarrely wrong: studying recent OS developments would show a strong trend for protecting user data from malicious unprivileged code — and that every improvement has been met with people arguing that this is taking away users’ freedom. Security experts have been arguing for decades that it’s of little value to protect the kernel but still allow someone’s data to be compromised.

The reason why the other work matters is that security depends on layers. If you put in a system which blocks the easy attacks, most attackers aren’t going to give up but will instead switch to more complicated attacks and social engineering has been enduringly effective. Facebook had to add a warning message for the JavaScript console because users were successfully being convinced to copy and paste code which exfiltrated their own session cookies!

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#95

Post by twir »

acdha wrote: post #88
twir wrote: post #80

Earlier quoted context omitted.

I don't mind those features in and of themselves, and I see their value; it's Apple's paternalistic attitude that bothers me. I've used Macs for my entire life and always felt I still had a semblance of control over the hardware and software that I bought, but that feeling of control is going away.

How is a feature you can turn off paternalistic? I’d think that argument is much stronger about iOS.

Yes, iOS is a better example. I'm not a big fan of closed platforms in general. I like to be able to decide which software I run on my device, so my most recent laptop and phone purchases have been GNU/Linux devices.

I understand and appreciate the security advantage that comes with protecting users from themselves, but at least SELinux and related software still give users the rope needed to hang themselves if they're into that sort of thing.

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#96

Post by pfranz »

twir wrote: post #62

Add "System Integrity Protection" to the list of reasons why my next laptop won't be a Mac. Although based on a free operating system, Mac OS is gradually taking away users' control over their own devices. Either the user controls the software, or the software controls the user.

Just one antidotal data point, but I haven't had to think about SIP and I updated my OS soon after it was released (I did wait a few months for any issues to surface). The only near-concern I remember was the directory Homebrew used, which either was a non-issue or was addressed over the course of updates. I didn't do anything. I feel like through the course of work I would have hit corner-cases caused by SIP or other macOS "protections."

Out of all the protections added over the years, I only really regularly encounter GateKeeper. I don't generally mind because I know what it is. I don't feel like I'm limited by these things, they feel more like running as non-root user and having to run "sudo" when needed. It makes sure anything silly I might do is done intentionally.

I've had way more issues with SELinux than anything Apple has added to their OS.

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#97

Post by AnIdiotOnTheNet »

acdha wrote: post #94
AnIdiotOnTheNet wrote: post #87

Earlier quoted context omitted.

> Your mistake is conflating what the user authorizing with what the user wants. Unless you are arrogant enough to believe that you can read the user's mind to know what they actually want, then the only alternative is that you end up with a system that can only be used for the narrow use case you imagine. This is probably why the Linux Desktop is only really useful as a web kiosk. >If blaming the user for mistakes w…

> Unless you are arrogant enough to believe that you can read the user's mind Hint: reading the next sentence will reveal that you are not arguing against a point I made. > because some idiot was so concerned with protecting the OS from the user they forgot to protect the user's data Similarly, this is bizarrely wrong: studying recent OS developments would show a strong trend for protecting user data from malicious u…

Yet in 2017 we only have application level permissions widespread on mobile OSs, and we still bother the user to click "Yes" or run through a sudo prompt to do trivial OS configuration tasks.

Not to mention that this entire discussion takes place in the context of a MacOS "feature" that literally makes it impossible for the user to change the OS configuration.

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#98

Post by AnIdiotOnTheNet »

blowski wrote: post #93
AnIdiotOnTheNet wrote: post #35

Earlier quoted context omitted.

It doesn't. We've had user-based permissions in the mainstream on personal devices ever since XP, and they have totally failed to protect us from anything. It is an utterly broken, worse than useless, backwards model of security for this class of device. If you think I'm wrong, by all means tell me why instead of just downvoting like some reddit user. I'll happily provide you with a list of all the ransomware that di…

From the guidelines: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. Better to provide that list without complaining about the downvotes. Even better would be suggesting how you would improve the system.

Even better would be if I just left this hellhole I think. The only difference between this place and the cesspool of reddit seems to be that people here think they're better than redditors while behaving exactly the same way.

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#99

Post by jsjohnst »

AnIdiotOnTheNet wrote: post #98
blowski wrote: post #93

Earlier quoted context omitted.

From the guidelines: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. Better to provide that list without complaining about the downvotes. Even better would be suggesting how you would improve the system.

Even better would be if I just left this hellhole I think. The only difference between this place and the cesspool of reddit seems to be that people here think they're better than redditors while behaving exactly the same way.

> Even better would be if I just left this hellhole I think.

If that’s what you think about it, then yeah, I agree you should, at least until you cool off anyway.

Re: The ‘app’ you can’t trash: how SIP is broken in High Sierra

#100

Post by jsjohnst »

twir wrote: post #95
acdha wrote: post #88

Earlier quoted context omitted.

How is a feature you can turn off paternalistic? I’d think that argument is much stronger about iOS.

Yes, iOS is a better example. I'm not a big fan of closed platforms in general. I like to be able to decide which software I run on my device, so my most recent laptop and phone purchases have been GNU/Linux devices. I understand and appreciate the security advantage that comes with protecting users from themselves, but at least SELinux and related software still give users the rope needed to hang themselves if they'…

> but at least SELinux and related software still give users the rope needed to hang themselves if they're into that sort of thing.

How’s that not possible on macOS too?

Post reply on HN