Which APIs were only available via Mac App Store that prevented distribution outside it?
I am very skeptical on this point.
macOS, like all Unix systems, already limits privileges for non-root users. What do you accomplish by placing limits on root as well?
If a malicious application gets root, you are very screwed. The app can encrypt most of your hard drive, monitor most keystrokes, do nasty things with your hosts file, and steal most of your personal data. It won't be able to directly inject itself into other processes and certain critical OS files we protected, but how relevant is that?
As I see it, SIP's main purpose is to (1) prevent non-technical users from (completely) hosing their systems by copying and pasting terminal commands from the internet, and (2) to protect TCC.db so that apps can't bypass Apple's privacy system.
If you're able to turn off SIP, you have enough technical knowledge than #1 isn't necessary. I suppose #2 may have some limited value, but not much.
If I am completely off base on this, feel free to educate me—but in my several years of research I have not come across any plausible scenarios for when SIP's protection would be helpful.
------
Edit: One other relevant note: Apple lets you selectively disable and enable parts of SIP. So you'd likely be able to turn off sideload-blocking (or whatever it is) without disabling SIP completely, if you want to for whatever reason.
Normal users need UX to save them from owning themselves.
I'm a little frustrated by all the FUD I've seen spread in Apple enthusiast communities about how SIP is this super important security feature that should never be turned off.
My opinion is that if you have a reason to disable SIP, go ahead and do so with a clear conscious. You will continue to be protected by the privilege system that's in place for (basically) all UNIX's.
Didn’t stop apps from trying exactly that anyway.
https://daringfireball.net/linked/2016/09/20/dropbox-macos-s...
SIP is a piece of design intended to make you less screwed when that happens.
If a thief breaks into my house, I don't particularly care if he can access the drawer where I keep pencils.
Stated better: it appears to me that the consequence of a malicious app getting root is already so incredibly catastrophic, that at that point it makes little difference whether or not SIP is enabled.
Edit: Also, security be damned, I don’t want to use an OS without a proper root account! So while not entirely relevent to the discussion, I know that I would either continue to turn off SIP or move to another platform.
Let's say you wanted an OS with better privilege control and other clever security doodads people have come up with in the years since merely having user accounts seemed like unconscionable oppression. If you don't care about backward compatibility much and start with Linux and a JVM you might end up with something like Android. If you start Linux and Chrome you might end up with something like ChromeOS. If you start with OS X you might end up with something like iOS. If you start from scratch you might end up with something like Fuchsia.
But what if you do care about backward compatibility? You then have a far more difficult, thankless and long-term job. If you start with OS X, somewhere along the line you'll have something like OS X + SIP + Sandbox + FDE. Or Windows NT + UAC + irritating autoreboots in the middle of the night. We're in the 'somewhere along the line' stage.
Can you cite a source for that?
Therefore it will become unviable for 99% of apps to be distributed outside the app store, so they won't.
I distribute an app outside the app store. It's free and open source, but not meant to be for technical users (it's art-related). I like people being able to use it, because I am a nice guy, but I also don't want to pay Apple $100/year and go through the hassle of putting it in the app store, if that would even work. My users are not going to disable SIP so if Apple continues in this way I really will be forced to put it in the app store (or more likely, abandon OSX).
Personally I'm happy to see WireGuard in the App Store, but would be concerned if Apple indeed limits the API to it. Could you elaborate on if distribution outside of the App Store is impossible?
I have tried to reproduce the issue and found that even though you can create provisioning profiles for direct distribution with the Network Extension entitlement, and the UI shows that all is fine, the provisioning profile does NOT contain the required entitlement.
After some digging I found a FAQ on network extensions by Apple [1]. Point #8 clearly says:
> #8 — On the Mac, can Developer ID apps host Network Extension providers?
> Currently this is not possible; only Mac App Store apps can host Network Extension providers.
Thus the missing entitlement is most likely not a bug (and the cert UI is just bad). This is not a technical limitation, just Apple with questionable politics.
Is there any way around this for a user? What if SIP is off?
If there's no workaround, that makes me quite uncomfortable.
I totally understand that if Apple builds and maintains a PKI-based security model, they are going to want to check your stuff before allowing you in. If, on the other hand, the user doesn't care, they can simply turn off the security model or adjust it.
If that is now coming to the Mac as well then I will stop being Mac user and I will move away from Apple's platforms altogether.
Requiring Apple's permission to run WireGuard automatically means requring the permission of the government as well.
You don't even have to resort to China to see why that is bad. Many western governments are aggressively working towards banning various forms of encrypted communications.
The problem you are running in to is that your ideas don't match their ideas and you want them to match your ideas (which they won't because they don't live in your world, they live in their world, which at this time is mostly the USA world).
If in your country the government would enforce some law stating that companies should not block sex in their content pipelines, then Apple, just like they do in every other country, will comply. This is also the reason they censor stuff in China, it's the law over there.
So while their ideas and values might not match with you, they do still have to follow the law. If you believe companies with a large impact should not block certain information from flowing, that is something you can enforce by law.
A company has to deal with the law, and cannot go and be an anarchist whenever it feels like it (but people can) because then they cease to exist.
(This topic doesn't really apply to macOS though, just iOS.)
That's what I find so concerning. There has to be some general purpose computing device that allows me to take full responsibility in terms of security and in terms of complying with the law.
Other platforms often tend to imitate Apple. So if this is the general direction of travel then I find that very worrying
It's hard to quantify "moving in a direction", but Gatekeeper was introduced nearly a decade ago and has always been possible to disable via a quick Terminal command. Apple did remove it from the UI in Sierra, so perhaps you could say that's a sign of things to come, but I honestly doubt it.
No. I don't want them to match my ideas. I want them to respect the fact that people have different ideas and values.
To allow that diversity of ideas to exist, it is necessary to keep the separation of concerns and legal responsibilities as it has been since the invention of the Mac (and the PC).
They make the hardware and the OS. I decide what software to install and what content to store. This has always been my legal responsibilty and it is on that basis that I decided to purchase my Mac.
If they change that equation, I'm out. I'm out as user. I'm out as developer. I'm out as decision maker and as a go-to person for others who make purchasing decisions.
The notion that they supply hardware and software and you then decide how they are going to work for you is no longer valid for the Apple products as they are. By default, macOS is being more like iOS now, which diverges from the generic idea of the personal computer.
This problem is of course far wider than just computers and Apple, more devices, services and companies are headed this way in varying degrees.
I suppose that means you are out as a user, developer and decision maker etc. Apple probably won't care unless you take 10 million customers with you at the same time. Anything less than 1 million is probably not even going to register on their metrics, and anything less than 10 million is only marginal. This is both the problem (our problem as users) and the benefit (their benefit as a company at scale) of this broad customer base many companies now have. It's not really a globalisation thing, but more a combined globalisation+commercialism+scale thing that makes this kind of thing common.
It's not that they want to make things less attractive to certain users on purpose either, that would be counter to their purpose of making money; it's probably far more likely that it's a case of Hanlon's razor. Take the way PKI is used to enforce some rules on hardware (i.e. iBoot and the A-series SoCs from Apple but also Intel's BootGuard on a much larger scale); it's not that they want to block people that want to fiddle with their hardware and software, it's just that this is the best they could come up with to defend against generic attacks. And it's far from ideal.
I have ideas on different levels that shouldn't be conflated. I'm not asking Apple or anyone else to share my preferences and tastes.
But some meta ideas are a prerequisite for disagreement on preferences, tastes and beliefs. Without those ideas we are moving towards authoritarianism.
Once global companies become dominant enough, their decisions start to either facilitate or hinder liberty and authoritarianism, even under the assumption that they have to comply with the law at all times.
I don't think being seen to be on the side of oppression and authoritarianism against your own users is ultimately conducive to maximising profits.
While being totally OK with (gun) violence. Hello, double (American) standard. Keep that double standard in the US. I don't want it in the EU. Thank you.
I'd very much like to know what this involves. I'll feel better knowing how it can be done. If you have a link that would be great!
Security-wise, that can be problematic, and I suggest you turn on EFI password authentication so it's not something everyone can do to your machine. This means you can still change the SIP settings on-demand per boot using a USB stick with rEFInd on it, but doing that requires you to chain boot off of that USB drive and doing that triggers EFI protection and requires a password before you can do that. Normal boot would not require a password and lets you use the system as-is.
Since this is a topic on VPN software.