Being required to reboot my computer into recovery mode just to add a directory is certainly a WTF worthy situation.

BTW, thanks for the down vote?

99.99% of users will never need to touch those system directories, (They aren't even required for homebrew), and, at the same time, writing to them poses a huge gaping security hole for all OS X users. Locking them down (particularly in a way that can be trivially reversed with a user who has physical possession of the device and the password) is the right thing to do.

For the 0.01% who need to screw around with the operating system directories, they can take the 90 seconds to hop into recovery mode.

This is a situation where 100% of the user community has a reasonable solution, 99.99% aren't inconvenienced in the slightest, and the security situation goes up significantly. It's like hiding ~/Library by default - 99% of users probably don't need to mess around there, and hiding it probably reduced a lot of failure modes. (and, once again, for the 1%, chflags solves the problem in 5 seconds)

Honestly - I've always been terrified whenever I've been asked for my password during installation (I do a gut check every time an ARQ upgrades asks me for my password - "Do I trust them one more time? Well, they are my backup software, so, ...) - What if it's dropping something in my system directory?

I usually follow up with a cd /; sudo find -cmin -5 to see if things look reasonable - but I'm guess not all users do that. Also - with all the extended attr stuff on OS X, it's not even clear that a find -cmin -5 would be sufficient.

So - count me in the group that is really, really pleased that Apple is locking down those system directories by default.

> cd /; sudo find -cmin -5

Sorry, but I can't resist mentioning that there's no need for that `cd /`; `sudo find / -cmin -5` would work just fine.

To add a directory to a system-protected directory. It's all about protecting the integrity of the installed system. If you don't like/want it, you can reboot into recovery, disable it, and leave it that way.

> It's all about protecting the integrity of the installed system

Why is this important? It's trivial to reformat my drive and have a fresh install. The stuff I have that's actually sensitive is in my home directory and still unprotected =/

The integrity of the installed system could be violated by creating a directory?

My system was plenty protected already - it had a root account with a password only I knew. This is just more annoying Apple gatekeeping.

Your system is much more secure with SIP in place because it makes big parts of your system immune to trojans and privilege escalation attacks, the two biggest ways malware creeps into your filesystem. It's not very difficult to disable (even permanently if you are inclined), and offers a big security boost.

And yes, it is Apple "Gatekeeping"... the same gatekeeping that's kept OS X almost completely free of major hacks for over a decade. I don't consider that annoying but to each his own.

From the hn guidelines:

> Please resist commenting about being downvoted. It never does any good, and it makes boring reading.

(though personally I'm not sure why you were downvoted originally)

Yeah, I couldn't resist. I never understand down-voting something you disagree with so I'm shocked each time it happens to me as I rarely down-vote people myself. I just wish someone would require you enter a reason for down-voting.

No, it's not. Mainly because it's not just "adding a directory"

"mkdir /usr/local" is just making a directory. It's not like that suddenly triggers your battery to overheat and explode.

Again, no it's not. Unless you just want to ignore everything about where you're making that directory.