If you want run an unsigned installer you just right click in Finder and select 'Open' instead of double clicking.

I'm not aware of any Mac user among my friends who isn't aware of this.

Most OSS installers but even many commerical ones aren't code signed because devs don't want to pay the Apple tax.

> I'm not aware of any Mac user among my friends who isn't aware of this.

I don't think any of my non-tech friends would know this.

I think that's the point though. Our non-tech friends are exactly the people who shouldn't be downloading and installing random (unsigned) binaries.

As much as I love to hack and tinker with my OS, I also appreciate the safety inherent in the Apple ecosystem. That's why even as a life-long Windows user, I bought my Dad an iPad - I know the chance of him getting p0wned via some social engineering attack and having his banking password stolen are a lot lower than with a Windows or Android tablet.

SIP is a collection of protection features. You can disable bits and pieces, or all of it.

Disabling SIP is generally a bad idea, but there are times when it can be useful, e.g. modifying stock applications like Dock.app.

You don't need to disable SIP to run unsigned code. If a binary is unsigned all you need to do is hold a key down while clicking the program. macOS will show a warning popup and let you continue. This isn't super user friends, but then again the majority of Apple's customers are not going to (or want to) run untrusted code, and if you do want to run untrusted code it is not that big of an inconvenience.

My understanding is that SIP makes certain locations read-only, like /System, /usr, applications bundled with the OS, etc. You’d turn it off if you had a bunch of wacky Unix packages from the old days that expected to run from specific paths.

I think if you want to just run any code you want, you sudo spctl --master-disable. I’ve never had to use it.