News for hackers. Stuff that matters.

A comment on macOS Containers v0.0.1. Parent comment

Re:macOS Containers v0.0.1 by solatic on Tuesday September 26, 2023 @04:16AM (#37656076)
I'm more interested in this as part of a CI/CD process for releasing macOS software. For an isolated build worker - yeah, sure, I'll go ahead and disable SIP.

Not every workload is running on an endpoint connected to a human via keyboard and screen.

[ Parent | on HN ]
Re:macOS Containers v0.0.1 by garblegarble on Tuesday September 26, 2023 @05:51PM (#37666264)
>For an isolated build worker - yeah, sure, I'll go ahead and disable SIP.

Isn't this especially dangerous on a build worker? All your source code goes in and you (presumably) use the binaries that come out across the rest of your infrastructure. Compromising a build worker in a persistent fashion due to lack of SIP seems like it could do some serious[1] harm...

1: https://wiki.c2.com/?TheKenThompsonHack

[ Parent | on HN ]
Re:macOS Containers v0.0.1 by solatic on Tuesday September 26, 2023 @11:34PM (#37669685)
Depends on your threat modeling. Are you running untrusted code on the worker (maybe you have an org with thousands of engineers, maybe you're running builds from a public fork)? Sure, that's an issue. Are you a small startup? Take the convenience and focus on the bigger fish to fry.
[ Parent | on HN ]