Comment by afpx
17 hours ago
If you’ve ever tried to lock down a mac and dealt with the 100s of system services, you’d know why. I like the hardware and base os, but I have no idea what those services are doing.
Many are undocumented. A lot can’t be disabled, even with SIP disabled. And, they’re chatty and persistent in trying to communicate out. You can kind of disable communication of TCP/IP but they’ll find alternatives - like low power bluetooth or even lower in the network stack.
I only use my mac for development. I’m a simple man and don’t need all the bloat and hidden behavior. Plus, I always feel like I’m one automatic update away from it becoming unusable.
Not to mention coming from something like Niri, or even default Gnome to MacOS Tahoe is just gimping productivity tenfold. It is so incredibly unintuitive in every way for window management and keyboard shortcuts and everything in between.
My Mac Mini M4 is for building the Mac/iOS apps, other than that it's useless as a daily driver. I will patiently wait for Asahi while I use my other computers that can run serious operating systems.
> A lot can’t be disabled, even with SIP disabled.
Sure you can
> You can kind of disable communication of TCP/IP but they’ll find alternatives - like low power bluetooth or even lower in the network stack.
No
No, really you can't disable all of the services with SIP disabled, at least not the latest Tahoe. Maybe there's a better tool than launchctl, but I don't know what that is. Plus, you disable one, and it crashes and you have to debug it for an hour.
Yes, I'm exaggerating about the networking. Yes, you can lock it down by turning off all of the devices, but honestly, I'm still not 100% on that. It was a surprise to me after I disabled ethernet and wifi and turned off everything in system settings, and someone passed by with an ios device.
However, if you're an expert - please save me a year of trial and error and point me to the minimal list of services and daemons.
So many daemons. And while a lot can be disabled, some of them cause important stuff to break if you disable them, or even cause the OS to crash in a Heisenbugian fashion. And there's no documentation. So debugging this crap is anything but simple.