macOS-enterprise-privileges

Developer scratchpad: https://github.com/IvanMathy/Boop Outbound firewall: https://objective-see.org/products/lulu.html Stop working as admin all the time (but switch easily): https://github.com/SAP/macOS-enterprise-privileges

> For technically-inclined users, I'm still largely unconvinced of the value of SIP. Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week. Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator. https://github.com/SAP/macOS-enterprise-privileges This helps prevent (not categorically prevents) drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.

A well known macOS It developer created an app that can give you admin rights and take them away with an app. https://github.com/SAP/macOS-enterprise-privileges Essentially you can still be the admin on your account but this app can make you a general user. When you need to install anything, run the app and grant yourself temporary admin rights. If you deploy this to employees with a management system, you can define default reversion to general user. It addresses the need to not allow users to be admins all the time, grants only when the need it for installation.