Hardening macOS
I like how they recount the "secure, not private" mantra at the top of the page. MacOS has a funny threat model: it's obviously not a very private machine, but the security measures like filesystem sandboxing and SIP go a long way towards... well, making your Mac more like an iPhone. This is good for defending against smaller, petty actors (identity theft, phishers, stray keyloggers, etc.), but it does very little to defend against the <i>actually</i> scary stuff like government surveillance, first-party data collection or foreign threat actors.<p>So, a lot of you are probably rearing up to write me a 5000-word response essay about how unreasonable it is to expect MacOS to compete with Team Red from around the world. I know. No operating system will ever be perfect.<p>...but on the flip side, MacOS' security concessions really don't seem to protect the user, from where I'm standing. Apple has made it so that trusting their OS means trusting them, which frankly, I don't. Apple is part of PRISM. Apple put iCloud in Chinese government datacenters. Maybe that Chinese data is encrypted-on-disk (eg. secure), but the fact that the Chinese government has the decryption keys certainly doesn't make it very private. With any degree of likelihood, that's already happening in most first-world countries too.