Personally I think I like having SIP. It means a webkit zero-day can&#x27;t as easily load a kernel extension or edit firmware.  I guess DTrace works by putting probes into other processes, so even though it is only &quot;reading&quot; system information, it&#x27;s only able to instrument the data it reads in the first place by mutating other running processes.