Landon Fuller

@landonfuller @mikeash Sorry. Malware defense. Developers and tinkerers can turn it off.

@gparker @mikeash If developers and tinkerers can turn it off, can't malware?

@landonfuller task_for_pid()) restricted by Sandbox.kext MAC policy...Root can still load Kexts which can disable the corresponding hook

@tweakbsd signed kexts only though, right? And that requires a special Apple cert.

@rsesek That is not completely right. If you use Apple's kextload binary to load a kext it gets validated. But I implemented my own :-D

@tweakbsd Is your kexttool code still available? SVN repo doesn't seem to be working.

@landonfuller had a little server problem today...should all be running again, I should definitely go the github route as all do

@tweakbsd Thanks! I actually like that you have it self-hosted, but ymmv.

@landonfuller so pretty useless this 'rootless'...

@tweakbsd Sure, workarounds still exist -- for now.

@landonfuller It can be switched off.

@landonfuller @trimosx Also, DTrace's system-wide traces become less useful as it can't see probes in restricted processes anymore. :-/

@trimosx @landonfuller However, one of DTrace's selling points is/was that you can use it anytime on a production system (without reboot).