nudge VS macOS-enterprise-privileges

Nudge https://github.com/macadmins/nudge

Not a direct answer but I've been implementing Nudge all day. It reminds the user to update. You install the pkg and then push an mdm profile with your minimum version and date. https://github.com/macadmins/nudge

We deployed Nudge to our Macs to remind users to accept their updates. There's a script on Microsoft's Shell script GitHub to deploy it/keep it up to date. You can build a custom config profile using the documentation on the Macadmins' Nudge Github home as well.

Nudge: https://github.com/macadmins/nudge

Taking a few steps back, I’m assuming this is in an effort to patch macOS? If so, I personally feel this is not the right method. Take a look at other encouragement tools instead, like Nudge (https://github.com/macadmins/nudge) or utilising device compliance solutions like Jamf and Intune via their plugin solution.

Also, if you need them to have admin rights, you can use something like https://github.com/SAP/macOS-enterprise-privileges

> For technically-inclined users, I'm still largely unconvinced of the value of SIP.

Problem is technically-inclined users are the ones most likely to not be running "defense in depth" and therefore susceptible to zero days such as the H.264->code execution discussion earlier this week.

Arguably, technically-inclined users participating in the software supply chain should go beyond SIP and run in Lockdown mode permanently, both on the dev machine and any mobile devices used for MFA, or at the very least self-install SAP's "Privileges" or equivalent that requires a deliberate unlock to act as Administrator.

https://github.com/SAP/macOS-enterprise-privileges

This helps* prevent drive-bys with persistent payloads without the extra attack surface that is commercial AV or anti-malware.

* Helps prevent, not prevents.