Clarification about the article Removing PUP system extensions

[Massimiliano]

@treed this your article great as always

But I would like to clarify: when disabling SIP is it better to disable WiFi / disconnect Ethernet cable for greater security?

Thanks

[alvarnell]

Of really marginal benefit, in my opinion. You are still protected by one or more firewalls (router, Mac, Little Snitch, etc.) so penetration from your local network is no more or less possible with SIP disabled and should someone managed to do so, it's unlikely they would attack areas protected by SIP, especially during the very short time you have it disabled. It's more likely to be corrupted by you, so make sure you only run the commands listed and don't leave it disabled when finished.

[Massimiliano]

Thanks, @alvarnell

Leave it disabled, not for sure. Indeed, except for the horrendous eventuality mentioned in the article, I would not disable it.

As a Firewall I only have that of macOS, that of my Router (provided by the operator) we drop a pitiful veil. 

Obviously I have never installed the aforementioned software, I have very little software outside the Mac AppStore (Handbrake, VLC, Titanium-Software, 4kdownload.com, Firefox, Paintbrush - only because I know nothing else of similar - and obviously Malwarebytes - the only security software )

[treed]

I'd agree with Al that this would be of very limited benefit. It can't hurt, but also probably isn't worth the bother, as there's nothing about SIP that would have provided any network protection at all. The bigger concern with SIP, if you're already infected with something at the time, would be that the malware copies something into a SIP-protected location. PUPs aren't known to show that kind of behavior - if they did, that would be potential grounds for detecting them as malware - but if you had something nastier installed, it could do that. That's a pretty unlikely edge case, though, especially with something like Malwarebytes installed that should remove such malware for you.

If the concern is getting infected, that's highly unlikely as long as you don't leave SIP disabled while you engage in other activities beyond removing the system extension.

[Massimiliano]

Thank @treed