Question:In the session yesterday, it was mentioned that Gatekeeper's app relocation moved the app on an unsigned disk image to a randomized place on the filesystem. How does this work?Answer:When the app with the unsigned dependencies is launched, Gatekeeper makes a synthetic instance of the app at a randomized location elsewhere in the filesystem. The synthesized instance of the app is what is actually being launched.The synthesized instance is by itself in this new location, so it's unable to access the unsigned code / library / script, etc when it launches.The synthesized instance is not a copy of the app. Overall behavior is similar to nullfs on BSD, or using bind mounts on Linux.Question:Are there any new features in System Integrity Protection on Sierra, or will the functionality be the same as in El Capitan? If there are new features, what are they?Answer:Same functionality as in El Capitan.Question:Are there new restrictions in System Integrity Protection on Sierra, or do the restrictions currently m