Setting up your Mac for Grey Goo

Leave a reply

In a Grey Goo scenario, basically anything that is connected to the internet will stand an increasing chance of getting hacked. Now, having a computer is nice, even if it can’t access the web, so I’ve decided to make it so that my Mac requires my explicit permission to connect to a network. Any network. Variations of this approach should work for Windows and Linux. Ask your local LLM.

Until you can’t.

In modern versions of macOS, the operating system goes out of its way to keep you connected. Even if you turn off Wi-Fi before shutting down, your Mac will often auto-join known networks upon reboot. And forcing your Mac to boot with zero network access can be surprisingly tricky. With some help from Gemini, I was able to set up my Mac so that it is not going to be accidentally overrun by accidental or malicious agents.

This guide walks you through setting up a native, secure, bulletproof architecture: your Mac will boot completely dark to the network, and you will have two authenticated desktop shortcuts to manually toggle your connection on demand.

Instead of fighting with hardware toggles or writing brittle scripts that turn off Wi-Fi interfaces individually, we use macOS’s built-in Network Locations feature.

We will build an “Offline” profile that contains no network services whatsoever. We then deploy a system daemon to force your Mac into this profile during boot, accompanied by two password-protected desktop applications to toggle between states.

Phase 1: Build a Blank Network Profile

First, we must create a networking location that has absolutely no data interfaces configured.

  1. Go to the Apple Menu () > System Settings > Network.
  2. Click the three dots icon at the very bottom of the network interface list and select Locations > Edit Locations…
  3. Click the + icon, name the new profile Offline, and click Done.
  4. Choose Offline from the location menu to activate it.
  5. In your network service list, Control-click (right-click) on each active interface (Wi-Fi, Ethernet, Thunderbolt Bridge, etc.) and select Make Service Inactive.
  6. Click Apply. Your Mac is now completely offline.
  7. Switch back to your Automatic profile for now so you can complete the rest of this tutorial.

Phase 2: Force the Offline Profile at Boot

To ensure your Mac drops its network profile before you even hit the login lock screen, we use a root-level system daemon (launchd).

1. Create the Backend Script

Open Terminal and create a script that forces the location change:

bash

sudo nano /usr/local/bin/go_offline.sh

Paste the following logic inside the editor:

bash

#!/bin/bash
# Automatically switch to the Offline network configuration profile
/usr/sbin/networksetup -switchtolocation "Offline"

Save and exit (Ctrl + O, Enter, Ctrl + X). Then, make the file executable:

bash

sudo chmod +x /usr/local/bin/go_offline.sh

2. Register the Launch Daemon

To get macOS to run this script globally on startup, create a configuration plist file:

bash

sudo nano /Library/LaunchDaemons/com.user.offlineboot.plist

Paste this configuration layout into the file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://apple.com">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.user.offlineboot</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/go_offline.sh</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
</dict>
</plist>

Save and exit. Set the required root permissions for the file, and load it into the system cycle:

sudo chown root:wheel /Library/LaunchDaemons/com.user.offlineboot.plist
sudo chmod 644 /Library/LaunchDaemons/com.user.offlineboot.plist
sudo launchctl load -w /Library/LaunchDaemons/com.user.offlineboot.plist

Your Mac will now boot directly into a completely disconnected state every single time it turns on.

Phase 3: Create the “Go Online” Desktop App

To securely reconnect when you are ready, we will wrap an authenticated AppleScript command inside a double-clickable Automator application on your desktop.

  1. Open the Automator app on your Mac and select New Document > Application.
  2. Search for Run AppleScript in the left sidebar and drag the action into the workspace on the right.
  3. Replace the placeholder text entirely with this code:applescripton run {input, parameters} do shell script "networksetup -switchtolocation 'Automatic'" with administrator privileges return input end run Use code with caution.
  4. Go to File > Save, name the app Go Online, choose your Desktop as the destination, and hit save.

Phase 4: Create the “Go Offline” Desktop App

To drop offline instantly without rebooting your Mac, create a matching kill-switch utility.

  1. In Automator, create another New Document > Application.
  2. Drag another Run AppleScript block into the workspace.
  3. Use the following code to explicitly pull your network plug:applescripton run {input, parameters} do shell script "networksetup -switchtolocation 'Offline'" with administrator privileges return input end run Use code with caution.
  4. Go to File > Save, name the app Go Offline, and save it to your Desktop.

By building your shortcuts this way, you maintain absolute control over your machine’s connection state:

  • Secure Booting: Your computer turns on in total digital isolation. No background software updates can run, and no remote telemetry can broadcast.
  • Authenticated Control: Both desktop shortcuts use with administrator privileges. This means clicking them safely prompts you for your Mac password or a Touch ID swipe.
  • Zero System Vulnerabilities: This setup relies entirely on native network location engines rather than unlocking system files or turning off System Integrity Protection (SIP).

To reverse everything in the future, simply delete the files from your desktop and unload the startup file using: sudo launchctl unload /Library/LaunchDaemons/com.user.offlineboot.plist.

Leave a Reply