Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hardening macOS

blog.bejarano.io

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Hardening macOS

#51

Post by syoc »

miles wrote: post #26
infogulch wrote: post #25

Earlier quoted context omitted.

Those permissions are necessary for any blocker to perform its function. And while the threat models for blockers and vpns are different, I agree that I would trust a local blocker [threat: extension hijack via auto-update; mitigation: very public source and update policy] much more than I would trust any third party vpn [threat: their 'no logging' policy is insufficient or they don't honor it; mitigation: 'we promis…

> Those permissions are necessary for any blocker to perform its function. Not blockers for Safari like Wipr that use Content Blocking Extensions: https://giorgiocalderolla.com/wipr.html

uBlock origin has a lot of features beyond being a simple ad domain blacklist. You can remove elements from websites at wish. It can spoof information about which fonts you have installed to websites, block WebRTC and more. A pure ad blocker with a smaller feature scope will require fewer permissions. While I have not read the source code my self I have a hard time believing that uBlock origin is not limited to the lowest amount possible of required permissions to do the job it does.

Re: Hardening macOS

#52

Post by [deleted] »

infogulch wrote: post #25
miles wrote: post #9

Thanks to the author for compiling and sharing this guide. Two of the recommendations have the potential to make your Mac less secure: 1. > …install an ad blocker (I recommend uBlock Origin) While uBlock Origin has a great track record, it requires these permissions: * Access your data for all websites * Read and modify privacy settings * Access browser tabs * Access browser activity during navigation That is a lot o…

Those permissions are necessary for any blocker to perform its function. And while the threat models for blockers and vpns are different, I agree that I would trust a local blocker [threat: extension hijack via auto-update; mitigation: very public source and update policy] much more than I would trust any third party vpn [threat: their 'no logging' policy is insufficient or they don't honor it; mitigation: 'we promis…

[deleted]

Re: Hardening macOS

#53

Post by ianai »

infogulch wrote: post #50
miles wrote: post #26

Earlier quoted context omitted.

> Those permissions are necessary for any blocker to perform its function. Not blockers for Safari like Wipr that use Content Blocking Extensions: https://giorgiocalderolla.com/wipr.html

Content Blocking Extensions are pretty neat from a privacy perspective, but they're quite limited in functionality since they're basically glorified block lists (why you'd pay $2 for a list that's freely published is another question) and it requires support from the platform. uBlock supports a lot of features that CBE apps can't.

Especially when you can block many things on a local router.

Re: Hardening macOS

#54

Post by pfschell »

comboy wrote: post #13

Give me a good reason why defaults chosen by a macOS user would be more secure than those chosen by a security team working full time on developing the system. This article isn't even that bad if you are willing to make your system less practical, but even here you are potentially making your system less secure as suggested in some other comments.

Because security and usability are inherently at odds, and Apple has always erred on the side of usability, until the security downsides are simply to great to ignore. This has been the pattern for every single security improvement in Mac OS X.

If you understand the tradeoffs, you can do a wide variety of things to massively increase the inherent security of your Mac by changing system and app configurations.

Re: Hardening macOS

#56

Post by ravivyas »

That is a comprehensive list, which I know most normal folks could never do.

More importantly, how secure are my parents on iOS devices vs the Mac for most of the vectors described here?

Re: Hardening macOS

#57

Post by pfschell »

konart wrote: post #49

>Go to System Preferences > Security & Privacy > Firewall > Firewall Options… and check Block all incoming connections Thanks, but no, I need this one. The whole guide is for people feeling paranoid. PS: I'm not trying to say you should not make your machine more secure, but blocking\locking "all the stuff" is not a sane option either.

What do you need it for that it actually prevents? I've used this for close to a decade, and it has never broken anything. Sounds like FUD mate.

Re: Hardening macOS

#58

Post by ricardbejarano »

pfschell wrote: post #57
konart wrote: post #49

>Go to System Preferences > Security & Privacy > Firewall > Firewall Options… and check Block all incoming connections Thanks, but no, I need this one. The whole guide is for people feeling paranoid. PS: I'm not trying to say you should not make your machine more secure, but blocking\locking "all the stuff" is not a sane option either.

What do you need it for that it actually prevents? I've used this for close to a decade, and it has never broken anything. Sounds like FUD mate.

I second this.

Re: Hardening macOS

#60

Post by idle_zealot »

pfschell wrote: post #57
konart wrote: post #49

>Go to System Preferences > Security & Privacy > Firewall > Firewall Options… and check Block all incoming connections Thanks, but no, I need this one. The whole guide is for people feeling paranoid. PS: I'm not trying to say you should not make your machine more secure, but blocking\locking "all the stuff" is not a sane option either.

What do you need it for that it actually prevents? I've used this for close to a decade, and it has never broken anything. Sounds like FUD mate.

Ssh and p2p stuff are two examples off the top of my head. For p2p, you lose the ability for peers to initiate a connection with you if you block incoming traffic.
Post reply on HN