Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Firewalls in macOS Big Sur

twitter.com

Post reply on HN
Print view View original

111–120 of 251 posts

Re: Bypassing Firewalls in macOS Big Sur

#111

Post by saagarjha »

chongli wrote: post #96
smnrchrds wrote: post #53

Earlier quoted context omitted.

I expect Apple to take the opposite path, not immediately, but eventually: disable sideloading and enforce a Mac App Store only policy on macOS, similar to iOS. After all, if all apps are reviewed and approved by Apple, there is no malware that can use this weakness or the future ones. And I am sure the 30% cut and $100 annual fee has nothing to do with the decision either. Apple only cares about customers, not money…

disable sideloading and enforce a Mac App Store only policy on macOS People have been repeating that for years, since the Mac App Store was announced. It’s not in Apple’s interest to do it. There is a ton of software, open source in particular, that Apple benefits tremendously by. It costs Apple nothing to maintain the status quo. Going Mac App Store only would drive tons of developers off the platform and do absolut…

Apple single-handedly killed off the Safari extensions ecosystem for extremely dubious reasons. It would be inaccurate to say that they have locked down macOS to Mac App Store-only apps, but even if you ignore the embedded platforms the concerns about locking down macOS are extremely founded even as Apple repeatedly says they aren't trying to do this.

Re: Bypassing Firewalls in macOS Big Sur

#112

Post by saagarjha »

kypro wrote: post #43
Bud wrote: post #32

Earlier quoted context omitted.

No, that is not the most reasonable expectation. Fails both Occam's Razor and the laugh test. To believe this, one has to believe that a $2 trillion company did this on purpose, knowing it would be revealed within hours and that it would take a major hit on the very reputation for user privacy and security that they have spent years building. There are a lot of better explanations available than "Apple decided user s…

Maybe you're right – I am quite a paranoid person. I guess I just don't understand how this wasn't flagged as a concern when the feature was being worked on? How is it possible that Apple's engineering team built a backdoor like this without it raising serious security concerns? And if concerns were raised why was this not adequately pen tested prior to release? I'm not sure what's worse from a reputational perspecti…

I've always thought that Apple would do well to have someone on staff to give the things they make the "Hacker News" treatment.

Re: Bypassing Firewalls in macOS Big Sur

#113

Post by saagarjha »

Zachpocalypse wrote: post #85

I commented on your Twitter post already, but I'll reiterate here. This is not a vulnerability, it is as intended. By default, you can only install Applications via the App Store on Big Sur, and AppProxyProvider only affects Applications installed via this method. This has the dual-benefit of protecting casual users, and allowing power-users flexibility with any binaries that aren't sandboxed. From what I understand…

> By default, you can only install Applications via the App Store on Big Sur

You can install notarized software, though.

Re: Bypassing Firewalls in macOS Big Sur

#114

Post by midrus »

lostlogin wrote: post #18
qz2 wrote: post #13

This whole release cycle is just one gigantic facepalm after another. I am feeling pretty heavily smug that I got rid of my Apple kit earlier this year because I wasn't happy with the direction of the platform.

What did you move to?

Same here, fedora on a thinkpad t14s.

Couldn't be happier.

Re: Bypassing Firewalls in macOS Big Sur

#115

Post by ekianjo »

chefandy wrote: post #92

Ugh. I'd love to switch to Linux, but as a designer, I'm stuck. It's not a lack of understanding of how it works— Before I was a designer I was a developer, worked in IT for a while, worked in upper-level support for a while, and Linux was my primary personal and professional OS from the late 90s to like 2010. Why don't I just run a closed-source OS in a VM? They are fussy. Having some weird graphics tablet driver pr…

> and that's just not an option for a pro.

get 2 machines then. Who says you need to have a single machine for everything? Get a Mac for your design work, treat it like an appliance, and use Linux for everything else on another machine. Problem solved.

Re: Bypassing Firewalls in macOS Big Sur

#116

Post by submeta »

qz2 wrote: post #13

This whole release cycle is just one gigantic facepalm after another. I am feeling pretty heavily smug that I got rid of my Apple kit earlier this year because I wasn't happy with the direction of the platform.

I have gotten rid of almost any Apple only tools (OmniGraffle to Figma; OmniFocus, Things3, iA Writer, Ulysses, Alfred App to Emacs+Org, and some more), but there is only only a few left that I can‘t find a replacement for in Linux-land: DEVONthink for managing my thousands of documents (actually I just keep my files in DEVONthink and use the search feature, could end up using just file system), ScanSnap Manager (a driver for my Fujitsu Scanner plus a desktop app for scannning the documents, and Spotlight search that works from within every other app for instantly finding any document.

I guess I need to get a Thinkpad running Linux for slowly finding replacments for my tools, and migrate not within weeks, but spreading my migration process over months.

My most essential tool is Emacs / Org and Lisp, Python plus the terminal with some shell scripting for automating all my workflows.

Yes, I will miss the smoothness that comes from very tight integration of hardware and services, but I absolutely hate the path that Apple is on, slowly taking all freedom from its users, until macOS is as closed as iOS. This is against every conviction I have as a citizen for whose freedom it is essential to have control over the machine that enables me to connect to the world and do my work. We are no toddlers, Apple does not need to put us in a walled garden, a promised land without any malware and danger (that‘s the promise, but in reality they want to control every aspect of their ecosystem, like an emperor that wants to tax every aspect of acting and movement in his land).

Re: Bypassing Firewalls in macOS Big Sur

#117

Post by kvz »

lostlogin wrote: post #18
qz2 wrote: post #13

This whole release cycle is just one gigantic facepalm after another. I am feeling pretty heavily smug that I got rid of my Apple kit earlier this year because I wasn't happy with the direction of the platform.

What did you move to?

Played it safe with an XPS + Ubuntu https://kvz.io/tobuntu.html

Re: Bypassing Firewalls in macOS Big Sur

#118

Post by pram »

systemvoltage wrote: post #97
mmastrac wrote: post #64

I could really use a "special edition" of MacOS - sort of like what happened with XP in the later days. Strip out all the Apple stuff, privacy failures, and excessive gatekeeping [$] and just leave the raw OS. [$] for me

UNIX was a proprietary OS but literally everyone used it in the 80’s - without a license. Campuses to labs around the US. We need to nuke the Apple bullshit from MacOS Catalina and convert it into people’s operating system. Ethics be damned.

If only there were freely available, open source UNIX clones in the 21st century. Oh well!

Re: Bypassing Firewalls in macOS Big Sur

#119

Post by pram »

Has anyone tested if disabling the 'Automatically allow built-in software to receive incoming connections' setting in the Firewall config changes this behavior? Seems like it might be attached to that static list of whitelisted processes.

Re: Bypassing Firewalls in macOS Big Sur

#120

Post by pjmlp »

keyle wrote: post #48
rubatuga wrote: post #7

How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.... And a humorous guide on disabling protections like code signing and notarization: https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-li...

Why _should_ you have to disable this feature? Sigh. My point: opting out should be much, much easier.

When OS X was introduced, asking on Apple forums how to run as root was almost a daily question.

Most consumers don't care about security, making it easy to disable just opens the floodgates of their systems.

Post reply on HN