Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Firewalls in macOS Big Sur

twitter.com

Post reply on HN
Print view View original

161–170 of 251 posts

Re: Bypassing Firewalls in macOS Big Sur

#161

Post by varenc »

systemvoltage wrote: post #146
ronyfadel wrote: post #140

Earlier quoted context omitted.

Absolutely not. You should be able to deny/allow connections for any app, including 1st party apps. This isn’t only an issue of trust. There are apps made to meter your connection (e.g. when you’re using your phone as a Personal Hotspot), where you’d like to see how much bw your 1st party apps are using, and have the option to block them.

Are there other ways to put a firewall (home user setup)? Kind of like Little Snitch but running on a separate device/broker/server?

Yes, but you won't have much visibility into anything encrypted (HTTPS). Which is everything. You'll just see opaque traffic going to certain IP addresses and you also won't know what process on the computer caused it. Doing this in the OS is way nicer.

Re: Bypassing Firewalls in macOS Big Sur

#162

Post by eps »

ilikepi wrote: post #136
rubatuga wrote: post #122

Earlier quoted context omitted.

Yeah but as a counterpoint, most Hacker News users have used Linux at one point, which lets you run commands like `rm -rf /` as root. I think it's fair to allow power users to easily disable these protections.

Ironically, coreutils introduced[1] a requirement to add `--no-preserve-root` to `rm -rf /` way back in 2003, so that particular example doesn't really support the counterpoint you're trying to make. EDIT: clarity [1]: https://github.com/coreutils/coreutils/commit/34e3ea055721ec...

That's because it was abused to troll inexperienced users.

"How do I do X? Just run this as root." Sometimes slightly disguised, but more often not.

Re: Bypassing Firewalls in macOS Big Sur

#163

Post by jackjeff »

rubatuga wrote: post #7

How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.... And a humorous guide on disabling protections like code signing and notarization: https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-li...

I’m not sure I want to turn off SIP and SSV to get a firewall that works.

Re: Bypassing Firewalls in macOS Big Sur

#164

Post by mxxx »

ekianjo wrote: post #115
chefandy wrote: post #92

Ugh. I'd love to switch to Linux, but as a designer, I'm stuck. It's not a lack of understanding of how it works— Before I was a designer I was a developer, worked in IT for a while, worked in upper-level support for a while, and Linux was my primary personal and professional OS from the late 90s to like 2010. Why don't I just run a closed-source OS in a VM? They are fussy. Having some weird graphics tablet driver pr…

> and that's just not an option for a pro. get 2 machines then. Who says you need to have a single machine for everything? Get a Mac for your design work, treat it like an appliance, and use Linux for everything else on another machine. Problem solved.

Buying double the hardware doesn’t necessarily seem _that_ feasible for most.

Re: Bypassing Firewalls in macOS Big Sur

#165

Post by zimpenfish »

saagarjha wrote: post #112
kypro wrote: post #43

Earlier quoted context omitted.

Maybe you're right – I am quite a paranoid person. I guess I just don't understand how this wasn't flagged as a concern when the feature was being worked on? How is it possible that Apple's engineering team built a backdoor like this without it raising serious security concerns? And if concerns were raised why was this not adequately pen tested prior to release? I'm not sure what's worse from a reputational perspecti…

I've always thought that Apple would do well to have someone on staff to give the things they make the "Hacker News" treatment.

I'd posit that if that were true, they'd probably never have made it to even a $2bn company, never mind $2tn. HN is - for Apple's intents and purposes - an insignificantly tiny bunch of people they're 95% not really interested in as customers.

Re: Bypassing Firewalls in macOS Big Sur

#166

Post by andybak »

pjmlp wrote: post #133
sjwright wrote: post #63

Earlier quoted context omitted.

There are numerous excellent reasons why that will never happen. And why it’s not in Apple’s interest to do so. The most obvious reason is that it would utterly destroy the Mac among influencer communities and developers. But perhaps the most underrated reason is that Apple already has a managed computing platform in the iPad. Rather than the Mac becoming more locked down, I expect the iPad will become ever-more desk…

Developers on the Apple that matter to Apple are those using Objective-C and Swift, everything else was a nice thing back in the dark days of almost closing shop.

Aren't most iOS games still made with Unity?

Re: Bypassing Firewalls in macOS Big Sur

#167

Post by woj-tek »

Apart from security implications I can see multiple privacy issues here. Apple's services may attempt connections to non-Apple resources as well as Apple's. My understanding is that trustd (Trust Daemon) will be allowed to report/validate (OCSP? CT?) certificates anywhere issuer points it to, and that nsurlsessiond (NSURLSession Daemon) will be allowed to attempt any connections other Apple processes will tell it to. From what I observed, opening a single podcast in Podcasts.app sometimes results in nsurlsessiond connecting to resources under multiple different domains.

My pessimistic view of today's techworld tells me to follow the money on this and that I might not be able to block in-system ads in some future.

Re: Bypassing Firewalls in macOS Big Sur

#168

Post by grishka »

andy_ppp wrote: post #158
grishka wrote: post #153

Earlier quoted context omitted.

Why should they not? Linux for example doesn't have any such features and somehow is okay to use like that.

What stops a Linux program altering the system? I guess you need root access to change things outside of /usr/local this could easily be done on macOS too but the wheel had to be reinvented by Apple in a way that is probably less trustworthy.

You actually need root on macOS to modify anything under /System, and this was the case even before SIP. This is why some installers ask for the root password.

Re: Bypassing Firewalls in macOS Big Sur

#169

Post by pjmlp »

andybak wrote: post #166
pjmlp wrote: post #133

Earlier quoted context omitted.

Developers on the Apple that matter to Apple are those using Objective-C and Swift, everything else was a nice thing back in the dark days of almost closing shop.

Aren't most iOS games still made with Unity?

Unity has a large percentage yes, but by and large UIKit and Cocoa dominates, those are the developers Apple cares about.

Re: Bypassing Firewalls in macOS Big Sur

#170

Post by presentation »

mxxx wrote: post #164
ekianjo wrote: post #115

Earlier quoted context omitted.

> and that's just not an option for a pro. get 2 machines then. Who says you need to have a single machine for everything? Get a Mac for your design work, treat it like an appliance, and use Linux for everything else on another machine. Problem solved.

Buying double the hardware doesn’t necessarily seem _that_ feasible for most.

Not to mention it’s super wasteful.
Post reply on HN