Live data from Hacker News

Bypassing Firewalls in macOS Big Sur

twitter.com

241–250 of 251 posts

Re: Bypassing Firewalls in macOS Big Sur

#241

Earlier quoted context omitted.

The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iO…

The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer. Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry...

I have a G4 I bought for use as a DAW. It still has OS9; I never installed OSX as I knew it would probably slow things down. I never needed to connect the Mac to the internet. If I needed to send/receive files via internet I moved them via crossover cable to a laptop or PC that was connected to the internet.

People today, even more so than in the 2000's, have multiple computers. Would it still be feasible to have a Mac used for {music, cinema, graphics} that is not connected to the internet. Certainly one would have other computers that were connected to the internet and moving files between computers on the local network, preferably via Ethernet, is much faster.

But the point of me telling personal stories is not to suggest anyone could/should do the same things; on the contrary, it is to illustrate that "one size does not fit all". Today's Apple chooses for the user, rather than letting the user choose.

Re: Bypassing Firewalls in macOS Big Sur

#242

Earlier quoted context omitted.

I have gotten rid of almost any Apple only tools (OmniGraffle to Figma; OmniFocus, Things3, iA Writer, Ulysses, Alfred App to Emacs+Org, and some more), but there is only only a few left that I can‘t find a replacement for in Linux-land: DEVONthink for managing my thousands of documents (actually I just keep my files in DEVONthink and use the search feature, could end up using just file system), ScanSnap Manager (a d…

What did you replace Things and iA Writer with?

> OmniFocus, Things3, iA Writer, Ulysses, Alfred App to Emacs+Org, and some more

All of these were replaced with org-mode and Emacs (and likely some other Linux features for Alfred). Doom Emacs is a good framework to explore Emacs as it supports both vim and Emacs bindings (there’s also cua-mode).

https://orgmode.org https://github.com/hlissner/doom-emacs

Re: Bypassing Firewalls in macOS Big Sur

#244
post #65

https://imgur.com/a/y0NPJ2o - DNS activity of my Mac PRO + Big Sur during the last 30 mins. This is a filter on ` apple ` domain so I'm not sure if I'm seeing everything since they might use other domains but heh - for the curious.

What is this supposed to show? I see a lot of iCloud and Software update stuff in there. Nothing malicious from first glance.

Nobody said it is anything malicious in there

Re: Bypassing Firewalls in macOS Big Sur

#245

Earlier quoted context omitted.

How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for i…

> On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. The reason is that Firecracker is a virtual machine, and Linux containers and sandboxing primitives are not meant to be used for virtual machines. Pointing at Snap and Flatpak's "sandboxes" is disingenuous when they're notorious for having sandboxing as an after thought to app dist…

Firecracker is a virtual machine that exists to provide a container-level interface. It is not designed for nor capable of running a full virtual machine. GVisor is even less virtual machine like: in fact it originally only worked via a ptrace sandbox and added a KVM-based interface (without a real Linux guest kernel) latter to improve performance.

I point to snap and flatpak because outside of browsers they are AFAICT the only attempts to sandbox user applications on Linux. It would be disingenuous if there were some other apps or distribution channels doing a better job that I hadn’t mentioned, I’d love to hear of some.

Re: Bypassing Firewalls in macOS Big Sur

#246
post #217

Earlier quoted context omitted.

How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for i…

> On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile. actually firecracker is not a sandbox. it's basically qemu/libvirt and a minimal implementation of devices. it's qemu-kv…

I’m not sure of the distinction you’re drawing here. Originally Amazon used the Linux namespaces, cgroups, etc. for isolating Lambda invocations, but they only did this at the AWS account granularity (i.e. your Lambdas only shared the same VM with other Lambdas from your account) for security reasons. They built FirecrackerVM so they could run Lambdas freely on the same bare metal machine as others without having to group by tenant VM in this way. Obviously they found using the Linux primitives to be insufficient for maintaining isolation when dealing with hostile native code.

Re: Bypassing Firewalls in macOS Big Sur

#247
post #43

Earlier quoted context omitted.

Maybe you're right – I am quite a paranoid person. I guess I just don't understand how this wasn't flagged as a concern when the feature was being worked on? How is it possible that Apple's engineering team built a backdoor like this without it raising serious security concerns? And if concerns were raised why was this not adequately pen tested prior to release? I'm not sure what's worse from a reputational perspecti…

I've always thought that Apple would do well to have someone on staff to give the things they make the "Hacker News" treatment.

I volunteer as tribute.

Re: Bypassing Firewalls in macOS Big Sur

#248
post #234
post #26

For a company that boasts privacy, it sure leaves a lot of holes in it's OS for malicious people to exploit. Guess I won't be upgrading from Catalina for a long time.

Wait a bit until a new iOS feature will require a new XCode and the new XCode will require a new MacOS. :) Been there, seen it.

This is the exact reason I was forced onto Catalina. It sucks so much

Re: Bypassing Firewalls in macOS Big Sur

#249

Earlier quoted context omitted.

Are there other ways to put a firewall (home user setup)? Kind of like Little Snitch but running on a separate device/broker/server?

Yes. Your router probably already has one. Also i am wondering if you cant just change dns to block it either pihole, nextdns or even just change hosts file.

[deleted]

Re: Bypassing Firewalls in macOS Big Sur

#250

As opposed to the OCSP thing, bypassing firewalls and VPNs seem to be really out there, especially the VPN part You have a VPN active - I'm actually saying go here not there. Because the default connection might be unsafe, limited, etc. Now, since I have to spend money on multiple dongles, etc that might justify me to buy a pi-hole for a home connection. Get around that Apple

apple will easily get around pi-hole.

Apple is allowing apps to specifically their own DNS over HTTPs. This DOH setting will not be transparent to the user and will be per application. So imagine a world where each app can bypass your system network settings .... already here

Post reply on HN