Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lulu – Mac open-source firewall that aims to block unknown outgoing connections

objective-see.com

Post reply on HN
Print view View original

121–130 of 158 posts

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#121

Post by dmix »

thih9 wrote: post #18
wgx wrote: post #2

Interesting to see this on the front page of HN - I've been using it happily for years, no complaints. It's illuminating to see just how "chatty" certain apps are (or wish to be!).

I guess it’s been submitted here because of the recent v2.1.0 release, which brings Apple M1 compatibility, https://mobile.twitter.com/patrickwardle/status/134889032317...

So this one says to "make sure you're using 11.1" (aka Big Sur) and the first comment on HN warns there are serious (unclosed) issues with Big Sur on their Github.

Not sure who to believe but I'll pass for now.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#122

Post by gruez »

qwerty456127 wrote: post #72
kmlx wrote: post #33

Earlier quoted context omitted.

iptables?

iptables don't let you know when a particular program tries to access an outside host and choose whether you want to allow that. Speaking of a desktop (not a server) firewall I'm rarely even interested which host/port/whatever is a connection about. What matters to me is what app initiated it (if it's initiated from outside my PC it should be always blocked). Iptables used to expose a field attributing a connection t…

> iptables don't let you know when a particular program tries to access an outside host and choose whether you want to allow that.

How does this model work for commonly used programs like curl? Do you block it and can't use it at all in your shell scripts, or do you whitelist it and hope that nefarious programs don't use it to exfiltrate data?

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#123

Post by acdha »

a1369209993 wrote: post #114
ecf wrote: post #97

Earlier quoted context omitted.

What kind of argument is this? It’s a single app... how can you judge an operating system off of something that a) probably hasn’t been updated to support changes or b) kinda buggy because it happens to be a fairly invasive program.

Without saying anything about OSX in particular , any operating system that requires network access to log in is a user-hostile piece of shit, and the linked bug#284 pretty well implies that that is in fact the case. It's entirely possible that the problem is due to incompatibities with new OS code or bugs in the firewall program (edit: ie, your case a and case b), but evidence in the bug report pretty clearly sugges…

You're making a mistake jumping to the assumption of malice rather than thinking about all of the other possibilities. This class of bugs is pretty common: people sometimes test software without a network connection at all but its far less common to test with one which drops packets but does not return errors. I've had to fix variations of this problem on Windows, Linux, and things like VMware's HA module.

My guess would be that it's something like checking for things like application revocation or other updates or, if you have iCloud enabled, something like attempting to synchronize your settings or data.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#124

Post by acdha »

webmobdev wrote: post #105
FabHK wrote: post #90

Earlier quoted context omitted.

Could you enlighten me what the gross invasion of privacy and the security risk is for the majority of users that do not hack their machine in a way that prevents those connections? I'm aware of Gatekeeper checking developer certificates upon opening apps over an unencrypted connection (so far; Apple is fixing that), but not sure where the gross privacy invasion or security risk is (in particular compared to existing…

> Could you enlighten me what the gross invasion of privacy and the security risk is for the majority of users The same reasons that people use application firewalls on their system - Access to our personal data by Apple - intentionally or "accidently". Malware may be able to hijack Apple whitelisted softwares to do their mischief. (And please don't reply by saying we can "trust" Apple with our data - I don't, and if…

The services which are exempted either don't access personal data or only do so when you enable a service like iCloud Photos. If you don't trust Apple to not access data when the corresponding service is not enabled, your choices are to not use their OS or not use their OS — a tool like this can trivially be bypassed by anyone who controls the kernel.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#125

Post by m463 »

filleduchaos wrote: post #52
terramex wrote: post #42

Earlier quoted context omitted.

Users can develop and install custom kernel extensions (.kexts) that can access everything, but they first need to disable System Integrity Protection in recovery mode. Over the years Apple expanded their frameworks library to reduce need for custom .kexts, but they are still supported even on M1 Macs (as long as they are compiled for ARM64). So to answer you question - 'root' user on macOS is by default not a true r…

It's honestly mind-boggling how many people whine and complain about macOS not "letting" them do this or that when they can turn off virtually every one of their gripes in about two minutes. The most egregious was someone complaining that /bin and other system folders are read-only [on systems under System Integrity Protection]. Surely anybody with a pressing desire to e.g. upgrade their bash install or any other thi…

I wonder if it's possible to turn all this on before activating the machine?

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#126

Post by m463 »

_rend wrote: post #106
joshspankit wrote: post #98

Earlier quoted context omitted.

Downvote? I'm confused. This whole "Apple gets to bypass firewalls" thing is IMO a huge deal. Whoever figures out how to make a system-wide firewall that can block everything including "unblockable" Apple network traffic likely deserves (again: IMO) all the attention we can give them.

This already exists. Apple processes can bypass app-specific filters (NEFilterDataProvider), but not system-wide firewalls (like the built-in BPF), VPN configurations, etc.

I thought they DID bypass vpn connections.

Also, apple will routinely clear your pf rules when installing stuff.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#127

Post by ArchOversight »

microtonal wrote: post #57
filleduchaos wrote: post #52

Earlier quoted context omitted.

It's honestly mind-boggling how many people whine and complain about macOS not "letting" them do this or that when they can turn off virtually every one of their gripes in about two minutes. The most egregious was someone complaining that /bin and other system folders are read-only [on systems under System Integrity Protection]. Surely anybody with a pressing desire to e.g. upgrade their bash install or any other thi…

It's honestly mind-boggling how many people whine and complain about macOS not "letting" them do this or that when they can turn off virtually every one of their gripes in about two minutes. It it too much to ask to have the normal security protections that macOS provides and still being able to block Apple services with Little Snitch or Lulu or letting Apple services go through a VPN as well?

> letting Apple services go through a VPN as well

Apple Services go through a VPN as well. A VPN redirects all traffic and does not use the content filtering framework which allows the Apple services to bypass restrictions.

So if you install a VPN it will happily route all traffic over it, including traffic from Apple's own applications.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#128

Post by hobs »

acdha wrote: post #124
webmobdev wrote: post #105

Earlier quoted context omitted.

> Could you enlighten me what the gross invasion of privacy and the security risk is for the majority of users The same reasons that people use application firewalls on their system - Access to our personal data by Apple - intentionally or "accidently". Malware may be able to hijack Apple whitelisted softwares to do their mischief. (And please don't reply by saying we can "trust" Apple with our data - I don't, and if…

The services which are exempted either don't access personal data or only do so when you enable a service like iCloud Photos. If you don't trust Apple to not access data when the corresponding service is not enabled, your choices are to not use their OS or not use their OS — a tool like this can trivially be bypassed by anyone who controls the kernel.

Its a firewall, it either works or it doesn't. If you don't allow me to block your services, then your firewall simply doesn't work.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#129

Post by ArchOversight »

user3939382 wrote: post #55
m463 wrote: post #10

I wonder how this works with respect to apple's "special exemptions" for its own applications. (bypass NEFilterDataProvider)

I recently learned that even blackholing the entire /8 block of Apple's IPs at the router, after they bypass your provided DNS servers, after they bypass your /etc/hosts file, macOS then tries to phone home using IPv6. These attempts* go on 24/7 even with 0 apps open and the computer being idle. * https://i.imgur.com/md2ykLl.png helpd, geod, locationd, cloudd, the list of apps phoning home when your computer is idle…

So block their ASN, and not just IPv4. Apple has a long standing policy that all apps should be useable over IPv6, this is the same for their own applications.

Re: Lulu – Mac open-source firewall that aims to block unknown outgoing connections

#130

Post by hobs »

noname120 wrote: post #53
lovelyviking wrote: post #44

Earlier quoted context omitted.

What is point then to have such app all? if you can’t control _all_ connections then it appears useless. What is the proper solution? Something on router? Is there a way? Can Openwrt do the job of protecting privacy properly?

“This solution is not completely perfect so it's absolutely worthless”.

As the solution worked before and they purposefully broke it, your statement is just idiotic.
Post reply on HN