Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

11–20 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#11
So does this mean we won’t be seeing the behavior I just documented the other day on here?

https://news.ycombinator.com/item?id=25746007

In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#12

Prediction: this will somehow still be spun as Apple wanting to own your Mac even though you bought it and turn it into an iDevice.

No, as someone who does often criticize Apple for taking away control from their users, this is a good move. Their original action that triggered this was them wanting to own your Mac.

I sincerely doubt that was the motivation. See my kittycorner comment: https://news.ycombinator.com/item?id=25771339

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#13
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer…

> Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about.

This more or less confirms my hunch. Thanks for inside perspective on it. That’s how literally every other org works but I know Apple got this reputation for having a very executive-micromanaged culture under both Jobs eras, it’s good to have a reminder that at the end of the day it’s not the borg.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#14
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Curious why you phrased Apple listening to their customers in such a negative way. Maybe from pessimism bias? I observe a lot of HN commenters don't vibe with how Apple controls & develops their ecosystem. Yet, instead of go elsewhere, complaining and acting like being oh so very special enough to know how things should be done is preferred; while expecting a major company to just cater to their personal whims. I'm u…

Well, I've had a Mac continuously since the original 128k Mac, so I'm pretty well situated as an observer of all things Apple and more knowledgeable about their history and their machines/software then the vast majority of their employees, some of whom are close friends.

I want them to listen, since the decisions they make affect the ecosystem I've adopted for my extended family (for whom I'm the main technical point of contact,) and poor ones will affect me and them disproportionately.

So to me, it doesn't feel at all like entitlement, rather, the wishes of a longtime, loyal customer hoping they continue down the path of listening to those of us who have promoted their products and helped make them successful.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#15
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Curious why you phrased Apple listening to their customers in such a negative way. Maybe from pessimism bias? I observe a lot of HN commenters don't vibe with how Apple controls & develops their ecosystem. Yet, instead of go elsewhere, complaining and acting like being oh so very special enough to know how things should be done is preferred; while expecting a major company to just cater to their personal whims. I'm u…

There is no call to invent reasons of entitlement or faithlessness in engineering prowess when the desire is simply to control your own device.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#16
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Curious why you phrased Apple listening to their customers in such a negative way. Maybe from pessimism bias? I observe a lot of HN commenters don't vibe with how Apple controls & develops their ecosystem. Yet, instead of go elsewhere, complaining and acting like being oh so very special enough to know how things should be done is preferred; while expecting a major company to just cater to their personal whims. I'm u…

To be honest I think having a pessimism bias towards large corporations is healthy. Sure, they might in the end do a good thing (or a less harmful thing than they could have), but they have a huge amount of power and very little oversight.

I like Apple products, but I try to avoid any illusion that they’re good guys on a corporate scale. They’ve proven they’re not in a lot of ways (see many recent articles about their labor practices). That doesn’t mean every thing they do should be equally scrutinized with a pessimistic predisposition. But I really don’t fault anyone for assuming a large for profit organization will prioritize their own priorities over everything else.

The thing I try to moderate that with is understanding their actual priorities and not just falling into blind cynicism.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#17
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

This happened so quickly I suspect there was never a decision for or against. Pretty likely a boneheaded engineer did what us boneheaded engineers do and cut corners, likely with all of the fun boneheaded management and deadlines that come along for the ride. Why, you might ask, would this be a matter of cutting corners? Well, fault tolerance is hard . What happens when the OS can’t reach external services it depends…

The imagined timeline of this comment doesn't seem to align with reality. The exclusion list was already present in the first WWDC builds in summer 2020, as the Little Snitch developers noticed: https://blog.obdev.at/a-hole-in-the-wall/

The Mac "OSCP appocalypse" occurred in November on the day that Big Sur was released to the public, with the exclusion list still present, and a number of firewall developers were already aware of the exclusion list and had reported bugs to Apple.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#18
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer…

> That's why Apple has the Developer and Public Beta releases for iOS/OSX so that external users can provide feedback. And on this occasion just like on many other they will take action if necessary.

Except that Apple did not take action. Firewall developers such as Little Snitch did become aware of the issue during the beta releases and gave feedback to Apple, which Apple ignored and shipped it anyway to the public. https://blog.obdev.at/a-hole-in-the-wall/

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#19
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer…

> Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions.

I wonder what the backstory to the original decision was.

Pure speculation: a "bug" was reported in which something was broken, and it turned out to be because a third party firewall was blocking access to some Apple-hosted service, and someone started working on "how to fix the bug", and the "bugfix" was to make sure third party software can't do that.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#20

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing.

Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com URL for their reachability test, so your blackhole should be blocking that too.

Post reply on HN