Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

31–40 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#31

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#32
post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

I think your second point is next to impossible, businesses make mistakes no matter how much they try to stop them and what makes them who they are is how they respond.

In this case Apple responded well and that's great. We don't know how many of these decisions are already being squashed each day through appropriate governance.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#33
post #24
post #22

Earlier quoted context omitted.

It's reasonable not to take action based on the feedback from a developer who sells an app-level firewall - it's neither a broad nor disinterested constituency. Big Sur's been out for less than two months - for a bigass company, it's decent turnaround.

Who else would Apple take feedback from during the betas? Who else would even notice that there was a hole in the firewalls except the firewall developers?

The gigantic majority of users who are not firewall developers as well as the gigantic majority who never touches the betas both seem like sensible and important sources of feedback.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#34
post #23

Earlier quoted context omitted.

> Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. This more or less confirms my hunch. Thanks for inside perspective on it. That’s how literally every other org works but I know Apple got this…

> it’s good to have a reminder that at the end of the day it’s not the borg. The impression I always got was more like a mid-to-late USSR than the Borg (in structure rather than efficacy, the USSR didn't work, apple does). Everyone in the Borg is (supposed to be) identical, whereas Apple seems like a structure of lots of groups of often brilliant people working in seperate-but-equal subtrees, working under a (especia…

I think their reticence to document is more a function of how long they’ve been able to get away with not doing it. Almost every engineering culture that finds that balance unfortunately embraces it.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#35
post #21
post #17

Earlier quoted context omitted.

The imagined timeline of this comment doesn't seem to align with reality. The exclusion list was already present in the first WWDC builds in summer 2020, as the Little Snitch developers noticed: https://blog.obdev.at/a-hole-in-the-wall/ The Mac "OSCP appocalypse" occurred in November on the day that Big Sur was released to the public, with the exclusion list still present, and a number of firewall developers were alr…

I don't think the comment you're replying to made specific claims about this timeline.

You’re right, I didn’t. Thank you for saying so with much more clarity than I probably would have.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#36
post #33
post #24

Earlier quoted context omitted.

Who else would Apple take feedback from during the betas? Who else would even notice that there was a hole in the firewalls except the firewall developers?

The gigantic majority of users who are not firewall developers as well as the gigantic majority who never touches the betas both seem like sensible and important sources of feedback.

> the gigantic majority who never touches the betas

I was replying to a comment that literally said, "That's why Apple has the Developer and Public Beta releases for iOS/OSX", so maybe you should argue with that comment instead of with me.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#37

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

Its possible that they saw it as a purely positive move that would improve security on MacOS and then after seeing everyone's response they reevaluated its importance.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#38

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

Apple gives two fucks about media pressure. Their longstanding history of giving in to pressure almost exclusively is responsive to their users, either:

- pro/dev users who act as their trend setters (see recent backpedals on keyboards and Mac Pro form factor)

- people hacking stuff where it’s popular enough they want more influence on the UX (bootcamp)

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#39
post #26

Earlier quoted context omitted.

> Except that Apple did not take action. Look, I don't mean to criticise. But how do you know that Apple didn't start working on a fix when they were told about it? Apple doesn't exactly say when they start working on a fix for something, or else we would have known earlier.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

It’s possible they were working on other changes so firewalls didn’t break the whitelisted components.

They shouldn’t have been broken in the first place, but hey.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#40
post #21

Earlier quoted context omitted.

I don't think the comment you're replying to made specific claims about this timeline.

You’re right, I didn’t. Thank you for saying so with much more clarity than I probably would have.

> This happened so quickly

This was your claim. What is the justification for the claim? The comment seemed to imply that it was the OCSP problem. Otherwise, no other explanation was offered by the comment.

Post reply on HN