Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

41–50 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#41

Post by eyelidlessness »

_qulr wrote: post #18
threeseed wrote: post #7

Earlier quoted context omitted.

Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer…

> That's why Apple has the Developer and Public Beta releases for iOS/OSX so that external users can provide feedback. And on this occasion just like on many other they will take action if necessary. Except that Apple did not take action. Firewall developers such as Little Snitch did become aware of the issue during the beta releases and gave feedback to Apple, which Apple ignored and shipped it anyway to the public.…

To be “fair”, it’s a fairly well known secret that official feedback channels for all Apple software are basically a trash chute.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#42

Post by ilikepi »

_qulr wrote: post #26
vulcan01 wrote: post #25

Earlier quoted context omitted.

> Except that Apple did not take action. Look, I don't mean to criticise. But how do you know that Apple didn't start working on a fix when they were told about it? Apple doesn't exactly say when they start working on a fix for something, or else we would have known earlier.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

> Does that take 6 months?

If this one change is in a pool with tens of thousands of other possible changes, and it also has to go through one or more QA cycles? Sure, why not 6 months?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#43

Post by eyelidlessness »

_qulr wrote: post #26
vulcan01 wrote: post #25

Earlier quoted context omitted.

> Except that Apple did not take action. Look, I don't mean to criticise. But how do you know that Apple didn't start working on a fix when they were told about it? Apple doesn't exactly say when they start working on a fix for something, or else we would have known earlier.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

My sweet summer child I hope you never have to develop or schedule software releases at a level of complexity where 6 months sounds anything less than luxurious.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#45

Post by s0cur10us »

oneplane wrote: post #28
user3939382 wrote: post #11

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

That's an odd one. If my Mac is offline it works just fine. Perhaps your filtering/firewalling isn't complete so it gets partial connections and then times out on the rest? If you do that in large quantities, any OS will start to show trouble.

I had that freeze issue and the DROP vs REJECT idea came to my mind too. As far as I remember, it was REJECT everywhere. So no.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#46

Post by eyelidlessness »

_qulr wrote: post #40
eyelidlessness wrote: post #35

Earlier quoted context omitted.

You’re right, I didn’t. Thank you for saying so with much more clarity than I probably would have.

> This happened so quickly This was your claim. What is the justification for the claim? The comment seemed to imply that it was the OCSP problem. Otherwise, no other explanation was offered by the comment.

It happened quickly on the heels of the public release. The problem I cited was about how embarrassing a half assed solution could be, not about prompting a different response.

Good engineers who boneheadedly cut corners are already tracking their omissions and FIXMEs. The fact that they shipped and quickly turned around a better solution reads to me like engineers doing their dang job.

Edit: I just realized who I responded to and even if we don’t see it the same way I just want to say I appreciate your work and even your particular cynicism.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#47

Post by _qulr »

eyelidlessness wrote: post #43
_qulr wrote: post #26

Earlier quoted context omitted.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

My sweet summer child I hope you never have to develop or schedule software releases at a level of complexity where 6 months sounds anything less than luxurious.

I've been a professional Mac software engineer for 15 years.

I've also lived my entire life in the North (which for some reason is called the Midwest).

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#48

Post by eyelidlessness »

_qulr wrote: post #47
eyelidlessness wrote: post #43

Earlier quoted context omitted.

My sweet summer child I hope you never have to develop or schedule software releases at a level of complexity where 6 months sounds anything less than luxurious.

I've been a professional Mac software engineer for 15 years. I've also lived my entire life in the North (which for some reason is called the Midwest).

See other comment re: realizing who I was responding to. Also I spent last winter up there (Saint Paul).

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#49

Post by user3939382 »

lilyball wrote: post #20
user3939382 wrote: post #11

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing. Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com UR…

Why are they ignoring /etc/hosts if this is good behavior?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#50

Post by oefrha »

user3939382 wrote: post #11

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

init-p01st.push.apple.com and *-courier.push.apple.com requests come from apsd(8), the Apple Push Notification service daemon. It's attempting to get push notifications, rather than some sort of phone home telemetry thing.

Now, I do have an issue with apsd specifically on Big Sur, but "sending phone home packets" isn't it.

Post reply on HN