Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

51–60 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#51

Post by user3939382 »

p1mrx wrote: post #27
user3939382 wrote: post #11

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

The screenshot shows init-p01st.push.apple.com and ##-courier.push.apple.com, none of which have IPv6 AAAA records that I can see.

If you proxy macOS connections overnight with no apps running and the computer idle you get about 15 hosts from 7-8 Apple processes phoning home, a handful of them resort last to IPv6 after ignoring your DNS and /etc/hosts

The screenshot is an example of traffic to Apple unsolicited by the user.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#52

Post by sjwright »

ilikepi wrote: post #42
_qulr wrote: post #26

Earlier quoted context omitted.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

> Does that take 6 months? If this one change is in a pool with tens of thousands of other possible changes, and it also has to go through one or more QA cycles? Sure, why not 6 months?

In some industries 6 months from initial report to consumer deployment would sound almost irresponsibly fast.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#53

Post by [deleted] »

_qulr wrote: post #40
eyelidlessness wrote: post #35

Earlier quoted context omitted.

You’re right, I didn’t. Thank you for saying so with much more clarity than I probably would have.

> This happened so quickly This was your claim. What is the justification for the claim? The comment seemed to imply that it was the OCSP problem. Otherwise, no other explanation was offered by the comment.

[deleted]

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#54

Post by Rebelgecko »

aarchi wrote: post #44
xyst wrote: post #10

very nice - this was one of my main contentions on Big Sur. Will upgrade once 11.2 is stable :)

I'm still on Mojave to use 32-bit apps. Any way to use 32-bit in Catalina or later?

For my 32 bit binaries, the easiest way to use them is to run the Windows version, because that OS has better backwards compatability.

It's possible to get a Mojave VM up and running but it was nontrivial when I gave it a shot

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#55

Post by sjwright »

oneplane wrote: post #28
user3939382 wrote: post #11

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

That's an odd one. If my Mac is offline it works just fine. Perhaps your filtering/firewalling isn't complete so it gets partial connections and then times out on the rest? If you do that in large quantities, any OS will start to show trouble.

Flaky network stacks aren't rare. I've experienced plenty of consumer-facing operating systems that will freeze on boot for 10 to 60 seconds if the network interface is up but DHCP is unreachable.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#57

Post by alwillis »

Paraesthetic wrote: post #31
exabrial wrote: post #29

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

When it comes to media pressure, Apple is like the honey-badger—they don’t care.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#58

Post by saagarjha »

alwillis wrote: post #57
Paraesthetic wrote: post #31

Earlier quoted context omitted.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

When it comes to media pressure, Apple is like the honey-badger—they don’t care.

They want to make it seem like they don’t care…but they very much do.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#59

Post by tanelpoder »

Rebelgecko wrote: post #54
aarchi wrote: post #44

Earlier quoted context omitted.

I'm still on Mojave to use 32-bit apps. Any way to use 32-bit in Catalina or later?

For my 32 bit binaries, the easiest way to use them is to run the Windows version, because that OS has better backwards compatability. It's possible to get a Mojave VM up and running but it was nontrivial when I gave it a shot

I’m using a Mojave VM with VMWare Fusion on my laptop (that runs Catalina) on the rare occasion of needing to run 32bit apps. Install & setup was easy, without any problems. VMWare Fusion is a paid app, but VirtualBox should be able to do the same for free.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#60

Post by jojobas »

exabrial wrote: post #29

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

The firewall is just the tip of the iceberg.

Microsoft provides the sources and special builds for sensitive environments.

They work with governments worldwide and open their source code to get certified.

As far as I understand it never was Apple's priority.

Post reply on HN