Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

61–70 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#61

Post by jojobas »

user3939382 wrote: post #49
lilyball wrote: post #20

Earlier quoted context omitted.

You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing. Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com UR…

Why are they ignoring /etc/hosts if this is good behavior?

In their book a bit of malware might have modified /etc/hosts.

It's for your own good!

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#62

Post by oneplane »

joshspankit wrote: post #30
oneplane wrote: post #28

Earlier quoted context omitted.

That's an odd one. If my Mac is offline it works just fine. Perhaps your filtering/firewalling isn't complete so it gets partial connections and then times out on the rest? If you do that in large quantities, any OS will start to show trouble.

Timing out packets instead of denying them could certainly be an issue (I run across this a lot with internet being down while the router and internal DNS is still up). But your claim that “any OS will start to show trouble” is not how it’s supposed to work, nor how it used to work before 24/7 connections, nor even how it should work assuming you’re ok with phone-home daemons.

Of course it's not how it's supposed to work, but that is how it tends to work ;-)

An OS in general has a few layers with caches and monitors and resolvers etc, and if you block a few of them, in a partial manner, they tend to get in to an extreme version of the bus bunching problem. Windows still does that with their 'network identification' where sometimes something goes wrong in the probing process and the connection hangs on "identifying" indefinitely. And that's just a silly "optional" service (which should default to the public profile and only change from there instead of defaulting to no connection at all).

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#63

Post by _qulr »

ilikepi wrote: post #42
_qulr wrote: post #26

Earlier quoted context omitted.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

> Does that take 6 months? If this one change is in a pool with tens of thousands of other possible changes, and it also has to go through one or more QA cycles? Sure, why not 6 months?

> Sure, why not 6 months?

Because the first WWDC preview version of Big Sur was released to developers on June 22, 2020, and Big Sur was released to the public on November 12, 2020, so Apple needs to be able to fix issues identified during the beta period much quicker than in 6 months.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#64

Post by oneplane »

s0cur10us wrote: post #45
oneplane wrote: post #28

Earlier quoted context omitted.

That's an odd one. If my Mac is offline it works just fine. Perhaps your filtering/firewalling isn't complete so it gets partial connections and then times out on the rest? If you do that in large quantities, any OS will start to show trouble.

I had that freeze issue and the DROP vs REJECT idea came to my mind too. As far as I remember, it was REJECT everywhere. So no.

Come to think of it, I did hear about this from someone a while ago who was using some sort of public WiFi HotSpot (bad idea in general) which had a broken redirect page and in turn didn't open up the firewall and gets you that 'partial' connection that causes all sorts of problems. Was on both macOS (10.12 I think) and Linux (some Ubuntu version) at that time.

Seems to be an interesting problem: if it works fine with no connection and fine with a complete connection but not 'in between' (which is the best way I can describe it so far) you'd think it must be some common library or component in a network stack that causes this. macOS has some reachability system that might be in play here, perhaps if it flags the network as 'reachable' but then gets REJECT'ed it goes bad? Or the other way around: marks network as 'unreachable' but traffic flows anyway?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#65

Post by davisr »

jojobas wrote: post #60
exabrial wrote: post #29

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

The firewall is just the tip of the iceberg. Microsoft provides the sources and special builds for sensitive environments. They work with governments worldwide and open their source code to get certified. As far as I understand it never was Apple's priority.

You're commending Micro$oft for sharing source code? Please! They both are completely irresponsible and push proprietary malware. Anything less than freely usable/sharable software is inadequate.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#67

Post by judge2020 »

user3939382 wrote: post #49
lilyball wrote: post #20

Earlier quoted context omitted.

You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing. Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com UR…

Why are they ignoring /etc/hosts if this is good behavior?

Are you writing

  ::/0 domain.example
as well? It might using either AAAA DNS lookups or the equivalent of `getent hosts` which pulls v6 records first, which are only overridden if there is a v6 override for the hostname.

  $ getent hosts cloudflare.com && getent ahosts cloudflare.com
  2606:4700::6810:85e5 cloudflare.com
  104.16.133.229  STREAM cloudflare.com
  $ echo "0.0.0.0 cloudflare.com" | sudo tee -a /etc/hosts
  $ getent hosts cloudflare.com && getent ahosts cloudflare.com
  2606:4700::6810:85e5 cloudflare.com
  0.0.0.0         STREAM cloudflare.com

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#68

Post by random5634 »

user3939382 wrote: post #51
p1mrx wrote: post #27

Earlier quoted context omitted.

The screenshot shows init-p01st.push.apple.com and ##-courier.push.apple.com, none of which have IPv6 AAAA records that I can see.

If you proxy macOS connections overnight with no apps running and the computer idle you get about 15 hosts from 7-8 Apple processes phoning home, a handful of them resort last to IPv6 after ignoring your DNS and /etc/hosts The screenshot is an example of traffic to Apple unsolicited by the user.

Does Apple allow DNS hijacking / local override of their domains? Some security sensitive software will resolve using known good resolvers for things that shouldn't be redirected locally (ie, google may use 8.8.8.8 in some of their VPN products rather than rely on comcast or your malware infected local source?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#69

Post by yalogin »

Paraesthetic wrote: post #31
exabrial wrote: post #29

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight or a resourcing issue.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#70

Post by floatingatoll »

user3939382 wrote: post #49
lilyball wrote: post #20

Earlier quoted context omitted.

You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing. Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com UR…

Why are they ignoring /etc/hosts if this is good behavior?

Why are you using /etc/hosts to modify the behavior of the Apple resolver system? That’s not how macOS directory services work, and Apple only appears to offers it as a legacy backwards-compat stub with no guarantee of support or effectiveness for modern anything. It’s no surprise that it’s not an effective solution for you.
Post reply on HN