Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

121–130 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#121

Post by webmobdev »

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously that's going to be really hard with the changes they have made to the OS).

I know many Apple's fan see this as a positive move.

But let's not ignore the pattern of privacy violations and user data collections due to deliberate design and the "apology" and "changes" that follow once CAUGHT. A few of these that immediately come to mind are:

- Apple selling user data to US government: https://www.theguardian.com/world/2013/jun/06/us-tech-giants...

- Apple iPhone 11 tracks user location even when location services are explicitly turned off by user (another BACKDOOR): https://www.silicon.co.uk/mobility/smartphones/apple-iphone-...

- Apple macOS tracks every app that you use: https://sneak.berlin/20201112/your-computer-isnt-yours/

- Apple introduces BACKDOOR in its API to allow Apple apps to bypass application firewalls: https://www.patreon.com/posts/hooray-no-more-46179028

(For those who want to diss me for the above, realise that Apple's new found love for privacy doesn't mean shit without such public scrutiny and discussions. And if you want it to last, remain suspicious and VOCAL on any such possible violations.)

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#122

Post by fredsted »

FireBeyond wrote: post #117
xyst wrote: post #10

very nice - this was one of my main contentions on Big Sur. Will upgrade once 11.2 is stable :)

My other major contention is that Display Stream Compression has been broken since .0 betas through .1. I have 2 27" 4K HDR 144Hz monitors. On Catalina I can drive them at full spec on my 2019 Mac Pro, with a W5700X. On Big Sur, my options are HDR @ 60Hz, or SDR @ 95Hz. Not to mention the monitors also got a firmware update to unlock 165Hz, which neither Catalina or Big Sur recognize.

Which monitors are you using?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#123

Post by conistonwater »

webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#124

Post by pilif »

robertlagrant wrote: post #118
jraph wrote: post #109

Earlier quoted context omitted.

> I wasn't aware that VS Code was "proprietary malware"? I'm sorry to see you are discovering this. VS Code is under this proprietary license [1]. As for the malware part: > Data Collection. The software may collect information about you and your use of the software, and send that to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may opt-out of many of the…

> Indeed you can rebuild your copy or get Codium without the telemetry under the MIT license, and the software is really good, but it is a crippled version and does not make VS Code free software. What can't it do that regular VSCode can?

talk to many language server plugins released by MS and containing checks to make sure they only talk to regular VSCode

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#125

Post by darwingr »

While I'm glad they fixed it (upgrading past Catalina was not going to happen), It's going to take me a LONG time to trust them again.

The fact that they could rationalize their own thought process to think this was a good idea or even anywhere close to acceptable, at best leads me to doubt their judgement. At worst, well it's best to assume incompetence over malice but you can see what doors this would open in the future. Now we know they CAN do this without it being obvious to most users, which is a new dimension of risk regardless of intent.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#126

Post by kristofferR »

conistonwater wrote: post #123
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

You don't create a whitelist system literally called ContentFilterExclusionList by accident.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#127

Post by felipelemos »

conistonwater wrote: post #123
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

How a 'ContentFilterExclusionList' creation can be a bug? Somebody hit the wrong keys by mistake and nobody noticed during the pull request review?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#128

Post by webmobdev »

miles wrote: post #84
yalogin wrote: post #69

Earlier quoted context omitted.

As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight or a resourcing issue.

Tweet[1] by Apple developer Russ Bishop: "Some system processes bypassing NetworkExtensions in macOS is a bug, in case you were wondering." Reply[2] by David Dudok de Wit, developer of TripMode: "Glad to see it's being reconsidered as a bug, because Apple told us it 'behaves as designed' (FB7740671 + FB7665551). And why is there an exclusion list in the first place? I'd love to know more and see this documented." Rep…

The tweet by the Apple developer has been deleted - hope he didn't lose job, and at worst only earned a reprimand. (Nobody with experience would call it a bug, when it was clearly a deliberate design decision).

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#129

Post by jraph »

robertlagrant wrote: post #118
jraph wrote: post #109

Earlier quoted context omitted.

> I wasn't aware that VS Code was "proprietary malware"? I'm sorry to see you are discovering this. VS Code is under this proprietary license [1]. As for the malware part: > Data Collection. The software may collect information about you and your use of the software, and send that to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may opt-out of many of the…

> Indeed you can rebuild your copy or get Codium without the telemetry under the MIT license, and the software is really good, but it is a crippled version and does not make VS Code free software. What can't it do that regular VSCode can?

As ianlevesque said [1], the python extension and remoting. Probably other things too.

[1] - https://news.ycombinator.com/item?id=25772409

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#130

Post by webmobdev »

aarchi wrote: post #44
xyst wrote: post #10

very nice - this was one of my main contentions on Big Sur. Will upgrade once 11.2 is stable :)

I'm still on Mojave to use 32-bit apps. Any way to use 32-bit in Catalina or later?

Why do you want to upgrade though? What's Mojave lacking that Catalina has?
Post reply on HN