Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

141–150 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#141

Post by webmobdev »

conistonwater wrote: post #123
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

(That tweet has been deleted by the Apple developer).

Before macOS Big Sur / Catalina, many of these application firewalls - Lulu, Little Snitch, HandsOff, TripMode, RadioSilence etc. - all used their own kernel extensions to effectively monitor and block any processes from connecting to the internet.

Firewalls are system security softwares. And naturally Apple would prefer to oversee and have this in-built in their OS. Apple also wants to discourage kernel extensions on macOS (they have some good reasons - a poorly designed kernel extension can make the OS unstable; but mostly its about feature control with Apple).

So they informed all such firewall app developers that their individual kernel extensions will no longer be allowed, and Apple had instead created an OS API specifically for their use case. (They described the features it would have and invited them to give their feedback). And so all application firewalls were forced to update their apps and use this OS API.

But this API had an undisclosed, in-built list of Apple approved applications that no firewall was allowed to block. Someone created that list. Someone added that list in the system, and coded the API to specifically give them special privileges to bypass any application firewalls.

Bugs are accidental. Backdoors like these are intentional.

(You can however take exception to the usage of "Backdoor" here - perhaps from Apple's perspective it was a good design decision as many of these services go wacko, and sometimes even freeze your system, when they aren't allowed to do what they are coded to, like do some operation over the internet. I've often seen CPU spikes and slowdowns when you block some of these services.)

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#142

Post by zaphirplane »

kristofferR wrote: post #126
conistonwater wrote: post #123

Earlier quoted context omitted.

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

You don't create a whitelist system literally called ContentFilterExclusionList by accident.

A backdoor has some malicious connotations to me. Having security profiles controlled by a list seems a thing

Without spending a lot of time sshd has allowLists (AllowGroups) and match directives

Sudo also has per group config

As a user on any operating system what you can and can’t do is controlled by a list

Perhaps the issue is the list isn’t user controlled ?

Perhaps the issue falls into the “I own and control my device” vs “we sell you a safe, foot gun safe, easy to use device (in their opinion)”

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#143

Post by stretchcat »

webmobdev wrote: post #128
miles wrote: post #84

Earlier quoted context omitted.

Tweet[1] by Apple developer Russ Bishop: "Some system processes bypassing NetworkExtensions in macOS is a bug, in case you were wondering." Reply[2] by David Dudok de Wit, developer of TripMode: "Glad to see it's being reconsidered as a bug, because Apple told us it 'behaves as designed' (FB7740671 + FB7665551). And why is there an exclusion list in the first place? I'd love to know more and see this documented." Rep…

The tweet by the Apple developer has been deleted - hope he didn't lose job, and at worst only earned a reprimand. (Nobody with experience would call it a bug, when it was clearly a deliberate design decision).

Inexperience is less concerning than trying to publicly whitewash the misdeeds of a corporation. I'm not sure you can even chalk this up to inexperience; my charitable guess is he probably didn't look at the code or config, assumed the company he likes would only do something like this by accident, went to twitter to say as much, then got a little carried away in the heat of it.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#144

Post by pstrateman »

conistonwater wrote: post #123
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

> Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

They're lying.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#145

Post by yholio »

webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Apple has no love for privacy nor ever had. They are in a market position where their main competitors - Google primarily, Microsoft and Amazon - are highly dependent on revenue streams extracted by monetizing personal information.

Apple is in a position to cut that stream without affecting its bottom line, so it does it and claims privacy as a core value.

I won't look a gift horse in the mouth, but I have no doubt that the tables could switch at any time.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#146

Post by stretchcat »

Demiurge wrote: post #100
colejohnson66 wrote: post #76

Earlier quoted context omitted.

As much as I'd like to believe it was just an oversight, how do you accidentally have your services bypass the firewall? That feels like it would have to be a deliberate choice under the assumption that "our apps are signed by us, and the OS verifies that, so all traffic through these apps should be OK, right?" I don't mean this snarkily; it's a genuine question. I don't know how OSes work.

Perhaps they wanted a bypass as system recovery option, or preference, not on by default.

I don't see why half the shit in that list would be needed during a recovery process, let alone need to bypass a VPN as well. If Apple wants to claim this as their defense, let them. Until then, I see little value in dreaming up excuses they aren't willing to make for themselves.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#147

Post by jakubp »

zaphirplane wrote: post #142
kristofferR wrote: post #126

Earlier quoted context omitted.

You don't create a whitelist system literally called ContentFilterExclusionList by accident.

A backdoor has some malicious connotations to me. Having security profiles controlled by a list seems a thing Without spending a lot of time sshd has allowLists (AllowGroups) and match directives Sudo also has per group config As a user on any operating system what you can and can’t do is controlled by a list Perhaps the issue is the list isn’t user controlled ? Perhaps the issue falls into the “I own and control my…

If they claim "here's the API you can use to control network access" but can then put arbitrary apps to work around that, that's the definition of backdoor access to the device.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#148

Post by lovelyviking »

cromka wrote: post #107
lovelyviking wrote: post #97

Earlier quoted context omitted.

I find it amazing that recently on a presumably ‘hacker’ forum opinions showing a ‘freedom software’ perspective get a bully response in form of simply downvoting and shutting up the person. I urge the admins to stop this practice. I wish to hear such points of view and consider things from such perspective. It is very logical to assume that once you have no direct access to the sources of software, that software cou…

> On recent M1 you can’t even have own OS without Apple permission That's not true. https://asahilinux.org/about/ , "Does Apple allow this? Don’t you need a jailbreak?"

It would be good news when it’s finished ( If it will be finished at all) but it is not the case so far.

Also, from the same source: “ Will this make Apple Silicon Macs a fully open platform? No, Apple still controls the boot process ...”

Without open firmware and bootloader ... well, is it really Own OS?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#149

Post by Synaesthesia »

webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

The PRISM revelations in particular made me realise that we can really only rely on Linux for security, since Apple, MS, Amazon and all the big tech companies are onboard with cooperating with the NSA. If you've read the way eg the CIA installs snooping software on Macs and PC's, they hide the Mac version in your hidden EFI boot volume, even from the factory.

It's enough to make you never trust them again.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#150

Post by lovelyviking »

saagarjha wrote: post #135
cromka wrote: post #107

Earlier quoted context omitted.

> On recent M1 you can’t even have own OS without Apple permission That's not true. https://asahilinux.org/about/ , "Does Apple allow this? Don’t you need a jailbreak?"

And Apple released a build today which provides the kmutil options for it, too :)

great, and how it helps to boot own os?
Post reply on HN