Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

151–160 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#151

Post by rorykoehler »

conistonwater wrote: post #123
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

It's always a bug. Fool me once....

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#152

Post by saagarjha »

lovelyviking wrote: post #150
saagarjha wrote: post #135

Earlier quoted context omitted.

And Apple released a build today which provides the kmutil options for it, too :)

great, and how it helps to boot own os?

You make a boot object and use that to point your Mac at it.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#154

Post by rorykoehler »

threeseed wrote: post #7
mrkstu wrote: post #3

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer…

IMO Apple move too fast and try do too much. They're always shipping half baked features and making bad decisions like this.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#155

Post by lern_too_spel »

webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Your first link was debunked the day it was printed. https://mobile.twitter.com/search?q=Greenwald%20direct%20acc...

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#156

Post by confiq »

yholio wrote: post #145
webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

Apple has no love for privacy nor ever had. They are in a market position where their main competitors - Google primarily, Microsoft and Amazon - are highly dependent on revenue streams extracted by monetizing personal information. Apple is in a position to cut that stream without affecting its bottom line, so it does it and claims privacy as a core value. I won't look a gift horse in the mouth, but I have no doubt t…

ironically, most of these companies are out of China because they don't want to comply with Chinese laws. Not apple https://applecensorship.com/

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#157

Post by tempodox »

SulfurHexaFluri wrote: post #37
Paraesthetic wrote: post #31

Earlier quoted context omitted.

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

Its possible that they saw it as a purely positive move that would improve security on MacOS and then after seeing everyone's response they reevaluated its importance.

Having to be told by outsiders that this backdoor could be abused by malware is pretty embarrassing. It's hard to imagine Apple's engineers weren't aware of that.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#158

Post by SXX »

This firewall issue isn't the only privacy feature strip from Big Sur release. Unfortunately no big media care about other huge problem Apple introduced.

My only hope they will also fix full disk encryption in this update. Since Big Sur broken installation of macOS on passphrase-encrypted disk partitions.

I bought into M1 hype and now it's end up that you no longer able to have separate password for the disk encryption.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#159

Post by tempodox »

kitsunesoba wrote: post #104
Rebelgecko wrote: post #54

Earlier quoted context omitted.

For my 32 bit binaries, the easiest way to use them is to run the Windows version, because that OS has better backwards compatability. It's possible to get a Mojave VM up and running but it was nontrivial when I gave it a shot

If I'm not mistaken, WINE is now capable of running 32-bit Windows binaries on 64-bit-only macOS as well, so that may also be an option particularly for more simple apps.

Even the 64-bit WINE can't run 32-bit apps on Catalina. Their website specifically says they support up to macOS-10.14. Apparently 64-bit WINE can run 64-bit Windos apps on Catalina, though.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#160

Post by yarcob »

zaphirplane wrote: post #142
kristofferR wrote: post #126

Earlier quoted context omitted.

You don't create a whitelist system literally called ContentFilterExclusionList by accident.

A backdoor has some malicious connotations to me. Having security profiles controlled by a list seems a thing Without spending a lot of time sshd has allowLists (AllowGroups) and match directives Sudo also has per group config As a user on any operating system what you can and can’t do is controlled by a list Perhaps the issue is the list isn’t user controlled ? Perhaps the issue falls into the “I own and control my…

A "back door" is any kind of mechanism that was added by the vendor to circumvent security mechanisms.

Back doors are typically not disclosed to the user, and can't be turned off. So for example an automatic software update mechanism isn't a back door, as the user is aware of it and can typically turn it off if they are concerned about security.

An undisclosed mechanism that allows Apple apps to circumvent firewalls does very much fit the description of a back door.

Intent doesn't matter with regards to back doors. Most back doors are not made with malicious intent, or at least the vendors usually claim that they only had good intentions for the back door. (Eg. see the recent reports where a router manufacturer had a secret password that they claimed was only used for software updates)

The danger about back doors is that malicious software can use the back doors to circumvent the security measures, just like Patrick Wardle demonstrated that it was possible to use Apple's content filter exclusion to circumvent firewalls.

Post reply on HN