Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple removes first-party firewall exemption in macOS 11.2 beta 2

twitter.com

Post reply on HN
Print view View original

191–200 of 354 posts

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#191

Post by iforgotpassword »

g_p wrote: post #138
iforgotpassword wrote: post #114

Earlier quoted context omitted.

> Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company. Relying on a personal firewall on the device itself seems ill-fated. Maybe it could be considered an additional layer of security, but I've yet to work at a place where a personal firewall is part of the security concept, no matter which OS. It's either firewalls at the gateway, maybe addition…

An application firewall on the device serves a different purpose to that running off-device, namely the ability to filter traffic based on the origin (or destination) application. Clearly if your kernel or userspace are compromised that's not much use, and that's where external controls kick in. You can't determine (absent some custom network and protocols) which piece of software was responsible for a given packet o…

To fight apps phoning home, I agree. But even the tweet linked in OP refers to a tweet that shows how to abuse the now removed whitelisting by piggybacking your traffic through one of those whitelisted apps. On a locked down system like Android or iOS this isn't that trivial, but in a classic desktop OS use case it's easy to abuse another app to exfiltrate data.

> In essence it's about raising the number of independent failures required to result in a compromise.

Sure, it doesn't hurt, minus maybe the case that a vulnerability in that firewall itself is used.

> If you imagine the application firewall on the device has its policies managed rather than selected by the user, it starts to make more sense.

That's a requirement I guess. You don't want accountants and HR people handling popups by a firewall app. :-)

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#192

Post by brainbag »

webmobdev wrote: post #130
aarchi wrote: post #44

Earlier quoted context omitted.

I'm still on Mojave to use 32-bit apps. Any way to use 32-bit in Catalina or later?

Why do you want to upgrade though? What's Mojave lacking that Catalina has?

The latest XCode that supports deploying to iOS 14 devices, unfortunately.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#193

Post by my123 »

SXX wrote: post #158

This firewall issue isn't the only privacy feature strip from Big Sur release. Unfortunately no big media care about other huge problem Apple introduced. My only hope they will also fix full disk encryption in this update. Since Big Sur broken installation of macOS on passphrase-encrypted disk partitions. I bought into M1 hype and now it's end up that you no longer able to have separate password for the disk encrypti…

On the M1, that's by design. If you install macOS on an external volume it doesn't have that behaviour.

On the internal disk, it's there because they carried over the iOS infrastructure, where your login password is the FDE one.

macOS also now boots before asking for your password, like iOS.

(the OS volume itself isn't encrypted and is read-only, the data volume is encrypted with your password)

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#194

Post by fsflover »

user-the-name wrote: post #179
mcdevilkiller wrote: post #170

Earlier quoted context omitted.

Why us it poor? (Genuinely asking).

No real push to use sandboxing or to limit access to personal information. Any app you install can do anything it wants with all of your data.

Can't you run apps on behalf of restricted users?

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#195

Post by fsflover »

simonh wrote: post #184
novaRom wrote: post #173

Earlier quoted context omitted.

> especially bearing in mind most of the factories are in Taiwan Zyxel, Asus, and other manufacturers of networking devices (with backdoors of course) are also there. https://arstechnica.com/information-technology/2021/01/hacke...

OK, so some Taiwanese network device manufacturers have poor default account practices, news at 11:00. I'm not seeing the CIA connection. Devices like this are used by the government and military contractors as well, and as you can see such vulnerabilities are trivial to detect so you can't count on the opposition finding out about it and using it. This one was picked up days after the firmware release. The smoking g…

> poor default account practices

Understatement of the year. Secret account is exactly what people call "a backdoor".

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#196

Post by webmobdev »

raverbashing wrote: post #169
webmobdev wrote: post #141

Earlier quoted context omitted.

(That tweet has been deleted by the Apple developer). Before macOS Big Sur / Catalina, many of these application firewalls - Lulu, Little Snitch, HandsOff, TripMode, RadioSilence etc. - all used their own kernel extensions to effectively monitor and block any processes from connecting to the internet. Firewalls are system security softwares. And naturally Apple would prefer to oversee and have this in-built in their…

I agree, this is 90% likely malicious. The non-malicious usage I can imagine is that for debugging the firewall you don't want to lock your other services out of it in case something goes wrong (or as you said, for reliability issues)

My fear is that Apple will now make the design decision to make these services more unreliable if blocked. Like I experienced, others too have noticed similar behaviour:

> It’s worth noting that Big Sur and its predecessors are built to assume that they can talk to Apple at any time, but when we don’t allow it, a few unwanted side effects pop up. For example, the keyboard sometimes takes longer to wake up from sleep mode. Or, in certain situations, the Mullvad app takes longer to detect that the computer is online.

- https://mullvad.net/en/blog/2020/11/16/big-no-big-sur-mullva...

(Ofcourse, as a developer, I can sympathize with the Apple developers - when you design a product to use the internet, you don't really think hard about all kinds of use cases where internet access is deliberately denied).

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#198

Post by coldtea »

_qulr wrote: post #171
coldtea wrote: post #93

Earlier quoted context omitted.

Noticing the issue, discussing it, setting meetings to agree to revert, and handling all other higher priority stuff before an eminent GM release and the most pressing x.1 update release, can take more than 6 months. Not to mention that "removing the ContentFilterExclusionList" is a hacky fix suggestion. Doesn't mean it's the actual hollistic fix, and there weren't other under the hood changes for this issue.

> Not to mention that "removing the ContentFilterExclusionList" is a hacky fix suggestion. You've got in backwards. The ContentFilterExclusionList was itself a hack. It never should have existed. Some people are handwaving about a mysterious vague problem that calls for a ContentFilterExclusionList, but Little Snitch has existed for many many years on the Mac and has been able to block everything , including Apple se…

>You've got in backwards. The ContentFilterExclusionList was itself a hack. It never should have existed.

It might or might not be a hack, but that's orthogonal to the functionality or whether it uses a ContentFilterExclusionList.

The fact that it wasn't there before, or that it is a misguided feature idea, doesn't mean it was done as a quick and dirty implementation or that it's hastily made feature done via cutting corners.

If you accept the need for your own apps to bypass user application filtering (eg. because you consider your traffic/apps integral to the OS operation) then that's the kind of thing you'd implement -- and you could do it with a team of 100, working for months with fine specs, to deliver the same thing.

There's nothing inherently hacky about it.

>There was no problem with that until Apple decided to exempt itself from getting blocked.

That's neither here nor there though, as to whether it was done as a hack - or, to get back to the point, as to whether they could just rip it off trivially.

People forget this is not just a single feature, but part of a change to how network filtering is done (not through a third party kernel extension anymore), accompanied with new APIs.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#199

Post by coldtea »

_qulr wrote: post #168
coldtea wrote: post #91

Earlier quoted context omitted.

Apple doesn't have to "fix issues identified during the beta period" much quicker than the release date. No OS does, including FOSS distros / OSes. Apple just has to fix "the most important issues" with the most bang for the buck identified during the beta period before release. Which they do. The ones they consider less important are put in a backlog. You can find "issues identified during beta releases" still open…

> The ones they consider less important are put in a backlog. True, but this just proves my point. It still doesn't take 6 months to fix this issue... if they wanted to fix it. Deprioritizing it was a deliberate choice by Apple. The reason the exclusion list shipped to the public in Big Sur wasn't technical, the reason is that Apple's priorities are messed up. From my perspective, the explanation is simple: ContentFi…

>True, but this just proves my point. It still doesn't take 6 months to fix this issue... if they wanted to fix it.

Just because it was reported as an issue doesn't mean it was thought as a bug (or an issue to fix) by Apple. That's what they wanted to do. People coded it explicitly.

>Deprioritizing it was a deliberate choice by Apple.

Of course. Why wouldn't it be?

>From my perspective, the explanation is simple: ContentFilterExclusionList wasn't a "bug", it was a deliberate "feature".

Again, of course. Some people complained this was a bug, Apple thought it wasn't, the issue remained on the back burner, until some time it was given more consideration and was decided to fix.

What I'm saying is "why this took 6 months" doesn't make much sense as a question. Why wouldn't it? Unless something is a show stopper or high impact bug, it would take time. Even to be accepted as an issue to fix in the first place will take time. Plus all the internal red tape.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#200

Post by kalleboo »

pstrateman wrote: post #144
conistonwater wrote: post #123

Earlier quoted context omitted.

Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?

> Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug? They're lying.

Why would they lie and not just shut the hell up? It makes no sense.
Post reply on HN