Apple removes first-party firewall exemption in macOS 11.2 beta 2 • Hacker News Board

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#211

Post by audunw » Thu, Jan 14, 2021, 12:06 PM UTC

_qulr wrote: post #26

vulcan01 wrote: post #25

Earlier quoted context omitted.

> Except that Apple did not take action. Look, I don't mean to criticise. But how do you know that Apple didn't start working on a fix when they were told about it? Apple doesn't exactly say when they start working on a fix for something, or else we would have known earlier.

There was a ContentFilterExclusionList key in the /System/Library/Frameworks/NetworkExtension.framework/Versions/Current/Resources/Info.plist file. macOS 11.2 beta 2 removed the ContentFilterExclusionList. Does that take 6 months?

> Does that take 6 months?

You're assuming that changing that list is the only thing they needed to do. Have you thought about why they felt they needed that list to begin with? Maybe because they wanted to quality control that all their core services could graceful handle being blocked by a firewall first? That is, the job wasn't changing the list. The job was probably quality control of everything potentially blocked by that list.

Or they just didn't think it was such an important issue. Most MacOS users by far probably don't care.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#212

Post by vaduz » Thu, Jan 14, 2021, 12:10 PM UTC

fsflover wrote: post #194

user-the-name wrote: post #179

Earlier quoted context omitted.

No real push to use sandboxing or to limit access to personal information. Any app you install can do anything it wants with all of your data.

Can't you run apps on behalf of restricted users?

Via CLI you can, but GUI apps connect to your X server session, and then the fun begins - any application you allow to connect can essentially capture your keyboard, mouse, clipboard and a ton of other fun things,as there is no sandboxing applied between them. It's inherent in the design of the X protocol.

There are solutions that are intended to force the sandboxing by opening a new Xserver for every application, e.g. Firejail [0], but that comes with another set of interoperability problems.

Wayland was supposed to address some of these concerns, but it will only do so for applications that natively talk wayland protocol, not the ones that connect through x-protocol via xwayland

[0] https://firejail.wordpress.com/

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#213

Post by blub » Thu, Jan 14, 2021, 12:15 PM UTC

webmobdev wrote: post #178

blub wrote: post #164

Earlier quoted context omitted.

While I agree that one should remain suspicious and be vocal about privacy violations and security issues, I find your attitude of continuing to attack Apple inappropriate. Apple competitors Google and Microsoft which control the great majority of OS installs both for mobile and desktop don't even pretend to care about privacy. I have collected over the years reports about dozens of underhanded tactics they use to ma…

> I find your attitude of continuing to attack Apple inappropriate. I do so because I am an Apple user - this is being typed on a mac mini. I also own other Apple hardwares. I also advocated for Apple hardware within my family & friends to switch from Android to Apple quite successfully (I am the IT guy in my circle). I did so because I would like to believe their commitment to privacy they have publicly stated. (Tim…

Your CV or Apple credentials are not relevant. If one considers privacy important, as you seem to, then they should engage with companies which at least try to behave in a privacy-friendly way instead of typing backdoor in all caps several times and painting those companies in a bad light while not recognizing any of their contributions to improving the privacy of their customers.

And here are those contributions spelled out for you: Apple is the only company preventing Google from having the private information of all smartphone users on the planet on their servers.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#214

Post by aardshark » Thu, Jan 14, 2021, 12:15 PM UTC

StavrosK wrote: post #188

yholio wrote: post #145

Earlier quoted context omitted.

Apple has no love for privacy nor ever had. They are in a market position where their main competitors - Google primarily, Microsoft and Amazon - are highly dependent on revenue streams extracted by monetizing personal information. Apple is in a position to cut that stream without affecting its bottom line, so it does it and claims privacy as a core value. I won't look a gift horse in the mouth, but I have no doubt t…

Isn't "it's in our financial interests right now" about as much "love" as you'll get for anything by a corporation? Saying "Apple has no love for privacy, they're only doing it because it sells" sounds moot to me, every company only does things because they sell.

Companies are made up of and run by people and the decisions made by those people are not necessarily solely profit-driven.

That doesn't mean that making money is not important to these people; of course it is. But it's not the only factor.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#215

Post by vaduz » Thu, Jan 14, 2021, 12:22 PM UTC

blub wrote: post #164

webmobdev wrote: post #121

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously th…

While I agree that one should remain suspicious and be vocal about privacy violations and security issues, I find your attitude of continuing to attack Apple inappropriate. Apple competitors Google and Microsoft which control the great majority of OS installs both for mobile and desktop don't even pretend to care about privacy. I have collected over the years reports about dozens of underhanded tactics they use to ma…

The fact that their competitors are as bad or worse in this regard does not make Apple saints - and this has all the hallmarks of an intentional addition to position Apple apps differently from the others, which is a classic Apple move.

Compromise in security and prviacy clearly has been deemed worth by someone at Apple before the stink was raised.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#216

Post by fsflover » Thu, Jan 14, 2021, 12:27 PM UTC

vaduz wrote: post #212

fsflover wrote: post #194

Earlier quoted context omitted.

Can't you run apps on behalf of restricted users?

Via CLI you can, but GUI apps connect to your X server session, and then the fun begins - any application you allow to connect can essentially capture your keyboard, mouse, clipboard and a ton of other fun things,as there is no sandboxing applied between them. It's inherent in the design of the X protocol. There are solutions that are intended to force the sandboxing by opening a new Xserver for every application, e.…

I expected that Wayland isolates the applications by default, not just when they allow it.

So you might be interested in Qubes OS, which provides a very strong isolation through virtualization.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#217

Post by chippiewill » Thu, Jan 14, 2021, 12:29 PM UTC

StavrosK wrote: post #188

yholio wrote: post #145

Earlier quoted context omitted.

Apple has no love for privacy nor ever had. They are in a market position where their main competitors - Google primarily, Microsoft and Amazon - are highly dependent on revenue streams extracted by monetizing personal information. Apple is in a position to cut that stream without affecting its bottom line, so it does it and claims privacy as a core value. I won't look a gift horse in the mouth, but I have no doubt t…

Isn't "it's in our financial interests right now" about as much "love" as you'll get for anything by a corporation? Saying "Apple has no love for privacy, they're only doing it because it sells" sounds moot to me, every company only does things because they sell.

That's quite an extreme-end of capitalist way of looking at it.

Companies build a vision or image for how they behave and a lot of that is going to be driven by marketability.

For example Microsoft has taken a very pro-developer stance since Satya Nadella took over. Not just because it's directly profitable to be pro-developer, but because it helps their long term image, culture etc. This goes a long way to explaining a lot of their recent actions like helping Github be available in Iran again and open sourcing large parts of C# / .NET.

So the question becomes: are Apple being pro-privacy because it's a long term stance they want to take and make a basis for their company culture because it's something their customers really want. Or are they taking the stance simply because it doesn't impact their own profitability right now, but would drop it if there was an obvious potential income stream.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#218

Post by user-the-name » Thu, Jan 14, 2021, 12:33 PM UTC

tremon wrote: post #205

user-the-name wrote: post #179

Earlier quoted context omitted.

No real push to use sandboxing or to limit access to personal information. Any app you install can do anything it wants with all of your data.

I know, it's amazing, isn't it? Just think of the amazing possibilities this new "general-purpose computing" could unlock!

Claiming that a lack of security is a feature, actually, is not a great strategy.

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#219

Post by vaduz » Thu, Jan 14, 2021, 12:33 PM UTC

fsflover wrote: post #216

vaduz wrote: post #212

Earlier quoted context omitted.

Via CLI you can, but GUI apps connect to your X server session, and then the fun begins - any application you allow to connect can essentially capture your keyboard, mouse, clipboard and a ton of other fun things,as there is no sandboxing applied between them. It's inherent in the design of the X protocol. There are solutions that are intended to force the sandboxing by opening a new Xserver for every application, e.…

I expected that Wayland isolates the applications by default, not just when they allow it. So you might be interested in Qubes OS, which provides a very strong isolation through virtualization.

XWayland is essentially a translation layer consisting of Xserver and Wayland client [0]. Therefore it has all the same problems a normal Xserver has, which they do acknowledge:

> A Wayland compositor usually spawns only one Xwayland instance. This is because many X11 applications assume they can communicate with other X11 applications through the X server, and this requires a shared X server instance. This also means that Xwayland does not protect nor isolate X11 clients from each other, unless the Wayland compositor specifically chooses to break the X11 client intercommunications by spawning application specific Xwayland instances. X11 clients are naturally isolated from Wayland clients.

I use QubesOS, but it comes with its own set of problems as well.

[0] https://wayland.freedesktop.org/docs/html/ch05.html

Re: Apple removes first-party firewall exemption in macOS 11.2 beta 2

#220

Post by KraftKacke » Thu, Jan 14, 2021, 12:35 PM UTC

webmobdev wrote: post #178

blub wrote: post #164

Earlier quoted context omitted.

While I agree that one should remain suspicious and be vocal about privacy violations and security issues, I find your attitude of continuing to attack Apple inappropriate. Apple competitors Google and Microsoft which control the great majority of OS installs both for mobile and desktop don't even pretend to care about privacy. I have collected over the years reports about dozens of underhanded tactics they use to ma…

> I find your attitude of continuing to attack Apple inappropriate. I do so because I am an Apple user - this is being typed on a mac mini. I also own other Apple hardwares. I also advocated for Apple hardware within my family & friends to switch from Android to Apple quite successfully (I am the IT guy in my circle). I did so because I would like to believe their commitment to privacy they have publicly stated. (Tim…

As a queer person myself, I think your trust in the "gay experience" of rich guys is dangerous.

We just had this Szajer scandal, where a powerful outspoken homophobe was caught in an gay orgy.

The gay experience (shame, rejection and discrimination) also comes with increased chance of "co-morbid" personality defects, which may be more pronounced worh exceptional wealth and status.

Queer solidarity by gay men is not a given anymore.