Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
1–10 of 649 posts
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#2That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ as an option until DNS encryption becomes widespread :/
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#3A great example of why you need defense in depth. Ideally you'd be running the local firewall on your box, as well as an external firewall.
That being said, this is not ok behavior on Apple's part. There shouldn't be a way for traffic to go around the firewall like this, even if it is just Apple apps.
Because as Apple well knows, once you make a backdoor, someone will figure out a way to exploit it.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#4different but feels reminisce of Google double-dealing by not-clearing their browser storage cache when asked to. two days old: https://news.ycombinator.com/item?id=24817304
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#5"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!"
...and now Apple has altered the deal and we must pray they do not alter it further. Disgusting. Predictable, expected, unsurprising -- but still disgusting.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#6This is one of those tough cases where software cuts both ways.
Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed.
Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that don't use zero days.
Is the world better or worse due to this change? I'd say a touch better, but I don't like the fact that this change was needed in the first place. I trust Apple, but I don't like trusting trust.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#7I suppose this is a consequence of Little Snitch moving from a kernel extension to Apple's new system that runs in user-space. :(
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#8This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…
If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else.
I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#9The solution is simple, just look at the tricks these apps are using and use them to implement malware.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#10This is a big breach of trust in terms of Apple always being on the side of user privacy.
If someone knows enough to install these firewall apps, then they know enough to figure out what they want to enable/disable even for Apple applications.
If Apple thinks certain rules cause issues, they certainly could work with the developer of these apps to educate users of adverse effects when certain things cause unintended issues for the user. The decision should still lie with the user. Bypassing firewalls by privileging some traffic is not okay.
Looks like for now, the only real option is an external device you always connect through running pfsense or another firewall, which is not too big a deal for use on a home network, but requires carrying around another device when on other networks.