Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

obdev.at

Post reply on HN
Print view View original

11–20 of 215 posts

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#14

Post by hiatus »

pkulak wrote: post #10
skrrtww wrote: post #2

The title sort of implies this is intentional or privileged to Apple, while it rather seems more like just a bug. I also wish people would post the FB numbers and the details of their report when they say they've reported things like this.

Yeah, if it was intentional, it would probably be a hard-coded, encrypted URL. Some devices are starting to do that to get around ad blocking.

Good thing you can still see the domain over the network if you control the network.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#15

Post by kelnos »

It's a little weird to me that getaddrinfo() is considered a "low-level legacy API". Maybe things are drastically different on macOS, but getaddrinfo() is the way to resolve names on Linux and I suspect the *BSDs.

Sure, I expect most macOS apps will use something in Foundation or some other NetworkKit-type framework to do DNS queries, but it's odd to me that the code there wouldn't then call down to getaddrinfo() or the like to do the dirty work. I guess GAI is blocking, so presumably there's some other low-level non-blocking call?

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#17

Post by unethical_ban »

kelnos wrote: post #15

It's a little weird to me that getaddrinfo() is considered a "low-level legacy API". Maybe things are drastically different on macOS, but getaddrinfo() is the way to resolve names on Linux and I suspect the *BSDs. Sure, I expect most macOS apps will use something in Foundation or some other NetworkKit-type framework to do DNS queries, but it's odd to me that the code there wouldn't then call down to getaddrinfo() or…

I'll pile on, as someone who has never developed for Apple systems: What APIs are supposed to be used for DNS resolution?

  * Host file
  * Configured DNS server
  * App-specific DNS server if it exists
What "API" is there? Why doesn't an app doing system-wide DNS modifictions just modify the settings for default resolver?

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#18

Post by Reptur »

skrrtww wrote: post #2

The title sort of implies this is intentional or privileged to Apple, while it rather seems more like just a bug. I also wish people would post the FB numbers and the details of their report when they say they've reported things like this.

Devil's advocate would say: They could do this and make it look like a bug that never gets fixed in order to avoid backlash. How it gets achieved is flexible if the goal is met.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#19

Post by OptionOfT »

unluckier wrote: post #6

Sequoia also breaks an application's ability to use DNS (or presumably anything UDP-based) if the macOS firewall is enabled, and an app is listed as "Block incoming connections". https://waclaw.blog/macos-firewall-blocking-web-browsing-aft...

Honestly, I'm fine with that. Applications themselves should not be resolving DNS outside of what I set in settings.

The reasons applications do this is to prevent users from blocking telemetry etc. It's my computer, I should have final say on what goes out.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#20

Post by threeseed »

unethical_ban wrote: post #17
kelnos wrote: post #15

It's a little weird to me that getaddrinfo() is considered a "low-level legacy API". Maybe things are drastically different on macOS, but getaddrinfo() is the way to resolve names on Linux and I suspect the *BSDs. Sure, I expect most macOS apps will use something in Foundation or some other NetworkKit-type framework to do DNS queries, but it's odd to me that the code there wouldn't then call down to getaddrinfo() or…

I'll pile on, as someone who has never developed for Apple systems: What APIs are supposed to be used for DNS resolution? * Host file * Configured DNS server * App-specific DNS server if it exists What "API" is there? Why doesn't an app doing system-wide DNS modifictions just modify the settings for default resolver?

> This library wraps around the dnssd framework and the c-ares C library with Swift-friendly APIs and data structures.

https://github.com/apple/swift-async-dns-resolver

Post reply on HN