Welp, time to block softwareupdated and stick with Catalina for a while
Bypassing Firewalls in macOS Big Sur
101–110 of 251 posts
Re: Bypassing Firewalls in macOS Big Sur
#102Re: Bypassing Firewalls in macOS Big Sur
#103This seems so negligent it's difficult for me to believe this was a mistake. Perhaps it could be argued that Apple doesn't want applications blocking the network traffic of trusted applications because there is limited upside to doing so and doing so may restrict core functionality such as system updates, etc. But surely the most reasonable explanation here is that Apple wants a back door to guarantee they can monito…
In fact, it was so negligent because Apple is actually secretly rebelling against the Illuminati, who forced them to do this, by making such a deliberate cock-up of it that it was discovered within hours of release. We need to go deeper.
[flagged]
Re: Bypassing Firewalls in macOS Big Sur
#104Discussion about when this originally surfaced, but was thought to only affect Apple apps: https://news.ycombinator.com/item?id=24838816
This is a related issue but not the same. The previous discussion was about how Big Sur has some built-in exceptions for Apple software. The current discussion is about the discovery that these built-in exceptions can also be abused by non-Apple software, rendering the firewall completely ineffective.
Can they be abused by ways Apple cannot fix with security upgrades?
Re: Bypassing Firewalls in macOS Big Sur
#105Reading news about Apple on this board feels like a cult which I've gotten out of.
Re: Bypassing Firewalls in macOS Big Sur
#106"If Microsoft had done something like this circa 1999, it would have been used as evidence in the antitrust suit."
Apple doesn't have a monopoly on the computing market. Microsoft basically did at that time.
Re: Bypassing Firewalls in macOS Big Sur
#107This is "bypassing firewalls in macOS BigSur" by adding an address to the firewall bypass whitelist.
I can hack ipf in a similar way, adding an ACCEPT rule...
Nothing to see here, move along...
Re: Bypassing Firewalls in macOS Big Sur
#108Earlier quoted context omitted.
Can you give an example of what you consider proper protections?
You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.
How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for it. X11 probably being the most egregious limiter, followed by no standard trusted file access UI.
On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile.
Re: Bypassing Firewalls in macOS Big Sur
#109https://imgur.com/a/y0NPJ2o - DNS activity of my Mac PRO + Big Sur during the last 30 mins. This is a filter on ` apple ` domain so I'm not sure if I'm seeing everything since they might use other domains but heh - for the curious.
What is this supposed to show?
I see a lot of iCloud and Software update stuff in there.
Nothing malicious from first glance.
Re: Bypassing Firewalls in macOS Big Sur
#110How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.... And a humorous guide on disabling protections like code signing and notarization: https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-li...
Although possible to disable the feature, those steps are crazy complicated, and probably impossible for anyone who isn't a developer. (Apart from anything else, regular users should never be advised to disable SIP.)
I am sure the complexity is intentional.