Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

121–130 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#121

Post by adambatkin »

indymike wrote: post #70
metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).

Linux on the desktop and Linux on the laptop (heh) has definitely improved. It _sometimes_ needs a little tweaking to get it right, but KDE/Plasma also happens to offer that level of "tweakability" that should satisfy almost all semi-mainstream users (at least anyone coming from Windows or Mac).

Compared to my first Linux laptop (a Sony Vaio circa 2000), my current XPS 13 works as well as any Mac laptop I have ever owned, and all the hardware that you would "expect" to work (but probably didn't work as smoothly 10 or 20 years ago) Just Works (WiFi, external displays, excellent battery life/sleep, etc...)

Based on the complaints I have heard about Apple hardware and MacOS over the past few years, I'd even argue that Linux-on-the-desktop isn't any less stable or harder to get working than a Mac.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#122

Post by parliament32 »

smnrchrds wrote: post #84

Apple has been more and more acting on the belief that when you buy one of their devices, you don't buy and own the device. You rather purchase an experience—a service—from Apple. They don't have to let you run your own software on your device or poke around the internals. That is not part of the experience offered. You should use the device as Apple intends it to be used.

Device-as-a-Service is an excellent way to describe the Apple ecosystem.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#123

Post by pmarreck »

nix23 wrote: post #104
ineedasername wrote: post #90

Earlier quoted context omitted.

What's the alternative for the typical user? Windows has its own problems, and let's face it: market forces on this sort of thing or any other practices by the two of them have not driven people to use desktop Linux instead. For most people, there's simply no reasonable option to switch to that would avoid these things or employ market forces to get these companies to change their ways.

I'm not a "typical" user so i dont care.

So basically you provided a suggestion that only works for you.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#124

Post by throwaway2048 »

nix23 wrote: post #107
throwaway2048 wrote: post #86

Earlier quoted context omitted.

Windows 10 has even more invasive spyware nonsense.

Not the Enterprise/Education edition.

That you can't legally acquire outside of a commercial support contract.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#125

Post by kar1181 »

metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

The linux desktop experience is still quite in a state. I will likely do the same and suffer Linux, but I think many will go back to windows as WSL continues to improve.

Apple is going to lose developers.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#126

Post by montjoy »

api wrote: post #33
3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

Tech savvy users are not just the minority. They're also cheap. They've been conditioned by the FOSS movement to think all software should be free as-in-beer. (The people who started FOSS didn't say that, but that's what it's become.) They say they want free as-in-freedom, but since they are not willing to pay for it they don't exist. Those who pay set the agenda for everything. Developing a truly polished operating…

Where are these weird anti-FOSS statements being bred from?

> Those who pay set the agenda for everything. And this different from non FOSS software how?

> Developing a truly polished operating system with a whole ecosystem of services is far, far beyond what volunteers and hobbyists can achieve.

As someone who uses Linux as my primary workstation I disagree. My coworkers that use Mac or Windows seem to have about the same number of issues overall. I mean- look at the article this is about. I’m pretty confident that would be much harder to get away with in the Linux community. Gnome shell is more polished than windows or macOS were at the same age.

> It also requires focus and coordination and someone who is able and willing to say no.

Clearly you haven’t dealt with the Gnome folks who are perfectly willing to say no to features some users scream for. Or read any of Linus’s rants about nvidia.

Edit: formatting

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#127

Post by gruez »

throwaway2048 wrote: post #87
gruez wrote: post #83

Earlier quoted context omitted.

>Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes why would that be the case? All you'd need to do is provide some sort of private network api, and only allow apple signed code to use it.

that is not how kexts work(ed), they can do completely arbitrary things to the kernel, including removing any theoretical code signing requirement.

any access? On Windows, you can write a driver that would run in kernel mode, but critical sections can't be modified[1]. I'd imagine there's something similar for mac.

[1] https://en.wikipedia.org/wiki/Kernel_Patch_Protection

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#128

Post by gabereiser »

nix23 wrote: post #111
Skunkleton wrote: post #36

Earlier quoted context omitted.

It's a frustrating road we are headed down. Tech companies have gotten so big that they don't really have to work together using standardization anymore. Options are limited, and most are anti-consumer in one way or another.

>Options are limited No not really, but limited is the mindset of peoples.

>No not really, but limited is the mindset of peoples.

I'd argue options really are limited. Your counter argument assumes one can just roll their own OS with the same features and functionality as current-gen OS's. That's quite a leap. Options today are Windows, Mac, or some flavor of Linux if you can get it to work. Linux aside, Windows and Mac both are making it so you no longer own the OS but are "subscribed" to it. Making it easy for them to implement anti-consumer strategies to lock you in.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#129

Post by chrisshroba »

joncp wrote: post #32

That totally breaks my use case for Little Snitch: working tethered. When I tether my laptop it thinks it has free reign with the bandwidth and all of the little background processes can kill my data in a few minutes. With a firewall, I can grant access to only the processes that I need to get my work done. Now, I guess I have to run some external firewall between my laptop and my phone. ... or better yet, abandon Ap…

For what it's worth, my hacky solution to this is this script which kills all the background processes that use significant bandwidth. If you're interested in how I came up with the list of processes, I can share the BitBar [1] script I wrote for monitoring per-process network usage (I wrote a small wrapper around nettop that logs to a db, which is read periodically by my BitBar script to show me the per-process usage:

    if [ $(whoami) != root ]
    then
      echo "Please run as root, not $(whoami)"
      exit
    fi

    while true
    do
      killall -9 planb 2>/dev/null && echo "$(date) - Killed planb"
      killall -9 murdockd 2>/dev/null && echo "$(date) - Killed murdockd"
      killall -9 uplink-soecks 2>/dev/null && echo "$(date) - Killed uplink"
      killall -9 nsscacheclient 2>/dev/null && echo "$(date) - Killed nsscacheclient"
      killall -9 ksfetch 2>/dev/null && echo "$(date) - Killed ksfetch"
      killall -9 nsurlsessiond 2>/dev/null && echo "$(date) - Killed nsurlsessiond"
      killall -9 softwareupdated 2>/dev/null && echo "$(date) - Killed softwareupdated"
    done
[1]: https://github.com/matryer/bitbar

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#130

Post by _qulr »

threatofrain wrote: post #77
addicted wrote: post #30

Earlier quoted context omitted.

In this situation the question isn’t about whether or not Apple can be trusted. Apple has clearly betrayed users’ trust in this situation. People don’t install Little Snitch only to prevent nefarious third party activity. Some may want to know what traffic is going to and from their computers. Other may want to block all traffic for testing and/or research purposes. I can trust that Apple is not doing something nefar…

> any backdoors Apple builds for its own apps Apple hasn't weakened the security of their devices to provide a secret way in, in fact, they made their systems even more robust. The question absolutely is whether Apple can be trusted. Little Snitch works for other apps, just not Apple's apps. The remaining slice of the pie you're arguing for is whether or not we can trust Apple. So what delta in security and trust ove…

> The question absolutely is whether Apple can be trusted.

This is a false dichotomy. I choose to use a Mac, but I also choose not to let my Mac phone home to Cupertino unless I allow it. Why can't I have that choice? Why does it have to be all or nothing? I'm only interested in the Mac, I have zero interest in Apple "services". It's a fine computing device, but I see no reason why the device has to continue to talk to Apple after I purchase it, except to download software updates — which I manually trigger.

It's not about trust, it's about choice.

EDIT: Now if Apple provided a way to easily disable all of those "services" that phone home, there would be a lot fewer complaints about this issue. But they don't.

Post reply on HN