Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

obdev.at

Post reply on HN
Print view View original

121–130 of 215 posts

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#121

Post by ruthmarx »

mzs wrote: post #84
josephcsible wrote: post #27

Earlier quoted context omitted.

It feels like Embrace, Extend, Extinguish to claim that a portable API is "legacy" and that its replacement is Apple-only.

That's what you use to create a utility like nslookup in swift, Apple does not want you to do any resolving yourself, just pass a hostname instead: https://developer.apple.com/documentation/network/nwendpoint...

> Apple does not want you to do any resolving yourself

Which honestly sounds like a good reason to make sure you do do it yourself.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#122

Post by dishsoap »

TheJoeMan wrote: post #103
asplake wrote: post #3

> Update 2024-09-17, 7:10 p.m. > After further investigation, we found that this bug has already existed at least since macOS 14.5 Sonoma (maybe even earlier, but we currently don’t have access to an older 14.x system for testing).

It's ridiculous us developers still have to jump through hoops to save around older versions of the OS for testing. There is 0 technical reason why Apple can't let us downgrade.

Can someone fill me in on this? What hoops have to be jumped through? The last time I used macs, there were no issues downloading and installing older OS versions, but I have not used them recently.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#123

Post by admax88qqq »

roywashere wrote: post #22
unethical_ban wrote: post #17

Earlier quoted context omitted.

I'll pile on, as someone who has never developed for Apple systems: What APIs are supposed to be used for DNS resolution? * Host file * Configured DNS server * App-specific DNS server if it exists What "API" is there? Why doesn't an app doing system-wide DNS modifictions just modify the settings for default resolver?

Yes, this! I even wonder how else you would do this. By the way I worked with many IoT devices that do not use your dhcp dns but just hardcode quad 8 or similar

Most isp resolvers are shit and broken

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#124

Post by jonhohle »

matheusmoreira wrote: post #110
kelnos wrote: post #15

It's a little weird to me that getaddrinfo() is considered a "low-level legacy API". Maybe things are drastically different on macOS, but getaddrinfo() is the way to resolve names on Linux and I suspect the *BSDs. Sure, I expect most macOS apps will use something in Foundation or some other NetworkKit-type framework to do DNS queries, but it's odd to me that the code there wouldn't then call down to getaddrinfo() or…

> getaddrinfo() is the way to resolve names on Linux Not at all. That's just a glibc function, it's got nothing to do with Linux. People just assume that glibc is how things are done in Linux user space but it doesn't have to be that way. For example, systemd came up with its own resolved mechanism which turned out to be much better than the glibc stuff. I will probably end up inventing my own at some point as well s…

getaddrinfo is defined by POSIX and UNIX. Where the implementation is doesn’t matter. It’s portable, which is why it’s used. The slide deck referenced above talks about better implementations for various platforms, but they are all platform specific.

So OP might not be completely accurate, but getaddrinfo is _the_ way to resolve names if you are writing portable POSIX and/or UNIX code.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#125

Post by jonhohle »

troyvit wrote: post #78
cj wrote: post #50

Earlier quoted context omitted.

We recently had a developer join our team and he got stuck setting up his dev environment. We use a .dev domain as a localhost alias, and turns out his ISP’s DNS wouldn’t resolve 127.0.0.1 (or whatever it is) for the .dev domain. Changing his resolver at the network level to 1.1.1.1 fixed it. I imagine there are lots of difficult support tickets for app devs, and at a certain point they just hardcode the DNS to remov…

Wayyyy back in 1995 or '96 I was working for a non-profit called "Next Generation Magazine" and our goal was to have young people write content for web sites to get their names out there. Back then it was all local ISPs, so we went to our ISP and asked for ngm.org and were stoked when we got it! We built out the site (Thanks to Building Killer Websites of course) and it looked awesome! Only problem was that nobody in…

That’s incredible!

I remember one of the first times I used the Internet and opened my local radio station’s website from several states away. It was incredible to me that it worked and I also wondered why anyone across the country would care. The early internet was amazing.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#126

Post by Mainsail »

Reason077 wrote: post #72
Mainsail wrote: post #53

Earlier quoted context omitted.

What am I missing here? Reading the article, it appears that Firefox is the browser that seems to be bypassing.

They're using Little Snitch as an OS-level DNS proxy, which should intercept all DNS requests from any app and encrypt them. But, depending on what API the app uses for its DNS lookups, some DNS requests do not go via the proxy. Presumably Firefox, in its default configuration with DNS encryption set to OFF ("Use your default DNS resolver"), uses one the affected APIs.

Ah, that makes sense. Ty.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#128

Post by brynet »

kelnos wrote: post #15

It's a little weird to me that getaddrinfo() is considered a "low-level legacy API". Maybe things are drastically different on macOS, but getaddrinfo() is the way to resolve names on Linux and I suspect the *BSDs. Sure, I expect most macOS apps will use something in Foundation or some other NetworkKit-type framework to do DNS queries, but it's odd to me that the code there wouldn't then call down to getaddrinfo() or…

> getaddrinfo() is the way to resolve names on Linux and I suspect the *BSDs.

At least on OpenBSD, all classical/standard DNS functions (getaddrinfo/gethostbyname/...) are wrappers around OpenBSD's libc asr implementation, written by Eric Faurot.

https://man.openbsd.org/man3/asr_run.3

https://github.com/openbsd/src/tree/master/lib/libc/asr

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#129

Post by thewileyone »

luxuryballs wrote: post #104
TheJoeMan wrote: post #103

Earlier quoted context omitted.

It's ridiculous us developers still have to jump through hoops to save around older versions of the OS for testing. There is 0 technical reason why Apple can't let us downgrade.

yeah it feels like they decided bank accounts flush with cash were a better investment than legacy system support

Newsflash, they've always thought this way.

Re: Warning: DNS encryption in Little Snitch 6.1 may occasionally fail

#130

Post by kccqzy »

OJFord wrote: post #109

I was confused at the Little Snitch mention, and then reading further it just seems like a LS bug, that it only works in certain cases. Well, seems this is the LS blog, so only confusion is why this is portrayed as a macOS bug? I'm not saying it's wrong, it's their domain not mine after all, it just doesn't seem to be justified in TFA?

If the OS allows the registration of a DNS proxy, and some calls bypass the proxy, it's squarely an OS bug.
Post reply on HN