Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Firewalls in macOS Big Sur

twitter.com

Post reply on HN
Print view View original

131–140 of 251 posts

Re: Bypassing Firewalls in macOS Big Sur

#131

Post by thdrdt »

chefandy wrote: post #92

Ugh. I'd love to switch to Linux, but as a designer, I'm stuck. It's not a lack of understanding of how it works— Before I was a designer I was a developer, worked in IT for a while, worked in upper-level support for a while, and Linux was my primary personal and professional OS from the late 90s to like 2010. Why don't I just run a closed-source OS in a VM? They are fussy. Having some weird graphics tablet driver pr…

Some things changed for the good the last couple of years.

I am programming on Ubuntu (C#, PHP, Javascript) with Jetbrains software. This works absolutely great.

For 3D work I use Blender.

But for graphical work I agree that there are still alternatives missing.

Figma is a very good alternative for Sketch. Scribus is a good alternative for Indesign. Krita is very good for concept art. But that's about it.

Inscape is a good alternative for Illustrator, but only if you work in RGB.

Gimp can do what Photoshop can but it will take you 3 times as long.

But for me the trade-offs work. I want to own my computer so I choose to work in Gimp instead of Photoshop. I also started to design websites directly with CSS. And I switched from 3DsMax to Blender (which isn't a trade-off anymore).

The choice is yours.

Re: Bypassing Firewalls in macOS Big Sur

#132

Post by pjmlp »

chongli wrote: post #96
smnrchrds wrote: post #53

Earlier quoted context omitted.

I expect Apple to take the opposite path, not immediately, but eventually: disable sideloading and enforce a Mac App Store only policy on macOS, similar to iOS. After all, if all apps are reviewed and approved by Apple, there is no malware that can use this weakness or the future ones. And I am sure the 30% cut and $100 annual fee has nothing to do with the decision either. Apple only cares about customers, not money…

disable sideloading and enforce a Mac App Store only policy on macOS People have been repeating that for years, since the Mac App Store was announced. It’s not in Apple’s interest to do it. There is a ton of software, open source in particular, that Apple benefits tremendously by. It costs Apple nothing to maintain the status quo. Going Mac App Store only would drive tons of developers off the platform and do absolut…

Apple developers would stay on the platform, regardless.

The GNU/Linux developers that have been giving money to Apple for a shinny UNIX, might go to Windows with WSL, which I doubt unless we are speaking about the crowd that only cares about POSIX and keeps calling that "Linux".

The GNU/Linux developers that have been giving money to Apple for a shiny UNIX instead of sponsoring OEMs, now they finally learn how Apple has always been, including before the days of almost getting to close shop.

Re: Bypassing Firewalls in macOS Big Sur

#133

Post by pjmlp »

sjwright wrote: post #63
smnrchrds wrote: post #53

Earlier quoted context omitted.

I expect Apple to take the opposite path, not immediately, but eventually: disable sideloading and enforce a Mac App Store only policy on macOS, similar to iOS. After all, if all apps are reviewed and approved by Apple, there is no malware that can use this weakness or the future ones. And I am sure the 30% cut and $100 annual fee has nothing to do with the decision either. Apple only cares about customers, not money…

There are numerous excellent reasons why that will never happen. And why it’s not in Apple’s interest to do so. The most obvious reason is that it would utterly destroy the Mac among influencer communities and developers. But perhaps the most underrated reason is that Apple already has a managed computing platform in the iPad. Rather than the Mac becoming more locked down, I expect the iPad will become ever-more desk…

Developers on the Apple that matter to Apple are those using Objective-C and Swift, everything else was a nice thing back in the dark days of almost closing shop.

Re: Bypassing Firewalls in macOS Big Sur

#134

Post by NickNameNick »

darthrupert wrote: post #103
yborg wrote: post #45

Earlier quoted context omitted.

In fact, it was so negligent because Apple is actually secretly rebelling against the Illuminati, who forced them to do this, by making such a deliberate cock-up of it that it was discovered within hours of release. We need to go deeper.

[flagged]

They solved the cooling issue by distributing it in liquid nitrogen!

Re: Bypassing Firewalls in macOS Big Sur

#135

Post by pjmlp »

coldtea wrote: post #107

This is "bypassing firewalls in macOS BigSur" by adding an address to the firewall bypass whitelist. I can hack ipf in a similar way, adding an ACCEPT rule... Nothing to see here, move along...

Pssst, lets not turn off the Apple hate. /s

I love this though, finally the GNU/Linux crowd that has been giving money to Apple for convinience, instead of sponsoring Linux OEMs gets the message.

Re: Bypassing Firewalls in macOS Big Sur

#136

Post by ilikepi »

rubatuga wrote: post #122
pjmlp wrote: post #120

Earlier quoted context omitted.

When OS X was introduced, asking on Apple forums how to run as root was almost a daily question. Most consumers don't care about security, making it easy to disable just opens the floodgates of their systems.

Yeah but as a counterpoint, most Hacker News users have used Linux at one point, which lets you run commands like `rm -rf /` as root. I think it's fair to allow power users to easily disable these protections.

Ironically, coreutils introduced[1] a requirement to add `--no-preserve-root` to `rm -rf /` way back in 2003, so that particular example doesn't really support the counterpoint you're trying to make.

EDIT: clarity

[1]: https://github.com/coreutils/coreutils/commit/34e3ea055721ec...

Re: Bypassing Firewalls in macOS Big Sur

#137

Post by microtonal »

johncolanduoni wrote: post #108
heavyset_go wrote: post #70

Earlier quoted context omitted.

You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.

How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for i…

followed by no standard trusted file access UI.

If an application uses Gtk+3 or Qt5 then portals will be used automatically for Open/Save dialogs:

https://docs.flatpak.org/en/latest/sandbox-permissions.html#...

I agree with the thrust of you comment though, outside the webbrowser, proper sandboxing a barely used outside web browsers. However, I think the problem is as much social as technical. Every time Flatpak comes up, it mostly gets hostile reactions.

The situation is rather unfortunate. A lot of people believe that Linux is more secure than other operating systems, but in practice the Linux desktop is far less secure than e.g. macOS, iOS/iPadOS, or Android.

And no, you aren't safe because it is open source software. Sandboxing also protects against unknown vulnerabilities in open source software.

Re: Bypassing Firewalls in macOS Big Sur

#138

Post by bartvk »

Unpopular opinion follows.

Apparently Patrick Wardle describes a security hole, which uses the NetworkExtension framework to make it as if his code is Apple code, and thus ignores the firewall rules. My guess is, that it'll get patched and that will be that.

If you think about it, blocking OS stuff makes less sense. You're already trusting the OS to a great degree.

(I can understand the need for most people to control the OS to a great degree, but personally I don't feel that need for macOS, which is my workhorse.)

Re: Bypassing Firewalls in macOS Big Sur

#139

Post by rubatuga »

thdrdt wrote: post #131
chefandy wrote: post #92

Ugh. I'd love to switch to Linux, but as a designer, I'm stuck. It's not a lack of understanding of how it works— Before I was a designer I was a developer, worked in IT for a while, worked in upper-level support for a while, and Linux was my primary personal and professional OS from the late 90s to like 2010. Why don't I just run a closed-source OS in a VM? They are fussy. Having some weird graphics tablet driver pr…

Some things changed for the good the last couple of years. I am programming on Ubuntu (C#, PHP, Javascript) with Jetbrains software. This works absolutely great. For 3D work I use Blender. But for graphical work I agree that there are still alternatives missing. Figma is a very good alternative for Sketch. Scribus is a good alternative for Indesign. Krita is very good for concept art. But that's about it. Inscape is…

Have you tried Photopea as a replacement for photoshop? It’s truly amazing.

https://www.photopea.com/

Re: Bypassing Firewalls in macOS Big Sur

#140

Post by ronyfadel »

bartvk wrote: post #138

Unpopular opinion follows. Apparently Patrick Wardle describes a security hole, which uses the NetworkExtension framework to make it as if his code is Apple code, and thus ignores the firewall rules. My guess is, that it'll get patched and that will be that. If you think about it, blocking OS stuff makes less sense. You're already trusting the OS to a great degree. (I can understand the need for most people to contro…

Absolutely not.

You should be able to deny/allow connections for any app, including 1st party apps.

This isn’t only an issue of trust. There are apps made to meter your connection (e.g. when you’re using your phone as a Personal Hotspot), where you’d like to see how much bw your 1st party apps are using, and have the option to block them.

Post reply on HN