Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

161–170 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#161

Post by ebiester »

AlexandrB wrote: post #109
hexis wrote: post #61

Earlier quoted context omitted.

Maybe desktop Linux needs more people like you and me to help make it better?

I appreciate the sentiment, but I'm not a UX designer or expert. And the problem is not that Linux doesn't have enough UI developers, it's that many of them are working on re-inventing the wheel in different, competing ways. Linux needs a dictatorial BDFL for UI - a Linus Torvalds for the desktop - an idea somewhat antithetical to the distributed nature of open source development. It doesn't help that organizations t…

Two groups tried that. Unity tried that, and GNOME is trying that. Many of us really hate GNOME's decisions.

I'm not sure I really like the BDFL here.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#162

Post by Macha »

OJFord wrote: post #80
Skunkleton wrote: post #65

Earlier quoted context omitted.

DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.

Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?

My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#163

Post by eknkc »

kar1181 wrote: post #125
metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

The linux desktop experience is still quite in a state. I will likely do the same and suffer Linux, but I think many will go back to windows as WSL continues to improve. Apple is going to lose developers.

I switched to Windows and been working exclusively on WSL2. It is pretty decent and I'm glad I got out of Apple ecosystem.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#164

Post by droopyEyelids »

chrisshroba wrote: post #129
joncp wrote: post #32

That totally breaks my use case for Little Snitch: working tethered. When I tether my laptop it thinks it has free reign with the bandwidth and all of the little background processes can kill my data in a few minutes. With a firewall, I can grant access to only the processes that I need to get my work done. Now, I guess I have to run some external firewall between my laptop and my phone. ... or better yet, abandon Ap…

For what it's worth, my hacky solution to this is this script which kills all the background processes that use significant bandwidth. If you're interested in how I came up with the list of processes, I can share the BitBar [1] script I wrote for monitoring per-process network usage (I wrote a small wrapper around nettop that logs to a db, which is read periodically by my BitBar script to show me the per-process usag…

please share the script for monitoring per-process network usage! I'd love it.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#165

Post by SCHiM »

gruez wrote: post #127
throwaway2048 wrote: post #87

Earlier quoted context omitted.

that is not how kexts work(ed), they can do completely arbitrary things to the kernel, including removing any theoretical code signing requirement.

any access? On Windows, you can write a driver that would run in kernel mode, but critical sections can't be modified[1]. I'd imagine there's something similar for mac. [1] https://en.wikipedia.org/wiki/Kernel_Patch_Protection

KPP is not considered a security boundary. That means, in Windows security jargon, that it's a feature that helps security. But not something that you or anyone else should consider a fail proof solution, or even something that would result in a patch if breached.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#166

Post by miguelmota »

AlexandrB wrote: post #53

Both major consumer OS vendors seem hell-bent on bringing the OS layer under their complete control. As a power user, it's very frustrating. Meanwhile "desktop" Linux still kind of sucks, just like it did 10 years ago. I don't have much hope of seeing a compelling, unified UX out of Linux in my lifetime.

Curious, what sort of things make desktop Linux suck in your opinion? I’ve been on Linux for years as my primary machine and haven’t encountered anything that made me switch back.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#167

Post by junon »

eptcyka wrote: post #136
dylan604 wrote: post #60

Earlier quoted context omitted.

Why not blame the idiotic decision to make this network check just to wake up?

I think the threat model here is that someone might've swapped out your keyboard to one that's spying on you, whilst you're out at a conference enjoying the more social aspects of such gatherings. At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

I don't believe this is ever the case. What happens if you legitimately installed a new keyboard? Will Apple just... prevent you from using it?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#168

Post by wyld »

lifty wrote: post #16
malandrew wrote: post #10

This is a big breach of trust in terms of Apple always being on the side of user privacy. If someone knows enough to install these firewall apps, then they know enough to figure out what they want to enable/disable even for Apple applications. If Apple thinks certain rules cause issues, they certainly could work with the developer of these apps to educate users of adverse effects when certain things cause unintended…

I would love if there would be a small appliance based on a raspberry pi zero or something of similar size, that could be controlled/configured from an app on your phone. This device would be powered through a usb cable (no data) from your laptop, and act as a WiFi hotstpot that you can use to route all your traffic via the VPN or network of your choice. Even if your laptop would be infected by malware or a rootkit,…

I've been pretty happy with the PiHole Remote app https://apps.apple.com/us/app/pi-hole-remote/id1515445551

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#169

Post by kitsunesoba »

adambatkin wrote: post #121
indymike wrote: post #70

Earlier quoted context omitted.

I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).

Linux on the desktop and Linux on the laptop (heh) has definitely improved. It _sometimes_ needs a little tweaking to get it right, but KDE/Plasma also happens to offer that level of "tweakability" that should satisfy almost all semi-mainstream users (at least anyone coming from Windows or Mac). Compared to my first Linux laptop (a Sony Vaio circa 2000), my current XPS 13 works as well as any Mac laptop I have ever o…

I try the major DEs every few years to see if they fit me, most recently trying the newest KDE and GNOME versions in a VM about a month ago. Both have improved for sure, but they still have a long way to go… GNOME actually came closest but its customizability level is even lower than that of macOS, even factoring in extensions.

Both suffer from a laundry list of minor annoyances that snowball into something that's hard to ignore, and in KDE's case the UX design they employ just doesn't jive with me at all.

It's all enough that I end up coming back to macOS because despite its problems, it fits me in ways that nothing else even comes close to touching. Sometimes it feels like there will never be a macOS alternative that has what it takes for me to switch without feeling a major sense of loss.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#170

Post by ProAm »

kccqzy wrote: post #148
ProAm wrote: post #139

Earlier quoted context omitted.

Would you use a good trackpad that connects via USB or bluetooth? Its a real question because I see a lot of comments about people not leaving the Macbook because of the trackpad even though they dislike the rest of the laptop? Seems like something that could be a product?

No you wouldn't. It's not about the trackpad hardware (Apple sells a separate Bluetooth trackpad after all), but it's about the software.

What about the software makes it good? Ive never used a macbook so have zero experience with it.
Post reply on HN