Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

181–190 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#181

Post by Wowfunhappy »

Arubis wrote: post #172
bayindirh wrote: post #153

Earlier quoted context omitted.

Jobs' Apple created technologies which have rooted deeply in POSIX standards and standard UNIX* conventions. If you knew UNIX(Linux/BSD/whatever), you can find the same data streams on the same places. OS was obscure but, predictable. Different but, familiar. It had kernel extensions, logs and devices. Nothing was extremely obfuscated. It was a UNIX device but, shinier . Now it feels like a glorified iOS box with mor…

I intend this with kindness: normally I don’t nitpick on grammar and punctuation, but you’ve got a repeated error here that’s easily corrected. Generally, you want to break your sentences with commas _before_ usage of “but”: “He wanted to buy a pen, but the store had run out.” If you’re a native speaker, the comma goes where you’d naturally have a brief pause in speech. If you’re not a native speaker, it may be helpf…

I read this as a poetic choice by GP—it evoked Apple's "Think different" tagline in my mind, although now I'm not actually sure why. I could be wrong though!

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#182

Post by _underfl0w_ »

indymike wrote: post #70
metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).

Just wanted to add another compliment for KDE (specifically Plasma). I've been using KDE Neon as my daily driver for a few months now and it's amazing. Connects to my android device to share notifications and clipboard content, is heavily customizable and themeable, the whole OS feels very snappy and uniform in terms of UI/UX, and installing alongside Win10 and macOS in a hackintosh setup with full LUKS disk encryption was a snap through the installer GUI. Absolute 10 out of 10.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#183

Post by kekebo »

metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

Is your kernel extension public?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#184

Post by sroussey »

eptcyka wrote: post #79
easton wrote: post #68

Earlier quoted context omitted.

Probably why the other discussed function exists: > Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out. So if the default route doesn't exist yet since it's still checking for internet, it would…

The default route verification is separate from the keyboard issue. I don't know exactly what is going on here, but in the above post what I mean by the system applying a default route is that the route isn't propagated to the system configration's dynamic store and whatever macOS uses for netlink, i.e. the route doesn't show up in `route monitor` until the check finishes. However, I do believe it would still be used…

The T2 has its own OS, so that makes sense.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#185

Post by 3pt14159 »

ballenf wrote: post #18
3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

I'd argue this opens up a giant attack surface where malicious software will try to route its command and control communication through a protected service. Do we really want to trust that Apple will keep all 50+ of these privileged services fully protected? I think it makes the "world" slightly worse in that it will be harder to discover malware. Little snitch has a small user base, but it's been used to identify ma…

Yes I agree with your first part. There are real drawbacks.

But it's like installing a custom HTTPS cert in your OS to inspect potential traffic that malware may use through, say, a Google Doc or Sheet. It's helpful to true professionals dealing with highly sensitive information, but it's ultimately a bigger source of compromise for the vast majority of software users.

I don't think there is an easy answer here. That's why I said I thought it made the world a "touch better" and I can see from your response that you understand the tradeoffs roughly as well as I do based on the wording of your response. The fact is that contemplating these hard tradeoffs belie the underlying truth: Securing computers is hard and getting harder and the stakes keep going up. I can't say if this move by Apple will ultimately be worth it, but I certainly understand the predicament they are in. This is no easy work.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#186

Post by rantwasp »

metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

hahaha. I also don’t plan to upgrade past Mojave. To me Catalina was a trainwreck and at this point I think I’m loosing a lot of trust I used to put in Apple.

this is compounded by the fact that I love Little Snitch and it has basically exponentially improved my life when it comes not only to browsing the web but when using any app on mac.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#187

Post by daniel-thompson »

ProAm wrote: post #170
kccqzy wrote: post #148

Earlier quoted context omitted.

No you wouldn't. It's not about the trackpad hardware (Apple sells a separate Bluetooth trackpad after all), but it's about the software.

What about the software makes it good? Ive never used a macbook so have zero experience with it.

For me, two things combine to make it feel super responsive: 1. The latency between you moving your finger(s) and seeing movement on the screen feels imperceptible. 2. There isn't any "lost" movement - if you scribble your finger around really quickly and come back to where you start, the cursor or window scroll position will be back to where it started too.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#189

Post by sroussey »

metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

“folks that want full control over their operating system” and “walware authors” want too much of the same thing.

I think everyone would appreciate ideas for solutions.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#190

Post by gruez »

dheera wrote: post #158
gruez wrote: post #110

Earlier quoted context omitted.

>Not happening if it were an encrypted Android device with a high-entropy password. because you have to balance security with usability. iPhones use its security chip to slow/prevent password guessing. that allows you to use a weak password without losing much security, but if that system is compromised you're back to square one. I'm sure if you used a high entropy password on ios, they wouldn't be able to get access…

> I'm sure if you used a high entropy password on ios The problem is you don't get this choice in iOS. A privacy-respecting company would provide you this option -- Android does. You can have a high-entropy passcode in Android if you wish, and choose to sacrifice usability in the interest of privacy, if that is what you'd like.

>The problem is you don't get this choice in iOS.

Who says you can't?

https://9to5mac.com/wp-content/uploads/sites/6/2019/05/custo...

Post reply on HN