Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

21–30 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#21

Post by eptcyka »

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route.

Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out.

I won't share the other sentiments about the above, but is it really that hard to document these behaviors?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#23

Post by addicted »

3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

Is there anything Apple can do that makes their platform less accessible to the users that you would not support?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#24

Post by paulryanrogers »

coldtea wrote: post #13
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...

Right, but many users want to delegate trust to more than just the OS vendor.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#25

Post by tankenmate »

lifty wrote: post #16
malandrew wrote: post #10

This is a big breach of trust in terms of Apple always being on the side of user privacy. If someone knows enough to install these firewall apps, then they know enough to figure out what they want to enable/disable even for Apple applications. If Apple thinks certain rules cause issues, they certainly could work with the developer of these apps to educate users of adverse effects when certain things cause unintended…

I would love if there would be a small appliance based on a raspberry pi zero or something of similar size, that could be controlled/configured from an app on your phone. This device would be powered through a usb cable (no data) from your laptop, and act as a WiFi hotstpot that you can use to route all your traffic via the VPN or network of your choice. Even if your laptop would be infected by malware or a rootkit,…

This is basically what pi-hole is, as to controlling it from a phone app, well it has a web interface.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#26

Post by Wowfunhappy »

rootusrootus wrote: post #15

Hasn't this always been a bit of an issue? Apps with root privileges have been able to get around Little Snitch for as long as I can recall. Some software relies specifically on that ability.

...no, I don't think they could. Is there an example you're thinking of?

Up until recently, Little Snitch monitored network traffic in kernel space.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#27

Post by Skunkleton »

jjoonathan wrote: post #5

"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!" ...and now Apple has altered the deal and we must pray they do not alter it further. Disgusting. Predictable, expected, unsurprising -- but still disgusting.

You understand that Apple could bypass kexts too? This is an issue of trust, not a technical issue.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#28

Post by nix23 »

jjoonathan wrote: post #5

"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!" ...and now Apple has altered the deal and we must pray they do not alter it further. Disgusting. Predictable, expected, unsurprising -- but still disgusting.

Dont pray, just dont buy Apple Products

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#29

Post by whimsicalism »

coldtea wrote: post #13
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...

I don't understand these style of responses. I think the point is that this "feature" makes the OS shittier.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#30

Post by addicted »

threatofrain wrote: post #17
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

If you don’t trust Apple then you need something more than little snitch. Apple is responsible for both hardware and OS. What delta in security or trust is little snitch going to offer over Apple?

In this situation the question isn’t about whether or not Apple can be trusted.

Apple has clearly betrayed users’ trust in this situation.

People don’t install Little Snitch only to prevent nefarious third party activity. Some may want to know what traffic is going to and from their computers. Other may want to block all traffic for testing and/or research purposes.

I can trust that Apple is not doing something nefarious and still see that Apple is blatantly betraying the fact that people trusted when switching stuff like firewalls away from kext that it wouldn’t build backdoors for itself.

Also, any backdoors Apple builds for its own apps and services are simply an additional attack vector that could potentially be used by non Apple malicious actors.

Post reply on HN