Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Firewalls in macOS Big Sur

twitter.com

Post reply on HN
Print view View original

211–220 of 251 posts

Re: Bypassing Firewalls in macOS Big Sur

#211

Post by dreamcompiler »

gardaani wrote: post #160
grishka wrote: post #153

Earlier quoted context omitted.

Why should they not? Linux for example doesn't have any such features and somehow is okay to use like that.

A year ago, a Chrome update (its Keystone auto-update agent) corrupted system files in Macs which had SIP disabled [1]. The result was that they didn't boot anymore. Mac users who had SIP enabled were not affected. I won't disable SIP and I'll avoid installing Google Chrome on my new Macs, if possible. [1] https://support.google.com/chrome/thread/15235262?hl=en

If you can figure out how to disable SIP, you can figure out how to disable Keystone. The latter is probably a much better idea.

Re: Bypassing Firewalls in macOS Big Sur

#212

Post by Wowfunhappy »

gardaani wrote: post #160
grishka wrote: post #153

Earlier quoted context omitted.

Why should they not? Linux for example doesn't have any such features and somehow is okay to use like that.

A year ago, a Chrome update (its Keystone auto-update agent) corrupted system files in Macs which had SIP disabled [1]. The result was that they didn't boot anymore. Mac users who had SIP enabled were not affected. I won't disable SIP and I'll avoid installing Google Chrome on my new Macs, if possible. [1] https://support.google.com/chrome/thread/15235262?hl=en

A major application briefly had a (very bad) bug. It happens. It probably won’t happen the same way again.

Re: Bypassing Firewalls in macOS Big Sur

#214

Post by TazeTSchnitzel »

eps wrote: post #162
ilikepi wrote: post #136

Earlier quoted context omitted.

Ironically, coreutils introduced[1] a requirement to add `--no-preserve-root` to `rm -rf /` way back in 2003, so that particular example doesn't really support the counterpoint you're trying to make. EDIT: clarity [1]: https://github.com/coreutils/coreutils/commit/34e3ea055721ec...

That's because it was abused to troll inexperienced users. "How do I do X? Just run this as root." Sometimes slightly disguised, but more often not.

I think the bigger problem is it is not very hard as a power user to unknowingly try to delete /

Re: Bypassing Firewalls in macOS Big Sur

#215

Post by merb »

1vuio0pswjnm7 wrote: post #148
rubatuga wrote: post #7

How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.... And a humorous guide on disabling protections like code signing and notarization: https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-li...

The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iO…

> Given the choice between (a) a corporate OS that requires me to perform some amount of work to "turn off" some "features" the corporation has enabled and (b) a non-corporate OS that requires me to perform some amount of work to "turn on" the "features" that I want to use, I prefer (b).

actually default on, is not a problem if it is easy to turn it off in that case. if apple would have had a button to turn it off, we would be fine.

Re: Bypassing Firewalls in macOS Big Sur

#216

Post by thdrdt »

chefandy wrote: post #205
thdrdt wrote: post #131

Earlier quoted context omitted.

Some things changed for the good the last couple of years. I am programming on Ubuntu (C#, PHP, Javascript) with Jetbrains software. This works absolutely great. For 3D work I use Blender. But for graphical work I agree that there are still alternatives missing. Figma is a very good alternative for Sketch. Scribus is a good alternative for Indesign. Krita is very good for concept art. But that's about it. Inscape is…

I think Blender and Figma are good, professional tools. For the rest of them, I'm sure they work fine if you don't need to produce extremely polished stuff at volume— but they're not even close to good for that use case. (which is what my comment was about) I could see a UX Designer who works primarily in wireframes and such things getting by fine with linux, but not someone who works primarily in visuals.

Visuals is a very broad term.

As you can read in my comment I agree with you. For example working with text in Gimp is just horrible. And Inkscape is very good untill you need it for CMYK.

But this thread is about owning your PC. And then I think all those trade-offs can be overcome. Sometimes this means thinking in other directions. For example the choice to design in CSS instead of Photoshop.

I don't think you can say: 'I cannot get away from Apple'.

But you can say: 'I choose to stay at Apple because I think it is more convenient'.

The choice is yours.

Re: Bypassing Firewalls in macOS Big Sur

#217

Post by merb »

johncolanduoni wrote: post #108
heavyset_go wrote: post #70

Earlier quoted context omitted.

You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.

How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for i…

> On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives. I think calling them “industrial grade” is pushing it when they’re rarely used as the first line of defense against code that is expected to be actively hostile.

actually firecracker is not a sandbox. it's basically qemu/libvirt and a minimal implementation of devices. it's qemu-kvm with a http interface and way less devices.

the reason why they rewritten qemu-kvm is because qemu-kvm contains a lot of code that is not needed and is way more bug prone. and also loading a kernel is way faster in firecracker since they optimized the kernel loading code.

Re: Bypassing Firewalls in macOS Big Sur

#218

Post by Fnoord »

1vuio0pswjnm7 wrote: post #148
rubatuga wrote: post #7

How to disable this feature: https://tinyapps.org/blog/202010210700_whose_computer_is_it.... And a humorous guide on disabling protections like code signing and notarization: https://www.naut.ca/blog/2020/11/13/forbidden-commands-to-li...

The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iO…

Defaults are opinionated per definition. You might agree or disagree with them.

I don't believe the defaults related to this issue are a problem; its the lack of transparency about this, coupled with it being difficult to change this. Probably every update you gotta fix that. That's akin to running a Hackintosh. And we all know macOS is moving towards iOS; not Hackintosh/PC.

Re: Bypassing Firewalls in macOS Big Sur

#219

Post by wool_gather »

Terretta wrote: post #186
1vuio0pswjnm7 wrote: post #148

Earlier quoted context omitted.

The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iO…

99% of users need opinionated settings as they are not qualified to have opinions on them. So the right path for consumer OS is ‘sound opinions, easily changed’.

Well said. And frankly, this is true even of FOSS -- or why are there so many flavors of Linux?

Even technical users are going to differ in the sets of opinions they hold and are qualified to hold. I care about which Python I have installed. The virtual memory manager? Not so much. Someone else might, though.

Re: Bypassing Firewalls in macOS Big Sur

#220

Post by unicornporn »

Lucasoato wrote: post #175
1vuio0pswjnm7 wrote: post #148

Earlier quoted context omitted.

The issue is defaults. Personally, I prefer using an open source alternative OS where generally everything is disbled by default. (NetBSD is best exemple I have found.) Commercial OS like the ones created by Apple, Microsoft, Google, etc. have default settings that are opinionated, i.e., some users might not wish to choose these settings. This puts a burden on the user to disable or work around them somehow. Apple iO…

The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer. Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry...

> The problem is that people who work on some specific fields (music, cinema, graphics) have almost no choice when choosing OS and computer.

Came here to say that.

> Most of them won't even care about sending too much data to a company if that's the price to have the same device everyone else is using in their industry...

I do, I truly do care. So much that I'm looking at open-source/Linux options, at least for my home projects. Doesn't look very bright on the video side, but DaVinci Resolve is at least available for Linux. Rawtherapee is getting there with local adjustments as we speak. Darktable has lots of power but terrible UX.

Post reply on HN