Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypassing Firewalls in macOS Big Sur

twitter.com

Post reply on HN
Print view View original

231–240 of 251 posts

Re: Bypassing Firewalls in macOS Big Sur

#231

Post by iso1210 »

damnyou wrote: post #221
grishka wrote: post #174

Earlier quoted context omitted.

SIP relies on entitlements, which rely on code signing. I'm not sure code signing is at all a thing on Linux.

Package signing is definitely a thing on Linux.

On installation sure, but not on execution.

/usr/bin/vim was installed by my package manager, but there's no guarentee the version I'm running matches the version that was installed. Now in debian there is a file which has a checksum of the version the package installed, but that's not checked on execution, nor is it itself signed (so the process that replaced vim could just as easilly replace the checksum, or the process that checks the checksum)

Re: Bypassing Firewalls in macOS Big Sur

#232

Post by systemvoltage »

spijdar wrote: post #126
systemvoltage wrote: post #97

Earlier quoted context omitted.

UNIX was a proprietary OS but literally everyone used it in the 80’s - without a license. Campuses to labs around the US. We need to nuke the Apple bullshit from MacOS Catalina and convert it into people’s operating system. Ethics be damned.

What UNIX are you thinking of? Even the Berkeley distribution appeared to require a license from AT&T to use, for V7 UNIX. Anything with AT&T's code was litigiously protected, culminating in a law suit in the 90s against 4.4BSD Lite, which was the first to claim to be rid of all AT&T code. Are you saying most installations were just unlicensed copies?

I heard it from Brian Kernighan's interview on Lex Fridman's channel: https://www.youtube.com/watch?v=O9upVbGSBFo

Re: Bypassing Firewalls in macOS Big Sur

#233

Post by shrimp_emoji »

submeta wrote: post #116
qz2 wrote: post #13

This whole release cycle is just one gigantic facepalm after another. I am feeling pretty heavily smug that I got rid of my Apple kit earlier this year because I wasn't happy with the direction of the platform.

I have gotten rid of almost any Apple only tools (OmniGraffle to Figma; OmniFocus, Things3, iA Writer, Ulysses, Alfred App to Emacs+Org, and some more), but there is only only a few left that I can‘t find a replacement for in Linux-land: DEVONthink for managing my thousands of documents (actually I just keep my files in DEVONthink and use the search feature, could end up using just file system), ScanSnap Manager (a d…

>I guess I need to get a Thinkpad running Linux

There are also Linux "commodity" laptops from Linux-focused companies now. E.g.,

https://puri.sm/products/librem-14/

https://system76.com/laptops

Re: Bypassing Firewalls in macOS Big Sur

#234

Post by neop1x »

xyst wrote: post #26

For a company that boasts privacy, it sure leaves a lot of holes in it's OS for malicious people to exploit. Guess I won't be upgrading from Catalina for a long time.

Wait a bit until a new iOS feature will require a new XCode and the new XCode will require a new MacOS. :) Been there, seen it.

Re: Bypassing Firewalls in macOS Big Sur

#235

Post by heavyset_go »

johncolanduoni wrote: post #108
heavyset_go wrote: post #70

Earlier quoted context omitted.

You get industrial grade security solutions out of the box with many Linux distributions. You get namespaces, firewalls and seccomp for free with any Linux kernel, and any Linux system with systemd gets unprivileged containers and sandboxes for free, too. AppArmor exists for MAC, and there are userspace sandboxes.

How many user applications actually fashion a sandbox that is non-trivial to escape with those protections? I struggle to think of any outside of the more popular browsers. The Snap and Flatpak sandboxes are good case studies in the practical limits of Linux sandboxing: it’s rarely effective without designing your entire app around it because the way most applications interact with the system was never designed for i…

> On the server, there’s a reason Amazon built Firecracker and Google built gVisor instead of just using the Linux sandboxing primitives.

The reason is that Firecracker is a virtual machine, and Linux containers and sandboxing primitives are not meant to be used for virtual machines.

Pointing at Snap and Flatpak's "sandboxes" is disingenuous when they're notorious for having sandboxing as an after thought to app distribution.

When I say industrial grade, I mean that the sandboxing and isolation primitives that are used in industry are those that are either provided in the kernel, or are deployed as part of a standard Linux server deployment.

Re: Bypassing Firewalls in macOS Big Sur

#236

Post by garyrob »

claudeganon wrote: post #229
garyrob wrote: post #227

Earlier quoted context omitted.

Thank you. I am not sophisticated about these things so let me ask a follow-up. By "open" a file, most end users think of documents that are opened by applications... either from the App Store or from Apple. I think you are thinking about things like shell scripts, binary executables that run in the terminal which being an official Mac "Application", etc. Is that right?

Malware can be embedded in just about anything. PDFs and other documents are a common vector. While scripts and executables are obviously a greater risk, it’s pretty easy to mask malware as those files as well.

For something like a PDF, macOS would open Preview, or some other PDF-handling app, to handle it if the user opens it in the Finder. So the PDF would have to have code in it that exploited some security weakness in the associated app that would cause the code to be executed, correct?

Just trying to make sure I'm understanding.

Re: Bypassing Firewalls in macOS Big Sur

#237

Post by claudeganon »

garyrob wrote: post #236
claudeganon wrote: post #229

Earlier quoted context omitted.

Malware can be embedded in just about anything. PDFs and other documents are a common vector. While scripts and executables are obviously a greater risk, it’s pretty easy to mask malware as those files as well.

For something like a PDF, macOS would open Preview, or some other PDF-handling app, to handle it if the user opens it in the Finder. So the PDF would have to have code in it that exploited some security weakness in the associated app that would cause the code to be executed, correct? Just trying to make sure I'm understanding.

Yes, that's correct.

Re: Bypassing Firewalls in macOS Big Sur

#238

Post by [deleted] »

Bud wrote: post #32
kypro wrote: post #28

This seems so negligent it's difficult for me to believe this was a mistake. Perhaps it could be argued that Apple doesn't want applications blocking the network traffic of trusted applications because there is limited upside to doing so and doing so may restrict core functionality such as system updates, etc. But surely the most reasonable explanation here is that Apple wants a back door to guarantee they can monito…

No, that is not the most reasonable expectation. Fails both Occam's Razor and the laugh test. To believe this, one has to believe that a $2 trillion company did this on purpose, knowing it would be revealed within hours and that it would take a major hit on the very reputation for user privacy and security that they have spent years building. There are a lot of better explanations available than "Apple decided user s…

[deleted]

Re: Bypassing Firewalls in macOS Big Sur

#239

Post by [deleted] »

andy_ppp wrote: post #158
grishka wrote: post #153

Earlier quoted context omitted.

Why should they not? Linux for example doesn't have any such features and somehow is okay to use like that.

What stops a Linux program altering the system? I guess you need root access to change things outside of /usr/local this could easily be done on macOS too but the wheel had to be reinvented by Apple in a way that is probably less trustworthy.

[deleted]

Re: Bypassing Firewalls in macOS Big Sur

#240

Post by [deleted] »

angry_octet wrote: post #171
andy_ppp wrote: post #158

Earlier quoted context omitted.

What stops a Linux program altering the system? I guess you need root access to change things outside of /usr/local this could easily be done on macOS too but the wheel had to be reinvented by Apple in a way that is probably less trustworthy.

With SIP you can't change some things even as root. SIP has definitely made macos a harder target, though it is still lagging Windows in some areas. Linux is almost comically unprotected. @grishka Edit because I'm rate limited: I've not seen anything that does executable validation for linux and actually works. Needs lots of kernel support. See the response from the old DigSig author: https://stackoverflow.com/questi…

[deleted]
Post reply on HN