Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

251–260 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#251

Post by Xylakant »

goatinaboat wrote: post #145
Skunkleton wrote: post #69

Earlier quoted context omitted.

This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.

If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.

I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted.

I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#252

Post by [deleted] »

dmd wrote: post #45
thewebcount wrote: post #35

Earlier quoted context omitted.

Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!

If you're using Cisco Anyconnect, blame that for that particular keyboard issue.

[deleted]

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#253

Post by m463 »

solatic wrote: post #78
3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

> Is the world better or worse due to this change? This is the false shortcut behind any attempt to weaken security. Security makes access harder, therefore let's weaken security to improve access. The fact is that weakening security also makes malicious behavior easier and/or more likely. Changes like this are bad particularly because Apple users pay for a protected walled garden.

What this will do is allow apple to decide what goes in and out of the machine.

It's pretty clear what they think - they allow basically any app to access the network on ios.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#254

Post by mulmen »

eptcyka wrote: post #136
dylan604 wrote: post #60

Earlier quoted context omitted.

Why not blame the idiotic decision to make this network check just to wake up?

I think the threat model here is that someone might've swapped out your keyboard to one that's spying on you, whilst you're out at a conference enjoying the more social aspects of such gatherings. At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

Huh? When I’m out socializing there’s no spying to do. But as soon as I get back I will just log in and the spying begins.

I’m so accustomed to flaky peripherals with Apple products I wouldn’t even be alarmed at the behavior.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#255

Post by m463 »

api wrote: post #33
3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

Tech savvy users are not just the minority. They're also cheap. They've been conditioned by the FOSS movement to think all software should be free as-in-beer. (The people who started FOSS didn't say that, but that's what it's become.) They say they want free as-in-freedom, but since they are not willing to pay for it they don't exist. Those who pay set the agenda for everything. Developing a truly polished operating…

I think that's a false false assumption.

With trust you get trade. Trade is commerce and the more trust you have the more money changes hands.

If I could firewall my phone I would upgrade every year no question.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#256

Post by beervirus »

giancarlostoro wrote: post #180

I mean I already knew something was weird when I couldnt su into root and do... root things without a bios hack on a Mac. Thats just not how Unix works at all... The whole concept of root is you are root no exceptions.

SELinux doesn’t let root just do whatever it wants.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#257

Post by miguelmota »

dylan604 wrote: post #228
miguelmota wrote: post #166

Earlier quoted context omitted.

Curious, what sort of things make desktop Linux suck in your opinion? I’ve been on Linux for years as my primary machine and haven’t encountered anything that made me switch back.

Can you select a file in the whatever is the Linux desktop equivalent of Finder and hit the spacebar to get a quick look at the file native to the OS? Can I run the software I need to be able to make a living? Can I run multiple HiDPI displays that I can connect/disconnect as needed without causing issues? I honestly don't know if these are or are not available features. The first question is a muscle memory thing fo…

> Can you select a file in the whatever is the Linux desktop equivalent of Finder and hit the spacebar to get a quick look at the file native to the OS?

Yes, I use pcmanfm on Linux and the spacebar will open the file in the default program.

> Can I run the software I need to be able to make a living?

Depends on what you do. If it's mostly design work and you require Adobe products then Linux is not a good choice. For software development then Linux is great.

> Can I run multiple HiDPI displays that I can connect/disconnect as needed without causing issues?

I never encountered problems connecting external monitors but also haven't tried connecting to an Apple monitor and makes me think drivers are probably non-existing for that.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#258

Post by oatmealsnap »

kitsunesoba wrote: post #169
adambatkin wrote: post #121

Earlier quoted context omitted.

Linux on the desktop and Linux on the laptop (heh) has definitely improved. It _sometimes_ needs a little tweaking to get it right, but KDE/Plasma also happens to offer that level of "tweakability" that should satisfy almost all semi-mainstream users (at least anyone coming from Windows or Mac). Compared to my first Linux laptop (a Sony Vaio circa 2000), my current XPS 13 works as well as any Mac laptop I have ever o…

I try the major DEs every few years to see if they fit me, most recently trying the newest KDE and GNOME versions in a VM about a month ago. Both have improved for sure, but they still have a long way to go… GNOME actually came closest but its customizability level is even lower than that of macOS, even factoring in extensions. Both suffer from a laundry list of minor annoyances that snowball into something that's ha…

Same experience. I tried, but Linux just isn’t ready to be used as a general OS right now.

I’ve dug through message boards and bug reports, and a lot of the features that MacOS has will never be implemented. I’m taking about features released 13+ years ago on OS X 10.4.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#259

Post by m463 »

kstrauser wrote: post #240
giancarlostoro wrote: post #180

I mean I already knew something was weird when I couldnt su into root and do... root things without a bios hack on a Mac. Thats just not how Unix works at all... The whole concept of root is you are root no exceptions.

That's absolutely not true. For instance, the BSDs have the notion of securelevels ( https://man.openbsd.org/securelevel.7 ) which severely limits what even the root user can do. SELinux can do a lot of the same things.

I don't know about bsd, but there's lots of documentation on how selinux works (including source code) and information on how to alter its behavior in a fine-grained fashion. and selinux doesn't leave itself a backdoor (as far as the nsa has told us)

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#260

Post by superasn »

metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

I've become a huge fan of Linux Mint. It looks amazing and unlike before now there are no driver related issues (the thing that kept me from using it all this time).

The only thing I miss is Photoshop but I really can't think of a single reason besides that to not use Linux anymore.

Post reply on HN