For anyone that wants to switch to Linux and retain similar functionality as this firewall app, there is this: https://github.com/gustavo-iniguez-goya/opensnitch
Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
281–290 of 649 posts
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#282Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…
> Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route.
When did they start doing this? I'm still using High Sierra on my 2018 MBP work laptop, because the keyboard and trackpad was freezing for anywhere up to 5 minutes or more with Mojave after a wakeup (usually after a long sleep). Downgrading to High Sierra fixed it, but fighting with the machine was such a pain I haven't dared touch it since.
I'm wondering if you're describing the problem I was having, but could never figure out.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#283Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…
> I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now.
I'd be interested to read more about this, and maybe even use your kext. I'm currently MITM'ing all of my SSL traffic[1] for a different, esoteric reason: I insist on using a 7-year-old version of macOS, and it doesn't natively support modern SSL ciphers, so I have to add it in with an mitm proxy.
I've run into a handful of issues with various software that I've had to work through as they arise, but if you've been doing this for ten years you've probably seen it all already.
1: https://forums.macrumors.com/threads/fixing-maverickss-outda...
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#284Earlier quoted context omitted.
What is it about Adobe software that makes it only work on Windows or macOS? Both of their graphics engines are totally different, so what makes it so difficult for Linux compatibility? It's the only software package that keeps me beholden to Apple (I'll never run Windows of my own decision).
Adobe doesn't care to support Linux. It's as simple as that.
That's an obvious drive by answer, but I'm asking a forum of developers for an explanation/guess on what it is about Linux that would make Adobe not care about it.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#285Earlier quoted context omitted.
Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!
If you're using Cisco Anyconnect, blame that for that particular keyboard issue.
Happens with the built-in, first-party VPN client as well. Definitely not just a Cisco issue.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#286Earlier quoted context omitted.
I think the threat model here is that someone might've swapped out your keyboard to one that's spying on you, whilst you're out at a conference enjoying the more social aspects of such gatherings. At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.
Huh? When I’m out socializing there’s no spying to do. But as soon as I get back I will just log in and the spying begins. I’m so accustomed to flaky peripherals with Apple products I wouldn’t even be alarmed at the behavior.
I think you misunderstand.
The idea is that if your keyboard is replaced with a keyboard that has modified (hacked) firmware, your computer will refuse to let you use it.
To do this, it must obtain a cryptographic attestation from the keyboard firmware, proving that it has not been modified. Further, to avoid replay attacks it must include the current time in the message it signs. NTP is used by macOS to determine the current time, so as to verify the signature provided by the keyboard.
So, if NTP is slow to respond or time out, you are stuck waiting for your Mac to verify your keyboard's signature.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#287Earlier quoted context omitted.
KPP is not considered a security boundary. That means, in Windows security jargon, that it's a feature that helps security. But not something that you or anyone else should consider a fail proof solution, or even something that would result in a patch if breached.
If patching the kernel to intercept network requests is sufficiently hard enough that you're forced to use their "approved" way of intercepting network requests, then it's very easy for them to sneak requests through. Even if patching the kernel wasn't an issue, it still turns into a game of whack a mole because apple can sneak as many changes as they want with each macos release. It heavily favors apple, not the dev…
Even if patching the kernel wasn't an issue, it still turns into a game of whack a mole
Exactly - but the game itself is the problem. Firewall vendors will go hunting through kernel code for jump targets and structs to plug into hidden interfaces, and Apple will remove and change them, causing crashes and instability. Apple has some leverage if they have a program like WHQL, but even then driver writers will commit shenanigans. Push them out of the kernel altogether and now only Apple can engage in shenanigans and break user trust. Which they already have.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#288Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…
I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).
How is desktop search? Spotlight (mac desktop search) is a killer feature for me -- fast, reliable, smooth, all straight out of the box. Meanwhile, I've wasted many hours trying to get desktop search up to the same standard on Windows and Linux. That was years ago (for linux, at least), hopefully things have improved. How is linux desktop search doing today?
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#289Looks like one of the answers in the Twitter thread mentions that this might be cached content. Is this confirmed that the network call is actually being made (by router for example?). Cause later down the line it seems that pf blocks the calls just fine.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#290Earlier quoted context omitted.
It's perhaps worth noting that iOS and all of its restrictions were created under Steve Jobs. And Jobs absolutely expected iOS devices to eventually replace full computers for most people; as he put it, everyone needs a car but only a few need a truck. Where I absolutely agree with you is that under Jobs, there were no attempts to make macOS behave more like a car. Lion did borrow a handful of visual elements from iO…
Indeed. I think for all his faults, Jobs was still himself a "power user". He understood why people wanted to be able to tweak things like this because he wanted to be able to this himself (even if most of the time he used an ipad).
It’s been documented how irate he would get over small details. Those small details are really only seen by someone who is a power user and has a vision for what it _should_ be. Not to make excuses for his behavior but he understood technology and wanted to make it simple for everyone. That drive towards simplicity makes you have to make a choice as to what features are left to the user and what features are managed by the system. Increasingly under Cook it’s been the later.
The argument that most of this started under Jobs is valid. True. But like it was commented he was dealing with an illness and it’s unknown just how much involvement he had. This is obviously just my view of the land and my perspective is my own. YMMV.