Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

371–380 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#371

Post by toast0 »

novok wrote: post #338
dwrodri wrote: post #94

Earlier quoted context omitted.

The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).

He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.

> I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.

DoH isn't really going to look like https, the requests and responses are going to be too small.

If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#372

Post by ineedasername »

brlewis wrote: post #223
ineedasername wrote: post #90

Earlier quoted context omitted.

What's the alternative for the typical user? Windows has its own problems, and let's face it: market forces on this sort of thing or any other practices by the two of them have not driven people to use desktop Linux instead. For most people, there's simply no reasonable option to switch to that would avoid these things or employ market forces to get these companies to change their ways.

Are you saying that because large numbers of typical users have not yet switched to desktop Linux, we can conclude that desktop Linux is not a reasonable option they can switch to?

No, the fact that Linux is not currently a practical option for most users isn't proof that it can't be or never will be.

I am saying the lack of desktop adoption is indicative of the difficulties of doing so. There is a level-of-effort barrier and technical-knowledge barrier to it. 20 years of progress have lowered those barriers a lot, but even if something like Ubuntu will often be fully functional with a standard install, most users never have to install an OS. They can't walk into Best Buy and come out with a computer that runs desktop Linux.

I think the success of Chrome Books show that people would be receptive to alternative operating systems, but we don't have a retail or post-purchase support environment in place to facilitate it, and I don't see that coming on the horizon.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#373

Post by dylan604 »

hombre_fatal wrote: post #314
dylan604 wrote: post #205

Earlier quoted context omitted.

I have a 2017 MBP. There are several keycaps that that are no longer physically connected to the key, so if I tilt the laptop 4 or 5 keys fall off. I have been dealing with it by using an external Apple keyboard (with added benefit of having 10-key and full sized arrow keys). Since it's on a desktop in this config, I have it set to never sleep so luckily I have not seen this unwakeable fuck up.

Apple has a three year warranty which means yours may have run out or is about to run out. If you still have time, get your keyboard replaced for free: https://support.apple.com/keyboard-service-program-for-mac-n... (it also means they have to replace your mobo and battery due to brilliant Apple engineering). It doesn't fix the problem, but it resets the clock until they fall off again. In Texas, it was <48 hours bet…

I just followed your link, and had an interesting experience. Of all of the Apple Stores and Authorized Repair they do not appear to be accepting repairs. Everyone of them tell me: "This location has no available reservations. You can check another location now, or check this location again tomorrow."

Can't even get far enough to see if the repair would be covered. Good job Apple

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#374

Post by Siira »

derrick_jensen wrote: post #359
grishka wrote: post #299

Earlier quoted context omitted.

> I appreciate the desire at making a device difficult for a bad actor to get to your data That's what FileVault is for. I don't understand what's the problem T2 is trying to solve by its existence. Being able to use something else to read the data from a drive you pulled out of your computer, after decrypting it with your password, is a feature, not a bug. T2 is a regression, not an improvement in security. You can'…

One of the value props was the inability to reset and resell if it were lost or stolen. Now that it’s cracked there is more of an incentive to not try and find the owner. As for actual data security you are probably right

Is the crack in hardware or software? Any links on it? I thought the iPhones at least could not be reset by thieves?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#375

Post by userbinator »

AnonHP wrote: post #37

I trust Apple a lot more than I trust Google or Facebook, but this clamping down of the Mac without options for power users while officially stating that the Mac will remain a Mac is alarming and distasteful on the part of Apple. With the transition to Apple’s own chips looming, it seems like the days of “a Mac is a personal computer and not an app console like an iPhone or iPad” will be over by the middle of this de…

Apple's authoritarian control-freak mentality has been around since the original Macintosh of the 80s. It was only a coincidence that moving to x86 opened up some freedom. Now it's just moving in the same direction Apple always was.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#376

Post by xondono »

capableweb wrote: post #131
AnonHP wrote: post #37

I trust Apple a lot more than I trust Google or Facebook, but this clamping down of the Mac without options for power users while officially stating that the Mac will remain a Mac is alarming and distasteful on the part of Apple. With the transition to Apple’s own chips looming, it seems like the days of “a Mac is a personal computer and not an app console like an iPhone or iPad” will be over by the middle of this de…

People keep saying "I trust company X a lot more than I trust company Y" but is "trust" really something that applies to companies at all? Feels weird to humanize companies in that way. If you trust a company, isn't it really that you trust the humans working at that company? So you should really say "I trust person X who happens to work at X today", as as soon as they leave, the trust went with them. Companies are n…

Not necessarily, you might trust the intangibles that are part of the company, like how do they do business or what kind of internal policies they have in place.

Think how (knowledgeable) people “trust in science”, they don’t trust the humans, they trust the method.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#377

Post by e28eta »

commandlinefan wrote: post #276
eptcyka wrote: post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

I was trying to figure out how my routing table was set up on my iPad and I found out that iOS doesn't expose any interface to routing tables, at any level of privilege. Very frustrating.

I think this is probably wrong. I don’t know what the interface is, but on my iPad running 14.0.1 this app shows a Routing Table that looks okay to me. https://networktools.he.net/

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#378

Post by Wowfunhappy »

sroussey wrote: post #189
metroholografix wrote: post #42

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…

“folks that want full control over their operating system” and “walware authors” want too much of the same thing. I think everyone would appreciate ideas for solutions.

Require the user to authenticate, then provide full control? Yes this provides a vulnerability pathway, but it's not like Apple software updates don't already provide this type of access.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#379

Post by ignoramous »

rsync wrote: post #358
buzzerbetrayed wrote: post #34

Earlier quoted context omitted.

Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.

Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as i…

> Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS.

Doesn't that relegate your recursive resolver to a stub?

You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/

I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#380

Post by nicoffeine »

oatmealsnap wrote: post #258
kitsunesoba wrote: post #169

Earlier quoted context omitted.

I try the major DEs every few years to see if they fit me, most recently trying the newest KDE and GNOME versions in a VM about a month ago. Both have improved for sure, but they still have a long way to go… GNOME actually came closest but its customizability level is even lower than that of macOS, even factoring in extensions. Both suffer from a laundry list of minor annoyances that snowball into something that's ha…

Same experience. I tried, but Linux just isn’t ready to be used as a general OS right now. I’ve dug through message boards and bug reports, and a lot of the features that MacOS has will never be implemented. I’m taking about features released 13+ years ago on OS X 10.4.

I'd be interested in the features that you were missing as well.

I just bought parts for a desktop that's literally 4x cheaper than a similarly specced Mac Pro with the usual caveats (Ryzen instead of Xeon, non ECC, etc.) It will have to be pretty rough for me to consider investing anything beyond a Mac Mini so I can have access to Xcode once my MBP dies.

Post reply on HN