Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

381–390 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#381

Post by a1369209993 »

fsflover wrote: post #220
gabereiser wrote: post #128

Earlier quoted context omitted.

>No not really, but limited is the mindset of peoples. I'd argue options really are limited. Your counter argument assumes one can just roll their own OS with the same features and functionality as current-gen OS's. That's quite a leap. Options today are Windows, Mac, or some flavor of Linux if you can get it to work. Linux aside, Windows and Mac both are making it so you no longer own the OS but are "subscribed" to…

> or some flavor of Linux if you can get it to work Do not try to get anything work. Just buy preinstalled.

Buy preinstalled from where, exactly?

(And no, chromebooks are not linux for any practical purpose, although they probably would be easier to install a real linux system on.)

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#382

Post by udev »

eptcyka wrote: post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

That's how typical Apple "magical/just works" features are implemented, i.e. very ugly behind the curtain.

Documenting means revealing the edge cases and the limitations, which engineering knows is the best kind of documentation. But marketing people are invested in the "magic".

Marketing people have too much sway at Apple.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#383

Post by bredren »

capableweb wrote: post #131
AnonHP wrote: post #37

I trust Apple a lot more than I trust Google or Facebook, but this clamping down of the Mac without options for power users while officially stating that the Mac will remain a Mac is alarming and distasteful on the part of Apple. With the transition to Apple’s own chips looming, it seems like the days of “a Mac is a personal computer and not an app console like an iPhone or iPad” will be over by the middle of this de…

People keep saying "I trust company X a lot more than I trust company Y" but is "trust" really something that applies to companies at all? Feels weird to humanize companies in that way. If you trust a company, isn't it really that you trust the humans working at that company? So you should really say "I trust person X who happens to work at X today", as as soon as they leave, the trust went with them. Companies are n…

Think of companies more like nation states than people and it will make more sense.

The organization is still molded heavily by those in power, but it is what the organization “stands for” that you must put your trust in.

For example, the United States is a republic and stands for “freedom and justice for all.”

As we have seen, different people in leadership will interpret these foundational ideas differently and will take actions accordingly.

It’s worth asking again what Apple stands for.

The company has made privacy and thus security core values. However, above that is a goal to make _the best_ products of any company, which as Jobs put it is a matter of “taste.”

So the sentiment of feeling as though Apple’s networking software and developer api choices deviate from your taste has to be measured against one’s support of these other values, and whether one believes Apple’s leadership succession will be measured and protected from weakness.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#384

Post by brimstedt »

anamexis wrote: post #137
y7 wrote: post #75

Earlier quoted context omitted.

Hear hear. All "just use an alternative" does is temporarily shift the problem. And then tomorrow an article appears highlighting Windows 10's invasive telemetry and people say "yeah just use macOS".

I think in both cases, people generally say "use Linux".

I have been using windows, apple and Linux (KDE) on a daily basis and handle all os' quite well.

KDE is by far my preference and in general I don't think neither windows nor macos has fewer problems despite the price tag.

After hearing the "it just works" mantra of apple users for many years I was surprised to find I had at least as many glitches on the Mac as I did on KDE (win 7 was better, 10 has more problems ime).

(I use my computers for development and sysadmin, not gaming or art)

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#385

Post by ignoramous »

toast0 wrote: post #371
novok wrote: post #338

Earlier quoted context omitted.

He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.

> I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, b…

> ...only allow connections to IPs that were received by DNS

Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can.

For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#386

Post by fsflover »

a1369209993 wrote: post #381
fsflover wrote: post #220

Earlier quoted context omitted.

> or some flavor of Linux if you can get it to work Do not try to get anything work. Just buy preinstalled.

Buy preinstalled from where , exactly? (And no, chromebooks are not linux for any practical purpose, although they probably would be easier to install a real linux system on.)

https://system76.com

https://puri.sm

https://www.debian.org/distrib/pre-installed

and many more.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#387

Post by Wowfunhappy »

jedberg wrote: post #3

A great example of why you need defense in depth. Ideally you'd be running the local firewall on your box, as well as an external firewall. That being said, this is not ok behavior on Apple's part. There shouldn't be a way for traffic to go around the firewall like this, even if it is just Apple apps. Because as Apple well knows, once you make a backdoor, someone will figure out a way to exploit it.

If you're on a laptop, you won't necessarily always be able to filter on the router level.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#388

Post by mlindner »

LocalH wrote: post #233
Wowfunhappy wrote: post #20

Earlier quoted context omitted.

You could (and perhaps would) make the same argument about Intel (for providing the processor) or Broadcom (for providing the wifi chip) or Comcast (for providing internet service). And it's true, all of these parties have the ability to use their positions for nefarious purposes. However, I would like to limit that potential as much as possible, partly by creating a stigma against practices that remove control from…

I find it interesting how the needs of legitimate security mesh so well with the industry desires to kill off general-purpose computing for the majority of users

There has always been a tradeoff between security and freedom.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#389

Post by threatofrain »

pier25 wrote: post #22

A bit contradictory with Apple's supposedly privacy-focused approach, no?

Big entities probably make up 99% of the firewall market today, and for those who currently want firewalls, it makes far more sense to have independent hardware.

The use case for an end user managing their firewall experience with a 3rd-party software-based firewall AND who also wish to monitor Apple traffic is very niche.

For the overwhelming portion of the population, I would be more worried about the MacOS security model. Someone's iPad or iPhone experience can only be screwed up so much and can be reset without losing data. For MacOS the stakes are a lot higher, and users are trained to enter credentials for annoying-to-audit vague permissions.

In my view, MacOS is the biggest security hole in Apple's ecosystem. Doesn't this make you wonder how Apple will handle the health app on MacOS?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#390

Post by ineedasername »

fsflover wrote: post #213
ineedasername wrote: post #90

Earlier quoted context omitted.

What's the alternative for the typical user? Windows has its own problems, and let's face it: market forces on this sort of thing or any other practices by the two of them have not driven people to use desktop Linux instead. For most people, there's simply no reasonable option to switch to that would avoid these things or employ market forces to get these companies to change their ways.

I installed GNU/Linux for my relatives and it's been working fine for years. So I would say GNU/Linux is a perfect alternative for typical users.

The key thing there is that you installed the OS. You're saying there's little difficulty in using the OS, but that isn't what I mean when I say it's not a practical option. The core problem is that the average person doesn't know how and wouldn't be comfortable taking that step, even if it's pretty easy once you know how. You have also made yourself their support person. They can't bring their computer to Best Buy or call Apple if they have a problem. We don't have the retail & support infrastructure in place for desktop Linux to be a viable option. These are the things I'm talking about when I say it's not a practical option for a typical user.
Post reply on HN