Earlier quoted context omitted.
I'm not a "typical" user so i dont care.
So basically you provided a suggestion that only works for you.
[deleted]
Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
411–420 of 649 posts
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#412Earlier quoted context omitted.
I mean the irony is when it comes to browsers you see the general tone of HN shift to the opposite opinion when it comes to features like, RTC, USB, Bluetooth, Filesystem Access. These are all features that give users more power but it's (apparently) easier to see the downsides and how these features can and are used maliciously. Now put yourself in the Apple's position where "an iOS app" or a "mac App" is about as t…
> I mean the irony is when it comes to browsers you see the general tone of HN shift to the opposite opinion when it comes to features like, RTC, USB, Bluetooth, Filesystem Access. I don't think it's that ironic. From my vantage point, the big tech companies specifically and consistently invoke the security arguments that are best aligned with their agendas. • We need to enforce automatic Windows 10 updates to keep y…
>hiding URLs does protect users from phishing
Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#413Earlier quoted context omitted.
I'm not a "typical" user so i dont care.
Then you have provided a solution that is not generalizable. Which is fine, but not particularly useful to this conversation.
Use Linux or any other free OS, personal preferences are normaly not generalizable.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#414Earlier quoted context omitted.
Adobe doesn't care to support Linux. It's as simple as that.
That's an obvious drive by answer, but I'm asking a forum of developers for an explanation/guess on what it is about Linux that would make Adobe not care about it.
The reasons that game developers give should be instructive:
- "Linux" is not a unified desktop environment, there are many different configurations and supporting such variety is difficult. The Linux desktop landscape also changes more frequently than most (eg. Pipewire & Pulseaudio, Xorg & Wayland, Snap & Flatpak & AppImage & native distro package managers) which requires more development resources to keep up with.
- But suppose you try to cut costs by supporting only one blessed Linux configuration and constrain your Linux development budget. You still have another cost that you can't avoid: customer support, which is very expensive. It's especially expensive when you get a lot of Linux users who don't know or care that you technically only support one blessed Linux configuration, they'll have some wacko configuration and they'll take the time to complain to your customer support agents about it. Your constrained Linux development budget will only exacerbate your customer support costs as more users run into Linux bugs more often.
- Which isn't worth it because you know that Linux has a small user base. The actual sales bump you get from Linux support isn't worth the cost of maintaining it.
Frankly, I don't think Linux will ever solve the problem of a small user base. No one working on Linux cares enough about the normal-person-UX of its desktop to make it good enough for a majority of people to use, and many current Linux users even oppose measures that would trade off the power & flexibility that they enjoy now for normal-person-UX. This isn't going to change because Linux is largely a volunteer-led project.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#415Earlier quoted context omitted.
If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.
If you don’t trust Apple then you need something more than little snitch. Apple is responsible for both hardware and OS. What delta in security or trust is little snitch going to offer over Apple?
You're overloading "trust". I think most people trust Apple not to be malicious, but that doesn't mean they trust apple to omniscient and perfect.
A back-channel that you can't inspect but Apple can use is a back-channel that you can't inspect but malicious actors have found a way to use waiting to happen. Preventing you from seeing that traffic doesn't protect you, only protects Apple at your expense, since you have no way of detecting whether something fishy is going on.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#416Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…
Another reason why I'm going to stick with Linux for the foreseeable future. I just wish the font rendering situation on Linux was better though. Text (in browsers) just looks so bad on Linux compared to both Windows and mac.
No, it's fine, just needs a bit of tweaking: https://aswinmohan.me/posts/better-fonts-on-linux/
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#417Earlier quoted context omitted.
> Apple hasn't weakened the security of their devices to provide a secret way in, in fact, they made their systems even more robust. I'd consider poking a hole in firewalls to be providing "a secret way in", particularly in the context of Little Snitch. This isn't some antivirus bloatware that comes preinstalled, or a firewall imposed by corporate networks. The entire pitch of Little Snitch is that it enables you , t…
ANY firewall inherently trusts the OS of the device it's running. They have to in order to function. The firewall sits on top of the OS, not underneath it. Even on Linux if you're running ipfw, the traffic first goes through the OS and then to your firewall.
Yes, but as a user, I expect the OS to behave in a transparent manner. If the OS provides a firewall API, I expect it to send all traffic through firewalls that use that API, not selectively redirect traffic from certain apps or domains.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#418Earlier quoted context omitted.
Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!
If you're using Cisco Anyconnect, blame that for that particular keyboard issue.
So I'm not the only one?! Holy I thought I was going crazy, dropping out of the VPN meant a ten second freeze until a couple of weeks ago. Do you have any additional sources?
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#419Earlier quoted context omitted.
Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
> My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too.
IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage.
I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.
Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur
#420A bit contradictory with Apple's supposedly privacy-focused approach, no?
Big entities probably make up 99% of the firewall market today, and for those who currently want firewalls, it makes far more sense to have independent hardware. The use case for an end user managing their firewall experience with a 3rd-party software-based firewall AND who also wish to monitor Apple traffic is very niche. For the overwhelming portion of the population, I would be more worried about the MacOS securit…
> In my view, MacOS is the biggest security hole in Apple's ecosystem.
Is it? Can you elaborate?