Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

421–430 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#421

Post by Spivak »

tpxl wrote: post #412
Wowfunhappy wrote: post #318

Earlier quoted context omitted.

> I mean the irony is when it comes to browsers you see the general tone of HN shift to the opposite opinion when it comes to features like, RTC, USB, Bluetooth, Filesystem Access. I don't think it's that ironic. From my vantage point, the big tech companies specifically and consistently invoke the security arguments that are best aligned with their agendas. • We need to enforce automatic Windows 10 updates to keep y…

>hiding URLs does protect users from phishing Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.

Because it's not really "hiding the URL" despite what all the outrage bloggers tried to make it seem. It's by default (i.e. until you tap/click it) hiding the parts of the URL that the site controls. So paypal.amazon.citibank.scamsite.biz/secure/login/trustus will just show scamsite.biz.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#422

Post by [deleted] »

bredren wrote: post #383
capableweb wrote: post #131

Earlier quoted context omitted.

People keep saying "I trust company X a lot more than I trust company Y" but is "trust" really something that applies to companies at all? Feels weird to humanize companies in that way. If you trust a company, isn't it really that you trust the humans working at that company? So you should really say "I trust person X who happens to work at X today", as as soon as they leave, the trust went with them. Companies are n…

Think of companies more like nation states than people and it will make more sense. The organization is still molded heavily by those in power, but it is what the organization “stands for” that you must put your trust in. For example, the United States is a republic and stands for “freedom and justice for all.” As we have seen, different people in leadership will interpret these foundational ideas differently and wil…

[deleted]

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#423

Post by greycol »

tpxl wrote: post #412
Wowfunhappy wrote: post #318

Earlier quoted context omitted.

> I mean the irony is when it comes to browsers you see the general tone of HN shift to the opposite opinion when it comes to features like, RTC, USB, Bluetooth, Filesystem Access. I don't think it's that ironic. From my vantage point, the big tech companies specifically and consistently invoke the security arguments that are best aligned with their agendas. • We need to enforce automatic Windows 10 updates to keep y…

>hiding URLs does protect users from phishing Real question: how? I would expect it to be the opposite, a perfect phishing site will have the wrong URL.

google.com.evilwebsite.example?=google.com

Oh that has google in it (twice even) we can go there.

There's also arguments that URLs are too complex for normal people to understand.

I agree with you though, hiding or redirecting URLs is the opposite of protecting users from phishing.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#424

Post by dhaavi »

ignoramous wrote: post #379
rsync wrote: post #358

Earlier quoted context omitted.

Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as i…

> Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.

Nice. Do you have any more info on that resolver of yours?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#425

Post by centimeter »

eptcyka wrote: post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

> your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard.

Holy shit, this is why my macbook sometimes won't let me log in for like 15 seconds on my shitty cellular hotspot connection? Absurd. Apple software has fallen so far from just 10 years ago.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#426

Post by yayr »

gowld wrote: post #410
comboy wrote: post #400

Earlier quoted context omitted.

The decision is questionable, but you can always inspect traffic from the machine outside it, I would even say that's preferable in context of malware.

Can you recommend a portable wifi firewall? Based on Raspberry Pi, perhaps?

saw the GL.iNet+GL-MT300N-V2 recently - have not bought it yet, maybe it's time if it's good

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#427

Post by Wowfunhappy »

mdoms wrote: post #298
coldtea wrote: post #13

Earlier quoted context omitted.

They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...

I trust my friend Mike to drive me to the pub. I don't trust Mike to be the executor of my will.

And also, you might be uncomfortable if Mike blacked out all the windows.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#428

Post by Wowfunhappy »

userbinator wrote: post #375
AnonHP wrote: post #37

I trust Apple a lot more than I trust Google or Facebook, but this clamping down of the Mac without options for power users while officially stating that the Mac will remain a Mac is alarming and distasteful on the part of Apple. With the transition to Apple’s own chips looming, it seems like the days of “a Mac is a personal computer and not an app console like an iPhone or iPad” will be over by the middle of this de…

Apple's authoritarian control-freak mentality has been around since the original Macintosh of the 80s. It was only a coincidence that moving to x86 opened up some freedom. Now it's just moving in the same direction Apple always was.

I'm not entirely sure what's leading you to this conclusion. The original Macintosh had no privileges system and let apps write to random bits of memory. It was quite problematic for multitasking, in fact.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#429

Post by [deleted] »

pier25 wrote: post #420
threatofrain wrote: post #389

Earlier quoted context omitted.

Big entities probably make up 99% of the firewall market today, and for those who currently want firewalls, it makes far more sense to have independent hardware. The use case for an end user managing their firewall experience with a 3rd-party software-based firewall AND who also wish to monitor Apple traffic is very niche. For the overwhelming portion of the population, I would be more worried about the MacOS securit…

> In my view, MacOS is the biggest security hole in Apple's ecosystem. Is it? Can you elaborate?

[deleted]

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#430

Post by codezero »

eptcyka wrote: post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

The keyboard thing is new to me, wow that sucks. The other one sounds like a workaround for captive portals. I think there is some documentation on that wrt Safari and the built in networking, but it was mostly a workaround needed to deal with wifi hotspots that intercept dns until you pay/subscribe, and it causes safari to look hung - so they had to make it clear it wasn’t their browser hanging since it couldn’t make SSL connections.
Post reply on HN