Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

431–440 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#431

Post by Fnoord »

novok wrote: post #324
adambatkin wrote: post #121

Earlier quoted context omitted.

Linux on the desktop and Linux on the laptop (heh) has definitely improved. It _sometimes_ needs a little tweaking to get it right, but KDE/Plasma also happens to offer that level of "tweakability" that should satisfy almost all semi-mainstream users (at least anyone coming from Windows or Mac). Compared to my first Linux laptop (a Sony Vaio circa 2000), my current XPS 13 works as well as any Mac laptop I have ever o…

Is there a 'little snitch' for desktop linux with the speed of it's UI in setting networking rules?

There's OpenSnitch [1].

[1] https://github.com/gustavo-iniguez-goya/opensnitch

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#432

Post by Wowfunhappy »

m3kw9 wrote: post #117

Maybe if you block it randomly renders your OS inoperable and you won’t know why. Example iCloud login, could be a few obscure network calls. You would then call Apple and ask wtf if you are some noob blocking everything. This isn’t old days where there could be zero dependence on the net for critical function.

This is one of the key purposes of the Apple Store. The Genius Bar would help you test on a clean account or do a full wipe — although, Little Snitch is well-known enough that I'd expect an Apple Store employee to recognize it pretty quickly.

I suppose it's theoretically possible they're trying to drive down support costs. But, geez, that would make me much more scared about the direction Apple is taking than anything else.

Really though, Little Snitch is quite explicit about what it does. It's also $40, and it's marketed to a pretty technical audience.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#433

Post by addicted »

threatofrain wrote: post #77
addicted wrote: post #30

Earlier quoted context omitted.

In this situation the question isn’t about whether or not Apple can be trusted. Apple has clearly betrayed users’ trust in this situation. People don’t install Little Snitch only to prevent nefarious third party activity. Some may want to know what traffic is going to and from their computers. Other may want to block all traffic for testing and/or research purposes. I can trust that Apple is not doing something nefar…

> any backdoors Apple builds for its own apps Apple hasn't weakened the security of their devices to provide a secret way in, in fact, they made their systems even more robust. The question absolutely is whether Apple can be trusted. Little Snitch works for other apps, just not Apple's apps. The remaining slice of the pie you're arguing for is whether or not we can trust Apple. So what delta in security and trust ove…

Bottom line is that Apple made software like Little Snitch switch away from kexts and then built in behavior that was unexpected, which would not have been possible for them to do while Little Snitch was based on kexts.

Whether this is malicious, not malicious, secure, insecure etc. is irrelevant to whether this is an untrustworthy action. It’s not what one would reasonably expect and is therefore a betrayal of users’ trust.

If Apple switched gatekeeper on MacOS to completely remove the option and the workarounds to run unsigned apps, it would certainly be more secure. It would also be a huge betrayal of users’ trust in Apple and the MacOS platform.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#434

Post by Sporktacular »

Wowfunhappy wrote: post #8
3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

5 years ago I found LS was unable detect any traffic out of a VMWare virtual machine running on the same Mac. Sure the VM is running through some installed virtual network adapter, but if that's all it takes an attacker can set up one of her own. Cool Hollywood interface but I gave up on LS as a serious security tool right there.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#435

Post by Sporktacular »

coldtea wrote: post #13
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...

Trust but verify. Now we must do the former without being able to do the latter.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#436

Post by ineedasername »

fsflover wrote: post #408
ineedasername wrote: post #390

Earlier quoted context omitted.

The key thing there is that you installed the OS. You're saying there's little difficulty in using the OS, but that isn't what I mean when I say it's not a practical option. The core problem is that the average person doesn't know how and wouldn't be comfortable taking that step, even if it's pretty easy once you know how. You have also made yourself their support person. They can't bring their computer to Best Buy o…

https://news.ycombinator.com/item?id=24840166

None of those options are viable for mass market adoption right now. They are niche operations that are practically invisible to anyone outside of the industry. I didn't say you can't buy Linux pre-installed, I said you can't go into a big-box store like Best Buy to do so, and that there's no significant consumer support infrastructure.

There's also the strong possibility that at least some of these places won't exist anymore at some time over the lifetime of the computer. Purism is only a few years old, with ~ $1million in revenue/year. It uses its own flavor of Linux, meaning support options are extremely limited. System76's website is itself half-broken, with 500 errors when I attempt to customize a system.

You cannot point to niche operations and claim it to be a viable mass-market option. I'm not saying it isn't possible to get there, I'm saying it doesn't exist today, which means it is not an option for mass-market consumers. If tomorrow a million Apple users said "Enough! LittleSnitch is the straw that breaks the camel's back!" and decided they wanted to shop for a desktop linux system, the market couldn't handle it.

Remember, I'm not saying Linux can't be successful on the desktop, I'm saying that it is not a mass-market option right now for users frustrated with Windows/OS X.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#437

Post by Dylan16807 »

api wrote: post #52
Skunkleton wrote: post #44

Earlier quoted context omitted.

> They say they want free as-in-freedom, but since they are not willing to pay for it they don't exist. Only paying users matter. Citation needed. If you look at app store pricing models the opposite seems true. If I were going to take a random guess I would say that tech savvy users use open source software to avoid anti-consumer bullshit more than anything else.

If enough people said to Apple "hey, this stuff is not acceptable and we won't pay for it" and then they actually did follow through, Apple would stop. My point is that the vast majority of people don't say that, only a very tiny minority. The vast majority of people want convenience, not control. They want their stuff to "just work" because even if they do have the technical knowledge they don't have the time to scr…

> Basically what it boils down to is that people don't actually care. Even the vocal people who say they care don't care because they won't open their wallets or change their buying habits. If you won't actually do anything about something, you don't care. Whining on the Internet is not doing something.

People aren't buying features off a list. In a situation like this a missing feature has to be so important that it completely disqualifies the product, which is a very different thing from a willingness to open the wallet.

It's similar to how you can get a kindle with or without lock screen ads. If the only option was with ads, you'd see more people buying that version because it becomes artificially hard for them to say "I don't want ads". Even though they're willing to pay for the feature.

And for convenience vs. control, well, this firewall bypass doesn't help convenience.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#438

Post by _qulr »

Sporktacular wrote: post #434
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

5 years ago I found LS was unable detect any traffic out of a VMWare virtual machine running on the same Mac. Sure the VM is running through some installed virtual network adapter, but if that's all it takes an attacker can set up one of her own. Cool Hollywood interface but I gave up on LS as a serious security tool right there.

I can't speak about 5 years ago, but I was using Little Snitch with VMWare last year, and it worked. I had to specifically allow the VMWare process.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#439

Post by Ensorceled »

joncp wrote: post #32

That totally breaks my use case for Little Snitch: working tethered. When I tether my laptop it thinks it has free reign with the bandwidth and all of the little background processes can kill my data in a few minutes. With a firewall, I can grant access to only the processes that I need to get my work done. Now, I guess I have to run some external firewall between my laptop and my phone. ... or better yet, abandon Ap…

Yeah, I tethered my MBP on the train and it used my entire 4GB data plan in about 15 minutes downloading an OS update.

Glad to know stopping shit like that is no longer an option.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#440

Post by DiederikvandenB »

Sporktacular wrote: post #435
coldtea wrote: post #13

Earlier quoted context omitted.

They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...

Trust but verify. Now we must do the former without being able to do the latter.

You can very easily monitor all outgoing traffic through an external device.
Post reply on HN