Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

471–480 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#471

Post by abhinav22 »

coldtea wrote: post #13
Wowfunhappy wrote: post #8

Earlier quoted context omitted.

If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.

They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...

Great comment - agree 100%

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#472

Post by Godel_unicode »

3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

If the data is so poorly protected in transit that a firewall app on the system is a concern, something has gone very wrong indeed. It's just going to see that your Apple services on your Apple device are speaking to Apple servers.

There's an availability consideration here, but that's about it.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#473

Post by admax88q »

If Microsoft did this in windows, or Google did this in chrome, would we see so much defense of this strategy? Or could it be those rose coloured glasses that HN tends to view Apple through.

Or more like "users are literally brain dead and cannot be trusted to change the channels on their TV" coloured glasses. If you only trust your users to watch TV, then get into TVs instead of computers.

We don't fault the maker of a drill when a careless user drills a hole in their hand. We fault the user for being careless. At what point do we start doing the same for computers? The advantage of physical power-tools is that their mechanism of operation is readily apparent, open, understandable, predictable. If Apple really cares about their users, they should start investing in making software open, understandable, predictable. This is a much harder problem, and probably less profitable, than just building another TV, but I'd rather live in that world than this one. I don't need another TV.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#474

Post by aftbit »

Chrome exempts Google properties from rules? Unacceptable!

macOS exempts Apple apps from rules? Protecting users!

Seriously, it's my machine. I should have top permissions on it, not Apple. If I chose to run an app that intercepts traffic, I want it to intercept _all_ traffic. What's next, making it impossible to hook a debugger to Apple services? Or did they already do that?

As much as I love Mac & iPhone UX, stuff like this will keep me off them and keep me from recommending them to anyone either.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#475

Post by Godel_unicode »

3pt14159 wrote: post #185
ballenf wrote: post #18

Earlier quoted context omitted.

I'd argue this opens up a giant attack surface where malicious software will try to route its command and control communication through a protected service. Do we really want to trust that Apple will keep all 50+ of these privileged services fully protected? I think it makes the "world" slightly worse in that it will be harder to discover malware. Little snitch has a small user base, but it's been used to identify ma…

Yes I agree with your first part. There are real drawbacks. But it's like installing a custom HTTPS cert in your OS to inspect potential traffic that malware may use through, say, a Google Doc or Sheet. It's helpful to true professionals dealing with highly sensitive information, but it's ultimately a bigger source of compromise for the vast majority of software users. I don't think there is an easy answer here. That…

Absolutely not, installing a CA makes attacks which weren't previously possible now possible. A host firewall isn't doing anything a network provider (read: your ISP, coffee shop, vpn provider, etc) couldn't already do. At least you can possibly look at what the host firewall is doing.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#476

Post by indymike »

jjoonathan wrote: post #288
indymike wrote: post #70

Earlier quoted context omitted.

I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).

How is desktop search? Spotlight (mac desktop search) is a killer feature for me -- fast, reliable, smooth, all straight out of the box. Meanwhile, I've wasted many hours trying to get desktop search up to the same standard on Windows and Linux. That was years ago (for linux, at least), hopefully things have improved. How is linux desktop search doing today?

KDE's search is very, very fast and at least on the latest KDE, just works.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#477

Post by [deleted] »

dylan604 wrote: post #284
jaywalk wrote: post #274

Earlier quoted context omitted.

Adobe doesn't care to support Linux. It's as simple as that.

That's an obvious drive by answer, but I'm asking a forum of developers for an explanation/guess on what it is about Linux that would make Adobe not care about it.

[deleted]

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#478

Post by radlad »

likeclockwork wrote: post #402
radlad wrote: post #286

Earlier quoted context omitted.

I think you misunderstand. The idea is that if your keyboard is replaced with a keyboard that has modified (hacked) firmware, your computer will refuse to let you use it. To do this, it must obtain a cryptographic attestation from the keyboard firmware, proving that it has not been modified. Further, to avoid replay attacks it must include the current time in the message it signs. NTP is used by macOS to determine th…

What happens if you have networking turned off or your WiFi isn't configured for the local network?

Per the grandparent...

> At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#479

Post by radlad »

Dylan16807 wrote: post #448
radlad wrote: post #286

Earlier quoted context omitted.

I think you misunderstand. The idea is that if your keyboard is replaced with a keyboard that has modified (hacked) firmware, your computer will refuse to let you use it. To do this, it must obtain a cryptographic attestation from the keyboard firmware, proving that it has not been modified. Further, to avoid replay attacks it must include the current time in the message it signs. NTP is used by macOS to determine th…

> Further, to avoid replay attacks it must include the current time in the message it signs. Use a counter...?

I'm not trying to defend Apple here, just explain the mechanism to the parent.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#480

Post by dylan604 »

mcyukon wrote: post #406
jasonv wrote: post #193

Earlier quoted context omitted.

I have an aging MacBook Air (works great for 99% of the things I want to do), an aging iPad Pro, and an iPhone XR. I probably am in the market to replace them in that order. I just bought my son a Lenovo laptop because he needed Windows. I'm dismayed at where Apple is going, so I'm considering a Dell Linux laptop as my daily driver. I need to do some video editing, so for a while I'll use my son's laptop, and possibl…

I'm in the same boat, just more from a Photography standpoint. Oldest Mac I own is a 2012 MBP and I really do not see any appeal in any of the newer machines. I built myself fairly high end Mini ITX Windows machine for a fraction of what a comparable Mac would cost. Only downside is having a somewhat bigger PC on my desk. For video editing I was very surprised at how quickly I picked up / understood the Free version…

The one thing the newer machines have are better discrete GPUs. Everything now will use the GPU from web browsing to full on video/photo editing and color correction. Your 2012 GPU might as well be hanging out with Moses its so old in GPU years. The speed difference you'll see in a photo edit standpoint will justify your upgrade. If you are even halfway serious about using Resolve, you cannot put enough GPU power in a box. (I've built Resolve desktop systems with 3 GPUs in a Mac PCIe external chasis. PCs/Linux Resolve systems can have even more GPUs.)
Post reply on HN