Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

twitter.com

Post reply on HN
Print view View original

561–570 of 649 posts

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#561

Post by vladvasiliu »

nicoffeine wrote: post #380
oatmealsnap wrote: post #258

Earlier quoted context omitted.

Same experience. I tried, but Linux just isn’t ready to be used as a general OS right now. I’ve dug through message boards and bug reports, and a lot of the features that MacOS has will never be implemented. I’m taking about features released 13+ years ago on OS X 10.4.

I'd be interested in the features that you were missing as well. I just bought parts for a desktop that's literally 4x cheaper than a similarly specced Mac Pro with the usual caveats (Ryzen instead of Xeon, non ECC, etc.) It will have to be pretty rough for me to consider investing anything beyond a Mac Mini so I can have access to Xcode once my MBP dies.

In my experience it's mostly "convenience" / "nice to haves" related to "modern things" such as entertainment. Of course, this excludes any specialty software you may need that may be unavailable for Linux, but I suppose that's not your case since you're considering this.

For example changing from a low-resolution (non-hidpi) screen to a hidpi one doesn't work that great. You want to watch netflix or prime video in FHD? Not going to happen (although, admittedly, that's not linux's fault but a DRM-related decision).

I've noticed that, as usual, all this is highly dependent on what one does with the computer. If it's a laptop often used with a high resolution external screen and for on-line media consumption, the experience can be less than ideal. If it's a working computer used in fixed conditions, the experience can be outright great. My "work" computer is a desktop linux with a UHD screen and I absolutely love working on it. But for random hanging around on the internet, watching a movie or whatever, I'll grab my macbook.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#562

Post by mindfulhack »

dhaavi wrote: post #394
bitobserver wrote: post #281

For anyone that wants to switch to Linux and retain similar functionality as this firewall app, there is this: https://github.com/gustavo-iniguez-goya/opensnitch

There is another - and I'd argue better - alternative for Linux and Windows: Portmaster by Safing https://safing.io/portmaster/ Not only is it an application firewall, but also gives you DNS filtering (ie. Pi-Hole basics) and DNS-over-TLS. Full Disclosure: I'm one of the founders.

But has it added pop-up per-app (and then per domain/port/ip) block/allow functionality in the Linux DE GUI yet? Thanks to your whole team for the awesome work.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#563

Post by saagarjha »

matheusmoreira wrote: post #539
LocalH wrote: post #233

Earlier quoted context omitted.

I find it interesting how the needs of legitimate security mesh so well with the industry desires to kill off general-purpose computing for the majority of users

User freedom means being able to command our computers to do anything , even if it's against the law or against the business interests of corporations. A free computer is by definition hostile to corporations and governments since it can be used against them. Security as an industry is generally all about protecting the interests of corporations and governments. Just look at how they react when normal people use subv…

> Security as an industry

…is not a monolith. There are plenty of people in security interested in giving you freedom as a user, actually, many do it specifically for that reason.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#564

Post by gsteiner »

eptcyka wrote: post #21

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…

What's the DNS name and type that gets looked up?

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#565

Post by unicornporn »

3pt14159 wrote: post #6

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that…

> Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed.

Wouldn't say I'm that smart. Wouldn't call myself a developer either. But I'm still kind of dismayed. I used to love macOS (or OS X to be precise), but the clock has been ticking for years now. Near every decision made about macOS future goes in the wrong direction (for me). Right now I'm looking at Manjaro. But still, I need the Adobe CC suite to get my work done, so I will have to use two machines. I hate running two computers. But that's probably where I'll end up.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#566

Post by saagarjha »

vaxman wrote: post #553
vaxman wrote: post #512

Earlier quoted context omitted.

If they can circumvent system security for their own purposes (even though I’m sure it wasn’t planned to be that way), then they should be open to circumventing it for our country (by backdoor-ing their encryption), at least that is how I would imagine it will be referenced in the inevitable government lawsuit. What a major screw up Apple!

How dare the guy with over 40 years on the job think such things! (What, are there like under 500 of us left?) Downvote him into retirement!! (what’s that? He STILL isn’t old enough to use the senior menu at IHop? Omg he might know something about Apple he didn’t read on a blog post!) Point being that people who actually need their reputation on here in order to maintain employment are fully suppressed, which means t…

I’m having trouble understanding your comment, but it sure sounds a lot like complaining about downvotes–that’s usually not well received.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#567

Post by saagarjha »

mlindner wrote: post #391
Wowfunhappy wrote: post #85

Earlier quoted context omitted.

> Apple hasn't weakened the security of their devices to provide a secret way in, in fact, they made their systems even more robust. I'd consider poking a hole in firewalls to be providing "a secret way in", particularly in the context of Little Snitch. This isn't some antivirus bloatware that comes preinstalled, or a firewall imposed by corporate networks. The entire pitch of Little Snitch is that it enables you , t…

ANY firewall inherently trusts the OS of the device it's running. They have to in order to function. The firewall sits on top of the OS, not underneath it. Even on Linux if you're running ipfw, the traffic first goes through the OS and then to your firewall.

There is trust and there is visibility. Here’s an alternative example I actually do quite often: I attach debuggers and such to system processes. Not because I don’t trust them to not do something malicious, but knowing what they are doing is always useful to me. If Mail is randomly reading files from my Documents folder, perhaps something is wrong with it. Maybe I should just tell it that I can’t look there and see why it might be doing so. These are things that give me more control over my system, not things I engage in because of a lack of trust.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#568

Post by saagarjha »

sjwright wrote: post #545
_abox wrote: post #361

Earlier quoted context omitted.

Who cares about the world.. I just want full access to the system I paid for. This should always remain an option.

Depending on your definition of "full access", you probably haven't truly had that for decades—on any broadly available computing system at least.

Regardless of whether that want is feasible today, having something that gets closer to it is clearly the goal.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#569

Post by silentOpen »

Godel_unicode wrote: post #475
3pt14159 wrote: post #185

Earlier quoted context omitted.

Yes I agree with your first part. There are real drawbacks. But it's like installing a custom HTTPS cert in your OS to inspect potential traffic that malware may use through, say, a Google Doc or Sheet. It's helpful to true professionals dealing with highly sensitive information, but it's ultimately a bigger source of compromise for the vast majority of software users. I don't think there is an easy answer here. That…

Absolutely not, installing a CA makes attacks which weren't previously possible now possible. A host firewall isn't doing anything a network provider (read: your ISP, coffee shop, vpn provider, etc) couldn't already do. At least you can possibly look at what the host firewall is doing.

It depends on the host firewall... many quality operating systems allow host firewalls to apply process-based policy which your upstream certainly can’t achieve.

Re: Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

#570

Post by mindfulhack »

dylan604 wrote: post #346
stallmanite wrote: post #340

Earlier quoted context omitted.

Dumb question: How does this differ from setting the view in the file selector to thumbnails?

Thumbnails might work for a folder of images. However, QuickLook will also allow you to preview a video, Word Doc, PDF, spreadsheet, and text files including source code. It's honestly my favorite feature of the OS. Trying to attach a file to an email, but not sure it's the right one? QuickLook allows you to view the document in the Open dialog. Once you use it, it is something you will just accept as natural and onl…

Linux Mint Cinnamon has this feature, with package `nemo-preview`. It even plays back actual video when spacebar'ing on an MKV file, something I can't do in macOS!
Post reply on HN