61–70 of 649 posts
Both major consumer OS vendors seem hell-bent on bringing the OS layer under their complete control. As a power user, it's very frustrating. Meanwhile "desktop" Linux still kind of sucks, just like it did 10 years ago. I don't have much hope of seeing a compelling, unified UX out of Linux in my lifetime.
That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ as an option until DNS encryption becomes widespread :/
Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.
Earlier quoted context omitted.
I should've clarified - it only does this if there is a default route. Funnily enough, whilst the firewalls in the original twitter post would possibly fail to catch this traffic, PF will block it just fine.
Having a default route does not mean the internet is reachable.
But on the other hand, there are use cases where checking for the existence of a default route is the best heuristic.
Earlier quoted context omitted.
Dont pray, just dont buy Apple Products
The alternative is what? System76 makes a decent laptop but they don’t have a repair center in every major city. I buy Apple computers because of the hardware support and integration with iPhone. Speaking of iPhone, the open options are at best abysmal for privacy (at least orders of magnitudes worse than Apple) and at worst part of planned obsolescence that creates e-waste much faster than Apple devices. Fun fact, a…
That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ as an option until DNS encryption becomes widespread :/
Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.
Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS…
I imagine it is, given the bureaucracy of a big company. Apple's documentation has long been really dreadful, mostly nonexistent and where it does exist, usually incomplete and even wrong. I've assumed it was because the code itself is developed by isolated groups while the documentation presumably has to touch all sorts of people (publishing, translation, language checks, ...) in a kind of Conway's law.
However, hard or not, writing comprehensive documentation is quite doable. I have never been a fan of the Windows programming model but I have long admired not just MS's documentation but the amount of effort and commitment they obviously put in.
Apple cares about some things but in this regard it appears they simply don't give a shit.
So? Users expect basic OS functionality (like the App Store, Maps, etc) to function. Do people really install Little Snitch (which I've used since 2005 or so) for blocking Apple's own apps?
It is a firewall, i should be able to decide what goes in and out of my computer
edit-to-add: further evidenced by Apple's stance on right-to-repair.
Earlier quoted context omitted.
I should've clarified - it only does this if there is a default route. Funnily enough, whilst the firewalls in the original twitter post would possibly fail to catch this traffic, PF will block it just fine.
Having a default route does not mean the internet is reachable.
> Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out.
So if the default route doesn't exist yet since it's still checking for internet, it would let you use the keyboard. DHCP probably runs every time the NIC is turned on (like from sleep), and they could just disable this function if you've set a static default route (since they may not be able to reach their NTP server on that route).
Earlier quoted context omitted.
Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.
Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?
Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the des…