3 ms·

I mostly have port 80 egress traffic blocked on Little Snitch. The web is painful to use like that but gives you an idea of the sorry state of websites. A lot

I mostly have port 80 egress traffic blocked on Little Snitch. The web is painful to use like that but gives you an idea of the sorry state of websites. A lot of websites just don't serve over HTTPS, or serve them with domains whose CN or SAN don't match the host. Many that do support https have links that downgrade you back to http on the same domain.

dijit 7y ago
How do you use public Wi-Fi with captive portals?
- ninkendo 7y ago
  Allowing http://captive.apple.com http://captive.apple.com should make macOS’s captive portal auth window work.
  - Liquid_Fire 7y ago
    Most captive portals I've seen use HTTP redirection to the actual domain of the captive portal, so it would still fail as soon as it follows the redirected URL.
  - Zarel 7y ago
    If you block port 80, you'll never get to the part where you do URL filtering in the first place. (And also the redirection thing.)
    - deleted 7y ago
      [deleted]
    - ninkendo 7y ago
      I mean whitelist port 80 for captive.apple.com. Sorry if that wasn't clear. macOS has a background daemon which automatically hits captive.apple.com on connection to a WiFi network, to detect if it's behind a captive portal (and opens up a browser window to let you complete the flow, if it gets a 302). So that much should work even if you block egress port 80 but whitelist captive.apple.com. ...that is, assuming the portal to which you get redirected would be served over https, but I guess that isn't a given either.
- gsich 7y ago
  You just don't.
  - dijit 7y ago
    Seems impractical, but ok.
    - gsich 7y ago
      With LTE I rarely have the need to use wlan.
- cassianoleal 7y ago
  As ninkendo said, whitelist captive.apple.com. If nothing else works, temporarily disabling the firewall is a couple clicks away, barely takes any time or effort at all. I don't know why people are making such a fuss out of this.
ancarda 7y ago
Same here. The browser extension HTTPS Everywhere can sometimes help, but I still have to turn off Little Snitch when some links are posted on HN

dijit 7y ago

How do you use public Wi-Fi with captive portals?

ninkendo 7y ago
Allowing http://captive.apple.com http://captive.apple.com should make macOS’s captive portal auth window work.
- Liquid_Fire 7y ago
  Most captive portals I've seen use HTTP redirection to the actual domain of the captive portal, so it would still fail as soon as it follows the redirected URL.
- Zarel 7y ago
  If you block port 80, you'll never get to the part where you do URL filtering in the first place. (And also the redirection thing.)
  - deleted 7y ago
    [deleted]
  - ninkendo 7y ago
    I mean whitelist port 80 for captive.apple.com. Sorry if that wasn't clear. macOS has a background daemon which automatically hits captive.apple.com on connection to a WiFi network, to detect if it's behind a captive portal (and opens up a browser window to let you complete the flow, if it gets a 302). So that much should work even if you block egress port 80 but whitelist captive.apple.com. ...that is, assuming the portal to which you get redirected would be served over https, but I guess that isn't a given either.
gsich 7y ago
You just don't.
- dijit 7y ago
  Seems impractical, but ok.
  - gsich 7y ago
    With LTE I rarely have the need to use wlan.
cassianoleal 7y ago
As ninkendo said, whitelist captive.apple.com. If nothing else works, temporarily disabling the firewall is a couple clicks away, barely takes any time or effort at all. I don't know why people are making such a fuss out of this.

ancarda 7y ago

Same here. The browser extension HTTPS Everywhere can sometimes help, but I still have to turn off Little Snitch when some links are posted on HN