31 ms·

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

1183 points by robenkleene 6y ago

paranorman 6y ago
That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ https://pi-hole.net/ as an option until DNS encryption becomes widespread :/
- buzzerbetrayed 6y ago
  Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.
  - blacksmith_tb 6y ago
    Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?
    - Skunkleton 6y ago
      This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
      - silon42 6y ago
        firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
        Spivak 6y ago
        But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
      - goatinaboat 6y ago
        If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
        Xylakant 6y ago
        I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
        goatinaboat 6y ago
        Thanks for clarifying that!
  - 0xCMP 6y ago
    You can always reconfigure your DNS. It's important feature so unlikely they'll get rid of that.
  - Skunkleton 6y ago
    DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.
    - OJFord 6y ago
      Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
      - Macha 6y ago
        My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
        gsnedders 6y ago
        Is this much more of a concern than closed source applications that use open DNS but use pinned certs to connect to the resolved host?
        ardy42 6y ago
        > My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty. IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too. IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage. I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.
  - dwrodri 6y ago
    The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).
    - novok 6y ago
      He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.
      - toast0 6y ago
        > I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.
        ignoramous 6y ago
        > ...only allow connections to IPs that were received by DNS Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can. For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.
  - skykooler 6y ago
    You could have it spoof the keys and add its keys to your OS's key store.
    - layoutIfNeeded 6y ago
      >add its keys to your OS's key store What key store? User-hostile apps (like Chrome) already use their own key store because they know better than the user :^)
  - Spivak 6y ago
    You use your pi-hole as your encrypted DNS provider?
    - buzzerbetrayed 6y ago
      > Not a pi-hole user
  - rsync 6y ago
    Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Finally, I set all of my networks to assign my personal DNS server (and no others) for all DHCP requests and I hardcoded it into my own machines. So now I control my own dns, globally, and my upstream source of name resolution is "sanitized". Theoretically, I could just remove ublock origin from my browsers now ... Then I
    - ignoramous 6y ago
      > Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.
      - dhaavi 6y ago
        Nice. Do you have any more info on that resolver of yours?
        deleted 6y ago
        [deleted]
        deleted 6y ago
        [deleted]
- anonymousisme 6y ago
  I don't see how pi-hole get affected by DNS via https, unless you are leaving out the part about computers, tablets, and phones using hard-coded DNS servers that use DNS via https. This is a trend, but a very small one right now.
  - throwaway2048 6y ago
    You are confusing DNSSEC and DoT/DoH, DNSSEC is not encrypted.
  - fanf2 6y ago
    DNSSEC does not do encryption: DNSSEC is about data origin authentication. Encrypted DNS is DoT or DoH, DNS-over-TLS or DNS-over-HTTPS (and maybe in the future DoQ, DNS-over-QUIC)
    - anonymousisme 6y ago
      Of course. I knew what I meant, but used the wrong word.
- m463 6y ago
  Easy to bypass. Apple will just talk directly to 17.x.y.z or akamai.
- heavyset_go 6y ago
  I've been using network-level ad blocking with software like Pi Hole for a while now. According to the stats, about a year ago, I used to block around ~40% of traffic via DNS. Recently, it's only about ~10% of traffic that gets blocked. Despite disabling application-level DoH in favor of network-level DoH on every device and app I could, I suspect streaming devices and various Android apps are using DoH at the application-level and are bypassing my DNS entirely.
jedberg 6y ago
A great example of why you need defense in depth. Ideally you'd be running the local firewall on your box, as well as an external firewall. That being said, this is not ok behavior on Apple's part. There shouldn't be a way for traffic to go around the firewall like this, even if it is just Apple apps. Because as Apple well knows, once you make a backdoor, someone will figure out a way to exploit it.
- klyrs 6y ago
  > Because as Apple well knows, once you make a backdoor, someone will figure out a way to exploit it. I can't help but see this as the real reasoning behind the change. With EARN-IT on on the table and antitrust cases looming, they've got every reason to bend over and give governments whatever access they can.
- Wowfunhappy 6y ago
  If you're on a laptop, you won't necessarily always be able to filter on the router level.
  - jedberg 6y ago
    Of course not, which is why this still isn't very cool. If you're super paranoid you can always carry around a small router or a pi to attach to the wifi and be your external router though.
    - sneak 6y ago
      This comment frames someone who wants privacy, a routine and everyday common desire, as “super paranoid”. That’s bad, but, worse yet, inaccurate. You shouldn’t have to carry around another box to keep your computer or phone from spying on you.
rektide 6y ago
different but feels reminisce of Google double-dealing by not-clearing their browser storage cache when asked to. two days old: https://news.ycombinator.com/item?id=24817304 https://news.ycombinator.com/item?id=24817304
jjoonathan 6y ago
"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!" ...and now Apple has altered the deal and we must pray they do not alter it further. Disgusting. Predictable, expected, unsurprising -- but still disgusting.
- Skunkleton 6y ago
  You understand that Apple could bypass kexts too? This is an issue of trust, not a technical issue.
  - CountSessine 6y ago
    Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes. Pushing these guys out of the kernel lets Apple cheat them and Mac users clean and easy.
    - gruez 6y ago
      >Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes why would that be the case? All you'd need to do is provide some sort of private network api, and only allow apple signed code to use it.
      - throwaway2048 6y ago
        that is not how kexts work(ed), they can do completely arbitrary things to the kernel, including removing any theoretical code signing requirement.
        gruez 6y ago
        any access? On Windows, you can write a driver that would run in kernel mode, but critical sections can't be modified[1]. I'd imagine there's something similar for mac. [1] https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection
3pt14159 6y ago
This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that don't use zero days. Is the world better or worse due to this change? I'd say a touch better, but I don't like the fact that this change was needed in the first place. I trust Apple, but I don't like trusting trust.
- Wowfunhappy 6y ago
  If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.
  - coldtea 6y ago
    They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...
    - Wowfunhappy 6y ago
      You could (and perhaps would) make the same argument about Intel (for providing the processor) or Broadcom (for providing the wifi chip) or Comcast (for providing internet service). And it's true, all of these parties have the ability to use their positions for nefarious purposes. However, I would like to limit that potential as much as possible, partly by creating a stigma against practices that remove control from the user.
      - LocalH 6y ago
        I find it interesting how the needs of legitimate security mesh so well with the industry desires to kill off general-purpose computing for the majority of users
Wowfunhappy 6y ago
I suppose this is a consequence of Little Snitch moving from a kernel extension to Apple's new system that runs in user-space. :(
tinus_hn 6y ago
The solution is simple, just look at the tricks these apps are using and use them to implement malware.
- koolba 6y ago
  I bet they have feature flags that are signed and validated by Apple. You wouldn’t be able to run your app without their approval (which they won’t give).
  - verytrivial 6y ago
    Yep. I think people need to get past the idea that they own their iPhone or Mac. Apple does, they just let you use it.
malandrew 6y ago
This is a big breach of trust in terms of Apple always being on the side of user privacy. If someone knows enough to install these firewall apps, then they know enough to figure out what they want to enable/disable even for Apple applications. If Apple thinks certain rules cause issues, they certainly could work with the developer of these apps to educate users of adverse effects when certain things cause unintended issues for the user. The decision should still lie with the user. Bypassing firewalls by privileging some traffic is not okay. Looks like for now, the only real option is an external device you always connect through running pfsense or another firewall, which is not too big a deal for use on a home network, but requires carrying around another device when on other networks.
- lifty 6y ago
  I would love if there would be a small appliance based on a raspberry pi zero or something of similar size, that could be controlled/configured from an app on your phone. This device would be powered through a usb cable (no data) from your laptop, and act as a WiFi hotstpot that you can use to route all your traffic via the VPN or network of your choice. Even if your laptop would be infected by malware or a rootkit, it would be impossible to avoid the little physical VPN/firewall.
  - tankenmate 6y ago
    This is basically what pi-hole is, as to controlling it from a phone app, well it has a web interface.
    - lifty 6y ago
      That's how I use pi-hole as well. But I would like something that has wireguard and tor as well, in a nice maintainable package or little box.
  - ignoramous 6y ago
    https://firewalla.com/ https://firewalla.com/ might be it, though I am sure there are other similar products. Disclaimer: I work on a similar product but for smartphones.
coldtea 6y ago
So? Users expect basic OS functionality (like the App Store, Maps, etc) to function. Do people really install Little Snitch (which I've used since 2005 or so) for blocking Apple's own apps?
- sim_io 6y ago
  It is a firewall, i should be able to decide what goes in and out of my computer
  - pnw_hazor 6y ago
    It is pretty clear Apple doesn't think it is your computer. Similar to how they feel about their phones that they let people use. edit-to-add: further evidenced by Apple's stance on right-to-repair.
  - pshirshov 6y ago
    Realistically, you have two options: to use Linux or to trade your control and freedom for convenience. In case the control and freedom are important for you, why not to switch to Linux, purchase Pinephone or Librem, use DD-WRT/VyOS/pfSense for your router?
- _qulr 6y ago
  > Do people really install Little Snitch (which I've used since 2005 or so) for blocking Apple's own apps? Yes, Absolutely! My primary use case for Little Snitch is to block Apple "services" that I don't use or want. I don't use iCloud at all. I don't want Apple phoning home unless I specifically, manually check for software updates.
  - coldtea 6y ago
    >I don't use iCloud at all. I don't want Apple phoning home unless I specifically, manually check for software updates. I don't think a valid buyer of macOS computers is the type that doesn't use iCloud and needs to block it. Sounds like masochism. They can of course not use iCloud or the App Store. Blocking it? Might as well use another OS. I don't doubt there are some users like that. I doubt there are many users like that. And I don't believe an OS maker should cater to such a niche demographic...
rootusrootus 6y ago
Hasn't this always been a bit of an issue? Apps with root privileges have been able to get around Little Snitch for as long as I can recall. Some software relies specifically on that ability.
- Wowfunhappy 6y ago
  ...no, I don't think they could. Is there an example you're thinking of? Up until recently, Little Snitch monitored network traffic in kernel space.
  - jiripospisil 6y ago
    Not OP but one example is bridged networking. I discovered this while trying Parallels Lite from the App Store. I was used to being prompted for every connection attempt VirtualBox was making but I was not getting any when using Parallels. I contacted Little Snitch's support and they acknowledged the issue but said that there's not much they can do because Little Snitch works on "application level" and Parallels uses bridged mode of networking that Little Snitch is unable to intercept. Note that the Lite version of Parallels doesn't require any kernel extensions (even on older macOS releases). If an application is running as root, you are similarly able to use the lower level APIs and completely "bypass" Little Snitch. I cannot find a good alternative source for this other than the Security and Privacy Guide [0]: It is worth noting that these firewalls can be bypassed by programs running as root or through OS vulnerabilities (pdf), but they are still worth having - just don't expect absolute protection. [0] https://github.com/drduh/macOS-Security-and-Privacy-Guide#third-party-firewalls https://github.com/drduh/macOS-Security-and-Privacy-Guide#th...
  - rootusrootus 6y ago
    Off the top of my head, I think it was Photoshop or something else along those lines (it's been a few years). It installed itself a little helper tool that ran as root which could talk to the licensing servers without tripping Little Snitch. I don't run Little Snitch any more, so it may no longer work that way. Some software (games seem to be an egregiously bad offender) insists on communicating with seemlingly random IP addresses and not using DNS to resolve them, and it's hard to run any kind of filtering software or parental controls such as Screen Time successfully. I make do with outbound filtering at my router.
eptcyka 6y ago
Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out. I won't share the other sentiments about the above, but is it really that hard to document these behaviors?
- thewebcount 6y ago
  Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!
  - dmd 6y ago
    If you're using Cisco Anyconnect, blame that for that particular keyboard issue.
    - dylan604 6y ago
      Why not blame the idiotic decision to make this network check just to wake up?
      - eptcyka 6y ago
        I think the threat model here is that someone might've swapped out your keyboard to one that's spying on you, whilst you're out at a conference enjoying the more social aspects of such gatherings. At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.
pier25 6y ago
A bit contradictory with Apple's supposedly privacy-focused approach, no?
- comeonseriously 6y ago
  Of course, but they'll get a pass because "Apple's got yer back!"
- dheera 6y ago
  Was Apple every privacy focused? I think they mostly try to play the good guys to get on users' sides but actually are pretty much the opposite. They know everything about you. Why was the FBI even able to get access to that person's phone? Sounds like there was a loophole. Not happening if it were an encrypted Android device with a high-entropy password. Apple also has vastly different policies in different countries. They do cooperate with government privacy invasions but they don't publish that fact in the US. It's a business decision but they are most definitely profit-focused, not privacy-focused.
  - gruez 6y ago
    >Not happening if it were an encrypted Android device with a high-entropy password. because you have to balance security with usability. iPhones use its security chip to slow/prevent password guessing. that allows you to use a weak password without losing much security, but if that system is compromised you're back to square one. I'm sure if you used a high entropy password on ios, they wouldn't be able to get access either.
    - dheera 6y ago
      > I'm sure if you used a high entropy password on ios The problem is you don't get this choice in iOS. A privacy-respecting company would provide you this option -- Android does. You can have a high-entropy passcode in Android if you wish, and choose to sacrifice usability in the interest of privacy, if that is what you'd like.
      - 6y ago
joncp 6y ago
That totally breaks my use case for Little Snitch: working tethered. When I tether my laptop it thinks it has free reign with the bandwidth and all of the little background processes can kill my data in a few minutes. With a firewall, I can grant access to only the processes that I need to get my work done. Now, I guess I have to run some external firewall between my laptop and my phone. ... or better yet, abandon Apple.
- chrisshroba 6y ago
  For what it's worth, my hacky solution to this is this script which kills all the background processes that use significant bandwidth. If you're interested in how I came up with the list of processes, I can share the BitBar [1] script I wrote for monitoring per-process network usage (I wrote a small wrapper around nettop that logs to a db, which is read periodically by my BitBar script to show me the per-process usage: if [ $(whoami) != root ] then echo "Please run as root, not $(whoami)" exit fi while true do killall -9 planb 2>/dev/null && echo "$(date) - Killed planb" killall -9 murdockd 2>/dev/null && echo "$(date) - Killed murdockd" killall -9 uplink-soecks 2>/dev/null && echo "$(date) - Killed uplink" killall -9 nsscacheclient 2>/dev/null && echo "$(date) - Killed nsscacheclient" killall -9 ksfetch 2>/dev/null && echo "$(date) - Killed ksfetch" killall -9 nsurlsessiond 2>/dev/null && echo "$(date) - Killed nsurlsessiond" killall -9 softwareupdated 2>/dev/null && echo "$(date) - Killed softwareupdated" done [1]: https://github.com/matryer/bitbar https://github.com/matryer/bitbar
  - droopyEyelids 6y ago
    please share the script for monitoring per-process network usage! I'd love it.
    - chrisshroba 6y ago
      I just pasted the relevant files in here. At some point I'll try to make this a bit more professional and easy to use, but for now it works! https://gist.github.com/chrisshroba/e31fd89b6a560733d3f915e8ee4deed8 https://gist.github.com/chrisshroba/e31fd89b6a560733d3f915e8... (ps if having an easily installable version of this would be helpful to anyone reading this, please comment or upvote this and maybe I'll prioritize it :) )
AnonHP 6y ago
I trust Apple a lot more than I trust Google or Facebook, but this clamping down of the Mac without options for power users while officially stating that the Mac will remain a Mac is alarming and distasteful on the part of Apple. With the transition to Apple’s own chips looming, it seems like the days of “a Mac is a personal computer and not an app console like an iPhone or iPad” will be over by the middle of this decade. All Apple devices locked down completely and Apple decides the limits of what users can do on devices. This model made some sense for mobile (where restrictions were gradually removed or workarounds provided), but the Mac is going in reverse.
- capableweb 6y ago
  People keep saying "I trust company X a lot more than I trust company Y" but is "trust" really something that applies to companies at all? Feels weird to humanize companies in that way. If you trust a company, isn't it really that you trust the humans working at that company? So you should really say "I trust person X who happens to work at X today", as as soon as they leave, the trust went with them. Companies are not people and cannot be trusted to act in any interest but profits. Any trust you feel towards a company is towards humans in the company, but let's not anthropomorphise companies (yet, until we have better AI at least).
  - snazz 6y ago
    You make a valid point, but it’s also worth considering how the stakeholders’ interests align with your own. Apple is in the premium hardware and value added services business, so its interests are aligned with mine with regards to privacy and producing a quality product. On the other hand, Facebook is in the ad business, so its interests are not aligned with mine on a variety of points.
  - deltron3030 6y ago
    >but is "trust" really something that applies to companies at all? Of course, It's called branding. Promises that aren't kept are still promises that aren't kept, and Apple was traditionally known for going beyond expectations, it's the core of their brand. Some companies are more B2B business and developer friendly, like MS and FB, and others like Apple and Amazon are the opposite, they're first and foremost about B2C and mainstream customers. Apple is less B2B focused than before because of the iPhone. They don't have to attract devs by giving them the best tools, they can attract them because of their market share among solvent customers on mobile alone.
metroholografix 6y ago
Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the desktop, the combination of a stable/uniform/attractive desktop environment with a Unix core that had great developer documentation -no longer the case!- and nicely-designed APIs was too much to resist. Unfortunately, the push towards consumers and Apple's increasingly one-sided my-way-or-the-highway approach (fueled by security concerns that to me are completely irrelevant, if not a huge annoyance and waste of time) means that a lot of us oldschool Unix hackers were left out in the cold. I don't plan to upgrade past Mojave and at some point in the future I will move back to Linux.
- indymike 6y ago
  I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).
  - adambatkin 6y ago
    Linux on the desktop and Linux on the laptop (heh) has definitely improved. It _sometimes_ needs a little tweaking to get it right, but KDE/Plasma also happens to offer that level of "tweakability" that should satisfy almost all semi-mainstream users (at least anyone coming from Windows or Mac). Compared to my first Linux laptop (a Sony Vaio circa 2000), my current XPS 13 works as well as any Mac laptop I have ever owned, and all the hardware that you would "expect" to work (but probably didn't work as smoothly 10 or 20 years ago) Just Works (WiFi, external displays, excellent battery life/sleep, etc...) Based on the complaints I have heard about Apple hardware and MacOS over the past few years, I'd even argue that Linux-on-the-desktop isn't any less stable or harder to get working than a Mac.
    - kitsunesoba 6y ago
      I try the major DEs every few years to see if they fit me, most recently trying the newest KDE and GNOME versions in a VM about a month ago. Both have improved for sure, but they still have a long way to go… GNOME actually came closest but its customizability level is even lower than that of macOS, even factoring in extensions. Both suffer from a laundry list of minor annoyances that snowball into something that's hard to ignore, and in KDE's case the UX design they employ just doesn't jive with me at all. It's all enough that I end up coming back to macOS because despite its problems, it fits me in ways that nothing else even comes close to touching. Sometimes it feels like there will never be a macOS alternative that has what it takes for me to switch without feeling a major sense of loss.
AlexandrB 6y ago
Both major consumer OS vendors seem hell-bent on bringing the OS layer under their complete control. As a power user, it's very frustrating. Meanwhile "desktop" Linux still kind of sucks, just like it did 10 years ago. I don't have much hope of seeing a compelling, unified UX out of Linux in my lifetime.
- hexis 6y ago
  Maybe desktop Linux needs more people like you and me to help make it better?
  - AlexandrB 6y ago
    I appreciate the sentiment, but I'm not a UX designer or expert. And the problem is not that Linux doesn't have enough UI developers, it's that many of them are working on re-inventing the wheel in different, competing ways. Linux needs a dictatorial BDFL for UI - a Linus Torvalds for the desktop - an idea somewhat antithetical to the distributed nature of open source development. It doesn't help that organizations that could be leading the charge keep changing direction. Ubuntu went Gnome -> Unity -> Gnome in the span of 15 years or so. And now they're going in hard on Snaps, which introduces breaks in UI uniformity again (Gnome Themes, for example[1]). [1] https://www.omgubuntu.co.uk/2020/10/automatic-theme-installation-for-snap-apps-is-shaping-up-nicely-video https://www.omgubuntu.co.uk/2020/10/automatic-theme-installa...
    - ebiester 6y ago
      Two groups tried that. Unity tried that, and GNOME is trying that. Many of us really hate GNOME's decisions. I'm not sure I really like the BDFL here.
  - baq 6y ago
    It needs more people willing to pay software developers, UX designers and testers to improve the Linux desktop, starting with the kernel, graphics drivers, ending in consistent set of apps. This is a (ten) billion dollar endeavor.
- 6y ago
deleted 6y ago
[deleted]
smnrchrds 6y ago
Apple has been more and more acting on the belief that when you buy one of their devices, you don't buy and own the device. You rather purchase an experience—a service—from Apple. They don't have to let you run your own software on your device or poke around the internals. That is not part of the experience offered. You should use the device as Apple intends it to be used.
- parliament32 6y ago
  Device-as-a-Service is an excellent way to describe the Apple ecosystem.
- spideymans 6y ago
  For better or for worse, this has been Apple’s philosophy since forever. Steve Jobs himself said, “[users] are paying us to make these choices”. https://youtu.be/rKPEK9BSIhA https://youtu.be/rKPEK9BSIhA
sbuk 6y ago
Use Murus, which uses PF, which is built in to OS X... https://www.murusfirewall.com https://www.murusfirewall.com
- deleted 6y ago
  [deleted]
acgkmopvvgvmgv 6y ago
A good lesson for the anti-FLOSS crowd so heavily present in this website. I'll be the first to admit Linux desktops are full of flaws (although there are other options), just like every other OS but they could be fixed given enough money or maybe you could be the one that write that code. But an OS that is not FLOSS will always work against their users and restrict their freedom. It's also a big joke that they have so many ads talking about privacy, when they are just as bad as their rivals. I do understand that not everyone has a choice because specialized software that they need for professional use could be available only in other platforms and that's unfortunately. I don't expect an utopic world where everything is FLOSS but the OS is too important to be closed. It will only get worse with time.
brightball 6y ago
Unreal. Does it feel to anybody else that a lot of grip tightening seems to be happening right now?
- GekkePrutser 6y ago
  Yes it does. All in line with "Computing as a service" rather than "Computing as a product". We're now a guest inside our computers rather than the owner.
ramosu 6y ago
"I should have got a Thinkpad"
rowanG077 6y ago
Apple SW and HW need to be broken up. They have abused their position too much.
deleted 6y ago
[deleted]
Wowfunhappy 6y ago
I wonder if it would make sense for Little Snitch to continue supporting their kext-based solution in parallel to the new one, possibly only for users who are willing to disable SIP. You might argue that disabling SIP for a security product defeats the point, but I'm not sure if that's necessarily true. SIP effectively delegates trust away from the user and towards Apple, which is fine as a default—but the calculus may be different for experienced users, like the ones who use Little Snitch.
- novok 6y ago
  Eventually I don't think little snitch will even have apis to access stuff like that in the kernel as a kext as macos updates continue on.
  - Wowfunhappy 6y ago
    Kexts are used by Apple internally, so I'd be shocked if they were removed from the OS completely. Third party kexts may be deprecated, but as long as SIP can be disabled it will always be possible to load your own.
    - dwaite 6y ago
      The networking subsystem that the kernel exposes could be removed however, replaced with one which is neither stable nor publicly documented.
    - saagarjha 6y ago
      Apple could stop allowing you to load kexts they don’t sign, like they do on iOS.
      - sneak 6y ago
        It’s my understanding (and I imagine yours is better than mine) that at least at present, the macOS kernel is open source, which would mean that unless they forked it, disabling firmware security and SIP would mean that you could replace it with a compatible one compiled from open sources that skips such a check. They can, of course, remove that option a number of ways: closed source kernel, disable the disablement of boot security (such as on iOS), et c.
m3kw9 6y ago
Maybe if you block it randomly renders your OS inoperable and you won’t know why. Example iCloud login, could be a few obscure network calls. You would then call Apple and ask wtf if you are some noob blocking everything. This isn’t old days where there could be zero dependence on the net for critical function.
- Wowfunhappy 6y ago
  This is one of the key purposes of the Apple Store. The Genius Bar would help you test on a clean account or do a full wipe — although, Little Snitch is well-known enough that I'd expect an Apple Store employee to recognize it pretty quickly. I suppose it's theoretically possible they're trying to drive down support costs. But, geez, that would make me much more scared about the direction Apple is taking than anything else. Really though, Little Snitch is quite explicit about what it does. It's also $40, and it's marketed to a pretty technical audience.
xyst 6y ago
This is a very sneaky move by Apple, shame on them.
danmg 6y ago
If a third party did anything like this, it would be considered malware.
- fsflover 6y ago
  Many already consider Apple software malware: https://www.gnu.org/proprietary/malware-apple.html https://www.gnu.org/proprietary/malware-apple.html.
  - fsflover 6y ago
    Not sure why downvotes: It's true that some people consider Apple as malware and they do have a point, including the present title.
  - murermader 6y ago
    Just read the german version of that article, and they way the talk, and the way it is represented does not sound professional at all. It often sounds like a parody, for example calling Apple „Big Brother“ for offering a cloud service. Its sounds really polemic and takes away some of its credibility, because of weird wording, and leaving out some information here and there so some things sound worse than they are.
    - fsflover 6y ago
      I agree with you, the style could be much better. However it does not change the listed facts.
giancarlostoro 6y ago
I mean I already knew something was weird when I couldnt su into root and do... root things without a bios hack on a Mac. Thats just not how Unix works at all... The whole concept of root is you are root no exceptions.
- Wowfunhappy 6y ago
  You don't need to hack anything, you just need to use the officially-supported mechanisms Apple provides to grant yourself more permissions (namely, disabling SIP and remounting the root filesystem).
- jlgaddis 6y ago
  > The whole concept of root is you are root no exceptions. Wait until you learn about mandatory access control [0] ... -- [0]: https://en.wikipedia.org/wiki/Mandatory_access_control https://en.wikipedia.org/wiki/Mandatory_access_control
- kstrauser 6y ago
  That's absolutely not true. For instance, the BSDs have the notion of securelevels (https://man.openbsd.org/securelevel.7 https://man.openbsd.org/securelevel.7) which severely limits what even the root user can do. SELinux can do a lot of the same things.
  - m463 6y ago
    I don't know about bsd, but there's lots of documentation on how selinux works (including source code) and information on how to alter its behavior in a fine-grained fashion. and selinux doesn't leave itself a backdoor (as far as the nsa has told us)
    - kstrauser 6y ago
      That's a different issue, though. Today, booting into macOS is similar to booting into a BSD with securelevel=1 enabled, or into Linux with SELinux set up not to allow modifying files in /bin or such.
deleted 6y ago
[deleted]
bitobserver 6y ago
For anyone that wants to switch to Linux and retain similar functionality as this firewall app, there is this: https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch
- dhaavi 6y ago
  There is another - and I'd argue better - alternative for Linux and Windows: Portmaster by Safing https://safing.io/portmaster/ https://safing.io/portmaster/ Not only is it an application firewall, but also gives you DNS filtering (ie. Pi-Hole basics) and DNS-over-TLS. Full Disclosure: I'm one of the founders.
  - mindfulhack 6y ago
    But has it added pop-up per-app (and then per domain/port/ip) block/allow functionality in the Linux DE GUI yet? Thanks to your whole team for the awesome work.
    - dhaavi 6y ago
      This is already implemented, but was broken during an important refactor. We hope to fix it soon.
xlii 6y ago
Looks like one of the answers in the Twitter thread mentions that this might be cached content. Is this confirmed that the network call is actually being made (by router for example?). Cause later down the line it seems that pf blocks the calls just fine.
azinman2 6y ago
Everyone seems to assume this is true, but are people also confirming this? I installed LittleSnitch recently on Big Sur and I’m constantly getting pop up’s for all of Apple’s internal daemons etc. While I haven’t tried the App Store specifically, I’m wondering if the person didn’t understand how things were configured and was allowing certain traffic thru. I can’t imagine there’s really some big conspiracy here.
- latexr 6y ago
  The tweeter is Patrick Wardle, security researcher and creator of Objective-See[1] which publishes several macOS security apps, including the LuLu firewall. Given Patrick’s track record, it’s generally safe to assume due diligence was given to the claim and that lack of understanding about configuration doesn’t apply. As to your specific case, the tweet does mention “many of” Apple’s apps are affected (i.e. not all, not even necessarily the majority). [1]: https://objective-see.com/ https://objective-see.com/
- LeoNatan25 6y ago
  Confirmed. Someone also found the strings in the network stack, which are tested against the app's bundle identifier to provide these wholes. It's ridiculous.
  - musicale 6y ago
    Do you have a reference? As noted, this seems to contradict what Objective Development is saying. Objective (sic) proof that Objective Development is lying would certainly be a big deal, and a very good reason not to trust Little Snitch.
Fizzadar 6y ago
I guess this means no updating to 5 or Big Sur then, I'll be keeping the kernel extension, thank you Apple.
sneak 6y ago
This is upsetting. I currently use macOS with iCloud, FaceTime, iMessage, and App Store all disabled, and use Little Snitch to prevent the machine from communicating with Apple except for on update days, and then limited only to those specific update processes. It’s possible that this will mean that the next macOS version will be unsuitable on privacy grounds, as I will then have to use a second physical device to prevent such network access. :(
dvfjsdhgfv 6y ago
Microsoft is doing the same as Apple, just because they can.
1MachineElf 6y ago
Is pf still included in macOS? I wonder if it blocks it. Last time I played with it was the Snow Leopard days: https://opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/net/pf.c.auto.html https://opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/ne...
hariboapfel 6y ago
i think this is a bug. for instance iCloud photos syncing network traffic, (belongig to nsurlsessiond) doesnt show up in the BigSur native Activity Monitor, but for some reason still gets shown in my Stats app.
admax88q 6y ago
If Microsoft did this in windows, or Google did this in chrome, would we see so much defense of this strategy? Or could it be those rose coloured glasses that HN tends to view Apple through. Or more like "users are literally brain dead and cannot be trusted to change the channels on their TV" coloured glasses. If you only trust your users to watch TV, then get into TVs instead of computers. We don't fault the maker of a drill when a careless user drills a hole in their hand. We fault the user for being careless. At what point do we start doing the same for computers? The advantage of physical power-tools is that their mechanism of operation is readily apparent, open, understandable, predictable. If Apple really cares about their users, they should start investing in making software open, understandable, predictable. This is a much harder problem, and probably less profitable, than just building another TV, but I'd rather live in that world than this one. I don't need another TV.
- wmeredith 6y ago
  My problem with defending this is even if you trust Apple now, what about in the future? Google used to be one of the good guys...
- nickflood 6y ago
  Btw, when I've been testing a "kill switch" on Windows (firewall configuration that doesn't allow internet access without a VPN running) using the built-in firewall, I discovered that - Chrome adds a Firewall rule on installation that grants it access to all networks, bypassing kill switch configurations. - Microsoft has an "Allow app through Firewall" [1] dialog that manages all of the rules for its apps and services along with some third-party apps. These rules again tend to allow everything, and at least on earlier builds from like 2018 they would reset to allow everything on _every_ update. This was such a pain to deal with. [1] https://az767233.vo.msecnd.net/images/Security/win8_winfirewall_allowapp_addanother.png https://az767233.vo.msecnd.net/images/Security/win8_winfirew...
aftbit 6y ago
Chrome exempts Google properties from rules? Unacceptable! macOS exempts Apple apps from rules? Protecting users! Seriously, it's my machine. I should have top permissions on it, not Apple. If I chose to run an app that intercepts traffic, I want it to intercept _all_ traffic. What's next, making it impossible to hook a debugger to Apple services? Or did they already do that? As much as I love Mac & iPhone UX, stuff like this will keep me off them and keep me from recommending them to anyone either.
m3nu 6y ago
Apple is not going in a great direction for more technical people. Started looking a Linux desktops and r/unixporn . Maybe time to switch, when my Macbook is up for replacement.
_qulr 6y ago
"You have to trust Apple", it's said. But I suspect that if you actually knew how much your Apple devices were phoning home to Cupertino, you wouldn't trust Apple anymore. Using Little Snitch (the kernel extension) was a real eye opener for me. Especially when I allowed Little Snitch to block all Apple processes (by disabling the built-in iCloud Services and macOS Services rule groups). This may be a good time to remind folks of my blog post where I explain how Catalina phones home when you run unsigned executables, including shell scripts! In the article I mentioned that you can prevent this with Little Snitch. But that was the LS kext. Is it even possible anymore? https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm... Let me just quote one comment from the HN discussion of that article: https://news.ycombinator.com/item?id=23278253 https://news.ycombinator.com/item?id=23278253 "Making this about speed is burying the lede. From a privacy and user-freedom perspective, it's horrifying. Don't think so? Apple now theoretically has a centralized database of every Mac user who's ever used youtube-dl. Or Tor. Or TrueCrypt." It's all too easy to dismiss the privacy violations that we're not aware of. Out of sight, out of mind.
- jachee 6y ago
  Apply Occam's Razor. Why would the most successful company in history—a success gained in no small part through protecting users, selling hardware and services instead of their data, and promoting and enhancing privacy as a first-class feature—do that sort of thing? What possible benefit could such a centralized database serve? How's that gonna make them more money?
  - _qulr 6y ago
    I'd love to apply Occam's Razor to Apple's network connections. Those entitles should not be multiplied without necessity. That's why I use Little Snitch! Seriously though, Tim Cook has been absolutely trashing Apple's hard won reputation by relentlessly pushing (via push notifications no less) TV shows and other garbage "subscriptions" on computer buyers. It's not what I signed up for when I became a Mac user many years ago.
  - strogonoff 6y ago
jerrysievert 6y ago
I'm not too concerned about privacy-focused apple doing this, but if apple can do it others could figure out how to do it too. that completely breaks any network filtering and is not acceptable.
deleted 6y ago
[deleted]
jzl 6y ago
In the off chance anyone here is able to answer ... does anyone know how to trace the originating app when Little Snitch detects an outgoing connection from netbiosd? I believe that happens when an app tries to access an smb mount. Some app on my computer is constantly doing that to an AWS-hosted mount, but I can't figure out what.
skissane 6y ago
Does anyone know how this actually works, technically? Are these apps using some kind of special API? (If yes, what's to stop other people's apps using that API?) Is it because they are signed with some kind of special entitlement? Is it due to some combination of both? (Maybe you have to use some magic API, but you need to be signed with some magic entitlement to be allowed to use it?)
est 6y ago
Would something similar be done with Linux's netns ?
seemslegit 6y ago
Loving the "are we ok with this ?" take - as if anyone cares.
ghthor 6y ago
If everyone in this thread would use their energy to build a nice Little Snitch GUI app for linux firewalling instead of bitching, that do be great.
j45 6y ago
This might mean running firewalls on the local networks which block outgoing traffic to Apple. And possibly keeping Apple devices vpned to such a network. I was looking forward to new Apple devices, but feel uncertain about the "trust Apple but no one else" approach. Concerns: 1) Apple devices have been configurable to be respectful if not invisible in corporate or client windows networks. You could use a Mac with a firewall in windows environments without being worried about setting off something on the network for unusual traffic. Especially for environments that don't support some but don't stop it either. 2) Corporate Windows networks can control the monitoring of telemetry and metadata to a higher degree than Apple now seems to. It could be a new gap in Apple when compared to others. If the above are true, it's not clear if Apple sees few Mac users in any corporate environment as an opportunity to grow, it's only accelerating the consideration of other operating systems. Apple also appears to be signaling that devices do not belong to the customer. The idea of we will protect your data, but trust your data to our policies, which we can change seems confusing. I'm considering the new iPhone for security, but this workaround seems like an affront to it.

1183 points by robenkleene 6y ago

That’s annoying yet pretty predictable, at least we’ve still got https://pi-hole.net/ https://pi-hole.net/ as an option until DNS encryption becomes widespread :/

buzzerbetrayed 6y ago
Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.
- blacksmith_tb 6y ago
  Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?
  - Skunkleton 6y ago
    This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
    - silon42 6y ago
      firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
      - Spivak 6y ago
        But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
    - goatinaboat 6y ago
      If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
      - Xylakant 6y ago
        I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
        goatinaboat 6y ago
        Thanks for clarifying that!
- 0xCMP 6y ago
  You can always reconfigure your DNS. It's important feature so unlikely they'll get rid of that.
- Skunkleton 6y ago
  DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.
  - OJFord 6y ago
    Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
    - Macha 6y ago
      My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
      - gsnedders 6y ago
        Is this much more of a concern than closed source applications that use open DNS but use pinned certs to connect to the resolved host?
      - ardy42 6y ago
        > My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty. IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too. IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage. I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.
- dwrodri 6y ago
  The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).
  - novok 6y ago
    He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.
    - toast0 6y ago
      > I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.
      - ignoramous 6y ago
        > ...only allow connections to IPs that were received by DNS Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can. For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.
- skykooler 6y ago
  You could have it spoof the keys and add its keys to your OS's key store.
  - layoutIfNeeded 6y ago
    >add its keys to your OS's key store What key store? User-hostile apps (like Chrome) already use their own key store because they know better than the user :^)
- Spivak 6y ago
  You use your pi-hole as your encrypted DNS provider?
  - buzzerbetrayed 6y ago
    > Not a pi-hole user
- rsync 6y ago
  Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Finally, I set all of my networks to assign my personal DNS server (and no others) for all DHCP requests and I hardcoded it into my own machines. So now I control my own dns, globally, and my upstream source of name resolution is "sanitized". Theoretically, I could just remove ublock origin from my browsers now ... Then I
  - ignoramous 6y ago
    > Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.
    - dhaavi 6y ago
      Nice. Do you have any more info on that resolver of yours?
      - deleted 6y ago
        [deleted]
      - deleted 6y ago
        [deleted]
anonymousisme 6y ago
I don't see how pi-hole get affected by DNS via https, unless you are leaving out the part about computers, tablets, and phones using hard-coded DNS servers that use DNS via https. This is a trend, but a very small one right now.
- throwaway2048 6y ago
  You are confusing DNSSEC and DoT/DoH, DNSSEC is not encrypted.
- fanf2 6y ago
  DNSSEC does not do encryption: DNSSEC is about data origin authentication. Encrypted DNS is DoT or DoH, DNS-over-TLS or DNS-over-HTTPS (and maybe in the future DoQ, DNS-over-QUIC)
  - anonymousisme 6y ago
    Of course. I knew what I meant, but used the wrong word.
m463 6y ago
Easy to bypass. Apple will just talk directly to 17.x.y.z or akamai.
heavyset_go 6y ago
I've been using network-level ad blocking with software like Pi Hole for a while now. According to the stats, about a year ago, I used to block around ~40% of traffic via DNS. Recently, it's only about ~10% of traffic that gets blocked. Despite disabling application-level DoH in favor of network-level DoH on every device and app I could, I suspect streaming devices and various Android apps are using DoH at the application-level and are bypassing my DNS entirely.

jedberg 6y ago

A great example of why you need defense in depth. Ideally you'd be running the local firewall on your box, as well as an external firewall. That being said, this is not ok behavior on Apple's part. There shouldn't be a way for traffic to go around the firewall like this, even if it is just Apple apps. Because as Apple well knows, once you make a backdoor, someone will figure out a way to exploit it.

klyrs 6y ago
> Because as Apple well knows, once you make a backdoor, someone will figure out a way to exploit it. I can't help but see this as the real reasoning behind the change. With EARN-IT on on the table and antitrust cases looming, they've got every reason to bend over and give governments whatever access they can.
Wowfunhappy 6y ago
If you're on a laptop, you won't necessarily always be able to filter on the router level.
- jedberg 6y ago
  Of course not, which is why this still isn't very cool. If you're super paranoid you can always carry around a small router or a pi to attach to the wifi and be your external router though.
  - sneak 6y ago
    This comment frames someone who wants privacy, a routine and everyday common desire, as “super paranoid”. That’s bad, but, worse yet, inaccurate. You shouldn’t have to carry around another box to keep your computer or phone from spying on you.

rektide 6y ago

different but feels reminisce of Google double-dealing by not-clearing their browser storage cache when asked to. two days old: https://news.ycombinator.com/item?id=24817304 https://news.ycombinator.com/item?id=24817304

jjoonathan 6y ago

"You don't need kernel extensions, we'll provide APIs for you! We won't abuse the power that gives us, promise!" ...and now Apple has altered the deal and we must pray they do not alter it further. Disgusting. Predictable, expected, unsurprising -- but still disgusting.

Skunkleton 6y ago
You understand that Apple could bypass kexts too? This is an issue of trust, not a technical issue.
- CountSessine 6y ago
  Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes. Pushing these guys out of the kernel lets Apple cheat them and Mac users clean and easy.
  - gruez 6y ago
    >Try to bypass kexts and you’re just asking for kernel stability issues and Mac customer crashes why would that be the case? All you'd need to do is provide some sort of private network api, and only allow apple signed code to use it.
    - throwaway2048 6y ago
      that is not how kexts work(ed), they can do completely arbitrary things to the kernel, including removing any theoretical code signing requirement.
      - gruez 6y ago
        any access? On Windows, you can write a driver that would run in kernel mode, but critical sections can't be modified[1]. I'd imagine there's something similar for mac. [1] https://en.wikipedia.org/wiki/Kernel_Patch_Protection https://en.wikipedia.org/wiki/Kernel_Patch_Protection

3pt14159 6y ago

This is one of those tough cases where software cuts both ways. Some people are smart, informed developers that install a trusted tool to monitor their traffic and have legitimate reasons to want to inspect Apple traffic. They're dismayed. Most people are the opposite and this move protects the most sensitive data from being easily scooped up or muddled in easily installed apps, or at least easily installed apps that don't use zero days. Is the world better or worse due to this change? I'd say a touch better, but I don't like the fact that this change was needed in the first place. I trust Apple, but I don't like trusting trust.

Wowfunhappy 6y ago
If I install Little Snitch, it's because I trust Little Snitch to be responsible for my computer's network traffic, over and above anyone else. I recognize that this won't necessarily apply to all users or all apps, but there needs to be a way for the user to designate trust. Apple services and traffic should not get special treatment.
- coldtea 6y ago
  They provide the OS. If you don't trust them, then you shouldn't trust anything running on top of it either...
  - Wowfunhappy 6y ago
    You could (and perhaps would) make the same argument about Intel (for providing the processor) or Broadcom (for providing the wifi chip) or Comcast (for providing internet service). And it's true, all of these parties have the ability to use their positions for nefarious purposes. However, I would like to limit that potential as much as possible, partly by creating a stigma against practices that remove control from the user.
    - LocalH 6y ago
      I find it interesting how the needs of legitimate security mesh so well with the industry desires to kill off general-purpose computing for the majority of users

Wowfunhappy 6y ago

I suppose this is a consequence of Little Snitch moving from a kernel extension to Apple's new system that runs in user-space. :(

tinus_hn 6y ago

The solution is simple, just look at the tricks these apps are using and use them to implement malware.

koolba 6y ago
I bet they have feature flags that are signed and validated by Apple. You wouldn’t be able to run your app without their approval (which they won’t give).
- verytrivial 6y ago
  Yep. I think people need to get past the idea that they own their iPhone or Mac. Apple does, they just let you use it.

malandrew 6y ago

This is a big breach of trust in terms of Apple always being on the side of user privacy. If someone knows enough to install these firewall apps, then they know enough to figure out what they want to enable/disable even for Apple applications. If Apple thinks certain rules cause issues, they certainly could work with the developer of these apps to educate users of adverse effects when certain things cause unintended issues for the user. The decision should still lie with the user. Bypassing firewalls by privileging some traffic is not okay. Looks like for now, the only real option is an external device you always connect through running pfsense or another firewall, which is not too big a deal for use on a home network, but requires carrying around another device when on other networks.

lifty 6y ago
I would love if there would be a small appliance based on a raspberry pi zero or something of similar size, that could be controlled/configured from an app on your phone. This device would be powered through a usb cable (no data) from your laptop, and act as a WiFi hotstpot that you can use to route all your traffic via the VPN or network of your choice. Even if your laptop would be infected by malware or a rootkit, it would be impossible to avoid the little physical VPN/firewall.
- tankenmate 6y ago
  This is basically what pi-hole is, as to controlling it from a phone app, well it has a web interface.
  - lifty 6y ago
    That's how I use pi-hole as well. But I would like something that has wireguard and tor as well, in a nice maintainable package or little box.
- ignoramous 6y ago
  https://firewalla.com/ https://firewalla.com/ might be it, though I am sure there are other similar products. Disclaimer: I work on a similar product but for smartphones.

coldtea 6y ago

So? Users expect basic OS functionality (like the App Store, Maps, etc) to function. Do people really install Little Snitch (which I've used since 2005 or so) for blocking Apple's own apps?

sim_io 6y ago
It is a firewall, i should be able to decide what goes in and out of my computer
- pnw_hazor 6y ago
  It is pretty clear Apple doesn't think it is your computer. Similar to how they feel about their phones that they let people use. edit-to-add: further evidenced by Apple's stance on right-to-repair.
- pshirshov 6y ago
  Realistically, you have two options: to use Linux or to trade your control and freedom for convenience. In case the control and freedom are important for you, why not to switch to Linux, purchase Pinephone or Librem, use DD-WRT/VyOS/pfSense for your router?
_qulr 6y ago
> Do people really install Little Snitch (which I've used since 2005 or so) for blocking Apple's own apps? Yes, Absolutely! My primary use case for Little Snitch is to block Apple "services" that I don't use or want. I don't use iCloud at all. I don't want Apple phoning home unless I specifically, manually check for software updates.
- coldtea 6y ago
  >I don't use iCloud at all. I don't want Apple phoning home unless I specifically, manually check for software updates. I don't think a valid buyer of macOS computers is the type that doesn't use iCloud and needs to block it. Sounds like masochism. They can of course not use iCloud or the App Store. Blocking it? Might as well use another OS. I don't doubt there are some users like that. I doubt there are many users like that. And I don't believe an OS maker should cater to such a niche demographic...

rootusrootus 6y ago

Hasn't this always been a bit of an issue? Apps with root privileges have been able to get around Little Snitch for as long as I can recall. Some software relies specifically on that ability.

Wowfunhappy 6y ago
...no, I don't think they could. Is there an example you're thinking of? Up until recently, Little Snitch monitored network traffic in kernel space.
- jiripospisil 6y ago
  Not OP but one example is bridged networking. I discovered this while trying Parallels Lite from the App Store. I was used to being prompted for every connection attempt VirtualBox was making but I was not getting any when using Parallels. I contacted Little Snitch's support and they acknowledged the issue but said that there's not much they can do because Little Snitch works on "application level" and Parallels uses bridged mode of networking that Little Snitch is unable to intercept. Note that the Lite version of Parallels doesn't require any kernel extensions (even on older macOS releases). If an application is running as root, you are similarly able to use the lower level APIs and completely "bypass" Little Snitch. I cannot find a good alternative source for this other than the Security and Privacy Guide [0]: It is worth noting that these firewalls can be bypassed by programs running as root or through OS vulnerabilities (pdf), but they are still worth having - just don't expect absolute protection. [0] https://github.com/drduh/macOS-Security-and-Privacy-Guide#third-party-firewalls https://github.com/drduh/macOS-Security-and-Privacy-Guide#th...
- rootusrootus 6y ago
  Off the top of my head, I think it was Photoshop or something else along those lines (it's been a few years). It installed itself a little helper tool that ran as root which could talk to the licensing servers without tripping Little Snitch. I don't run Little Snitch any more, so it may no longer work that way. Some software (games seem to be an egregiously bad offender) insists on communicating with seemlingly random IP addresses and not using DNS to resolve them, and it's hard to run any kind of filtering software or parental controls such as Screen Time successfully. I make do with outbound filtering at my router.

eptcyka 6y ago

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route. Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out. I won't share the other sentiments about the above, but is it really that hard to document these behaviors?

thewebcount 6y ago
Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!
- dmd 6y ago
  If you're using Cisco Anyconnect, blame that for that particular keyboard issue.
  - dylan604 6y ago
    Why not blame the idiotic decision to make this network check just to wake up?
    - eptcyka 6y ago
      I think the threat model here is that someone might've swapped out your keyboard to one that's spying on you, whilst you're out at a conference enjoying the more social aspects of such gatherings. At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

pier25 6y ago

A bit contradictory with Apple's supposedly privacy-focused approach, no?

comeonseriously 6y ago
Of course, but they'll get a pass because "Apple's got yer back!"
dheera 6y ago
Was Apple every privacy focused? I think they mostly try to play the good guys to get on users' sides but actually are pretty much the opposite. They know everything about you. Why was the FBI even able to get access to that person's phone? Sounds like there was a loophole. Not happening if it were an encrypted Android device with a high-entropy password. Apple also has vastly different policies in different countries. They do cooperate with government privacy invasions but they don't publish that fact in the US. It's a business decision but they are most definitely profit-focused, not privacy-focused.
- gruez 6y ago
  >Not happening if it were an encrypted Android device with a high-entropy password. because you have to balance security with usability. iPhones use its security chip to slow/prevent password guessing. that allows you to use a weak password without losing much security, but if that system is compromised you're back to square one. I'm sure if you used a high entropy password on ios, they wouldn't be able to get access either.
  - dheera 6y ago
    > I'm sure if you used a high entropy password on ios The problem is you don't get this choice in iOS. A privacy-respecting company would provide you this option -- Android does. You can have a high-entropy passcode in Android if you wish, and choose to sacrifice usability in the interest of privacy, if that is what you'd like.
    - 6y ago

joncp 6y ago

That totally breaks my use case for Little Snitch: working tethered. When I tether my laptop it thinks it has free reign with the bandwidth and all of the little background processes can kill my data in a few minutes. With a firewall, I can grant access to only the processes that I need to get my work done. Now, I guess I have to run some external firewall between my laptop and my phone. ... or better yet, abandon Apple.

chrisshroba 6y ago
For what it's worth, my hacky solution to this is this script which kills all the background processes that use significant bandwidth. If you're interested in how I came up with the list of processes, I can share the BitBar [1] script I wrote for monitoring per-process network usage (I wrote a small wrapper around nettop that logs to a db, which is read periodically by my BitBar script to show me the per-process usage: if [ $(whoami) != root ] then echo "Please run as root, not $(whoami)" exit fi while true do killall -9 planb 2>/dev/null && echo "$(date) - Killed planb" killall -9 murdockd 2>/dev/null && echo "$(date) - Killed murdockd" killall -9 uplink-soecks 2>/dev/null && echo "$(date) - Killed uplink" killall -9 nsscacheclient 2>/dev/null && echo "$(date) - Killed nsscacheclient" killall -9 ksfetch 2>/dev/null && echo "$(date) - Killed ksfetch" killall -9 nsurlsessiond 2>/dev/null && echo "$(date) - Killed nsurlsessiond" killall -9 softwareupdated 2>/dev/null && echo "$(date) - Killed softwareupdated" done [1]: https://github.com/matryer/bitbar https://github.com/matryer/bitbar
- droopyEyelids 6y ago
  please share the script for monitoring per-process network usage! I'd love it.
  - chrisshroba 6y ago
    I just pasted the relevant files in here. At some point I'll try to make this a bit more professional and easy to use, but for now it works! https://gist.github.com/chrisshroba/e31fd89b6a560733d3f915e8ee4deed8 https://gist.github.com/chrisshroba/e31fd89b6a560733d3f915e8... (ps if having an easily installable version of this would be helpful to anyone reading this, please comment or upvote this and maybe I'll prioritize it :) )

AnonHP 6y ago

I trust Apple a lot more than I trust Google or Facebook, but this clamping down of the Mac without options for power users while officially stating that the Mac will remain a Mac is alarming and distasteful on the part of Apple. With the transition to Apple’s own chips looming, it seems like the days of “a Mac is a personal computer and not an app console like an iPhone or iPad” will be over by the middle of this decade. All Apple devices locked down completely and Apple decides the limits of what users can do on devices. This model made some sense for mobile (where restrictions were gradually removed or workarounds provided), but the Mac is going in reverse.

capableweb 6y ago
People keep saying "I trust company X a lot more than I trust company Y" but is "trust" really something that applies to companies at all? Feels weird to humanize companies in that way. If you trust a company, isn't it really that you trust the humans working at that company? So you should really say "I trust person X who happens to work at X today", as as soon as they leave, the trust went with them. Companies are not people and cannot be trusted to act in any interest but profits. Any trust you feel towards a company is towards humans in the company, but let's not anthropomorphise companies (yet, until we have better AI at least).
- snazz 6y ago
  You make a valid point, but it’s also worth considering how the stakeholders’ interests align with your own. Apple is in the premium hardware and value added services business, so its interests are aligned with mine with regards to privacy and producing a quality product. On the other hand, Facebook is in the ad business, so its interests are not aligned with mine on a variety of points.
- deltron3030 6y ago
  >but is "trust" really something that applies to companies at all? Of course, It's called branding. Promises that aren't kept are still promises that aren't kept, and Apple was traditionally known for going beyond expectations, it's the core of their brand. Some companies are more B2B business and developer friendly, like MS and FB, and others like Apple and Amazon are the opposite, they're first and foremost about B2C and mainstream customers. Apple is less B2B focused than before because of the iPhone. They don't have to attract devs by giving them the best tools, they can attract them because of their market share among solvent customers on mobile alone.

metroholografix 6y ago

Background: I've written my own kernel extension that works in similar manner to Little Snitch, but does a lot more, including SSL MITM and on-demand packet capture, that I've been using for more than 10 years now. It's a fact that Apple has continuously moved to lock down macOS in ways that are antithetical to folks that want full control over their operating system. To many of us that moved on from Linux on the desktop, the combination of a stable/uniform/attractive desktop environment with a Unix core that had great developer documentation -no longer the case!- and nicely-designed APIs was too much to resist. Unfortunately, the push towards consumers and Apple's increasingly one-sided my-way-or-the-highway approach (fueled by security concerns that to me are completely irrelevant, if not a huge annoyance and waste of time) means that a lot of us oldschool Unix hackers were left out in the cold. I don't plan to upgrade past Mojave and at some point in the future I will move back to Linux.

indymike 6y ago
I just moved from Macos to Linux. The Linux desktop experience has improved a lot in the past five years (at least KDE has).
- adambatkin 6y ago
  Linux on the desktop and Linux on the laptop (heh) has definitely improved. It _sometimes_ needs a little tweaking to get it right, but KDE/Plasma also happens to offer that level of "tweakability" that should satisfy almost all semi-mainstream users (at least anyone coming from Windows or Mac). Compared to my first Linux laptop (a Sony Vaio circa 2000), my current XPS 13 works as well as any Mac laptop I have ever owned, and all the hardware that you would "expect" to work (but probably didn't work as smoothly 10 or 20 years ago) Just Works (WiFi, external displays, excellent battery life/sleep, etc...) Based on the complaints I have heard about Apple hardware and MacOS over the past few years, I'd even argue that Linux-on-the-desktop isn't any less stable or harder to get working than a Mac.
  - kitsunesoba 6y ago
    I try the major DEs every few years to see if they fit me, most recently trying the newest KDE and GNOME versions in a VM about a month ago. Both have improved for sure, but they still have a long way to go… GNOME actually came closest but its customizability level is even lower than that of macOS, even factoring in extensions. Both suffer from a laundry list of minor annoyances that snowball into something that's hard to ignore, and in KDE's case the UX design they employ just doesn't jive with me at all. It's all enough that I end up coming back to macOS because despite its problems, it fits me in ways that nothing else even comes close to touching. Sometimes it feels like there will never be a macOS alternative that has what it takes for me to switch without feeling a major sense of loss.

AlexandrB 6y ago

Both major consumer OS vendors seem hell-bent on bringing the OS layer under their complete control. As a power user, it's very frustrating. Meanwhile "desktop" Linux still kind of sucks, just like it did 10 years ago. I don't have much hope of seeing a compelling, unified UX out of Linux in my lifetime.

hexis 6y ago
Maybe desktop Linux needs more people like you and me to help make it better?
- AlexandrB 6y ago
  I appreciate the sentiment, but I'm not a UX designer or expert. And the problem is not that Linux doesn't have enough UI developers, it's that many of them are working on re-inventing the wheel in different, competing ways. Linux needs a dictatorial BDFL for UI - a Linus Torvalds for the desktop - an idea somewhat antithetical to the distributed nature of open source development. It doesn't help that organizations that could be leading the charge keep changing direction. Ubuntu went Gnome -> Unity -> Gnome in the span of 15 years or so. And now they're going in hard on Snaps, which introduces breaks in UI uniformity again (Gnome Themes, for example[1]). [1] https://www.omgubuntu.co.uk/2020/10/automatic-theme-installation-for-snap-apps-is-shaping-up-nicely-video https://www.omgubuntu.co.uk/2020/10/automatic-theme-installa...
  - ebiester 6y ago
    Two groups tried that. Unity tried that, and GNOME is trying that. Many of us really hate GNOME's decisions. I'm not sure I really like the BDFL here.
- baq 6y ago
  It needs more people willing to pay software developers, UX designers and testers to improve the Linux desktop, starting with the kernel, graphics drivers, ending in consistent set of apps. This is a (ten) billion dollar endeavor.
6y ago

deleted 6y ago

[deleted]

smnrchrds 6y ago

Apple has been more and more acting on the belief that when you buy one of their devices, you don't buy and own the device. You rather purchase an experience—a service—from Apple. They don't have to let you run your own software on your device or poke around the internals. That is not part of the experience offered. You should use the device as Apple intends it to be used.

parliament32 6y ago
Device-as-a-Service is an excellent way to describe the Apple ecosystem.
spideymans 6y ago
For better or for worse, this has been Apple’s philosophy since forever. Steve Jobs himself said, “[users] are paying us to make these choices”. https://youtu.be/rKPEK9BSIhA https://youtu.be/rKPEK9BSIhA

sbuk 6y ago

Use Murus, which uses PF, which is built in to OS X... https://www.murusfirewall.com https://www.murusfirewall.com

deleted 6y ago
[deleted]

acgkmopvvgvmgv 6y ago

A good lesson for the anti-FLOSS crowd so heavily present in this website. I'll be the first to admit Linux desktops are full of flaws (although there are other options), just like every other OS but they could be fixed given enough money or maybe you could be the one that write that code. But an OS that is not FLOSS will always work against their users and restrict their freedom. It's also a big joke that they have so many ads talking about privacy, when they are just as bad as their rivals. I do understand that not everyone has a choice because specialized software that they need for professional use could be available only in other platforms and that's unfortunately. I don't expect an utopic world where everything is FLOSS but the OS is too important to be closed. It will only get worse with time.

brightball 6y ago

Unreal. Does it feel to anybody else that a lot of grip tightening seems to be happening right now?

GekkePrutser 6y ago
Yes it does. All in line with "Computing as a service" rather than "Computing as a product". We're now a guest inside our computers rather than the owner.

ramosu 6y ago

"I should have got a Thinkpad"

rowanG077 6y ago

Apple SW and HW need to be broken up. They have abused their position too much.

deleted 6y ago

[deleted]

Wowfunhappy 6y ago

I wonder if it would make sense for Little Snitch to continue supporting their kext-based solution in parallel to the new one, possibly only for users who are willing to disable SIP. You might argue that disabling SIP for a security product defeats the point, but I'm not sure if that's necessarily true. SIP effectively delegates trust away from the user and towards Apple, which is fine as a default—but the calculus may be different for experienced users, like the ones who use Little Snitch.

novok 6y ago
Eventually I don't think little snitch will even have apis to access stuff like that in the kernel as a kext as macos updates continue on.
- Wowfunhappy 6y ago
  Kexts are used by Apple internally, so I'd be shocked if they were removed from the OS completely. Third party kexts may be deprecated, but as long as SIP can be disabled it will always be possible to load your own.
  - dwaite 6y ago
    The networking subsystem that the kernel exposes could be removed however, replaced with one which is neither stable nor publicly documented.
  - saagarjha 6y ago
    Apple could stop allowing you to load kexts they don’t sign, like they do on iOS.
    - sneak 6y ago
      It’s my understanding (and I imagine yours is better than mine) that at least at present, the macOS kernel is open source, which would mean that unless they forked it, disabling firmware security and SIP would mean that you could replace it with a compatible one compiled from open sources that skips such a check. They can, of course, remove that option a number of ways: closed source kernel, disable the disablement of boot security (such as on iOS), et c.

m3kw9 6y ago

Maybe if you block it randomly renders your OS inoperable and you won’t know why. Example iCloud login, could be a few obscure network calls. You would then call Apple and ask wtf if you are some noob blocking everything. This isn’t old days where there could be zero dependence on the net for critical function.

Wowfunhappy 6y ago
This is one of the key purposes of the Apple Store. The Genius Bar would help you test on a clean account or do a full wipe — although, Little Snitch is well-known enough that I'd expect an Apple Store employee to recognize it pretty quickly. I suppose it's theoretically possible they're trying to drive down support costs. But, geez, that would make me much more scared about the direction Apple is taking than anything else. Really though, Little Snitch is quite explicit about what it does. It's also $40, and it's marketed to a pretty technical audience.

xyst 6y ago

This is a very sneaky move by Apple, shame on them.

danmg 6y ago

If a third party did anything like this, it would be considered malware.

fsflover 6y ago
Many already consider Apple software malware: https://www.gnu.org/proprietary/malware-apple.html https://www.gnu.org/proprietary/malware-apple.html.
- fsflover 6y ago
  Not sure why downvotes: It's true that some people consider Apple as malware and they do have a point, including the present title.
- murermader 6y ago
  Just read the german version of that article, and they way the talk, and the way it is represented does not sound professional at all. It often sounds like a parody, for example calling Apple „Big Brother“ for offering a cloud service. Its sounds really polemic and takes away some of its credibility, because of weird wording, and leaving out some information here and there so some things sound worse than they are.
  - fsflover 6y ago
    I agree with you, the style could be much better. However it does not change the listed facts.

giancarlostoro 6y ago

I mean I already knew something was weird when I couldnt su into root and do... root things without a bios hack on a Mac. Thats just not how Unix works at all... The whole concept of root is you are root no exceptions.

Wowfunhappy 6y ago
You don't need to hack anything, you just need to use the officially-supported mechanisms Apple provides to grant yourself more permissions (namely, disabling SIP and remounting the root filesystem).
jlgaddis 6y ago
> The whole concept of root is you are root no exceptions. Wait until you learn about mandatory access control [0] ... -- [0]: https://en.wikipedia.org/wiki/Mandatory_access_control https://en.wikipedia.org/wiki/Mandatory_access_control
kstrauser 6y ago
That's absolutely not true. For instance, the BSDs have the notion of securelevels (https://man.openbsd.org/securelevel.7 https://man.openbsd.org/securelevel.7) which severely limits what even the root user can do. SELinux can do a lot of the same things.
- m463 6y ago
  I don't know about bsd, but there's lots of documentation on how selinux works (including source code) and information on how to alter its behavior in a fine-grained fashion. and selinux doesn't leave itself a backdoor (as far as the nsa has told us)
  - kstrauser 6y ago
    That's a different issue, though. Today, booting into macOS is similar to booting into a BSD with securelevel=1 enabled, or into Linux with SELinux set up not to allow modifying files in /bin or such.

deleted 6y ago

[deleted]

bitobserver 6y ago

For anyone that wants to switch to Linux and retain similar functionality as this firewall app, there is this: https://github.com/gustavo-iniguez-goya/opensnitch https://github.com/gustavo-iniguez-goya/opensnitch

dhaavi 6y ago
There is another - and I'd argue better - alternative for Linux and Windows: Portmaster by Safing https://safing.io/portmaster/ https://safing.io/portmaster/ Not only is it an application firewall, but also gives you DNS filtering (ie. Pi-Hole basics) and DNS-over-TLS. Full Disclosure: I'm one of the founders.
- mindfulhack 6y ago
  But has it added pop-up per-app (and then per domain/port/ip) block/allow functionality in the Linux DE GUI yet? Thanks to your whole team for the awesome work.
  - dhaavi 6y ago
    This is already implemented, but was broken during an important refactor. We hope to fix it soon.

xlii 6y ago

Looks like one of the answers in the Twitter thread mentions that this might be cached content. Is this confirmed that the network call is actually being made (by router for example?). Cause later down the line it seems that pf blocks the calls just fine.

azinman2 6y ago

Everyone seems to assume this is true, but are people also confirming this? I installed LittleSnitch recently on Big Sur and I’m constantly getting pop up’s for all of Apple’s internal daemons etc. While I haven’t tried the App Store specifically, I’m wondering if the person didn’t understand how things were configured and was allowing certain traffic thru. I can’t imagine there’s really some big conspiracy here.

latexr 6y ago
The tweeter is Patrick Wardle, security researcher and creator of Objective-See[1] which publishes several macOS security apps, including the LuLu firewall. Given Patrick’s track record, it’s generally safe to assume due diligence was given to the claim and that lack of understanding about configuration doesn’t apply. As to your specific case, the tweet does mention “many of” Apple’s apps are affected (i.e. not all, not even necessarily the majority). [1]: https://objective-see.com/ https://objective-see.com/
LeoNatan25 6y ago
Confirmed. Someone also found the strings in the network stack, which are tested against the app's bundle identifier to provide these wholes. It's ridiculous.
- musicale 6y ago
  Do you have a reference? As noted, this seems to contradict what Objective Development is saying. Objective (sic) proof that Objective Development is lying would certainly be a big deal, and a very good reason not to trust Little Snitch.

Fizzadar 6y ago

I guess this means no updating to 5 or Big Sur then, I'll be keeping the kernel extension, thank you Apple.

sneak 6y ago

This is upsetting. I currently use macOS with iCloud, FaceTime, iMessage, and App Store all disabled, and use Little Snitch to prevent the machine from communicating with Apple except for on update days, and then limited only to those specific update processes. It’s possible that this will mean that the next macOS version will be unsuitable on privacy grounds, as I will then have to use a second physical device to prevent such network access. :(

dvfjsdhgfv 6y ago

Microsoft is doing the same as Apple, just because they can.

1MachineElf 6y ago

Is pf still included in macOS? I wonder if it blocks it. Last time I played with it was the Snow Leopard days: https://opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/net/pf.c.auto.html https://opensource.apple.com/source/xnu/xnu-1456.1.26/bsd/ne...

hariboapfel 6y ago

i think this is a bug. for instance iCloud photos syncing network traffic, (belongig to nsurlsessiond) doesnt show up in the BigSur native Activity Monitor, but for some reason still gets shown in my Stats app.

admax88q 6y ago

If Microsoft did this in windows, or Google did this in chrome, would we see so much defense of this strategy? Or could it be those rose coloured glasses that HN tends to view Apple through. Or more like "users are literally brain dead and cannot be trusted to change the channels on their TV" coloured glasses. If you only trust your users to watch TV, then get into TVs instead of computers. We don't fault the maker of a drill when a careless user drills a hole in their hand. We fault the user for being careless. At what point do we start doing the same for computers? The advantage of physical power-tools is that their mechanism of operation is readily apparent, open, understandable, predictable. If Apple really cares about their users, they should start investing in making software open, understandable, predictable. This is a much harder problem, and probably less profitable, than just building another TV, but I'd rather live in that world than this one. I don't need another TV.

wmeredith 6y ago
My problem with defending this is even if you trust Apple now, what about in the future? Google used to be one of the good guys...
nickflood 6y ago
Btw, when I've been testing a "kill switch" on Windows (firewall configuration that doesn't allow internet access without a VPN running) using the built-in firewall, I discovered that - Chrome adds a Firewall rule on installation that grants it access to all networks, bypassing kill switch configurations. - Microsoft has an "Allow app through Firewall" [1] dialog that manages all of the rules for its apps and services along with some third-party apps. These rules again tend to allow everything, and at least on earlier builds from like 2018 they would reset to allow everything on _every_ update. This was such a pain to deal with. [1] https://az767233.vo.msecnd.net/images/Security/win8_winfirewall_allowapp_addanother.png https://az767233.vo.msecnd.net/images/Security/win8_winfirew...

aftbit 6y ago

Chrome exempts Google properties from rules? Unacceptable! macOS exempts Apple apps from rules? Protecting users! Seriously, it's my machine. I should have top permissions on it, not Apple. If I chose to run an app that intercepts traffic, I want it to intercept _all_ traffic. What's next, making it impossible to hook a debugger to Apple services? Or did they already do that? As much as I love Mac & iPhone UX, stuff like this will keep me off them and keep me from recommending them to anyone either.

m3nu 6y ago

Apple is not going in a great direction for more technical people. Started looking a Linux desktops and r/unixporn . Maybe time to switch, when my Macbook is up for replacement.

_qulr 6y ago

"You have to trust Apple", it's said. But I suspect that if you actually knew how much your Apple devices were phoning home to Cupertino, you wouldn't trust Apple anymore. Using Little Snitch (the kernel extension) was a real eye opener for me. Especially when I allowed Little Snitch to block all Apple processes (by disabling the built-in iCloud Services and macOS Services rule groups). This may be a good time to remind folks of my blog post where I explain how Catalina phones home when you run unsigned executables, including shell scripts! In the article I mentioned that you can prevent this with Little Snitch. But that was the LS kext. Is it even possible anymore? https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm... Let me just quote one comment from the HN discussion of that article: https://news.ycombinator.com/item?id=23278253 https://news.ycombinator.com/item?id=23278253 "Making this about speed is burying the lede. From a privacy and user-freedom perspective, it's horrifying. Don't think so? Apple now theoretically has a centralized database of every Mac user who's ever used youtube-dl. Or Tor. Or TrueCrypt." It's all too easy to dismiss the privacy violations that we're not aware of. Out of sight, out of mind.

jachee 6y ago
Apply Occam's Razor. Why would the most successful company in history—a success gained in no small part through protecting users, selling hardware and services instead of their data, and promoting and enhancing privacy as a first-class feature—do that sort of thing? What possible benefit could such a centralized database serve? How's that gonna make them more money?
- _qulr 6y ago
  I'd love to apply Occam's Razor to Apple's network connections. Those entitles should not be multiplied without necessity. That's why I use Little Snitch! Seriously though, Tim Cook has been absolutely trashing Apple's hard won reputation by relentlessly pushing (via push notifications no less) TV shows and other garbage "subscriptions" on computer buyers. It's not what I signed up for when I became a Mac user many years ago.
- strogonoff 6y ago

jerrysievert 6y ago

I'm not too concerned about privacy-focused apple doing this, but if apple can do it others could figure out how to do it too. that completely breaks any network filtering and is not acceptable.

deleted 6y ago

[deleted]

jzl 6y ago

In the off chance anyone here is able to answer ... does anyone know how to trace the originating app when Little Snitch detects an outgoing connection from netbiosd? I believe that happens when an app tries to access an smb mount. Some app on my computer is constantly doing that to an AWS-hosted mount, but I can't figure out what.

skissane 6y ago

Does anyone know how this actually works, technically? Are these apps using some kind of special API? (If yes, what's to stop other people's apps using that API?) Is it because they are signed with some kind of special entitlement? Is it due to some combination of both? (Maybe you have to use some magic API, but you need to be signed with some magic entitlement to be allowed to use it?)

est 6y ago

Would something similar be done with Linux's netns ?

seemslegit 6y ago

Loving the "are we ok with this ?" take - as if anyone cares.

ghthor 6y ago

If everyone in this thread would use their energy to build a nice Little Snitch GUI app for linux firewalling instead of bitching, that do be great.

j45 6y ago

This might mean running firewalls on the local networks which block outgoing traffic to Apple. And possibly keeping Apple devices vpned to such a network. I was looking forward to new Apple devices, but feel uncertain about the "trust Apple but no one else" approach. Concerns: 1) Apple devices have been configurable to be respectful if not invisible in corporate or client windows networks. You could use a Mac with a firewall in windows environments without being worried about setting off something on the network for unusual traffic. Especially for environments that don't support some but don't stop it either. 2) Corporate Windows networks can control the monitoring of telemetry and metadata to a higher degree than Apple now seems to. It could be a new gap in Apple when compared to others. If the above are true, it's not clear if Apple sees few Mac users in any corporate environment as an opportunity to grow, it's only accelerating the consideration of other operating systems. Apple also appears to be signaling that devices do not belong to the customer. The idea of we will protect your data, but trust your data to our policies, which we can change seems confusing. I'm considering the new iPhone for security, but this workaround seems like an affront to it.