5 ms·
Yes I agree with your first part. There are real drawbacks. But it's like installing a custom HTTPS cert in your OS to inspect potential traffic that malware m
by 3pt14159 6y ago
Yes I agree with your first part. There are real drawbacks.
But it's like installing a custom HTTPS cert in your OS to inspect potential traffic that malware may use through, say, a Google Doc or Sheet. It's helpful to true professionals dealing with highly sensitive information, but it's ultimately a bigger source of compromise for the vast majority of software users.
I don't think there is an easy answer here. That's why I said I thought it made the world a "touch better" and I can see from your response that you understand the tradeoffs roughly as well as I do based on the wording of your response. The fact is that contemplating these hard tradeoffs belie the underlying truth: Securing computers is hard and getting harder and the stakes keep going up. I can't say if this move by Apple will ultimately be worth it, but I certainly understand the predicament they are in. This is no easy work.
- Godel_unicode 6y agoAbsolutely not, installing a CA makes attacks which weren't previously possible now possible. A host firewall isn't doing anything a network provider (read: your ISP, coffee shop, vpn provider, etc) couldn't already do. At least you can possibly look at what the host firewall is doing.
- jachee 6y agoInstalling any third-party software that inspects network traffic makes attacks which weren't previously possible now possible, since that software can be targeted.
- deleted 6y ago[deleted]
- silentOpen 6y agoIt depends on the host firewall... many quality operating systems allow host firewalls to apply process-based policy which your upstream certainly can’t achieve.
- vaxman 6y agoIf they can circumvent system security for their own purposes (even though I’m sure it wasn’t planned to be that way), then they should be open to circumventing it for our country (by backdoor-ing their encryption), at least that is how I would imagine it will be referenced in the inevitable government lawsuit. What a major screw up Apple!
- vaxman 6y agoHow dare the guy with over 40 years on the job think such things! (What, are there like under 500 of us left?) Downvote him into retirement!! (what’s that? He STILL isn’t old enough to use the senior menu at IHop? Omg he might know something about Apple he didn’t read on a blog post!) Point being that people who actually need their reputation on here in order to maintain employment are fully suppressed, which means the commenters are following each other “in a circle” trying to maintain their popularity contest. Sadly, that means HackerNews is mainly for entertainment and judging popularity only. (I’m obviously here for the entertainment rofl)
- saagarjha 6y agoI’m having trouble understanding your comment, but it sure sounds a lot like complaining about downvotes–that’s usually not well received.
- specialp 6y agoI helped a friend of mine with her OS X laptop. She had installed something bad and it installed MITM proxy and its own CA and other things to totally own and inspect all of her web browser traffic including SSL. So these features that we find powerful and informative also do have a dark side for more novice users.
- calciphus 6y agoOK, but if it's a real security risk why do they only protect their own services? Why not have the user jump through a bunch of complex hoops like editing a plist file from an elevated terminal account? Hell, this is the os that makes it onerous to install software that didn't come from the App store. Clearly they don't mind throwing some user pain in front of basic activities.
- Wowfunhappy 6y ago> Hell, this is the os that makes it onerous to install software that didn't come from the App store. No, they really don’t. Unsigned software is a little onerous, but signed software can come from outside the Mac App Store.
- suifbwish 6y agoI’m trying to think of a powerful tool that is not dangerous. Still thinking
- Aerroon 6y agoWhy not just give additional permission levels? I don't really get why so many permission models on what software can do are effectively "admin mode" or "user mode". Why can't you get a very strong warning when software tries to snoop on traffic, but you can still do it? Or maybe you have to go into settings and allow it or something like that. When you rent space in a building, do you get access to every single apartment/office space in the building? No. You get access to specifically what you rented and the front door. The maintenance people for the building will have access to the front door and other maintenance areas, but won't have access to your space. We can clearly conceptualize models like that. We even have something like this on phones.
- saagarjha 6y agoApple's argument is typically "users ignore strong warnings".