7 ms·

So, there is no software way to prevent this? This is as crazy as it gets, and totally unbelievable. So there are no true VPN apps in Big Sur at all? Or true f

So, there is no software way to prevent this? This is as crazy as it gets, and totally unbelievable. So there are no true VPN apps in Big Sur at all? Or true firewalls? Honestly, this is so hard to believe that it cannot be untrue. They are totally sick at Apple.

deepstack 6y ago
Apple is the new MS!
- deepstack 6y ago
  By this I just mean it is general observation in company when they become large. If we are to support free market. Big companies are not be allowed to exist, it just encourage mon/dup/oli gopoly and hinter economic optimisation.
  - EGreg 6y ago
    AND it is Big Brother in its “1984” ad. “We will prevail!” Ironic, isn’t it PS: Why don’t the people here combine forces and capital to create a video and privately registered website like apple1984.com (I think trademarks can be used for criticism, otherwise just use 1984 plus something) and actually run this ad to shame apple on various social media and youtube? DoubleTwist did. https://www.dmlp.org/legal-guide/using-trademarks-others https://www.dmlp.org/legal-guide/using-trademarks-others
  - carlmr 6y ago
    One of the issues I see with this is that the free market encourages companies to try to become a monopoly/oligopoly, because it's the only way to sustain profits in the normal idealized market models. So you can't support the free market and not allow big companies to exist at the same time. Instead I think it would be honest to say that we don't want free markets, because they have inherent issues that are detrimental to people. At the same time we don't want planned markets which have historically failed as well. Instead there must either be a better paradigm or a sweet spot in between (e.g. a well regulated somewhat free market).
    - syshum 6y ago
      Actually you can support free markets and prevent large corporations Most large corporations become large not purely on market forces but because of Regulatory capture where by they slam the door on competing businesses by passing "consumer friendly" regulations that is in reality more focused on preventing new comers to the market Why do you think Facebook is soo hell bent on getting regluations from the government on social media, because they know they will be one of the "stakeholders" that will help write them thus ensuring their market dominance Why do you think Amazon is now in favor of National Sales Tax regulations, because now that they have to pay sales tax in all 50 states is favors them to have 1 regulation vs 3000 Why do you think Walmart now favors raising the minimum wage, because social and economic pressure has forced them to raise their own wages so they want to ensure all companies have to pay the same wages they are Point to any large company that is in a position of market dominance and I will show the government regulations that allow them to operate in that way hell the very basis of the corporation is a fictitious entity created by government to limit liability, the laws around those corporations (especially public corporations) are government regulations written by large corporations for their benefit, That is not a free market at all
      - asimpletune 6y ago
        I totally agree with this sentiment, e.g. > Why do you think Facebook is soo hell bent on getting regluations from the government on social media What truly threatens these corporations isn't regulation, in fact I'd wager they're counting on it. The real threat is the next Instagram that walks through the door that doesn't sell to FB. Basically, the biggest threat to FB is the fact that people don't really care about FB, they just want something to look at on their phones. It's totally in FB's best interest then to make it more difficult for competition to invent new ways to look for people to look at their phones. Banking and finance in general is probably the best example. It's so difficult to start a bank these days that your best bet is to acquire a failing one. However, on this point: > Point to any large company that is in a position of market dominance and I will show the government regulations that allow them to operate in that way I don't really see how Apple falls under this category? I can see it for Amazon, Netflix, Walmart, Google, Facebook, etc... but what about Apple?
mantap 6y ago
It also means Tor can no longer exist on the Mac. What a sad day for privacy.
- pfortuny 6y ago
  Totally irresponsible. There is no way I can understand this policy. Impossible. What, are they working with someone? Five eyes? China? Spain? The Soviet Block? Honestly, this is either utter imbecility or straight ill-will. There are no greys here. At all. When you do a think like this either you are stupid or you DO know the risks and are OK. Great: now people in Hong-Kong cannot use Big Sur because they should be afraid of the apps they are using.
  - BlueTemplar 6y ago
    Remember that we have no idea whether Windows and Intel processors with IME (and AMD processors since Ryzen ?) don't have built-in backdoors (And Macs have been using Intel exclusively for years now, haven't-they ?). So nothing very new here, really... https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
    - tpush 6y ago
      Apple disables most of Intel's ME [0]. [0] https://support.apple.com/guide/security/uefi-firmware-overview-seced055bcf6/web https://support.apple.com/guide/security/uefi-firmware-overv...
      - BlueTemplar 6y ago
        Interesting... though they don't give a date. Was it 2006, 2017... a gradual process since 2006 ?
      - chungus_khan 6y ago
        It's still in use for DRM though apparently, and so long as it still runs, and so long as we still can't audit it, it isn't trustworthy from a strict privacy perspective.
chank 6y ago
Supposedly, there is a way. You can just remove all the apps from the whitelist. After that apps like Little Snitch pickup on the activity. Hosts file I believe still works as well but I haven't seen anyone who's tried it out yet and posted about it. One caveat is that you probably have to monitor the whitelist to make sure nothing gets added to/back without you knowing about it. Not sure how well any of that works though. I'm not touching Big Sur or the new macs with a 10' pole until all the software that I rely on is updated to not require kexts 100% (including Little Snitch full support) and Apple silicon has virtualization support so I can run Docker. I'm really glad I just upgraded to the latest intel mbp a few months ago.
- lwkl 6y ago
  Yes according to this [1] there is a way to remove the whitelist entries. It doesn‘t seem practical and it‘s a big turn off for me. I was thinking about switching to an ARM Mac when the second or third generation comes out, depending on how they perform. But now I‘m thinking I probably won‘t switch. Especially with things like this and how stuff like this is enforced on other platforms. How can I know that the option to edit the whitelist won‘t be removed as fast as the default entries were added to the whitelist? 1: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....
  - claudeganon 6y ago
    And requires that you disable system integrity protection, which opens you up to other threats as well as bugs that can prevent you from being able to boot at all: https://mrmacintosh.com/google-chrome-keystone-is-modifying-var-symlink-on-non-sip-macs-causing-boot-issues/ https://mrmacintosh.com/google-chrome-keystone-is-modifying-...
- pfortuny 6y ago
  Oh, thanks. At least there seems to be a way to try and fight it. What a mess, man...
Aaargh20318 6y ago
> So there are no true VPN apps in Big Sur at all? VPN work just fine for me. Some Apple apps mat bypass the VPN, but I don’t see a reason those apps would need to connect to the company intranet in the first place.
- pfortuny 6y ago
  There is no guarantee that your vpn is doing what it claims it is doing... Because the kernel is not doing what you are telling it to do.
  - Aaargh20318 6y ago
    If it didn't work, then I wouldn't be able to access services on the intranet, now would I ?
- black_puppydog 6y ago
  Yeah. Just trust apple. You don't want those things to go through your VPN. Nevermind that your VPN might have the purpose of bypassing shitty, insecure public wifi. Nevermind you may not be trusting your local/national internet infrastructure. Apple knows best. Trust them. /s
  - Aaargh20318 6y ago
    > Nevermind that your VPN might have the purpose of bypassing shitty, insecure public wifi. > Nevermind you may not be trusting your local/national internet infrastructure. Routing traffic onto the public Internet through a 3rd party adds absolutely nothing to security. You shouldn’t trust the Internet in any case. If you use it to ‘bypass shitty security’ and then all you’re doing is trick yourself into a false sense of security. VPN services like that are complete and total bullshit.
    - detaro 6y ago
      You don't need to use a "bullshit" "VPN service" for that.
ur-whale 6y ago
There's a very easy way to prevent it: stop using Apple products.
floatingatoll 6y ago
False. True VPN apps, that simply set up a VPN network interface and alter your default route, continue to route Apple traffic along with all other traffic.
planb 6y ago
Everyone upvoting this, please read the (now) top rated comment and take a step back to think about how this line of thinking is destroying our society right now. If something fits your world view (Apple is evil) you stop looking for more evidence and join your tribe. Feels good, but only helps to spread misinformation.
- trevyn 6y ago
  Is thinking that everyone’s behavior is due to cognitive bias a cognitive bias itself?
  - lxgr 6y ago
    Of course there is :) https://en.wikipedia.org/wiki/Bias_blind_spot https://en.wikipedia.org/wiki/Bias_blind_spot It doesn't render GPs point moot, though.
- AlexandrB 6y ago
  The top rated comment is also misleading. This functionality (filtering Apple app traffic using Little Snitch) used to be possible before Apple made it impossible. The fact that you can still route Apple app traffic through a system-wide VPN doesn't change that a bunch of more-selective firewalls/VPNs have effectively been nerfed by Apple's actions. So yes, Apple is in the wrong. Edit: The article headline is technically accurate (if a little clickbaity): "Apple apps on Big Sur bypass firewalls and VPNs". Yes the do! Not all firewalls. But they bypass some of the most popular ones, like Little Snitch.
  - Sirened 6y ago
    I mean, I'm not close to Little Snitch's development but I'm pretty sure they used to use a kernel extension. Kernel extensions are deprecated but they aren't going anywhere anytime soon since it seems like Apple just built a brand new kext loading system to handle static kernelcaches
  - blub 6y ago
    The top rated comment from wizee seems correct. There are several technologies involved: * system-wide VPNs - apparently work as before * software firewalls - some Apple apps not blocked * per-app VPNs - These are designed to tunnel traffic of a specific app through e.g. a corporate VPN and frankly have no connection to the topic.

deepstack 6y ago

Apple is the new MS!

deepstack 6y ago
By this I just mean it is general observation in company when they become large. If we are to support free market. Big companies are not be allowed to exist, it just encourage mon/dup/oli gopoly and hinter economic optimisation.
- EGreg 6y ago
  AND it is Big Brother in its “1984” ad. “We will prevail!” Ironic, isn’t it PS: Why don’t the people here combine forces and capital to create a video and privately registered website like apple1984.com (I think trademarks can be used for criticism, otherwise just use 1984 plus something) and actually run this ad to shame apple on various social media and youtube? DoubleTwist did. https://www.dmlp.org/legal-guide/using-trademarks-others https://www.dmlp.org/legal-guide/using-trademarks-others
- carlmr 6y ago
  One of the issues I see with this is that the free market encourages companies to try to become a monopoly/oligopoly, because it's the only way to sustain profits in the normal idealized market models. So you can't support the free market and not allow big companies to exist at the same time. Instead I think it would be honest to say that we don't want free markets, because they have inherent issues that are detrimental to people. At the same time we don't want planned markets which have historically failed as well. Instead there must either be a better paradigm or a sweet spot in between (e.g. a well regulated somewhat free market).
  - syshum 6y ago
    Actually you can support free markets and prevent large corporations Most large corporations become large not purely on market forces but because of Regulatory capture where by they slam the door on competing businesses by passing "consumer friendly" regulations that is in reality more focused on preventing new comers to the market Why do you think Facebook is soo hell bent on getting regluations from the government on social media, because they know they will be one of the "stakeholders" that will help write them thus ensuring their market dominance Why do you think Amazon is now in favor of National Sales Tax regulations, because now that they have to pay sales tax in all 50 states is favors them to have 1 regulation vs 3000 Why do you think Walmart now favors raising the minimum wage, because social and economic pressure has forced them to raise their own wages so they want to ensure all companies have to pay the same wages they are Point to any large company that is in a position of market dominance and I will show the government regulations that allow them to operate in that way hell the very basis of the corporation is a fictitious entity created by government to limit liability, the laws around those corporations (especially public corporations) are government regulations written by large corporations for their benefit, That is not a free market at all
    - asimpletune 6y ago
      I totally agree with this sentiment, e.g. > Why do you think Facebook is soo hell bent on getting regluations from the government on social media What truly threatens these corporations isn't regulation, in fact I'd wager they're counting on it. The real threat is the next Instagram that walks through the door that doesn't sell to FB. Basically, the biggest threat to FB is the fact that people don't really care about FB, they just want something to look at on their phones. It's totally in FB's best interest then to make it more difficult for competition to invent new ways to look for people to look at their phones. Banking and finance in general is probably the best example. It's so difficult to start a bank these days that your best bet is to acquire a failing one. However, on this point: > Point to any large company that is in a position of market dominance and I will show the government regulations that allow them to operate in that way I don't really see how Apple falls under this category? I can see it for Amazon, Netflix, Walmart, Google, Facebook, etc... but what about Apple?

mantap 6y ago

It also means Tor can no longer exist on the Mac. What a sad day for privacy.

pfortuny 6y ago
Totally irresponsible. There is no way I can understand this policy. Impossible. What, are they working with someone? Five eyes? China? Spain? The Soviet Block? Honestly, this is either utter imbecility or straight ill-will. There are no greys here. At all. When you do a think like this either you are stupid or you DO know the risks and are OK. Great: now people in Hong-Kong cannot use Big Sur because they should be afraid of the apps they are using.
- BlueTemplar 6y ago
  Remember that we have no idea whether Windows and Intel processors with IME (and AMD processors since Ryzen ?) don't have built-in backdoors (And Macs have been using Intel exclusively for years now, haven't-they ?). So nothing very new here, really... https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf
  - tpush 6y ago
    Apple disables most of Intel's ME [0]. [0] https://support.apple.com/guide/security/uefi-firmware-overview-seced055bcf6/web https://support.apple.com/guide/security/uefi-firmware-overv...
    - BlueTemplar 6y ago
      Interesting... though they don't give a date. Was it 2006, 2017... a gradual process since 2006 ?
    - chungus_khan 6y ago
      It's still in use for DRM though apparently, and so long as it still runs, and so long as we still can't audit it, it isn't trustworthy from a strict privacy perspective.

chank 6y ago

Supposedly, there is a way. You can just remove all the apps from the whitelist. After that apps like Little Snitch pickup on the activity. Hosts file I believe still works as well but I haven't seen anyone who's tried it out yet and posted about it. One caveat is that you probably have to monitor the whitelist to make sure nothing gets added to/back without you knowing about it. Not sure how well any of that works though. I'm not touching Big Sur or the new macs with a 10' pole until all the software that I rely on is updated to not require kexts 100% (including Little Snitch full support) and Apple silicon has virtualization support so I can run Docker. I'm really glad I just upgraded to the latest intel mbp a few months ago.

lwkl 6y ago
Yes according to this [1] there is a way to remove the whitelist entries. It doesn‘t seem practical and it‘s a big turn off for me. I was thinking about switching to an ARM Mac when the second or third generation comes out, depending on how they perform. But now I‘m thinking I probably won‘t switch. Especially with things like this and how stuff like this is enforced on other platforms. How can I know that the option to edit the whitelist won‘t be removed as fast as the default entries were added to the whitelist? 1: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....
- claudeganon 6y ago
  And requires that you disable system integrity protection, which opens you up to other threats as well as bugs that can prevent you from being able to boot at all: https://mrmacintosh.com/google-chrome-keystone-is-modifying-var-symlink-on-non-sip-macs-causing-boot-issues/ https://mrmacintosh.com/google-chrome-keystone-is-modifying-...
pfortuny 6y ago
Oh, thanks. At least there seems to be a way to try and fight it. What a mess, man...

Aaargh20318 6y ago

> So there are no true VPN apps in Big Sur at all? VPN work just fine for me. Some Apple apps mat bypass the VPN, but I don’t see a reason those apps would need to connect to the company intranet in the first place.

pfortuny 6y ago
There is no guarantee that your vpn is doing what it claims it is doing... Because the kernel is not doing what you are telling it to do.
- Aaargh20318 6y ago
  If it didn't work, then I wouldn't be able to access services on the intranet, now would I ?
black_puppydog 6y ago
Yeah. Just trust apple. You don't want those things to go through your VPN. Nevermind that your VPN might have the purpose of bypassing shitty, insecure public wifi. Nevermind you may not be trusting your local/national internet infrastructure. Apple knows best. Trust them. /s
- Aaargh20318 6y ago
  > Nevermind that your VPN might have the purpose of bypassing shitty, insecure public wifi. > Nevermind you may not be trusting your local/national internet infrastructure. Routing traffic onto the public Internet through a 3rd party adds absolutely nothing to security. You shouldn’t trust the Internet in any case. If you use it to ‘bypass shitty security’ and then all you’re doing is trick yourself into a false sense of security. VPN services like that are complete and total bullshit.
  - detaro 6y ago
    You don't need to use a "bullshit" "VPN service" for that.

ur-whale 6y ago

There's a very easy way to prevent it: stop using Apple products.

floatingatoll 6y ago

False. True VPN apps, that simply set up a VPN network interface and alter your default route, continue to route Apple traffic along with all other traffic.

planb 6y ago

Everyone upvoting this, please read the (now) top rated comment and take a step back to think about how this line of thinking is destroying our society right now. If something fits your world view (Apple is evil) you stop looking for more evidence and join your tribe. Feels good, but only helps to spread misinformation.

trevyn 6y ago
Is thinking that everyone’s behavior is due to cognitive bias a cognitive bias itself?
- lxgr 6y ago
  Of course there is :) https://en.wikipedia.org/wiki/Bias_blind_spot https://en.wikipedia.org/wiki/Bias_blind_spot It doesn't render GPs point moot, though.
AlexandrB 6y ago
The top rated comment is also misleading. This functionality (filtering Apple app traffic using Little Snitch) used to be possible before Apple made it impossible. The fact that you can still route Apple app traffic through a system-wide VPN doesn't change that a bunch of more-selective firewalls/VPNs have effectively been nerfed by Apple's actions. So yes, Apple is in the wrong. Edit: The article headline is technically accurate (if a little clickbaity): "Apple apps on Big Sur bypass firewalls and VPNs". Yes the do! Not all firewalls. But they bypass some of the most popular ones, like Little Snitch.
- Sirened 6y ago
  I mean, I'm not close to Little Snitch's development but I'm pretty sure they used to use a kernel extension. Kernel extensions are deprecated but they aren't going anywhere anytime soon since it seems like Apple just built a brand new kext loading system to handle static kernelcaches
- blub 6y ago
  The top rated comment from wizee seems correct. There are several technologies involved: * system-wide VPNs - apparently work as before * software firewalls - some Apple apps not blocked * per-app VPNs - These are designed to tunnel traffic of a specific app through e.g. a corporate VPN and frankly have no connection to the topic.