10 ms·

Big no on Big Sur: Mullvad disallows Apple apps to bypass firewall

281 points by Semaphor 6y ago

beervirus 6y ago
This is just an ad.
pwinnski 6y ago
Does this mean that MacOS packet filtering does work as expected, and can block any/all traffic, including traffic to Apple? That's good, and what I would hope, but then I'm a little confused about what nastiness Apple is doing in Big Sur related to firewalls. Time to dig in, I guess.
- pram 6y ago
  That problem is different: whitelisted Apple traffic is not able to be dectected/stopped by third party software using the new userland network APIs (that replaced kexts)
  - gruez 6y ago
    >whitelisted Apple traffic is not able to be dectected/stopped by third party software using the new userland network APIs (that replaced kexts) This sentence suggests that there's no way to filter/vpn whitelisted traffic, but this is clearly not the case, as evidenced by this article. Furthermore, it's still possible to block/filter traffic on a whole machine basis by using the Packet Tunnel Provider API. https://news.ycombinator.com/item?id=25113039 https://news.ycombinator.com/item?id=25113039
    - pram 6y ago
      You have poor reading comprehension if you think thats what I said.
- floatingatoll 6y ago
  macOS packet filtering in Big Sur is unchanged, offering src/dst host/port/proto filters, as is typically thought of to be a 'firewall'. macOS content filtering in Big Sur is no longer able to intercept apps on the exclusion list shipped by Apple, and is akin to 'iptables --uid 501' or 'iptables --command firefox-bin' (actual syntax may vary). The content filtering API can see which user/app originated the traffic, as it's running higher up in the stack; the packet filtering API cannot, as it's running lower down in the stack. Apps such as Little Snitch allow you to filter network traffic per-application, which can't be done with PF; you need CF for that, and CF no longer extends to Apple core system processes in Big Sur. Mullvad's blocks are done imprecisely with PF (presumably they deny 17.0.0.0/8), which is why their blocks break various functionality such as the Mac App Store or: > For example, the keyboard sometimes takes longer to wake up from sleep mode. Or, in certain situations, the Mullvad app takes longer to detect that the computer is online. And while they note that it's possible to punch exceptions into the firewall, those exceptions can't be granted per-use, only per-IP.
  - pwinnski 6y ago
    Okay, this makes sense, thanks. I happen to not use app-level filtering these days, only pi-hole and and packet-firewall stuff, so I guess I'll be unaffected if I ever upgrade. Bypassing app-level filtering, though, that sucks.
    - floatingatoll 6y ago
      I assume that Apple's reasoning is "Userspace malware shouldn't be able to trivially intercept anti-malware checksum updates". Trivially is defined as 'click an OK button in a dialog' as the CF permissions process works in Big Sur today. Malware could still block anti-malware checksum updates with PF, but that requires sudo/root which is 'less easy' than the one-click CF approval process, and PF blocks break so many things on the system that malware can't get away with it without triggering a call to technical support. (I personally think that much of the issue here is 'macOS background updates can cause $$$$ cellular data drain over wifi-tethered cellular', and that the absence of Low Bandwidth mode in Control Center is one thing that drives users towards these third-party content filters, when they might otherwise not need a third-party product at all.)
- whazor 6y ago
  A VPN provides internet connectivity, therefore it is more like a partially broken internet connection instead of a firewall.
  - penagwin 6y ago
    This is the best description of a "programmer solution" ever.
  - fgonzag 6y ago
    Doesn't a VPN work over the internet (in order to access a local network). So I wouldn't say it provides internet connectivity (as you already need to be connected to the internet to connect to a VPN). A VPN simply gives you access to a local network. A specific use of a VPN is masking your internet traffic as if it came from that local network, but there are many uses besides it.
- zepto 6y ago
  The nastiness is based on misunderstanding of what Apple is doing, and of how their API’s work, coupled with a healthy distrust for large organizations. The distrust seems valid to me, but it unfortunately seems to lead to a bunch of confirmation bias.
Semaphor 6y ago
While I never used anything Apple, I’m a Mullvad user. This just popped up in my RSS feed and I thought it would be relevant.
gruez 6y ago
AFAIK it's nothing to do with mullvad specifically. Using the generic openvpn/wireguard client (or other VPN service's client that are based on those clients) should also be fine. The only thing that might be an issue would be VPN apps that implement split/per-app tunneling.
crazygringo 6y ago
This makes me feel somewhat better, honestly. The fact that packet-level firewalls work is reassuring. It hadn't been clear from previous reports that they all have to do with content-level filtering and VPN's. In that context, it seems to make more sense for Apple to exempt its own critical services (like malware detection and security updates). Kind of the same way applications can't overwrite system files either. I am curious though: can anyone think of any real-world scenario where it's a genuine problem that Apple traffic isn't routed through the VPN? When I think of normal uses for VPN's -- security for online work and communications, evading censorship, bypassing geo blocks -- these would all seem to be entirely unaffected. Is there anything at all an ISP or attacker could snoop on outside your VPN that could ever be genuinely threatening or privacy-invading? Or is there a worry that we don't have a definitive answer to this because nobody's catalogued everything Apple sends and looked for privacy vulnerabilities?
- jitl 6y ago
  The fact that you use an Apple device is readily apparent from these traffic patterns - that alone seems worth hiding with a VPN.
  - acdha 6y ago
    What's your threat model for this concern? Local networks are still going to see the MAC address (randomization means they can't track you specifically across different WiFi networks, but they still know it's an Apple device). VPNs aren't perfect so an attacker is almost certainly going to see enough from DNS queries, HTTP user agents, TLS SNI headers, etc. to detect the OS in the times where the VPN isn't active. Traffic analysis is also likely to be leaky at this level, too — if you see a big download around the time that Mac/iOS updates come out that's pretty indicative even if you can't see the traffic.
    - beagle3 6y ago
      Capital One used to offer different mortgage rates to IE users and Firefox users; I’m sure there are places that would try to charge Mac users more (or make them more likely to be mugged or something) as they are more well-off statistically. Verizon used to add http headers identifying their users to advertisers. Everyone is out to tag you, and it’s because on average it makes them ever-so-slightly more profitable - at your expense, on average.
varispeed 6y ago
It is a matter of time Apple will block it. They are thirsty for your personal data and they need to know everything you do on their computer. They also need to control what you can or cannot open. You are just not smart enough in Apple eyes to use a computer on your own. On a side note, if I was an Apple customer I'd start making GDPR complaints. Surely just because a OS is not a web app it doesn't mean it can violate privacy in such brazen way.
- judofyr 6y ago
  > They are thirsty for your personal data and they need to know everything you do on their computer. This is completely opposite of what Apple does, no? Out of all of the tech giants (Microsoft, Facebook, Google) it's my impression that Apple is the one that sends the least amount of data to their own servers.
  - wmf 6y ago
    It's contrarianly cool to interpret Apple's "pivot to services" to mean adopting the privacy-invading Google/Facebook business model but that's probably not happening in reality.
    - dewey 6y ago
      You pay for the service with money though, which is kinda the opposite of what Google/Facebooks services are.
      - totalZero 6y ago
        I pay Google for additional cloud storage. Doesn't mean they're any more careful with my data than they were when I was on the free tier.
  - jjd33 6y ago
    Apple is an American company. It does not matter what they say they are required by US to log everything and store it. Never got why people blindly trust those privacy claims.
unicornfinder 6y ago
I find it worrying that the side effects of leaving Mullvad enabled are that the keyboard takes longer to wake from sleep. What the hell is going on here?
- Zarel 6y ago
  This explains a lot, actually. I travel a lot, so I often deal with very bad internet connection quality. I also often have the problem that my keyboard takes a long time to start working again after sleep mode. I've even gotten the "you don't have a keyboard plugged in" error message on my laptop (because the keyboard hasn't been detected after ~30 seconds).
- bede 6y ago
  My guess is that this is somehow linked to iCloud device handoff, which does all kinds of questionable stuff [0] on e.g. device wake. [0] https://arxiv.org/pdf/1904.10600.pdf https://arxiv.org/pdf/1904.10600.pdf
- FireBeyond 6y ago
  This is also an issue on always-on VPNs, where the process of verifying keyboard firmware can result in the alarming "Please connect a keyboard via Bluetooth" dialog on even a laptop. It goes away as soon as the verification completes, but is not the fault of Mullvad per se.
  - crazygringo 6y ago
    I'm aware of this being a well-documented issue starting in Catalina [1], but I wasn't aware there was a definitive answer as to why. Do you have a source for the fact that it's firmware verification? Either way, seems like a terribly buggy design. [1] https://www.reddit.com/r/PrivateInternetAccess/comments/gqkhor/macos_catalina_keyboard_and_trackpad_issue_on/ https://www.reddit.com/r/PrivateInternetAccess/comments/gqkh...
    - FireBeyond 6y ago
      I wish I did. I just remember it being a huge annoyance. It does both make sense and seem incredibly buggy. It'd have to be a fairly impressive attack vector that hits the keyboard firmware, but if you did, I suppose you'd have access to the raw key stream to exfiltrate... not curious to see if it applied on my Mac Pro (which just has a WASD keyboard - I don't use the Apple Magic Keyboard), or a MBP without touchbar (maybe this is the firmware, not the keyboard per se). I do know it is demonstrably the VPN at issue - I can disable our always-on device VPN and the problem goes away, but alas, no easily accessible source that says "verification of HID firmware" or similar.
breatheoften 6y ago
Apple making some of its components bypass application level firewall might need to occur given the reality that a modern os is a decentralized system -- but I really think the set of such code with this functionality should be minimized to the absolute smallest possible surface area -- and this behavior should be confined to a tiny set (or even a single) of system components ... "low latency clock coordinator component" or whatever the true architectural reason for the system to require unfettered network access is ... It seems to me like ultimately the only use cases that should require bypassing network controls will relate to scenarios where there are architectural constraints imposed by the need to minimize latency - and minimizing latency needs to be possible ... so Whatever needs to happen at the architecture level to ensure minimal latency is going to need to happen -- but hopefully only those things ... -- and hopefully only in ways that are visible and decoupled from content-ful network transactions ...
mamcx 6y ago
One thing about this: Ok, Apple is not that evil to use my data(?), is not that bad because whatever, but: My mac become ABSOLUTELY freeze. Impossible to use. In the middle of a fix that UI must have delivery (a host was down for a customer, good timing!). So, the fact that the machine become a brick is a part that is not considered much on this discussion. Look, spy on me, ok(?); but also not allow me to move?
- valuearb 6y ago
  You can turn off the internet and freely use your Mac. The network dependent features are smart enough to know you are offline and not impede you. Their problems come when you have bad connections or Apples servers are down/overwhelmed. They don’t fail gracefully then. As a mobile developer I know there are always at least two or more failure modes with any network request, failures because of network/server failures, or failures because internet is off. My clients constantly think Airplane mode is the bad network test case,and I constantly remind them that no, it’s only one possible error cause.
  - swiley 6y ago
    A large number of people seem to use macs as fancy ssh video terminals/zoom phones. That application completely breaks in this situation.
  - mamcx 6y ago
    > You can turn off the internet and freely use your Mac Interesting! Now, how I could fix the problem with the SERVER DOWN of my customer: :)
xvector 6y ago
Mullvad is a fantastic provider!
- nbzso 6y ago
  I am using Mullvad (3 years in a row). The app updates are regular and interface for switching countries is clear and functional. Highly recommend.
  - 93po 6y ago
    You can also use Mozilla VPN to support Firefox and use the same service (it's done through Mullvad). Downside to Mozilla though is no Mac or Linux client
speakspokespok 6y ago
Is there a difference between disallowing an action and denying it? I think so, and that word choice matters. I see this pattern everywhere. Do you disallow someone on FB, or do you block them? Does iptables use disallow as a keyword? I do see BLOCK and DROP though. Normalized use of the passive voice is no different than being uncomfortable with making eye contact during a regular conversation. Perhaps the writer accounted for that considering the user base.
umvi 6y ago
> For example, the keyboard sometimes takes longer to wake up from sleep mode Apple computers phone home before waking up the keyboard from sleep? What in the world?
- SulfurHexaFluri 6y ago
  How else would they be able to protect the user from an unauthorized screen replacement?
  - echelon 6y ago
    When are they going to require an always-on camera to protect the user from potentially being held at gunpoint? Or is Apple confident they're the only party that gets to do that?
- pilsetnieks 6y ago
  There has been malware that pretends to be a HID driver and function as a keylogger and/or execute arbitrary code. While Apple may be being overly cautious here, it's not entirely unreasonable.
  - ballenf 6y ago
    And how does phoning home help here?
    - amelius 6y ago
      Presumably to check if the software that is about to run is in a blacklist. But this is nonsense because the blacklist could also be downloaded and checked locally.
      - deleted 6y ago
        [deleted]
  - eptcyka 6y ago
QEOHZadkDyBpX 6y ago
mullvad app overwrites firewall rules and allows all outgoing connections.. https://github.com/mullvad/mullvadvpn-app/issues/2171 https://github.com/mullvad/mullvadvpn-app/issues/2171
90red 6y ago
While I'm very grateful for the research that Mullvad has done to reassure us that VPN's can still be effective and work as normal, it's still a serious enough issue for me not to "upgrade" to Big Sur. Especially after reading about the Little Snitch fiasco as well. Both tools are essential for a proper internet experience.

281 points by Semaphor 6y ago

This is just an ad.

Does this mean that MacOS packet filtering does work as expected, and can block any/all traffic, including traffic to Apple? That's good, and what I would hope, but then I'm a little confused about what nastiness Apple is doing in Big Sur related to firewalls. Time to dig in, I guess.

pram 6y ago
That problem is different: whitelisted Apple traffic is not able to be dectected/stopped by third party software using the new userland network APIs (that replaced kexts)
- gruez 6y ago
  >whitelisted Apple traffic is not able to be dectected/stopped by third party software using the new userland network APIs (that replaced kexts) This sentence suggests that there's no way to filter/vpn whitelisted traffic, but this is clearly not the case, as evidenced by this article. Furthermore, it's still possible to block/filter traffic on a whole machine basis by using the Packet Tunnel Provider API. https://news.ycombinator.com/item?id=25113039 https://news.ycombinator.com/item?id=25113039
  - pram 6y ago
    You have poor reading comprehension if you think thats what I said.
floatingatoll 6y ago
macOS packet filtering in Big Sur is unchanged, offering src/dst host/port/proto filters, as is typically thought of to be a 'firewall'. macOS content filtering in Big Sur is no longer able to intercept apps on the exclusion list shipped by Apple, and is akin to 'iptables --uid 501' or 'iptables --command firefox-bin' (actual syntax may vary). The content filtering API can see which user/app originated the traffic, as it's running higher up in the stack; the packet filtering API cannot, as it's running lower down in the stack. Apps such as Little Snitch allow you to filter network traffic per-application, which can't be done with PF; you need CF for that, and CF no longer extends to Apple core system processes in Big Sur. Mullvad's blocks are done imprecisely with PF (presumably they deny 17.0.0.0/8), which is why their blocks break various functionality such as the Mac App Store or: > For example, the keyboard sometimes takes longer to wake up from sleep mode. Or, in certain situations, the Mullvad app takes longer to detect that the computer is online. And while they note that it's possible to punch exceptions into the firewall, those exceptions can't be granted per-use, only per-IP.
- pwinnski 6y ago
  Okay, this makes sense, thanks. I happen to not use app-level filtering these days, only pi-hole and and packet-firewall stuff, so I guess I'll be unaffected if I ever upgrade. Bypassing app-level filtering, though, that sucks.
  - floatingatoll 6y ago
    I assume that Apple's reasoning is "Userspace malware shouldn't be able to trivially intercept anti-malware checksum updates". Trivially is defined as 'click an OK button in a dialog' as the CF permissions process works in Big Sur today. Malware could still block anti-malware checksum updates with PF, but that requires sudo/root which is 'less easy' than the one-click CF approval process, and PF blocks break so many things on the system that malware can't get away with it without triggering a call to technical support. (I personally think that much of the issue here is 'macOS background updates can cause $$$$ cellular data drain over wifi-tethered cellular', and that the absence of Low Bandwidth mode in Control Center is one thing that drives users towards these third-party content filters, when they might otherwise not need a third-party product at all.)
whazor 6y ago
A VPN provides internet connectivity, therefore it is more like a partially broken internet connection instead of a firewall.
- penagwin 6y ago
  This is the best description of a "programmer solution" ever.
- fgonzag 6y ago
  Doesn't a VPN work over the internet (in order to access a local network). So I wouldn't say it provides internet connectivity (as you already need to be connected to the internet to connect to a VPN). A VPN simply gives you access to a local network. A specific use of a VPN is masking your internet traffic as if it came from that local network, but there are many uses besides it.
zepto 6y ago
The nastiness is based on misunderstanding of what Apple is doing, and of how their API’s work, coupled with a healthy distrust for large organizations. The distrust seems valid to me, but it unfortunately seems to lead to a bunch of confirmation bias.

Semaphor 6y ago

While I never used anything Apple, I’m a Mullvad user. This just popped up in my RSS feed and I thought it would be relevant.

gruez 6y ago

AFAIK it's nothing to do with mullvad specifically. Using the generic openvpn/wireguard client (or other VPN service's client that are based on those clients) should also be fine. The only thing that might be an issue would be VPN apps that implement split/per-app tunneling.

crazygringo 6y ago

This makes me feel somewhat better, honestly. The fact that packet-level firewalls work is reassuring. It hadn't been clear from previous reports that they all have to do with content-level filtering and VPN's. In that context, it seems to make more sense for Apple to exempt its own critical services (like malware detection and security updates). Kind of the same way applications can't overwrite system files either. I am curious though: can anyone think of any real-world scenario where it's a genuine problem that Apple traffic isn't routed through the VPN? When I think of normal uses for VPN's -- security for online work and communications, evading censorship, bypassing geo blocks -- these would all seem to be entirely unaffected. Is there anything at all an ISP or attacker could snoop on outside your VPN that could ever be genuinely threatening or privacy-invading? Or is there a worry that we don't have a definitive answer to this because nobody's catalogued everything Apple sends and looked for privacy vulnerabilities?

jitl 6y ago
The fact that you use an Apple device is readily apparent from these traffic patterns - that alone seems worth hiding with a VPN.
- acdha 6y ago
  What's your threat model for this concern? Local networks are still going to see the MAC address (randomization means they can't track you specifically across different WiFi networks, but they still know it's an Apple device). VPNs aren't perfect so an attacker is almost certainly going to see enough from DNS queries, HTTP user agents, TLS SNI headers, etc. to detect the OS in the times where the VPN isn't active. Traffic analysis is also likely to be leaky at this level, too — if you see a big download around the time that Mac/iOS updates come out that's pretty indicative even if you can't see the traffic.
  - beagle3 6y ago
    Capital One used to offer different mortgage rates to IE users and Firefox users; I’m sure there are places that would try to charge Mac users more (or make them more likely to be mugged or something) as they are more well-off statistically. Verizon used to add http headers identifying their users to advertisers. Everyone is out to tag you, and it’s because on average it makes them ever-so-slightly more profitable - at your expense, on average.

varispeed 6y ago

It is a matter of time Apple will block it. They are thirsty for your personal data and they need to know everything you do on their computer. They also need to control what you can or cannot open. You are just not smart enough in Apple eyes to use a computer on your own. On a side note, if I was an Apple customer I'd start making GDPR complaints. Surely just because a OS is not a web app it doesn't mean it can violate privacy in such brazen way.

judofyr 6y ago
> They are thirsty for your personal data and they need to know everything you do on their computer. This is completely opposite of what Apple does, no? Out of all of the tech giants (Microsoft, Facebook, Google) it's my impression that Apple is the one that sends the least amount of data to their own servers.
- wmf 6y ago
  It's contrarianly cool to interpret Apple's "pivot to services" to mean adopting the privacy-invading Google/Facebook business model but that's probably not happening in reality.
  - dewey 6y ago
    You pay for the service with money though, which is kinda the opposite of what Google/Facebooks services are.
    - totalZero 6y ago
      I pay Google for additional cloud storage. Doesn't mean they're any more careful with my data than they were when I was on the free tier.
- jjd33 6y ago
  Apple is an American company. It does not matter what they say they are required by US to log everything and store it. Never got why people blindly trust those privacy claims.

unicornfinder 6y ago

I find it worrying that the side effects of leaving Mullvad enabled are that the keyboard takes longer to wake from sleep. What the hell is going on here?

Zarel 6y ago
This explains a lot, actually. I travel a lot, so I often deal with very bad internet connection quality. I also often have the problem that my keyboard takes a long time to start working again after sleep mode. I've even gotten the "you don't have a keyboard plugged in" error message on my laptop (because the keyboard hasn't been detected after ~30 seconds).
bede 6y ago
My guess is that this is somehow linked to iCloud device handoff, which does all kinds of questionable stuff [0] on e.g. device wake. [0] https://arxiv.org/pdf/1904.10600.pdf https://arxiv.org/pdf/1904.10600.pdf
FireBeyond 6y ago
This is also an issue on always-on VPNs, where the process of verifying keyboard firmware can result in the alarming "Please connect a keyboard via Bluetooth" dialog on even a laptop. It goes away as soon as the verification completes, but is not the fault of Mullvad per se.
- crazygringo 6y ago
  I'm aware of this being a well-documented issue starting in Catalina [1], but I wasn't aware there was a definitive answer as to why. Do you have a source for the fact that it's firmware verification? Either way, seems like a terribly buggy design. [1] https://www.reddit.com/r/PrivateInternetAccess/comments/gqkhor/macos_catalina_keyboard_and_trackpad_issue_on/ https://www.reddit.com/r/PrivateInternetAccess/comments/gqkh...
  - FireBeyond 6y ago
    I wish I did. I just remember it being a huge annoyance. It does both make sense and seem incredibly buggy. It'd have to be a fairly impressive attack vector that hits the keyboard firmware, but if you did, I suppose you'd have access to the raw key stream to exfiltrate... not curious to see if it applied on my Mac Pro (which just has a WASD keyboard - I don't use the Apple Magic Keyboard), or a MBP without touchbar (maybe this is the firmware, not the keyboard per se). I do know it is demonstrably the VPN at issue - I can disable our always-on device VPN and the problem goes away, but alas, no easily accessible source that says "verification of HID firmware" or similar.

breatheoften 6y ago

Apple making some of its components bypass application level firewall might need to occur given the reality that a modern os is a decentralized system -- but I really think the set of such code with this functionality should be minimized to the absolute smallest possible surface area -- and this behavior should be confined to a tiny set (or even a single) of system components ... "low latency clock coordinator component" or whatever the true architectural reason for the system to require unfettered network access is ... It seems to me like ultimately the only use cases that should require bypassing network controls will relate to scenarios where there are architectural constraints imposed by the need to minimize latency - and minimizing latency needs to be possible ... so Whatever needs to happen at the architecture level to ensure minimal latency is going to need to happen -- but hopefully only those things ... -- and hopefully only in ways that are visible and decoupled from content-ful network transactions ...

mamcx 6y ago

One thing about this: Ok, Apple is not that evil to use my data(?), is not that bad because whatever, but: My mac become ABSOLUTELY freeze. Impossible to use. In the middle of a fix that UI must have delivery (a host was down for a customer, good timing!). So, the fact that the machine become a brick is a part that is not considered much on this discussion. Look, spy on me, ok(?); but also not allow me to move?

valuearb 6y ago
You can turn off the internet and freely use your Mac. The network dependent features are smart enough to know you are offline and not impede you. Their problems come when you have bad connections or Apples servers are down/overwhelmed. They don’t fail gracefully then. As a mobile developer I know there are always at least two or more failure modes with any network request, failures because of network/server failures, or failures because internet is off. My clients constantly think Airplane mode is the bad network test case,and I constantly remind them that no, it’s only one possible error cause.
- swiley 6y ago
  A large number of people seem to use macs as fancy ssh video terminals/zoom phones. That application completely breaks in this situation.
- mamcx 6y ago
  > You can turn off the internet and freely use your Mac Interesting! Now, how I could fix the problem with the SERVER DOWN of my customer: :)

xvector 6y ago

Mullvad is a fantastic provider!

nbzso 6y ago
I am using Mullvad (3 years in a row). The app updates are regular and interface for switching countries is clear and functional. Highly recommend.
- 93po 6y ago
  You can also use Mozilla VPN to support Firefox and use the same service (it's done through Mullvad). Downside to Mozilla though is no Mac or Linux client

speakspokespok 6y ago

Is there a difference between disallowing an action and denying it? I think so, and that word choice matters. I see this pattern everywhere. Do you disallow someone on FB, or do you block them? Does iptables use disallow as a keyword? I do see BLOCK and DROP though. Normalized use of the passive voice is no different than being uncomfortable with making eye contact during a regular conversation. Perhaps the writer accounted for that considering the user base.

umvi 6y ago

> For example, the keyboard sometimes takes longer to wake up from sleep mode Apple computers phone home before waking up the keyboard from sleep? What in the world?

SulfurHexaFluri 6y ago
How else would they be able to protect the user from an unauthorized screen replacement?
- echelon 6y ago
  When are they going to require an always-on camera to protect the user from potentially being held at gunpoint? Or is Apple confident they're the only party that gets to do that?
pilsetnieks 6y ago
There has been malware that pretends to be a HID driver and function as a keylogger and/or execute arbitrary code. While Apple may be being overly cautious here, it's not entirely unreasonable.
- ballenf 6y ago
  And how does phoning home help here?
  - amelius 6y ago
    Presumably to check if the software that is about to run is in a blacklist. But this is nonsense because the blacklist could also be downloaded and checked locally.
    - deleted 6y ago
      [deleted]
- eptcyka 6y ago

QEOHZadkDyBpX 6y ago

mullvad app overwrites firewall rules and allows all outgoing connections.. https://github.com/mullvad/mullvadvpn-app/issues/2171 https://github.com/mullvad/mullvadvpn-app/issues/2171

90red 6y ago

While I'm very grateful for the research that Mullvad has done to reassure us that VPN's can still be effective and work as normal, it's still a serious enough issue for me not to "upgrade" to Big Sur. Especially after reading about the Little Snitch fiasco as well. Both tools are essential for a proper internet experience.