5 ms·

Apple lets some Big Sur network traffic bypass firewalls

55 points by politelemon 6y ago

zanethomas 6y ago
That's just plain wrong.
90minuteAPI 6y ago
An Apple engineer tweeted that this was a bug, but that tweet has since been deleted.
kowlo 6y ago
Unlikely that they will backpedal on this, regardless of how much media attention it gets. If a macOS user has an issue with this, time to look for a new OS whilst avoiding the upgrade to Big Sur for as long as possible. Those who depend on it for their business will have issues...
- kalleboo 6y ago
  An Apple engineer tweeted that the firewall bypass was just a bug and not intentional behavior, but after getting hate replies he gave up and made his account private.
  - hvidgaard 6y ago
    In any case it's not an acceptable bug if you want to brand yourself as secure.
  - saagarjha 6y ago
    Either that or corporate told him to stop. Probably a combination of both, to be honest; situations where you the next steps are disappearing off the internet for a while are never easy :(
    - kalleboo 6y ago
      Well he also tweeted something along the lines of "if everyone is just going to get angry I'll just stop tweeting/delete my twitter"
      - saagarjha 6y ago
        Last I checked I don't think the account is deleted at the moment, although the first tweet is gone (and I never saw the other one you mentioned). That being said, I'm not at all surprised by that response–like I said, having an offhand tweet of yours get significant attention, and then have people come after you and attack you on top of whatever corporate might have to say to you on the topic, is a great way to get something like that. It's exactly things like these why most Apple engineers don't say much or publicly affiliate themselves with the company–and I am sure that the people who decided to go after him were well aware of what what kinds of things happen after that.
- qz2 6y ago
  If they backpedal or not it was a shitty trust breaking arrogance driven decision that should be remembered forever.
  - LoSboccacc 6y ago
    Apple literally solved their production chain suicide issues by installing nets to catch jumpers, which made the rounds across media https://www.wired.com/2011/02/ff-joelinchina/ https://www.wired.com/2011/02/ff-joelinchina/ I didn't see people ditching Apple then with people life on the line, I don't see people ditching Apple for a software configuration.
    - Rmblnm4n 6y ago
      Meanwhile, computer users toss toxic sewage generating gadgets on future humans to clean. Let’s not ignore the disposable consumer gadget minded’s unethical behavior at scale.
iso947 6y ago
Apple, putting the Sur in Surveillance
- bartvk 6y ago
  In what sense does this have to do with surveillance?
  - FartyMcFarter 6y ago
    Some people do use firewalls for preventing software from calling home and sending "analytics" kind of info, which could contain somewhat private information in some cases.
    - bartvk 6y ago
      I thought OP meant surveillance by Appple, thanks for clarifying. Yes, that could be a problem.
FartyMcFarter 6y ago
How many people use firewalls on Macs? Genuine question, not trying to minimise the issue (as I think there's little excuse for this).
- leipert 6y ago
  Personally I use it to stop certain apps from phoning home or auto-updating, as I manage them with from Homebrew Cask. There are so many apps which don’t need online access, but still send usage pings or check for updates.
- craftit 6y ago
  I've read applications like little snitch are popular enough that some malware changes their behavior if it detects it. It must be a non-trivial number. I do personally out of curiosity to see what connections are being made.
blowfish721 6y ago
Without looking into the details the ability to piggyback on the excempts or add excempts should be considered a bug. If it required root/admin then all bets would already be off when it comes to malware and host based firewalls. As for people regarding this as a privacy breach then that’s another thing, only real possibility then would probably be a VPN and firewall the traffic at a central point.
- Someone 6y ago
  At least on my system, it requires root. The config file is owned by root, and readable to the world. Also, I would expect, but haven’t tested it, a benefit of the ability to piggyback is that concerned users can remove Apple’s exceptions.
merricksb 6y ago
Big discussion about original discovery a month ago: https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816 (1183 points/620 comments) Related discussions: https://news.ycombinator.com/item?id=25115509 https://news.ycombinator.com/item?id=25115509 https://news.ycombinator.com/item?id=25095972 https://news.ycombinator.com/item?id=25095972 https://news.ycombinator.com/item?id=25109724 https://news.ycombinator.com/item?id=25109724

55 points by politelemon 6y ago

zanethomas 6y ago

That's just plain wrong.

90minuteAPI 6y ago

An Apple engineer tweeted that this was a bug, but that tweet has since been deleted.

kowlo 6y ago

Unlikely that they will backpedal on this, regardless of how much media attention it gets. If a macOS user has an issue with this, time to look for a new OS whilst avoiding the upgrade to Big Sur for as long as possible. Those who depend on it for their business will have issues...

kalleboo 6y ago
An Apple engineer tweeted that the firewall bypass was just a bug and not intentional behavior, but after getting hate replies he gave up and made his account private.
- hvidgaard 6y ago
  In any case it's not an acceptable bug if you want to brand yourself as secure.
- saagarjha 6y ago
  Either that or corporate told him to stop. Probably a combination of both, to be honest; situations where you the next steps are disappearing off the internet for a while are never easy :(
  - kalleboo 6y ago
    Well he also tweeted something along the lines of "if everyone is just going to get angry I'll just stop tweeting/delete my twitter"
    - saagarjha 6y ago
      Last I checked I don't think the account is deleted at the moment, although the first tweet is gone (and I never saw the other one you mentioned). That being said, I'm not at all surprised by that response–like I said, having an offhand tweet of yours get significant attention, and then have people come after you and attack you on top of whatever corporate might have to say to you on the topic, is a great way to get something like that. It's exactly things like these why most Apple engineers don't say much or publicly affiliate themselves with the company–and I am sure that the people who decided to go after him were well aware of what what kinds of things happen after that.
qz2 6y ago
If they backpedal or not it was a shitty trust breaking arrogance driven decision that should be remembered forever.
- LoSboccacc 6y ago
  Apple literally solved their production chain suicide issues by installing nets to catch jumpers, which made the rounds across media https://www.wired.com/2011/02/ff-joelinchina/ https://www.wired.com/2011/02/ff-joelinchina/ I didn't see people ditching Apple then with people life on the line, I don't see people ditching Apple for a software configuration.
  - Rmblnm4n 6y ago
    Meanwhile, computer users toss toxic sewage generating gadgets on future humans to clean. Let’s not ignore the disposable consumer gadget minded’s unethical behavior at scale.

iso947 6y ago

Apple, putting the Sur in Surveillance

bartvk 6y ago
In what sense does this have to do with surveillance?
- FartyMcFarter 6y ago
  Some people do use firewalls for preventing software from calling home and sending "analytics" kind of info, which could contain somewhat private information in some cases.
  - bartvk 6y ago
    I thought OP meant surveillance by Appple, thanks for clarifying. Yes, that could be a problem.

FartyMcFarter 6y ago

How many people use firewalls on Macs? Genuine question, not trying to minimise the issue (as I think there's little excuse for this).

leipert 6y ago
Personally I use it to stop certain apps from phoning home or auto-updating, as I manage them with from Homebrew Cask. There are so many apps which don’t need online access, but still send usage pings or check for updates.
craftit 6y ago
I've read applications like little snitch are popular enough that some malware changes their behavior if it detects it. It must be a non-trivial number. I do personally out of curiosity to see what connections are being made.

blowfish721 6y ago

Without looking into the details the ability to piggyback on the excempts or add excempts should be considered a bug. If it required root/admin then all bets would already be off when it comes to malware and host based firewalls. As for people regarding this as a privacy breach then that’s another thing, only real possibility then would probably be a VPN and firewall the traffic at a central point.

Someone 6y ago
At least on my system, it requires root. The config file is owned by root, and readable to the world. Also, I would expect, but haven’t tested it, a benefit of the ability to piggyback is that concerned users can remove Apple’s exceptions.

merricksb 6y ago

Big discussion about original discovery a month ago: https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816 (1183 points/620 comments) Related discussions: https://news.ycombinator.com/item?id=25115509 https://news.ycombinator.com/item?id=25115509 https://news.ycombinator.com/item?id=25095972 https://news.ycombinator.com/item?id=25095972 https://news.ycombinator.com/item?id=25109724 https://news.ycombinator.com/item?id=25109724