29 ms·

Apple removes first-party firewall exemption in macOS 11.2 beta 2

804 points by mortenjorck 6y ago

leons_yarn 6y ago
This is only in the beta so far though, right? I’m not sure how durable this stuff is generally in the beta releases, but there hasn’t been any official announcement or guarantee it won’t be reinserted?
mrkstu 6y ago
Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.
- eyelidlessness 6y ago
  This happened so quickly I suspect there was never a decision for or against. Pretty likely a boneheaded engineer did what us boneheaded engineers do and cut corners, likely with all of the fun boneheaded management and deadlines that come along for the ride. Why, you might ask, would this be a matter of cutting corners? Well, fault tolerance is hard. What happens when the OS can’t reach external services it depends on for security features? Well, Apple found out recently in quite an embarrassing way. Given the almost immutable yearly release cycle, I would be astonished if they didn’t just duct tape some whitelist in because a more resilient solution wasn’t ready.
  - _qulr 6y ago
    The imagined timeline of this comment doesn't seem to align with reality. The exclusion list was already present in the first WWDC builds in summer 2020, as the Little Snitch developers noticed: https://blog.obdev.at/a-hole-in-the-wall/ https://blog.obdev.at/a-hole-in-the-wall/ The Mac "OSCP appocalypse" occurred in November on the day that Big Sur was released to the public, with the exclusion list still present, and a number of firewall developers were already aware of the exclusion list and had reported bugs to Apple.
    - wilg 6y ago
      I don't think the comment you're replying to made specific claims about this timeline.
      - eyelidlessness 6y ago
        You’re right, I didn’t. Thank you for saying so with much more clarity than I probably would have.
        _qulr 6y ago
        > This happened so quickly This was your claim. What is the justification for the claim? The comment seemed to imply that it was the OCSP problem. Otherwise, no other explanation was offered by the comment.
        eyelidlessness 6y ago
        It happened quickly on the heels of the public release. The problem I cited was about how embarrassing a half assed solution could be, not about prompting a different response. Good engineers who boneheadedly cut corners are already tracking their omissions and FIXMEs. The fact that they shipped and quickly turned around a better solution reads to me like engineers doing their dang job. Edit: I just realized who I responded to and even if we don’t see it the same way I just want to say I appreciate your work and even your particular cynicism.
        deleted 6y ago
        [deleted]
- userbinator 6y ago
  Given how they have been always marketing on the privacy aspect, and this exception they made for themselves has been found out and shown to be bad for privacy, I'm not surprised.
- threeseed 6y ago
  Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer and Public Beta releases for iOS/OSX so that external users can provide feedback. And on this occasion just like on many other they will take action if necessary.
  - eyelidlessness 6y ago
    > Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. This more or less confirms my hunch. Thanks for inside perspective on it. That’s how literally every other org works but I know Apple got this reputation for having a very executive-micromanaged culture under both Jobs eras, it’s good to have a reminder that at the end of the day it’s not the borg.
    - mhh__ 6y ago
      > it’s good to have a reminder that at the end of the day it’s not the borg. The impression I always got was more like a mid-to-late USSR than the Borg (in structure rather than efficacy, the USSR didn't work, apple does). Everyone in the Borg is (supposed to be) identical, whereas Apple seems like a structure of lots of groups of often brilliant people working in seperate-but-equal subtrees, working under a (especially under Jobs) ideologically-inspired dictator from the top down. The way Apple are fairly reticent to document what they make partly informs the comparison.
      - eyelidlessness 6y ago
        I think their reticence to document is more a function of how long they’ve been able to get away with not doing it. Almost every engineering culture that finds that balance unfortunately embraces it.
- abellerose 6y ago
  Curious why you phrased Apple listening to their customers in such a negative way. Maybe from pessimism bias? I observe a lot of HN commenters don't vibe with how Apple controls & develops their ecosystem. Yet, instead of go elsewhere, complaining and acting like being oh so very special enough to know how things should be done is preferred; while expecting a major company to just cater to their personal whims. I'm unsure if it's entitlement I'm witnessing or just people that feel like they have no faith in Apple's competition at making anything better than Apple currently has.
  - mrkstu 6y ago
    Well, I've had a Mac continuously since the original 128k Mac, so I'm pretty well situated as an observer of all things Apple and more knowledgeable about their history and their machines/software then the vast majority of their employees, some of whom are close friends. I want them to listen, since the decisions they make affect the ecosystem I've adopted for my extended family (for whom I'm the main technical point of contact,) and poor ones will affect me and them disproportionately. So to me, it doesn't feel at all like entitlement, rather, the wishes of a longtime, loyal customer hoping they continue down the path of listening to those of us who have promoted their products and helped make them successful.
  - IncRnd 6y ago
    There is no call to invent reasons of entitlement or faithlessness in engineering prowess when the desire is simply to control your own device.
  - eyelidlessness 6y ago
    To be honest I think having a pessimism bias towards large corporations is healthy. Sure, they might in the end do a good thing (or a less harmful thing than they could have), but they have a huge amount of power and very little oversight. I like Apple products, but I try to avoid any illusion that they’re good guys on a corporate scale. They’ve proven they’re not in a lot of ways (see many recent articles about their labor practices). That doesn’t mean every thing they do should be equally scrutinized with a pessimistic predisposition. But I really don’t fault anyone for assuming a large for profit organization will prioritize their own priorities over everything else. The thing I try to moderate that with is understanding their actual priorities and not just falling into blind cynicism.
- NoPicklez 6y ago
  I think your second point is next to impossible, businesses make mistakes no matter how much they try to stop them and what makes them who they are is how they respond. In this case Apple responded well and that's great. We don't know how many of these decisions are already being squashed each day through appropriate governance.
eyelidlessness 6y ago
Prediction: this will somehow still be spun as Apple wanting to own your Mac even though you bought it and turn it into an iDevice.
- ryukafalz 6y ago
  No, as someone who does often criticize Apple for taking away control from their users, this is a good move. Their original action that triggered this was them wanting to own your Mac.
  - eyelidlessness 6y ago
    I sincerely doubt that was the motivation. See my kittycorner comment: https://news.ycombinator.com/item?id=25771339 https://news.ycombinator.com/item?id=25771339
    - shawnz 6y ago
      I don't think you are necessarily disagreeing with what they are saying. First of all, there are surely many people who influenced the creation and release of this feature and I don't think it would be accurate to assign a single motivation to all their work. Second, I don't think it's wrong to say that "boneheaded management cutting corners" by prioritizing the needs of other internal teams over the needs of the user is in some sense them "wanting to own your Mac". Although that is a dramatic way to describe it.
      - eyelidlessness 6y ago
        > I don't think it's wrong to say that "boneheaded management cutting corners" by prioritizing the needs of other internal teams over the needs of the user is in some sense them "wanting to own your Mac". Although that is a dramatic way to describe it. It’s beyond dramatic. It’s absurd. I’ve worked on so many projects and deadlines that have had to make such decisions, even decisions that eventually fell to me. In numerous cases I could cast aspersions on some of the management motivations, but even so I couldn’t describe it as them trying to own the product they’d sold to customers. In most cases it was a balance of market pressure and resources. In the cases where I’ve had to make those calls, it’s been balancing market pressure specifically so I had more room to satisfy users. I don’t think Apple engineers are immune to this. They have to ship big things on a tight deadline. When they can’t satisfy everyone they have to make choices. Sometimes they don’t make the best choices. Hopefully you don’t have these weights in your job. But lots of us do.
xyst 6y ago
very nice - this was one of my main contentions on Big Sur. Will upgrade once 11.2 is stable :)
- aarchi 6y ago
  I'm still on Mojave to use 32-bit apps. Any way to use 32-bit in Catalina or later?
  - Rebelgecko 6y ago
    For my 32 bit binaries, the easiest way to use them is to run the Windows version, because that OS has better backwards compatability. It's possible to get a Mojave VM up and running but it was nontrivial when I gave it a shot
    - tanelpoder 6y ago
      I’m using a Mojave VM with VMWare Fusion on my laptop (that runs Catalina) on the rare occasion of needing to run 32bit apps. Install & setup was easy, without any problems. VMWare Fusion is a paid app, but VirtualBox should be able to do the same for free.
      - inapis 6y ago
        The latest Vmware Fusion has a free license for personal use.
    - kitsunesoba 6y ago
      If I'm not mistaken, WINE is now capable of running 32-bit Windows binaries on 64-bit-only macOS as well, so that may also be an option particularly for more simple apps.
      - tempodox 6y ago
        Even the 64-bit WINE can't run 32-bit apps on Catalina. Their website specifically says they support up to macOS-10.14. Apparently 64-bit WINE can run 64-bit Windos apps on Catalina, though.
user3939382 6y ago
So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.
- lilyball 6y ago
  You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing. Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com URL for their reachability test, so your blackhole should be blocking that too.
  - user3939382 6y ago
    Why are they ignoring /etc/hosts if this is good behavior?
    - jojobas 6y ago
      In their book a bit of malware might have modified /etc/hosts. It's for your own good!
    - judge2020 6y ago
      Are you writing ::/0 domain.example as well? It might using either AAAA DNS lookups or the equivalent of `getent hosts` which pulls v6 records first, which are only overridden if there is a v6 override for the hostname. $ getent hosts cloudflare.com && getent ahosts cloudflare.com 2606:4700::6810:85e5 cloudflare.com 104.16.133.229 STREAM cloudflare.com $ echo "0.0.0.0 cloudflare.com" | sudo tee -a /etc/hosts $ getent hosts cloudflare.com && getent ahosts cloudflare.com 2606:4700::6810:85e5 cloudflare.com 0.0.0.0 STREAM cloudflare.com
exabrial 6y ago
This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.
- Paraesthetic 6y ago
  It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.
  - SulfurHexaFluri 6y ago
    Its possible that they saw it as a purely positive move that would improve security on MacOS and then after seeing everyone's response they reevaluated its importance.
    - onelovetwo 6y ago
      > positive move that would improve security That they purposefully added in the first place to let only Apple apps bypass third-party firewalls?
    - m463 6y ago
      or they started getting security bugs from the fuzzer teams. (it's a hard problem to sanitize so many exectutables, and the people who use VPNs are probably high-value customers, like business people wfh)
    - tempodox 6y ago
      Having to be told by outsiders that this backdoor could be abused by malware is pretty embarrassing. It's hard to imagine Apple's engineers weren't aware of that.
  - eyelidlessness 6y ago
    Apple gives two fucks about media pressure. Their longstanding history of giving in to pressure almost exclusively is responsive to their users, either: - pro/dev users who act as their trend setters (see recent backpedals on keyboards and Mac Pro form factor) - people hacking stuff where it’s popular enough they want more influence on the UX (bootcamp)
post_break 6y ago
Does anyone know how this impacts little snitch?
- pseudalopex 6y ago
  It lets Little Snitch 5 block Apple processes without editing a system file.
  - pcdoodle 6y ago
    Which processes should I block? I prefer to share less.
- webmobdev 6y ago
  It impacts all application firewalls on macOS - Lulu, Little Snitch, HandsOff, TripMode, RadioSilence etc - equally. Meaning, they can all now block the apps that Apple had exempted, in future versions of macOS Big Sur.
SmileyKeith 6y ago
An Apple employee tweeted after the news with 11.0 that this was a bug so I'm not surprised, but happy to see it fixed!
- devin 6y ago
  Link?
  - _qulr 6y ago
    There's no link because the tweet was deleted soon afterward. The tweet seems to have been very ill-advised. I don't know how anyone can describe this as a "bug", because as the linked article describes, there's an explicit "ContentFilterExclusionList" in the Info.plist file with a list of the specific Apple services excluded. That's not by accident, it's by design.
    - nytgop77 6y ago
      bug was in the design. (or in decision leading to design)
      - chipotle_coyote 6y ago
        I don't think I'd call it a bug. It's a poor decision. I can easily believe that it wasn't a decision made with malicious intent; the culture at Apple seems (at least from the outside, judging by results) to encourage an "it's okay to give our own software special exceptions" mentality.
        saagarjha 6y ago
        You could call it an entitled opinion.
        chipotle_coyote 6y ago
        I see what you did there. (+1.)
xbar 6y ago
Nice! I can finally upgrade.
PointyFluff 6y ago
Imagine being told what software you can and cannot run on your machine.
- na85 6y ago
  The linked tweet/TFA is actually about Apple's boneheaded decision to let its own apps bypass firewalls etc., and not about software permissions. FWIW you can just turn off the Gatekeeper feature which is what I assume you're complaining about.
webmobdev 6y ago
I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously that's going to be really hard with the changes they have made to the OS). I know many Apple's fan see this as a positive move. But let's not ignore the pattern of privacy violations and user data collections due to deliberate design and the "apology" and "changes" that follow once CAUGHT. A few of these that immediately come to mind are: - Apple selling user data to US government: https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... - Apple iPhone 11 tracks user location even when location services are explicitly turned off by user (another BACKDOOR): https://www.silicon.co.uk/mobility/smartphones/apple-iphone-collects-location-data-321509?cmpredirect https://www.silicon.co.uk/mobility/smartphones/apple-iphone-... - Apple macOS tracks every app that you use: https://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/ - Apple introduces BACKDOOR in its API to allow Apple apps to bypass application firewalls: https://www.patreon.com/posts/hooray-no-more-46179028 https://www.patreon.com/posts/hooray-no-more-46179028 (For those who want to diss me for the above, realise that Apple's new found love for privacy doesn't mean shit without such public scrutiny and discussions. And if you want it to last, remain suspicious and VOCAL on any such possible violations.)
- conistonwater 6y ago
  Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?
  - kristofferR 6y ago
    You don't create a whitelist system literally called ContentFilterExclusionList by accident.
    - 6y ago
darwingr 6y ago
While I'm glad they fixed it (upgrading past Catalina was not going to happen), It's going to take me a LONG time to trust them again. The fact that they could rationalize their own thought process to think this was a good idea or even anywhere close to acceptable, at best leads me to doubt their judgement. At worst, well it's best to assume incompetence over malice but you can see what doors this would open in the future. Now we know they CAN do this without it being obvious to most users, which is a new dimension of risk regardless of intent.
SXX 6y ago
This firewall issue isn't the only privacy feature strip from Big Sur release. Unfortunately no big media care about other huge problem Apple introduced. My only hope they will also fix full disk encryption in this update. Since Big Sur broken installation of macOS on passphrase-encrypted disk partitions. I bought into M1 hype and now it's end up that you no longer able to have separate password for the disk encryption.
- orf 6y ago
  Most users don’t want a separate password for disk encryption though, so I’m not sure it’s a huge problem?
  - La1n 6y ago
    Most users probably also didn't care about the first-party firewall exemptions. They could have asked people if they wanted a separate password for disk encryption (e.g. a small checkbox).
    - fpoling 6y ago
      It is highly non-trivial to extract private key from Apple encryption chips, last time I heared the price is at least 100K USD, and probably much higher now. So unless one values own secrets that high, a short password could be OK.
  - webmobdev 6y ago
    It's about choice and control over your data - an educated user knows that with hardware encryption, it is very difficult to retrieve data if the hardware fails. There's also the trust factor where you would prefer to have the keys, rather than trust some device. (E.g. Some Western Digital drives have problems with their hardware encryption and made the data on it irretrievable for many - https://github.com/andlabs/reallymine/issues/53 https://github.com/andlabs/reallymine/issues/53 . More here - https://carltonbale.com/western-digital-mybook-drive-lock-encryption-failure-and-recovery/ https://carltonbale.com/western-digital-mybook-drive-lock-en...). What is being questioned and criticized is the removal of this choice. Especially when a product claims a commitment to privacy.
sneak 6y ago
Sadly, they could just as easily add it back in with a later update. This means that after I update to 11.2, to preserve location privacy from Apple, I must now verify each and every OS update in the future. We need a better system.
sneak 6y ago
In Case You Didn't Know: Big Sur on M1 (and possibly on Intel) maintains a persistent, hardware-serial-number linked TLS connection to Apple (for APNS, just like on iOS) at all times when you are logged in, even if you don't use iCloud, App Store, iMessage, or FaceTime, and have all analytics turned off. There's no UI to disable this. This means that Apple has the coarse location track log (due to GeoIP of the client IP) for every M1 serial number. When you open the App Store app, that serial number is also sent, and associated with your Apple ID (email/phone) if you log in. Apple knows when you leave home, or arrive at the office, or travel to a different city, all with no Apple ID, no iCloud, and no location services. This has always been the case on all devices using iOS, too. This change is essential for blocking such traffic, and I'm glad for it, but there is a long way to go when it comes to pressuring the pro-privacy forces inside of Apple to do more.
- twobitshifter 6y ago
  How do you know that apple is logging GeoIPs and performing this association with appleIDs? Or are you just saying it’s possible to do so?
  - novok 6y ago
    With a datetime and IP, you can geoIP any time in the future. It's a single ETL operation. So you treat it like they do, one way or another.
    - zepto 6y ago
      This assumes they don’t scrub it before storing it, which we know they do for some services, and we have no information about others. We can’t in fact treat it like they do. We can only treat it like they might be able to.
      - sneak 6y ago
        Anyone monitoring the traffic outside of Apple can do it, as well. IIRC TLS client certificate information is not encrypted on the wire, but I'd need to review modern TLS protocol negotiation to confirm. This would allow anyone monitoring Apple's upstream, passively, to perform this same location logging that Apple does. Apple knows this, so shipping systems that leak information in this way is tacit acceptance of the military spying going on on the networks to which Apple's servers are connected.
slmjkdbtl 6y ago
It's great to see community feedback actually works, I really hope people can talk about having the option to disable .DS_Store now

804 points by mortenjorck 6y ago

This is only in the beta so far though, right? I’m not sure how durable this stuff is generally in the beta releases, but there hasn’t been any official announcement or guarantee it won’t be reinserted?

mrkstu 6y ago

Nice to see that Apple isn't so big that it doesn't think it has to listen to reasonable/rational public feedback that it is making poor decisions. Now, if they could empower lower levels to make these decisions before the issues blow up in the wider world context, all the better.

eyelidlessness 6y ago
This happened so quickly I suspect there was never a decision for or against. Pretty likely a boneheaded engineer did what us boneheaded engineers do and cut corners, likely with all of the fun boneheaded management and deadlines that come along for the ride. Why, you might ask, would this be a matter of cutting corners? Well, fault tolerance is hard. What happens when the OS can’t reach external services it depends on for security features? Well, Apple found out recently in quite an embarrassing way. Given the almost immutable yearly release cycle, I would be astonished if they didn’t just duct tape some whitelist in because a more resilient solution wasn’t ready.
- _qulr 6y ago
  The imagined timeline of this comment doesn't seem to align with reality. The exclusion list was already present in the first WWDC builds in summer 2020, as the Little Snitch developers noticed: https://blog.obdev.at/a-hole-in-the-wall/ https://blog.obdev.at/a-hole-in-the-wall/ The Mac "OSCP appocalypse" occurred in November on the day that Big Sur was released to the public, with the exclusion list still present, and a number of firewall developers were already aware of the exclusion list and had reported bugs to Apple.
  - wilg 6y ago
    I don't think the comment you're replying to made specific claims about this timeline.
    - eyelidlessness 6y ago
      You’re right, I didn’t. Thank you for saying so with much more clarity than I probably would have.
      - _qulr 6y ago
        > This happened so quickly This was your claim. What is the justification for the claim? The comment seemed to imply that it was the OCSP problem. Otherwise, no other explanation was offered by the comment.
        eyelidlessness 6y ago
        It happened quickly on the heels of the public release. The problem I cited was about how embarrassing a half assed solution could be, not about prompting a different response. Good engineers who boneheadedly cut corners are already tracking their omissions and FIXMEs. The fact that they shipped and quickly turned around a better solution reads to me like engineers doing their dang job. Edit: I just realized who I responded to and even if we don’t see it the same way I just want to say I appreciate your work and even your particular cynicism.
        deleted 6y ago
        [deleted]
userbinator 6y ago
Given how they have been always marketing on the privacy aspect, and this exception they made for themselves has been found out and shown to be bad for privacy, I'm not surprised.
threeseed 6y ago
Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. It's just that as an engineer you are often in a bubble and can't foresee every implication of your decision. That's why Apple has the Developer and Public Beta releases for iOS/OSX so that external users can provide feedback. And on this occasion just like on many other they will take action if necessary.
- eyelidlessness 6y ago
  > Having worked at Apple and other big companies it's almost always Engineers and PMs making these decisions. It's not like Tim Cook or Craig Federighi is running around demanding people add Apple apps to a firewall exclusion list. They have much bigger things to worry about. This more or less confirms my hunch. Thanks for inside perspective on it. That’s how literally every other org works but I know Apple got this reputation for having a very executive-micromanaged culture under both Jobs eras, it’s good to have a reminder that at the end of the day it’s not the borg.
  - mhh__ 6y ago
    > it’s good to have a reminder that at the end of the day it’s not the borg. The impression I always got was more like a mid-to-late USSR than the Borg (in structure rather than efficacy, the USSR didn't work, apple does). Everyone in the Borg is (supposed to be) identical, whereas Apple seems like a structure of lots of groups of often brilliant people working in seperate-but-equal subtrees, working under a (especially under Jobs) ideologically-inspired dictator from the top down. The way Apple are fairly reticent to document what they make partly informs the comparison.
    - eyelidlessness 6y ago
      I think their reticence to document is more a function of how long they’ve been able to get away with not doing it. Almost every engineering culture that finds that balance unfortunately embraces it.
abellerose 6y ago
Curious why you phrased Apple listening to their customers in such a negative way. Maybe from pessimism bias? I observe a lot of HN commenters don't vibe with how Apple controls & develops their ecosystem. Yet, instead of go elsewhere, complaining and acting like being oh so very special enough to know how things should be done is preferred; while expecting a major company to just cater to their personal whims. I'm unsure if it's entitlement I'm witnessing or just people that feel like they have no faith in Apple's competition at making anything better than Apple currently has.
- mrkstu 6y ago
  Well, I've had a Mac continuously since the original 128k Mac, so I'm pretty well situated as an observer of all things Apple and more knowledgeable about their history and their machines/software then the vast majority of their employees, some of whom are close friends. I want them to listen, since the decisions they make affect the ecosystem I've adopted for my extended family (for whom I'm the main technical point of contact,) and poor ones will affect me and them disproportionately. So to me, it doesn't feel at all like entitlement, rather, the wishes of a longtime, loyal customer hoping they continue down the path of listening to those of us who have promoted their products and helped make them successful.
- IncRnd 6y ago
  There is no call to invent reasons of entitlement or faithlessness in engineering prowess when the desire is simply to control your own device.
- eyelidlessness 6y ago
  To be honest I think having a pessimism bias towards large corporations is healthy. Sure, they might in the end do a good thing (or a less harmful thing than they could have), but they have a huge amount of power and very little oversight. I like Apple products, but I try to avoid any illusion that they’re good guys on a corporate scale. They’ve proven they’re not in a lot of ways (see many recent articles about their labor practices). That doesn’t mean every thing they do should be equally scrutinized with a pessimistic predisposition. But I really don’t fault anyone for assuming a large for profit organization will prioritize their own priorities over everything else. The thing I try to moderate that with is understanding their actual priorities and not just falling into blind cynicism.
NoPicklez 6y ago
I think your second point is next to impossible, businesses make mistakes no matter how much they try to stop them and what makes them who they are is how they respond. In this case Apple responded well and that's great. We don't know how many of these decisions are already being squashed each day through appropriate governance.

eyelidlessness 6y ago

Prediction: this will somehow still be spun as Apple wanting to own your Mac even though you bought it and turn it into an iDevice.

ryukafalz 6y ago
No, as someone who does often criticize Apple for taking away control from their users, this is a good move. Their original action that triggered this was them wanting to own your Mac.
- eyelidlessness 6y ago
  I sincerely doubt that was the motivation. See my kittycorner comment: https://news.ycombinator.com/item?id=25771339 https://news.ycombinator.com/item?id=25771339
  - shawnz 6y ago
    I don't think you are necessarily disagreeing with what they are saying. First of all, there are surely many people who influenced the creation and release of this feature and I don't think it would be accurate to assign a single motivation to all their work. Second, I don't think it's wrong to say that "boneheaded management cutting corners" by prioritizing the needs of other internal teams over the needs of the user is in some sense them "wanting to own your Mac". Although that is a dramatic way to describe it.
    - eyelidlessness 6y ago
      > I don't think it's wrong to say that "boneheaded management cutting corners" by prioritizing the needs of other internal teams over the needs of the user is in some sense them "wanting to own your Mac". Although that is a dramatic way to describe it. It’s beyond dramatic. It’s absurd. I’ve worked on so many projects and deadlines that have had to make such decisions, even decisions that eventually fell to me. In numerous cases I could cast aspersions on some of the management motivations, but even so I couldn’t describe it as them trying to own the product they’d sold to customers. In most cases it was a balance of market pressure and resources. In the cases where I’ve had to make those calls, it’s been balancing market pressure specifically so I had more room to satisfy users. I don’t think Apple engineers are immune to this. They have to ship big things on a tight deadline. When they can’t satisfy everyone they have to make choices. Sometimes they don’t make the best choices. Hopefully you don’t have these weights in your job. But lots of us do.

xyst 6y ago

very nice - this was one of my main contentions on Big Sur. Will upgrade once 11.2 is stable :)

aarchi 6y ago
I'm still on Mojave to use 32-bit apps. Any way to use 32-bit in Catalina or later?
- Rebelgecko 6y ago
  For my 32 bit binaries, the easiest way to use them is to run the Windows version, because that OS has better backwards compatability. It's possible to get a Mojave VM up and running but it was nontrivial when I gave it a shot
  - tanelpoder 6y ago
    I’m using a Mojave VM with VMWare Fusion on my laptop (that runs Catalina) on the rare occasion of needing to run 32bit apps. Install & setup was easy, without any problems. VMWare Fusion is a paid app, but VirtualBox should be able to do the same for free.
    - inapis 6y ago
      The latest Vmware Fusion has a free license for personal use.
  - kitsunesoba 6y ago
    If I'm not mistaken, WINE is now capable of running 32-bit Windows binaries on 64-bit-only macOS as well, so that may also be an option particularly for more simple apps.
    - tempodox 6y ago
      Even the 64-bit WINE can't run 32-bit apps on Catalina. Their website specifically says they support up to macOS-10.14. Apparently 64-bit WINE can run 64-bit Windos apps on Catalina, though.

user3939382 6y ago

So does this mean we won’t be seeing the behavior I just documented the other day on here? https://news.ycombinator.com/item?id=25746007 https://news.ycombinator.com/item?id=25746007 In sum, they’re intentionally circumventing DNS, /etc/hosts, and even IPv4 blackholing by attempting to send their phone-home packets through IPv6. Then if you block that as well your computer constantly freezes.

lilyball 6y ago
You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing. Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com URL for their reachability test, so your blackhole should be blocking that too.
- user3939382 6y ago
  Why are they ignoring /etc/hosts if this is good behavior?
  - jojobas 6y ago
    In their book a bit of malware might have modified /etc/hosts. It's for your own good!
  - judge2020 6y ago
    Are you writing ::/0 domain.example as well? It might using either AAAA DNS lookups or the equivalent of `getent hosts` which pulls v6 records first, which are only overridden if there is a v6 override for the hostname. $ getent hosts cloudflare.com && getent ahosts cloudflare.com 2606:4700::6810:85e5 cloudflare.com 104.16.133.229 STREAM cloudflare.com $ echo "0.0.0.0 cloudflare.com" | sudo tee -a /etc/hosts $ getent hosts cloudflare.com && getent ahosts cloudflare.com 2606:4700::6810:85e5 cloudflare.com 0.0.0.0 STREAM cloudflare.com

exabrial 6y ago

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

Paraesthetic 6y ago
It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.
- SulfurHexaFluri 6y ago
  Its possible that they saw it as a purely positive move that would improve security on MacOS and then after seeing everyone's response they reevaluated its importance.
  - onelovetwo 6y ago
    > positive move that would improve security That they purposefully added in the first place to let only Apple apps bypass third-party firewalls?
  - m463 6y ago
    or they started getting security bugs from the fuzzer teams. (it's a hard problem to sanitize so many exectutables, and the people who use VPNs are probably high-value customers, like business people wfh)
  - tempodox 6y ago
    Having to be told by outsiders that this backdoor could be abused by malware is pretty embarrassing. It's hard to imagine Apple's engineers weren't aware of that.
- eyelidlessness 6y ago
  Apple gives two fucks about media pressure. Their longstanding history of giving in to pressure almost exclusively is responsive to their users, either: - pro/dev users who act as their trend setters (see recent backpedals on keyboards and Mac Pro form factor) - people hacking stuff where it’s popular enough they want more influence on the UX (bootcamp)

post_break 6y ago

Does anyone know how this impacts little snitch?

pseudalopex 6y ago
It lets Little Snitch 5 block Apple processes without editing a system file.
- pcdoodle 6y ago
  Which processes should I block? I prefer to share less.
webmobdev 6y ago
It impacts all application firewalls on macOS - Lulu, Little Snitch, HandsOff, TripMode, RadioSilence etc - equally. Meaning, they can all now block the apps that Apple had exempted, in future versions of macOS Big Sur.

SmileyKeith 6y ago

An Apple employee tweeted after the news with 11.0 that this was a bug so I'm not surprised, but happy to see it fixed!

devin 6y ago
Link?
- _qulr 6y ago
  There's no link because the tweet was deleted soon afterward. The tweet seems to have been very ill-advised. I don't know how anyone can describe this as a "bug", because as the linked article describes, there's an explicit "ContentFilterExclusionList" in the Info.plist file with a list of the specific Apple services excluded. That's not by accident, it's by design.
  - nytgop77 6y ago
    bug was in the design. (or in decision leading to design)
    - chipotle_coyote 6y ago
      I don't think I'd call it a bug. It's a poor decision. I can easily believe that it wasn't a decision made with malicious intent; the culture at Apple seems (at least from the outside, judging by results) to encourage an "it's okay to give our own software special exceptions" mentality.
      - saagarjha 6y ago
        You could call it an entitled opinion.
        chipotle_coyote 6y ago
        I see what you did there. (+1.)

xbar 6y ago

Nice! I can finally upgrade.

PointyFluff 6y ago

Imagine being told what software you can and cannot run on your machine.

na85 6y ago
The linked tweet/TFA is actually about Apple's boneheaded decision to let its own apps bypass firewalls etc., and not about software permissions. FWIW you can just turn off the Gatekeeper feature which is what I assume you're complaining about.

webmobdev 6y ago

I am glad that the public backlash forced them to fix a deliberate BACKDOOR that they had introduced (by design) in the Network Extension Framework that macOS Big Sur now forces all the firewalls to use. (At least, they claim to have removed it). But it is hard to trust them again, and I would prefer to use a firewall that uses its own kernel extension to manage the network than using Apple's API again. (Obviously that's going to be really hard with the changes they have made to the OS). I know many Apple's fan see this as a positive move. But let's not ignore the pattern of privacy violations and user data collections due to deliberate design and the "apology" and "changes" that follow once CAUGHT. A few of these that immediately come to mind are: - Apple selling user data to US government: https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data https://www.theguardian.com/world/2013/jun/06/us-tech-giants... - Apple iPhone 11 tracks user location even when location services are explicitly turned off by user (another BACKDOOR): https://www.silicon.co.uk/mobility/smartphones/apple-iphone-collects-location-data-321509?cmpredirect https://www.silicon.co.uk/mobility/smartphones/apple-iphone-... - Apple macOS tracks every app that you use: https://sneak.berlin/20201112/your-computer-isnt-yours/ https://sneak.berlin/20201112/your-computer-isnt-yours/ - Apple introduces BACKDOOR in its API to allow Apple apps to bypass application firewalls: https://www.patreon.com/posts/hooray-no-more-46179028 https://www.patreon.com/posts/hooray-no-more-46179028 (For those who want to diss me for the above, realise that Apple's new found love for privacy doesn't mean shit without such public scrutiny and discussions. And if you want it to last, remain suspicious and VOCAL on any such possible violations.)

conistonwater 6y ago
Why do you call it a deliberate backdoor when the Apple developers (see elsewhere in this thread) have said this was a bug?
- kristofferR 6y ago
  You don't create a whitelist system literally called ContentFilterExclusionList by accident.
  - 6y ago

darwingr 6y ago

While I'm glad they fixed it (upgrading past Catalina was not going to happen), It's going to take me a LONG time to trust them again. The fact that they could rationalize their own thought process to think this was a good idea or even anywhere close to acceptable, at best leads me to doubt their judgement. At worst, well it's best to assume incompetence over malice but you can see what doors this would open in the future. Now we know they CAN do this without it being obvious to most users, which is a new dimension of risk regardless of intent.

SXX 6y ago

This firewall issue isn't the only privacy feature strip from Big Sur release. Unfortunately no big media care about other huge problem Apple introduced. My only hope they will also fix full disk encryption in this update. Since Big Sur broken installation of macOS on passphrase-encrypted disk partitions. I bought into M1 hype and now it's end up that you no longer able to have separate password for the disk encryption.

orf 6y ago
Most users don’t want a separate password for disk encryption though, so I’m not sure it’s a huge problem?
- La1n 6y ago
  Most users probably also didn't care about the first-party firewall exemptions. They could have asked people if they wanted a separate password for disk encryption (e.g. a small checkbox).
  - fpoling 6y ago
    It is highly non-trivial to extract private key from Apple encryption chips, last time I heared the price is at least 100K USD, and probably much higher now. So unless one values own secrets that high, a short password could be OK.
- webmobdev 6y ago
  It's about choice and control over your data - an educated user knows that with hardware encryption, it is very difficult to retrieve data if the hardware fails. There's also the trust factor where you would prefer to have the keys, rather than trust some device. (E.g. Some Western Digital drives have problems with their hardware encryption and made the data on it irretrievable for many - https://github.com/andlabs/reallymine/issues/53 https://github.com/andlabs/reallymine/issues/53 . More here - https://carltonbale.com/western-digital-mybook-drive-lock-encryption-failure-and-recovery/ https://carltonbale.com/western-digital-mybook-drive-lock-en...). What is being questioned and criticized is the removal of this choice. Especially when a product claims a commitment to privacy.

sneak 6y ago

Sadly, they could just as easily add it back in with a later update. This means that after I update to 11.2, to preserve location privacy from Apple, I must now verify each and every OS update in the future. We need a better system.

sneak 6y ago

In Case You Didn't Know: Big Sur on M1 (and possibly on Intel) maintains a persistent, hardware-serial-number linked TLS connection to Apple (for APNS, just like on iOS) at all times when you are logged in, even if you don't use iCloud, App Store, iMessage, or FaceTime, and have all analytics turned off. There's no UI to disable this. This means that Apple has the coarse location track log (due to GeoIP of the client IP) for every M1 serial number. When you open the App Store app, that serial number is also sent, and associated with your Apple ID (email/phone) if you log in. Apple knows when you leave home, or arrive at the office, or travel to a different city, all with no Apple ID, no iCloud, and no location services. This has always been the case on all devices using iOS, too. This change is essential for blocking such traffic, and I'm glad for it, but there is a long way to go when it comes to pressuring the pro-privacy forces inside of Apple to do more.

twobitshifter 6y ago
How do you know that apple is logging GeoIPs and performing this association with appleIDs? Or are you just saying it’s possible to do so?
- novok 6y ago
  With a datetime and IP, you can geoIP any time in the future. It's a single ETL operation. So you treat it like they do, one way or another.
  - zepto 6y ago
    This assumes they don’t scrub it before storing it, which we know they do for some services, and we have no information about others. We can’t in fact treat it like they do. We can only treat it like they might be able to.
    - sneak 6y ago
      Anyone monitoring the traffic outside of Apple can do it, as well. IIRC TLS client certificate information is not encrypted on the wire, but I'd need to review modern TLS protocol negotiation to confirm. This would allow anyone monitoring Apple's upstream, passively, to perform this same location logging that Apple does. Apple knows this, so shipping systems that leak information in this way is tacit acceptance of the military spying going on on the networks to which Apple's servers are connected.

slmjkdbtl 6y ago

It's great to see community feedback actually works, I really hope people can talk about having the option to disable .DS_Store now