12 ms·

This is really responsible of them! Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company.

Paraesthetic 6y ago
It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.
- SulfurHexaFluri 6y ago
  Its possible that they saw it as a purely positive move that would improve security on MacOS and then after seeing everyone's response they reevaluated its importance.
  - onelovetwo 6y ago
    > positive move that would improve security That they purposefully added in the first place to let only Apple apps bypass third-party firewalls?
  - m463 6y ago
    or they started getting security bugs from the fuzzer teams. (it's a hard problem to sanitize so many exectutables, and the people who use VPNs are probably high-value customers, like business people wfh)
  - tempodox 6y ago
    Having to be told by outsiders that this backdoor could be abused by malware is pretty embarrassing. It's hard to imagine Apple's engineers weren't aware of that.
- eyelidlessness 6y ago
  Apple gives two fucks about media pressure. Their longstanding history of giving in to pressure almost exclusively is responsive to their users, either: - pro/dev users who act as their trend setters (see recent backpedals on keyboards and Mac Pro form factor) - people hacking stuff where it’s popular enough they want more influence on the UX (bootcamp)
  - onelovetwo 6y ago
    Name an instance where Apple has reversed a decision where media outlets haven't reported on.
  - m463 6y ago
    Just search for example "apple backpedals" and it's pretty clear that Apple is not immune to the effects of publicity (like all companies)
    - eyelidlessness 6y ago
      I cited a pretty huge example (bootcamp) where there was no media pressure at all. There was definitely tech pressure, but the media had no dog in the fight.
      - stretchcat 6y ago
        Finding an example of Apple changing something for a reason other than media coverage is hardly evidence of media coverage never swaying Apple.
    - Uehreka 6y ago
      The iPhone Headphone Jack has entered the chat.
      - culopatin 6y ago
        Followed by the EarPods
- alwillis 6y ago
  When it comes to media pressure, Apple is like the honey-badger—they don’t care.
  - saagarjha 6y ago
    They want to make it seem like they don’t care…but they very much do.
- yalogin 6y ago
  As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight or a resourcing issue.
  - colejohnson66 6y ago
    As much as I'd like to believe it was just an oversight, how do you accidentally have your services bypass the firewall? That feels like it would have to be a deliberate choice under the assumption that "our apps are signed by us, and the OS verifies that, so all traffic through these apps should be OK, right?" I don't mean this snarkily; it's a genuine question. I don't know how OSes work.
    - Demiurge 6y ago
      Perhaps they wanted a bypass as system recovery option, or preference, not on by default.
      - jtbayly 6y ago
        That could really make sense of why you need a config file and it is just a simple bug at the same time.
      - stretchcat 6y ago
        I don't see why half the shit in that list would be needed during a recovery process, let alone need to bypass a VPN as well. If Apple wants to claim this as their defense, let them. Until then, I see little value in dreaming up excuses they aren't willing to make for themselves.
      - webmobdev 6y ago
        They already have a "system recovery mode" where no such firewalls run, and only select system tools are available. There's also "safe mode".
    - acdha 6y ago
      My guess is that this started small (“we shouldn’t let firewalls block security updates or Find My Mac”) and once that mechanism was there people kept adding other things to it thinking about support (security filters are notorious for people blocking things without understanding the implications and then file big reports) but not the users who would be upset about not being able to block those services.
- ROARosen 6y ago
  Nah, it's not media outlets Apple is scared of, it's the front page of Hacker News...
- jiofih 6y ago
  The amount of people reading about firewalls in the latest OS release surely does not qualify as “media pressure” on any kind of scale.
  - Unklejoe 6y ago
    Don't underestimate the power that a few angry nerds can have when it comes to the overall narrative about a technology. Every family has that one computer geek who everyone asks for advice, which ultimately influences purchase decisions.
jojobas 6y ago
The firewall is just the tip of the iceberg. Microsoft provides the sources and special builds for sensitive environments. They work with governments worldwide and open their source code to get certified. As far as I understand it never was Apple's priority.
- davisr 6y ago
  You're commending Micro$oft for sharing source code? Please! They both are completely irresponsible and push proprietary malware. Anything less than freely usable/sharable software is inadequate.
  - jojobas 6y ago
    I'm not in the business of commending or admonishing. The question was whether Apple could/should be used in government classified/sensitive business environments.
  - colejohnson66 6y ago
    I wasn't aware that VS Code was "proprietary malware"? All the code for that is right on GitHub.[0] If you don't trust the prebuilt ones, you're free to build it from the source yourself. Want something else? Their GitHub repo list has almost 4000 repositories totaling 130 pages![1] Just because the OS itself isn't open source[a] doesn't mean that Microsoft doesn't open source a whole crap ton of stuff. And sure, Window's telemetry can easily be construed as "malware", but Windows is not the entirety of Microsoft. [a]: And that's a lie too (sortove). It is open source.[2] (ahem source available (sorry, FSF)) You just need a valid reason to look at it besides "I want to". Sidenote: I personally would hope that Windows gets open sourced, but I'm not holding my breath. [0]: https://github.com/Microsoft/vscode https://github.com/Microsoft/vscode [1]: https://github.com/microsoft https://github.com/microsoft [2]: https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/ P.S. Can we not use the "M$" moniker? It's almost childish. Just like "Crapple", "Microshit", etc, It serves no purpose.
    - ianlevesque 6y ago
iforgotpassword 6y ago
> Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company. Relying on a personal firewall on the device itself seems ill-fated. Maybe it could be considered an additional layer of security, but I've yet to work at a place where a personal firewall is part of the security concept, no matter which OS. It's either firewalls at the gateway, maybe additional ones for certain departments, or mandatory proxy servers if you're stuck in the 90s.
- Spearchucker 6y ago
  Defense in depth suggests using controls to protect each individual resource. This includes individual apps, individual servers and individual user devices. A firewall is a single control, but never the only control. This from experience working with... government things.
- g_p 6y ago
  An application firewall on the device serves a different purpose to that running off-device, namely the ability to filter traffic based on the origin (or destination) application. Clearly if your kernel or userspace are compromised that's not much use, and that's where external controls kick in. You can't determine (absent some custom network and protocols) which piece of software was responsible for a given packet once you leave the device though, so that's the (current) best place to do that - if you want to impose policies controlling the hosts and protocols an application can use, you will want to implement this on-device, then firewall for the superset of all of those at the network level. In essence it's about raising the number of independent failures required to result in a compromise. If you imagine the application firewall on the device has its policies managed rather than selected by the user, it starts to make more sense.
  - iforgotpassword 6y ago
    To fight apps phoning home, I agree. But even the tweet linked in OP refers to a tweet that shows how to abuse the now removed whitelisting by piggybacking your traffic through one of those whitelisted apps. On a locked down system like Android or iOS this isn't that trivial, but in a classic desktop OS use case it's easy to abuse another app to exfiltrate data. > In essence it's about raising the number of independent failures required to result in a compromise. Sure, it doesn't hurt, minus maybe the case that a vulnerability in that firewall itself is used. > If you imagine the application firewall on the device has its policies managed rather than selected by the user, it starts to make more sense. That's a requirement I guess. You don't want accountants and HR people handling popups by a firewall app. :-)

Paraesthetic 6y ago

It would be responsible of them if they had done it in a situation where they weren't pressured into the decision by media outlets.

SulfurHexaFluri 6y ago
Its possible that they saw it as a purely positive move that would improve security on MacOS and then after seeing everyone's response they reevaluated its importance.
- onelovetwo 6y ago
  > positive move that would improve security That they purposefully added in the first place to let only Apple apps bypass third-party firewalls?
- m463 6y ago
  or they started getting security bugs from the fuzzer teams. (it's a hard problem to sanitize so many exectutables, and the people who use VPNs are probably high-value customers, like business people wfh)
- tempodox 6y ago
  Having to be told by outsiders that this backdoor could be abused by malware is pretty embarrassing. It's hard to imagine Apple's engineers weren't aware of that.
eyelidlessness 6y ago
Apple gives two fucks about media pressure. Their longstanding history of giving in to pressure almost exclusively is responsive to their users, either: - pro/dev users who act as their trend setters (see recent backpedals on keyboards and Mac Pro form factor) - people hacking stuff where it’s popular enough they want more influence on the UX (bootcamp)
- onelovetwo 6y ago
  Name an instance where Apple has reversed a decision where media outlets haven't reported on.
- m463 6y ago
  Just search for example "apple backpedals" and it's pretty clear that Apple is not immune to the effects of publicity (like all companies)
  - eyelidlessness 6y ago
    I cited a pretty huge example (bootcamp) where there was no media pressure at all. There was definitely tech pressure, but the media had no dog in the fight.
    - stretchcat 6y ago
      Finding an example of Apple changing something for a reason other than media coverage is hardly evidence of media coverage never swaying Apple.
  - Uehreka 6y ago
    The iPhone Headphone Jack has entered the chat.
    - culopatin 6y ago
      Followed by the EarPods
alwillis 6y ago
When it comes to media pressure, Apple is like the honey-badger—they don’t care.
- saagarjha 6y ago
  They want to make it seem like they don’t care…but they very much do.
yalogin 6y ago
As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight or a resourcing issue.
- colejohnson66 6y ago
  As much as I'd like to believe it was just an oversight, how do you accidentally have your services bypass the firewall? That feels like it would have to be a deliberate choice under the assumption that "our apps are signed by us, and the OS verifies that, so all traffic through these apps should be OK, right?" I don't mean this snarkily; it's a genuine question. I don't know how OSes work.
  - Demiurge 6y ago
    Perhaps they wanted a bypass as system recovery option, or preference, not on by default.
    - jtbayly 6y ago
      That could really make sense of why you need a config file and it is just a simple bug at the same time.
    - stretchcat 6y ago
      I don't see why half the shit in that list would be needed during a recovery process, let alone need to bypass a VPN as well. If Apple wants to claim this as their defense, let them. Until then, I see little value in dreaming up excuses they aren't willing to make for themselves.
    - webmobdev 6y ago
      They already have a "system recovery mode" where no such firewalls run, and only select system tools are available. There's also "safe mode".
  - acdha 6y ago
    My guess is that this started small (“we shouldn’t let firewalls block security updates or Find My Mac”) and once that mechanism was there people kept adding other things to it thinking about support (security filters are notorious for people blocking things without understanding the implications and then file big reports) but not the users who would be upset about not being able to block those services.
ROARosen 6y ago
Nah, it's not media outlets Apple is scared of, it's the front page of Hacker News...
jiofih 6y ago
The amount of people reading about firewalls in the latest OS release surely does not qualify as “media pressure” on any kind of scale.
- Unklejoe 6y ago
  Don't underestimate the power that a few angry nerds can have when it comes to the overall narrative about a technology. Every family has that one computer geek who everyone asks for advice, which ultimately influences purchase decisions.

jojobas 6y ago

The firewall is just the tip of the iceberg. Microsoft provides the sources and special builds for sensitive environments. They work with governments worldwide and open their source code to get certified. As far as I understand it never was Apple's priority.

davisr 6y ago
You're commending Micro$oft for sharing source code? Please! They both are completely irresponsible and push proprietary malware. Anything less than freely usable/sharable software is inadequate.
- jojobas 6y ago
  I'm not in the business of commending or admonishing. The question was whether Apple could/should be used in government classified/sensitive business environments.
- colejohnson66 6y ago
  I wasn't aware that VS Code was "proprietary malware"? All the code for that is right on GitHub.[0] If you don't trust the prebuilt ones, you're free to build it from the source yourself. Want something else? Their GitHub repo list has almost 4000 repositories totaling 130 pages![1] Just because the OS itself isn't open source[a] doesn't mean that Microsoft doesn't open source a whole crap ton of stuff. And sure, Window's telemetry can easily be construed as "malware", but Windows is not the entirety of Microsoft. [a]: And that's a lie too (sortove). It is open source.[2] (ahem source available (sorry, FSF)) You just need a valid reason to look at it besides "I want to". Sidenote: I personally would hope that Windows gets open sourced, but I'm not holding my breath. [0]: https://github.com/Microsoft/vscode https://github.com/Microsoft/vscode [1]: https://github.com/microsoft https://github.com/microsoft [2]: https://www.microsoft.com/en-us/sharedsource/ https://www.microsoft.com/en-us/sharedsource/ P.S. Can we not use the "M$" moniker? It's almost childish. Just like "Crapple", "Microshit", etc, It serves no purpose.
  - ianlevesque 6y ago

iforgotpassword 6y ago

> Before, I was trying to figure out how mac's would ever be used anywhere near something classified or secret for a company. Relying on a personal firewall on the device itself seems ill-fated. Maybe it could be considered an additional layer of security, but I've yet to work at a place where a personal firewall is part of the security concept, no matter which OS. It's either firewalls at the gateway, maybe additional ones for certain departments, or mandatory proxy servers if you're stuck in the 90s.

Spearchucker 6y ago
Defense in depth suggests using controls to protect each individual resource. This includes individual apps, individual servers and individual user devices. A firewall is a single control, but never the only control. This from experience working with... government things.
g_p 6y ago
An application firewall on the device serves a different purpose to that running off-device, namely the ability to filter traffic based on the origin (or destination) application. Clearly if your kernel or userspace are compromised that's not much use, and that's where external controls kick in. You can't determine (absent some custom network and protocols) which piece of software was responsible for a given packet once you leave the device though, so that's the (current) best place to do that - if you want to impose policies controlling the hosts and protocols an application can use, you will want to implement this on-device, then firewall for the superset of all of those at the network level. In essence it's about raising the number of independent failures required to result in a compromise. If you imagine the application firewall on the device has its policies managed rather than selected by the user, it starts to make more sense.
- iforgotpassword 6y ago
  To fight apps phoning home, I agree. But even the tweet linked in OP refers to a tweet that shows how to abuse the now removed whitelisting by piggybacking your traffic through one of those whitelisted apps. On a locked down system like Android or iOS this isn't that trivial, but in a classic desktop OS use case it's easy to abuse another app to exfiltrate data. > In essence it's about raising the number of independent failures required to result in a compromise. Sure, it doesn't hurt, minus maybe the case that a vulnerability in that firewall itself is used. > If you imagine the application firewall on the device has its policies managed rather than selected by the user, it starts to make more sense. That's a requirement I guess. You don't want accountants and HR people handling popups by a firewall app. :-)