4 ms·

As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight o

As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight or a resourcing issue.

colejohnson66 6y ago
As much as I'd like to believe it was just an oversight, how do you accidentally have your services bypass the firewall? That feels like it would have to be a deliberate choice under the assumption that "our apps are signed by us, and the OS verifies that, so all traffic through these apps should be OK, right?" I don't mean this snarkily; it's a genuine question. I don't know how OSes work.
- Demiurge 6y ago
  Perhaps they wanted a bypass as system recovery option, or preference, not on by default.
  - jtbayly 6y ago
    That could really make sense of why you need a config file and it is just a simple bug at the same time.
  - stretchcat 6y ago
    I don't see why half the shit in that list would be needed during a recovery process, let alone need to bypass a VPN as well. If Apple wants to claim this as their defense, let them. Until then, I see little value in dreaming up excuses they aren't willing to make for themselves.
  - webmobdev 6y ago
    They already have a "system recovery mode" where no such firewalls run, and only select system tools are available. There's also "safe mode".
- acdha 6y ago
  My guess is that this started small (“we shouldn’t let firewalls block security updates or Find My Mac”) and once that mechanism was there people kept adding other things to it thinking about support (security filters are notorious for people blocking things without understanding the implications and then file big reports) but not the users who would be upset about not being able to block those services.
miles 6y ago
Tweet[1] by Apple developer Russ Bishop: "Some system processes bypassing NetworkExtensions in macOS is a bug, in case you were wondering." Reply[2] by David Dudok de Wit, developer of TripMode: "Glad to see it's being reconsidered as a bug, because Apple told us it 'behaves as designed' (FB7740671 + FB7665551). And why is there an exclusion list in the first place? I'd love to know more and see this documented." Reply[3] by Russ: "Can't get too specific but I promise it's really mundane/boring software development stuff... like two features that interact in an unintended way kind of boring." Comment[4] on Russ's original tweet by Sérgio Silva: "Yes. A bug with its own configuration file /System/Library/Frameworks/NetworkExtension.framework/Resources/Info.plist ContentFilterExclusionList" [1] https://web.archive.org/web/20201118140434/https://twitter.com/xenadu02/status/1328904159408521218 https://web.archive.org/web/20201118140434/https://twitter.c... [2] https://twitter.com/david_ddw/status/1329017113709842437 https://twitter.com/david_ddw/status/1329017113709842437 [3] https://twitter.com/xenadu02/status/1329030446269620224 https://twitter.com/xenadu02/status/1329030446269620224 [4] https://twitter.com/sergiojdsilva/status/1328991480657162242 https://twitter.com/sergiojdsilva/status/1328991480657162242
- webmobdev 6y ago
  The tweet by the Apple developer has been deleted - hope he didn't lose job, and at worst only earned a reprimand. (Nobody with experience would call it a bug, when it was clearly a deliberate design decision).
  - saagarjha 6y ago
    Twitter indicates that he is still employed.
  - stretchcat 6y ago
    Inexperience is less concerning than trying to publicly whitewash the misdeeds of a corporation. I'm not sure you can even chalk this up to inexperience; my charitable guess is he probably didn't look at the code or config, assumed the company he likes would only do something like this by accident, went to twitter to say as much, then got a little carried away in the heat of it.

As much the community wants to think they are evil and want to purposefully violate trust, most often the easier explanation works very well. Its an oversight or a resourcing issue.

colejohnson66 6y ago

As much as I'd like to believe it was just an oversight, how do you accidentally have your services bypass the firewall? That feels like it would have to be a deliberate choice under the assumption that "our apps are signed by us, and the OS verifies that, so all traffic through these apps should be OK, right?" I don't mean this snarkily; it's a genuine question. I don't know how OSes work.

Demiurge 6y ago
Perhaps they wanted a bypass as system recovery option, or preference, not on by default.
- jtbayly 6y ago
  That could really make sense of why you need a config file and it is just a simple bug at the same time.
- stretchcat 6y ago
  I don't see why half the shit in that list would be needed during a recovery process, let alone need to bypass a VPN as well. If Apple wants to claim this as their defense, let them. Until then, I see little value in dreaming up excuses they aren't willing to make for themselves.
- webmobdev 6y ago
  They already have a "system recovery mode" where no such firewalls run, and only select system tools are available. There's also "safe mode".
acdha 6y ago
My guess is that this started small (“we shouldn’t let firewalls block security updates or Find My Mac”) and once that mechanism was there people kept adding other things to it thinking about support (security filters are notorious for people blocking things without understanding the implications and then file big reports) but not the users who would be upset about not being able to block those services.

miles 6y ago

Tweet[1] by Apple developer Russ Bishop: "Some system processes bypassing NetworkExtensions in macOS is a bug, in case you were wondering." Reply[2] by David Dudok de Wit, developer of TripMode: "Glad to see it's being reconsidered as a bug, because Apple told us it 'behaves as designed' (FB7740671 + FB7665551). And why is there an exclusion list in the first place? I'd love to know more and see this documented." Reply[3] by Russ: "Can't get too specific but I promise it's really mundane/boring software development stuff... like two features that interact in an unintended way kind of boring." Comment[4] on Russ's original tweet by Sérgio Silva: "Yes. A bug with its own configuration file /System/Library/Frameworks/NetworkExtension.framework/Resources/Info.plist ContentFilterExclusionList" [1] https://web.archive.org/web/20201118140434/https://twitter.com/xenadu02/status/1328904159408521218 https://web.archive.org/web/20201118140434/https://twitter.c... [2] https://twitter.com/david_ddw/status/1329017113709842437 https://twitter.com/david_ddw/status/1329017113709842437 [3] https://twitter.com/xenadu02/status/1329030446269620224 https://twitter.com/xenadu02/status/1329030446269620224 [4] https://twitter.com/sergiojdsilva/status/1328991480657162242 https://twitter.com/sergiojdsilva/status/1328991480657162242

webmobdev 6y ago
The tweet by the Apple developer has been deleted - hope he didn't lose job, and at worst only earned a reprimand. (Nobody with experience would call it a bug, when it was clearly a deliberate design decision).
- saagarjha 6y ago
  Twitter indicates that he is still employed.
- stretchcat 6y ago
  Inexperience is less concerning than trying to publicly whitewash the misdeeds of a corporation. I'm not sure you can even chalk this up to inexperience; my charitable guess is he probably didn't look at the code or config, assumed the company he likes would only do something like this by accident, went to twitter to say as much, then got a little carried away in the heat of it.