9 ms·

The headline implies that normal user traffic bypasses the firewall. When in fact, it's only apple system traffic. Still not great, but way less bad than if the

The headline implies that normal user traffic bypasses the firewall. When in fact, it's only apple system traffic. Still not great, but way less bad than if the VPN was actually bypassed for all traffic: "It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices). The Mullvad VPN app does add firewall rules. Once you connect the Mullvad app, Private Relay announces that it has disabled itself. We see no correlation between user traffic and the leaking packets. We believe they are just some heartbeat signal calling home to Apple. We do not know what information is transmitted to Apple, but since the destination is Apple servers, it is a strong signal to your local network and ISP that you might be a macOS user."

gigel82 5y ago
It's not the first time Apple allowed certain applications bypass the firewall / VPN (see https://www.macworld.co.uk/news/apples-own-programs-bypass-firewalls-vpns-in-big-sur-3798193/ https://www.macworld.co.uk/news/apples-own-programs-bypass-f... ). It is very bad indeed; not even Microsoft dares to do this in Windows (you can still very much block any network request from any part of the system via firewalls or DNS ad-blockers).
- adamomada 5y ago
  I’ve been using little snitch for a decade+ and as far as I remember it was the only time, and was probably a mistake by Apple. From your link: > Objective Development, the developers of Little Snitch, also writes about the discovery - and that they take it for granted that Apple will correct it. (Update, 14 January 2021: Apple indeed appears to have removed the whitelist exemption in macOS Big Sur 11.2 beta 2.)
- ridgered4 5y ago
  Is that true? I thought I recall reading the Windows firewall resets itself and that come call homes use hard coded IPs.
tedmiston 5y ago
> It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices). Unclear if that's the case on iOS though.

gigel82 5y ago

It's not the first time Apple allowed certain applications bypass the firewall / VPN (see https://www.macworld.co.uk/news/apples-own-programs-bypass-firewalls-vpns-in-big-sur-3798193/ https://www.macworld.co.uk/news/apples-own-programs-bypass-f... ). It is very bad indeed; not even Microsoft dares to do this in Windows (you can still very much block any network request from any part of the system via firewalls or DNS ad-blockers).

adamomada 5y ago
I’ve been using little snitch for a decade+ and as far as I remember it was the only time, and was probably a mistake by Apple. From your link: > Objective Development, the developers of Little Snitch, also writes about the discovery - and that they take it for granted that Apple will correct it. (Update, 14 January 2021: Apple indeed appears to have removed the whitelist exemption in macOS Big Sur 11.2 beta 2.)
ridgered4 5y ago
Is that true? I thought I recall reading the Windows firewall resets itself and that come call homes use hard coded IPs.

tedmiston 5y ago

> It is worth noting that Private Relay (mostly) disables itself as soon as any firewall rule is added to PF (the system firewall on macOS devices). Unclear if that's the case on iOS though.