6 ms·

It's wild that you need a firewall just to stop OS features from phoning home every file you preview on your computer.

by ok123456 4y ago

gjsman-1000 4y ago
Or just turn off "Siri Suggestions" in System Settings as stated in the article.
- c22 4y ago
  I'd probably stick with the firewall just to be safe, thorough, and future-proofed...
  - gjsman-1000 4y ago
    Well... macOS is hardly the worst IoT offender. Roku is unbelievable. ;) Many good reasons to set up a Pi-Hole...
  - Xylakant 4y ago
    You’d need a network level firewall for that - the OS can circumvent any firewall you run on your computer. That would imply that you’re unprotected once you leave your home network. The firewall would also need to inspect all network traffic, including TLS secured connections.
    - deleted 4y ago
      [deleted]
  - VWWHFSfQ 4y ago
    Apple allows itself to bypass the OS firewall so you will need something at the network level.
    - sundvor 4y ago
      .. on every single network you connect your computer to. Maybe there is such a thing as a portable battery powered wireless travel router with proper firewall rules, that can also do VPN etc. Must admit that's something I never looked into.
  - djur 4y ago
    Using a firewall to protect your privacy from the company that designed the hardware and wrote the software for your computer is kind of like putting on a raincoat before going swimming.
    - ok123456 4y ago
      Why do they deserve any trust when they're phoning home?
      - scarface74 4y ago
        The person you are replying to is saying that at some level you have to trust someone and “open source” is not the answer. There have been plenty of latent bugs in Linux that took years to discover that could have led to information extraction
        ok123456 4y ago
        "Every platform has RVEs eventually" is a pretty lazy answer. The answer is to stop normalizing telemetry and data exfiltration even if it's 'the good guys' doing it. It's not your "cloud" therefore it's not your data.
        scarface74 4y ago
        So if you are not going to trust anyone are you going to stop using computers?
        ok123456 4y ago
        No. Just don't use "cloud" "services" like this or LassPass.
        djur 4y ago
        No, that's not what I'm saying. I think it's conceivable that with a great deal of effort you could build an open source system that is highly trustworthy. What I'm saying is that the gradient between "highly trustworthy" and "untrustworthy" is extremely steep. To use another analogy, someone using a firewall to keep a MacBook from phoning home is like a person who invests in a really high-quality lock on their jewelry box to keep their housecleaner from stealing from them.
- cma 4y ago
  What if an auto update adds something similar new, and defaulted on like this one was?
pwdisswordfish9 4y ago
As if apple would have their services obey firewall restrictions.
- est31 4y ago
  Or even VPNs... https://www.macrumors.com/2022/10/13/ios-16-vpns-leak-data-even-with-lockdown-mode/ https://www.macrumors.com/2022/10/13/ios-16-vpns-leak-data-e...
Helmut10001 4y ago
Just replaced my router with OPNsense and starting to get some sense for all the egress traffic.
- hammock 4y ago
  Simple instructions how to do this?
  - jeroenhd 4y ago
    I recommend browsing the install guide here to get an idea of how opnsense works: https://docs.opnsense.org/manual/hardware.html https://docs.opnsense.org/manual/hardware.html You'll need to make a few choices and gather some details before you can start. First of all, hardware: Simplest, but most expensive: buy an opnsense device that comes preloaded with the right software Cheaper, but still not too hard: buy one of those aliexpress routers that are supported by opnsense Harder, less efficient, and requires the right hardware: find an old computer that's supported enough by FreeBSD, chuck in a few ethernet cards supported by FreeBSD, and install opnsense. Installing opnsense and setting it up as a basic ethernet to ethernet router is relatively straightforward. You can run it from a flash drive if you want, but a small SSD won't wear out as far if you enable logs and such (16GiB will be far more than enough for an install without additional packages!). If you're planning on replacing your ISP router, you'll need to find the documentation your ISP or random forum users provide for connecting. If you have a separate modem you may need to find PPPoE credentials somewhere, or you may just be able to use basic DHCP to get it to work. If you don't have a separate modem, your best bet is to put your router+modem into bridge mode; that will often be enough to get the basics up and running. If your ISP doesn't provide such a mode, you may use addin cards to get the right connector into your system (RJ11/fiber/whatever) but you'll need to find devices with FreeBSD support so I would use this as a last resort. Also of note: many opnsense solutions don't include great WiFi. You can likely reuse the ISP modem as a wireless access point, but if you can't, consider investing in a separate access point to keep your WiFi coverage. The kind of hardware you need will depend on your wishes. If you just want a router with some customisable routes and if you don't have fiber Internet, chances are a cheap aliexpress box will be more than enough to get you going. If your Internet connection is faster than 100 or 200mbps, you should check the ratings (and be sceptical of the price). If you also intend to go full deep packet inspection/security monitoring/etc, you will likely need desktop class hardware with plenty of RAM, CPU horsepower and storage. If you're really going high-end, a server chassis may also work. For simple routing, small router boxes are often way more energy efficient than full desktop power supplies because of hardware accelerated routing supported on some chipsets. I personally run a full desktop as a router(+server etc) and it works quite well, but it eats at least 10 times the energy a small router should need. Lastly, if you're planning on running a home lab already, you may be able to virtualise opnsense if you add (a) dedicated network card(s) forwarded to the VM. Setup sill be a bit trickier, but it can save on costs if you're planning on buying them together.
MBCook 4y ago
Right. Because preventing the computer from talking to Apple where it finds out if there are updates or new malware definitions in addition to the documented thing it’s doing is a much better option than turning off the option in settings.
- handsclean 4y ago
  Yes, firewalls often prevent this from happening, waiting to read about some new setting on HN does not. Firewalls also aren’t going to block legitimate traffic unless they’re badly configured.
  - acdha 4y ago
    You have to think about the problem in context: if abuse were happening, which to be clear is not true, you couldn’t trust a computer made by the company running the program you disagree with. They control the software stack and network endpoints, so they could exempt their own services from the local firewall and avoid a network firewall by using something like their network update service to receive queries.
    - MBCook 4y ago
      Right. They make the hardware (including CPU), the OS (and firmware), and there is a decent chance they make the app you’re using like Preview. Apple is the keys to the kingdom. They have full access to your decrypted data because they encrypt/decrypt it for you. If you don’t trust them to not go behind your back this is the least of your concerns.
      - acdha 4y ago
        I’d also add that this is an area where we’re predisposed to think of technical solutions but it seems more appropriate for a regulatory one: trusting Apple is not a bad idea for a lot of people (just a single party for many things) but a robust public audit would make that easier. Unfortunately if your threat model includes the U.S. government you’re basically hoping that the EU is willing to apply pressure.

It's wild that you need a firewall just to stop OS features from phoning home every file you preview on your computer.

gjsman-1000 4y ago

Or just turn off "Siri Suggestions" in System Settings as stated in the article.

c22 4y ago
I'd probably stick with the firewall just to be safe, thorough, and future-proofed...
- gjsman-1000 4y ago
  Well... macOS is hardly the worst IoT offender. Roku is unbelievable. ;) Many good reasons to set up a Pi-Hole...
- Xylakant 4y ago
  You’d need a network level firewall for that - the OS can circumvent any firewall you run on your computer. That would imply that you’re unprotected once you leave your home network. The firewall would also need to inspect all network traffic, including TLS secured connections.
  - deleted 4y ago
    [deleted]
- VWWHFSfQ 4y ago
  Apple allows itself to bypass the OS firewall so you will need something at the network level.
  - sundvor 4y ago
    .. on every single network you connect your computer to. Maybe there is such a thing as a portable battery powered wireless travel router with proper firewall rules, that can also do VPN etc. Must admit that's something I never looked into.
- djur 4y ago
  Using a firewall to protect your privacy from the company that designed the hardware and wrote the software for your computer is kind of like putting on a raincoat before going swimming.
  - ok123456 4y ago
    Why do they deserve any trust when they're phoning home?
    - scarface74 4y ago
      The person you are replying to is saying that at some level you have to trust someone and “open source” is not the answer. There have been plenty of latent bugs in Linux that took years to discover that could have led to information extraction
      - ok123456 4y ago
        "Every platform has RVEs eventually" is a pretty lazy answer. The answer is to stop normalizing telemetry and data exfiltration even if it's 'the good guys' doing it. It's not your "cloud" therefore it's not your data.
        scarface74 4y ago
        So if you are not going to trust anyone are you going to stop using computers?
        ok123456 4y ago
        No. Just don't use "cloud" "services" like this or LassPass.
      - djur 4y ago
        No, that's not what I'm saying. I think it's conceivable that with a great deal of effort you could build an open source system that is highly trustworthy. What I'm saying is that the gradient between "highly trustworthy" and "untrustworthy" is extremely steep. To use another analogy, someone using a firewall to keep a MacBook from phoning home is like a person who invests in a really high-quality lock on their jewelry box to keep their housecleaner from stealing from them.
cma 4y ago
What if an auto update adds something similar new, and defaulted on like this one was?

pwdisswordfish9 4y ago

As if apple would have their services obey firewall restrictions.

est31 4y ago
Or even VPNs... https://www.macrumors.com/2022/10/13/ios-16-vpns-leak-data-even-with-lockdown-mode/ https://www.macrumors.com/2022/10/13/ios-16-vpns-leak-data-e...

Helmut10001 4y ago

Just replaced my router with OPNsense and starting to get some sense for all the egress traffic.

hammock 4y ago
Simple instructions how to do this?
- jeroenhd 4y ago
  I recommend browsing the install guide here to get an idea of how opnsense works: https://docs.opnsense.org/manual/hardware.html https://docs.opnsense.org/manual/hardware.html You'll need to make a few choices and gather some details before you can start. First of all, hardware: Simplest, but most expensive: buy an opnsense device that comes preloaded with the right software Cheaper, but still not too hard: buy one of those aliexpress routers that are supported by opnsense Harder, less efficient, and requires the right hardware: find an old computer that's supported enough by FreeBSD, chuck in a few ethernet cards supported by FreeBSD, and install opnsense. Installing opnsense and setting it up as a basic ethernet to ethernet router is relatively straightforward. You can run it from a flash drive if you want, but a small SSD won't wear out as far if you enable logs and such (16GiB will be far more than enough for an install without additional packages!). If you're planning on replacing your ISP router, you'll need to find the documentation your ISP or random forum users provide for connecting. If you have a separate modem you may need to find PPPoE credentials somewhere, or you may just be able to use basic DHCP to get it to work. If you don't have a separate modem, your best bet is to put your router+modem into bridge mode; that will often be enough to get the basics up and running. If your ISP doesn't provide such a mode, you may use addin cards to get the right connector into your system (RJ11/fiber/whatever) but you'll need to find devices with FreeBSD support so I would use this as a last resort. Also of note: many opnsense solutions don't include great WiFi. You can likely reuse the ISP modem as a wireless access point, but if you can't, consider investing in a separate access point to keep your WiFi coverage. The kind of hardware you need will depend on your wishes. If you just want a router with some customisable routes and if you don't have fiber Internet, chances are a cheap aliexpress box will be more than enough to get you going. If your Internet connection is faster than 100 or 200mbps, you should check the ratings (and be sceptical of the price). If you also intend to go full deep packet inspection/security monitoring/etc, you will likely need desktop class hardware with plenty of RAM, CPU horsepower and storage. If you're really going high-end, a server chassis may also work. For simple routing, small router boxes are often way more energy efficient than full desktop power supplies because of hardware accelerated routing supported on some chipsets. I personally run a full desktop as a router(+server etc) and it works quite well, but it eats at least 10 times the energy a small router should need. Lastly, if you're planning on running a home lab already, you may be able to virtualise opnsense if you add (a) dedicated network card(s) forwarded to the VM. Setup sill be a bit trickier, but it can save on costs if you're planning on buying them together.

MBCook 4y ago

Right. Because preventing the computer from talking to Apple where it finds out if there are updates or new malware definitions in addition to the documented thing it’s doing is a much better option than turning off the option in settings.

handsclean 4y ago
Yes, firewalls often prevent this from happening, waiting to read about some new setting on HN does not. Firewalls also aren’t going to block legitimate traffic unless they’re badly configured.
- acdha 4y ago
  You have to think about the problem in context: if abuse were happening, which to be clear is not true, you couldn’t trust a computer made by the company running the program you disagree with. They control the software stack and network endpoints, so they could exempt their own services from the local firewall and avoid a network firewall by using something like their network update service to receive queries.
  - MBCook 4y ago
    Right. They make the hardware (including CPU), the OS (and firmware), and there is a decent chance they make the app you’re using like Preview. Apple is the keys to the kingdom. They have full access to your decrypted data because they encrypt/decrypt it for you. If you don’t trust them to not go behind your back this is the least of your concerns.
    - acdha 4y ago
      I’d also add that this is an area where we’re predisposed to think of technical solutions but it seems more appropriate for a regulatory one: trusting Apple is not a bad idea for a lot of people (just a single party for many things) but a robust public audit would make that easier. Unfortunately if your threat model includes the U.S. government you’re basically hoping that the EU is willing to apply pressure.