14 ms·
Using a Mac without a network connection
- sneak 4y agoI do the same thing basically on bare metal: with Little Snitch I have blocked almost all system processes from accessing the network at all. macOS still works fine. (You have to widen the permissions a bit for OCSP and the TSS api when doing OS updates, however.)
- diimdeep 4y agomacOS underlying system is really opaque, is Little Snitch really do block all that there is ?
- newaccount74 4y agoProbably, but we don't know. macOS 11 stopped support for kernel extensions, and now requires firewall apps like Little Snitch to use "Network Extensions". In early versions of macOS 11, some Apple apps bypassed network extensions. This was supposedly fixed in macOS 11.2, but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions.
- capableweb 4y ago> Probably, but we don't know. Why not? It's not like it'd be hard to know. The submission article even talks about running it in a VM, wouldn't be hard to connect tcpdump to whatever bridge it's using and inspect if Little Snitch can truly capture and block all traffic.
- newaccount74 4y agoBecause you don't know what conditions would trigger a circumvention of the network extension. There might be a zero-day somewhere in macOS that allows a malicious app to circumvent network extensions. If you look for leaks, and don't find any, it doesn't mean there aren't any.
- throw0101c 4y ago> […] but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions. Sure there is: you connect the system to a managed Ethernet switch and do port mirroring to inspect what traffic goes over the wire: * https://community.fs.com/blog/port-mirroring-explained-basis-configuration-and-fa-qs.html https://community.fs.com/blog/port-mirroring-explained-basis... * https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html https://www.cisco.com/c/en/us/support/docs/switches/catalyst... * https://en.wikipedia.org/wiki/Port_mirroring https://en.wikipedia.org/wiki/Port_mirroring If it's encrypted we may not know the exact contents, but you can't conceal IPs.
- codetrotter 4y agoNot everyone can afford a managed switch and a second computer to inspect the traffic with. Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with
- lapcat 4y ago> Not everyone can afford a managed switch and a second computer to inspect the traffic with. Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.
- chasd00 4y agoIt’s not magic, the packets have to comply with IP standards if they’re going to work on an IP network. Below that, the frames have to comply with Ethernet if you’re plugged into an Ethernet port. The traffic can’t hide.
- bell-cot 4y ago> Not everyone can afford a... For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?
- dan1234 4y agoI think Little Snitch does a good job, but it would be easy to see any leaks at the router/hardware firewall if there's a real concern.
- satysin 4y agoI’m currently on the fence about buying Little Snitch. I tried the trial for a week and interestingly there were no outboard connections I did not expect so ended up allowing basically everything. I run a limited set of applications and that hasn’t changed in a number of years. Obviously I feel quite happy that I’ve not found I’ve been allowing connections I didn’t want to but it also makes me feel perhaps I am being a little over the top by adding Little Snitch into the mix. I went in thinking it would catch dozens of secret connections but nothing. So part of me feels it is over kill and a time waster for myself. Anyone care to explain how wrong I am? I would be grateful to be corrected and happy to buy if I can be convinced it is indeed worth while :)
- lapcat 4y agoTo me it's more about personal control than surprises. It doesn't surprise me that Apple software is phoning home; I just want to stop it and control which connections and data I allow to leave my Mac.
- satysin 4y agoDo you find LS causes any kind of network speed impact when dealing with systems that have hundreds or thousands of connections? I often have Transmission open downloading and as I have a 2.5gbps connection it can easily hit several hundred in and out connections when bandwidth hits >2gbps. I’m wondering if LS either slows that down or causes additional power use/heat?
- lapcat 4y ago> Do you find LS causes any kind of network speed impact when dealing with systems that have hundreds or thousands of connections? Not that I'm aware of. Only my main Mac has Little Snitch installed, but as a developer I have other Macs and iOS devices for testing that don't have Little Snitch, and I've never noticed any difference in speed.
- satysin 4y ago
- KingLancelot 4y ago[dead]
- grardb 4y agoPardon if this is a stupid question, but I think I must be missing something. How is all of this different from turning WiFi off?
- simondotau 4y agoIt isn’t. The how is provided for the sake of reader curiosity; it is ancillary to the analysis performed in this article.
- mrtksn 4y agoThe difference is that it includes the initial installation process too. So the idea is that since online services are deeply embedded into the OS, what happens if you don't have an internet connection? A few years back there was this issue of MacOS apps launching with a delay because the OS was checking with Appe if you are allowed to use the app. IIRC, this was just a bug. Also, you won't be able to use iOS without an initial internet connection. This creates a curiosity on how usable a Mac is without internet. As it turns out, it's pretty usable.
- pathartl 4y ago> A few years back there was this issue of MacOS apps launching with a delay because the OS was checking with Appe if you are allowed to use the app. IIRC, this was just a bug. If you're talking about Nov 2021 when Apple's Gatekeeper servers went down, apps weren't just delayed, they were unable to be opened _at all_ unless you blocked DNS requests to the server or completely disabled your internet connection. I believe the only apps that were allowed to be opened were the built in macOS apps. Why this verification is done on every single load is completely beyond me. After this and the whole iPhone 7 radio debacle I won't be buying their products for a long time.
- mrtksn 4y agoWhat’s the iPhone 7 radio debacle?
- 4y ago
- LeoPanthera 4y agotl;dr It works fine, except for features that naturally require an internet connection. Compare to Windows 11, which cannot be installed without an internet connection, without resorting to hacks.
- unxdfa 4y agoActually you can install windows 11 if the network is not plugged in. I just did it yesterday.
- InCityDreams 4y agoThe hack (sorry for the length) 1. unplug internet before installing, 2. install w11 3. Connect to Internet after installing. connect afterwards.
- LeoPanthera 4y agoThis is not correct, and I’ve tried it. The installer will ask you to connect to the internet, and halt until you do.
- Scharkenberg 4y agoThere is a straightforward workaround, namely Shift+F10 -> OOBE\BYPASSNRO.
- Idiot_in_Vain 4y ago[flagged]
- sgsag33 4y agoI don't understand your point. There are dpkg and rpm which do exactly that.
- Idiot_in_Vain 4y agoWith Windows you can download an MSI file from a software vendor and it will install on any recent version of Windows. Can you do the same with Linux?
- pjc50 4y agoYou can just get the debs or rpms, or the flatpack? I've certainly installed both Debian and RedHat without network back in the floppy and cdrom eras.
- sgsag33 4y agoOfc just download and install the package from the repository as well.
- wongarsu 4y agoGo to packages.ubuntu.com (or the equivalent of your favorite distro), download the packages, transfer them to your offline computer, install there. The requirement for dependency resolution does make it more of a pain than it is in Windows or MacOS though (where dependencies are simply vendored in the installer)
- cesarb 4y agoSince macOS is AFAIK a laptop-focused operating system, and laptops are often used on the go, without any network connectivity, I'd expect it to work perfectly in that kind of situation. So these results are not that surprising.
- cehrlich 4y agoGiven the title I was expecting some kind of surprise, but everything works exactly as you would expect.
- rbanffy 4y agoI like my Macs precisely because they are boring and almost never surprise me. TBH, the only reason my Linux boxes surprise me is because I try stupid things such as mounting /var/log as a tmpfs to reduce write loads (mostly on RPis SD cards and eMMC devices).
- oneeyedpigeon 4y agoI don't know about that — macs have enough weird behaviours that it wouldn't totally surprise me if, soon, they required a network connection, or the lack of one would at least make things awkward. For example, the inability to use clamshell mode without AC power.
- Aaron2222 4y agoAmphetamine[0] lets you prevent sleep on lid close. I presume it lets you do so without AC power (but I might be wrong on that), but one of the techniques they use to do that (setting the IOKit key that indicates the system is currently in clamshell mode) definitely does work without AC power. I made a command line utility[1] for myself a while back that does that if you're interested. It works fairly well, but the clamshell state tends to reset upon gaining/losing AC power. That's fine if the lid is open at the time (as the utility just applies the change again), but if the lid is closed, the system sleeps until the lid is opened again (at which point, it reapplies the change and you can close the lid again). [0]: https://apps.apple.com/us/app/amphetamine/id937984704?mt=12 https://apps.apple.com/us/app/amphetamine/id937984704?mt=12 [1]: https://github.com/Aaron-Rumpler/CDM https://github.com/Aaron-Rumpler/CDM
- college_physics 4y agoWould be interesting to every once in a while test "Using Linux without a network connection" (as in: install everything from usb/media and check all your workflows)
- 3np 4y agoI'd expect any serious dist to already be doing this as part of their release process.
- grishka 4y agoI don't know about now, but when Ubuntu came on CD images intended for burning to actual CDs and offline installation, those images included most of the packages you'd ever need. Or at least that was my impression.
- planede 4y agoI expect it to work fairly well, apart from "netinst" install medias, of course.
- Rediscover 4y agoSlackware works great. OpenBSD, too. I yard out the drive, attach it to another machine and toss a copy of, e.g., slackware64-current (+ sources) and a bootloader on the drive, put the drive back in its original machine and boot/install without a network. After that, it may or may not ever see a network depending on what it is slated to do. https://www.slackware.com/ https://www.slackware.com/
- lynguist 4y agoI never say things like that but isn’t this like saying the floor is made out of floor? I had to do a quick reality check after reading that article.
- ddalex 4y agoDefinitely a solution in search of a problem.
- asddubs 4y agoit read like someone appalled at the state of things setting up the ground work before getting to the problem, but then after that first stage, it just sort of ends. what a pointless read.
- dmtroyer 4y agosome day I may be able to downvote posts.
- tencentshill 4y agoIt’s no longer possible at all on Windows 11, so it’s good to know.
- snowe2010 4y agoPretty sure it's just an advertisement.
- lapcat 4y agoThis has already been refuted elsewhere in the comments. Your near certainty is completely unfounded. Howard Oakley and his work are well known in our community. If you don't know him, then please don't cast aspersions.
- lapcat 4y agoThe funny thing is that I've always done it this way, for many many years, when installing major Mac OS updates: choose the option "My Mac doesn't connect to the internet", and set up the internet connection later, after I configure everything how I want. Then of course the first thing I do after installing macOS is install Little Snitch (already having a hard copy on an external disk).
- IIsi50MHz 4y agoA…hard copy? Like, a print-out of the source code or… ? If so, it would seem to be resting on top of an external disk. o-: Sorry, just never seen someone refer to a digital copy as a hard copy before. You surprised me. (-:
- lapcat 4y agoOld habits are hard to break. It seems logical though that a copy on a hard drive should be called hard copy!
- collsni 4y agoGuys! Guys! I turned Internet off, and guess what?!? No internet based features worked!! Can you believe that I couldn't authenticate to my apple account?!
- _joel 4y agoHrm, a random download from wordpress.com. No thanks. Is there a github or alike?
- alpaca128 4y ago> Indeed, if anything, the first run of apps like Xcode was started with less delay than when an internet connection is available. Does anyone know whether this Apple server contact delay applies to every executable? Whenever I compile my code on a Mac the first run is delayed by 2-5 seconds and it's getting really annoying.
- lapcat 4y agoYes. https://lapcatsoftware.com/articles/catalina-executables.html https://lapcatsoftware.com/articles/catalina-executables.htm...
- xenophonf 4y agoWell, that's horrifying from the perspective of someone trying to preserve their right to privacy.
- steponlego 4y agoHeh, “right” to privacy.
- _V_ 4y agoThe problem with online checks (gatekeeper) are when you have flaky internet connection. It can handle no connection quite well, but unstable internet is really a PITA - commands and applications lag randomly when launching etc... It took me some time to troubleshoot why suddenly ma MacOS was almost unusable and this was the culprit.
- varispeed 4y agoIs there a way to make it "think" it is connected to internet? Like plugging a device that will be seen as network card and responding to certain api requests to trick whatever service calls them?
- lapcat 4y ago> Is there a way to make it "think" it is connected to internet? You actually want the opposite, to make it think it's not connected to the internet. In other words, a network connection blockers such as Little Snitch.
- yencabulator 4y agoAs far as I understand, Apple's own software can bypass Little Snitch. https://blog.obdev.at/a-hole-in-the-wall/index.html https://blog.obdev.at/a-hole-in-the-wall/index.html
- lapcat 4y agoThat issue was fixed relatively shortly thereafter.
- _V_ 4y agoNot really but you can simulate this by either using iPhone as an AP and forcing 3G if possible or you can hide behind linux proxy and set up packet dropping (can be done with nftables) random packets. That will result in almost unusable system.
- deleted 4y ago[deleted]
- sdflhasjd 4y agoThe experience is much worse on a mac when you have a _poor_ internet connection. - Apple just doesn't care about the size of their updates. Minor OS & XCode updates are in the gigabytes. - Updates that you don't need right now cannot be cancelled, paused or rate-limited and will just eat your entire data cap with no warning. - Applications literally take longer to open because of gatekeeper checks
- anamexis 4y agoWorth noting that macOS has a “low data mode” which solves several of these issues. Apps can hook into it also. https://apple.stackexchange.com/questions/449668/what-is-low-data-mode-on-macos-ventura-wlan-exactly https://apple.stackexchange.com/questions/449668/what-is-low...
- sdflhasjd 4y agoGood to hear that is now a feature in Ventura, better late than never... The enraging experience I had that prompted my complaint happened on Monterey.
- croutonwagon 4y agoThis is somewhat handy. Im currently traveling and relying tethering LTE witb a 1GB/day limit. Let me tell you on MacOS that is VERY easy to burn through in 15 minutes. Ultimately i have been using my personal laptop with ubuntu to stay under the limit. MacOS even with low data mode seems to use a lot of extraneous data for some reason. I havent had time to really see what its doing but its been heavy. The first couple days i burned through my allocation in a out 5 minutes.
- skinnymuch 4y agoYou can get apps like Roadtrip to help with data usage
- croutonwagon 4y ago
- adithyassekhar 4y agoThis just reminds me of Windows 11. The Home edition which most people would buy cannot bypass the setup screen without connecting to the internet and creating a Microsoft account. Can't believe Apple is the more free option here.
- miles 4y agoEven in the latest release of Windows 11 Home, the seemingly-required Microsoft account login can be bypassed via OOBE\BYPASSNRO: https://www.ghacks.net/2023/01/26/how-to-bypass-the-microsoft-account-requirement-during-windows-setup/ https://www.ghacks.net/2023/01/26/how-to-bypass-the-microsof...