3 ms·

> […] but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions. Sure there is: you connect the system to

> […] but there is no way to verify that macOS doesn't have any exceptions that might still bypass network extensions. Sure there is: you connect the system to a managed Ethernet switch and do port mirroring to inspect what traffic goes over the wire: * https://community.fs.com/blog/port-mirroring-explained-basis-configuration-and-fa-qs.html https://community.fs.com/blog/port-mirroring-explained-basis... * https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html https://www.cisco.com/c/en/us/support/docs/switches/catalyst... * https://en.wikipedia.org/wiki/Port_mirroring https://en.wikipedia.org/wiki/Port_mirroring If it's encrypted we may not know the exact contents, but you can't conceal IPs.

codetrotter 4y ago
Not everyone can afford a managed switch and a second computer to inspect the traffic with. Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with
- lapcat 4y ago
  > Not everyone can afford a managed switch and a second computer to inspect the traffic with. Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.
- chasd00 4y ago
  It’s not magic, the packets have to comply with IP standards if they’re going to work on an IP network. Below that, the frames have to comply with Ethernet if you’re plugged into an Ethernet port. The traffic can’t hide.
- bell-cot 4y ago
  > Not everyone can afford a... For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?
newaccount74 4y ago
While this would allow you to prove the presence of exceptions, it won't prove the absence of exceptions.

codetrotter 4y ago

Not everyone can afford a managed switch and a second computer to inspect the traffic with. Also, I’d worry that any traffic I was seeing on the mirrored port was not coming from the Mac but was appearing because I messed up the setup so that what I am seeing is traffic generated by the system I am using to inspect the traffic with

lapcat 4y ago
> Not everyone can afford a managed switch and a second computer to inspect the traffic with. Everyone doesn't need to verify this. The security researchers and other Mac experts can verify it. Security researchers and Mac developers discovered the previous bypass.
chasd00 4y ago
It’s not magic, the packets have to comply with IP standards if they’re going to work on an IP network. Below that, the frames have to comply with Ethernet if you’re plugged into an Ethernet port. The traffic can’t hide.
bell-cot 4y ago
> Not everyone can afford a... For this purpose, a bottom end (say) EdgeRouter and Raspberry Pi should more-or-less suffice. So maybe $100 total?

newaccount74 4y ago

While this would allow you to prove the presence of exceptions, it won't prove the absence of exceptions.