6 ms·

Apple's new macOS Sequoia update is breaking some cybersecurity tools

64 points by zspitzer 2y ago

yawnbox 2y ago
all my wireguard tunnels could not connect upon upgrade. disabling the macos firewall allowed me to use my tunnels again, fyi.
- bomewish 2y ago
  Tailscale affected?
  - vigormortis 2y ago
    It is for me. I've had to disable it on my mbp and ios devices; otherwise DNS lookups choke.
  - cassianoleal 2y ago
    Not for me.
- evulhotdog 2y ago
  I read somewhere about old ESET rules being in the macOS firewall blocked various udp traffic. Quick Google might get you more information.
move-on-by 2y ago
> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,” I would like to understand this better. Were there not any beta releases that these companies could have tested with in advance? Or were changes made between the beta and the release that broke things? Or something else?
- Spivak 2y ago
  This is the part I'm missing too. Major versions are the time to ship braking changes, did none of these companies bother to test their software that mucks deep in the plumbing of the OS?
  - 1over137 2y ago
    It is very typical to file bugs against even the first beta and not see them fixed before GM, or even ever.
  - RockRobotRock 2y ago
    Is there even an equivalent to WSUS on macOS that lets admins block an update until it's tested?
    - salmo 2y ago
      Yeah. There’s Jamf and similar tools. Companies often block major updates until their 100 agents all officially support it. Oh, and do cool things like not letting you change your background or whatever random settings some admin decides are good.
      - ripa 2y ago
        Yep, a lot of these policies seem to come from some random person scrolling through a list of supported options and arbitrarily making up values that are enforced on people. One of our policies enforce that screen savers must start after 20 minutes, and it’s not possible to reduce it (I have my personal on 3 minutes). Or the fact that it will constantly reset the UI notification volume to 100% and speaker output, even though have headphones almost always. Infuriating.
    - colechristensen 2y ago
      Yes, it's called MDM (Mobile Device Management) and lets admins set all kinds of policy on apple devices. There are several vendors out there that implement it.
musicale 2y ago
> And, somehow, the software update has broken the functionality of several security tools made by CrowdStrike, ... What terrible news – whatever shall we do?
- appendix-rock 2y ago
  Please look past the fact that CrowdStrike is today’s, or yesterday’s, cultural whipping boy. They make software, and its users would like it to work. It’s not a good thing.
  - ronsor 2y ago
    And it's their responsibility to make sure it works by testing on pre-release OS builds and implementing fixes when necessary.
    - FireBeyond 2y ago
      And when they report bugs to the vendor, and Apple just black holes those bugs, as they do in probably 99.8%+ of bug reports? "Suck it up"?
      - floydnoel 2y ago
        find a workaround because you already know what is coming down the pipe? this isn't new to development, I've done it in my own apps for apple issues before. maybe they just need some more experienced developers?
        ossobuco 2y ago
        > find a workaround because you already know what is coming down the pipe? this isn't new to development, I've done it in my own apps for apple issues before. I mean yes, ultimately if you want your app to be used, you'll have to do that, but wouldn't it be better if Apple stopped carelessly breaking backward compat with every update?
guidedlight 2y ago
These cybersecurity tools are like posting a contracted armed security guard to an airport departure lounge.
Someone 2y ago
> At this point, it’s unclear exactly what is the issue So, is this a bug in Sequoia or a change that affects these low-level tools? If the latter, they may not like it, but that’s par for the game on MacOS. (Tried reading https://x.com/patrickwardle/status/1836862900654461270 https://x.com/patrickwardle/status/1836862900654461270, referenced by sephamorr, but that link isn’t working for me)
- replete 2y ago
  There's a bug megatread on r/macos full of networking bugs that makes it clear that upgrading to sequoia is not a good idea just yet.
  - SemioticStandrd 2y ago
    Not just networking issues, there are plenty of reports with external drives having problems as well.
    - replete 2y ago
      I usually wait for a .4 update before upgrading. One time around Catalina there was a bug that broke USB-C docks.. Oh cool none of my devices work. Interestingly in that thread, 'Intel' is not mentioned once.
      - whynotmaybe 2y ago
        This reminds me of a joke about "windows users waiting for the service pack while macos is always stable" that a friend always rubbed in my face whenever I had some issue with windows a decade ago. And that I just sent a message yesterday to my team to wait before installing sequoia... But now I'll use your target of .4.
        replete 2y ago
        That's the trick for stability on MacOS, wait a few versions after a major. Done this for a few years now and I have had no problems. When they change OS APIs, it happens on a major point zero release. Another good reason to wait is many apps aren't ready in time for the changes. I'll install a point 2 or a point 3 if it looks like a good release, but it looks like this isn't one of them. My pro tip for finding out whether its a good upgrade or not is the macrumors article comments, I'll scan through and see what people are saying about the update.
jasonvorhe 2y ago
I don't see a single product listed there that actually improves security. I'd consider them "cover your ass for compliance" products. None of these vendors has a track record of delivering quality or actual protection without increasing the attack surface, as proven by past screwups of these companies. They even quote Crowdstrike in the first paragraph. macOS release dates are predictable and Apple ships developer previews and public betas. If these vendors can't update their products in time that doesn't speak for their processes, automated testing infrastructure nor care for their customers.
perryizgr8 2y ago
Yes, this is the right move that Windows should have done long ago. These are not security products; they are security theater. Chosen only for compliance or CYA reasons by people who don't fully understand the systems they are in charge of securing and administering. Break them again and again until people realize how useless they are.
mikl 2y ago
Always fun to see the spyware merchants whining about how Apple’s privacy protection efforts makes creeping on users difficult. Cry harder, dirtbags.
lxgr 2y ago
> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,” > On the day of macOS Sequoia’s release, a CrowdStrike sales engineer said in a Slack room for Mac admins that the company had to delay support for the new version of Mac’s operating system. “I’m very sorry to report that we will not be supporting Sequoia on day 1 in spite of our intention (and previous track record) to support the latest OS within hours of [General Availability],” the engineer said in the message, seen by TechCrunch. If only Apple had offered these clowns some sort of beta or developer preview version to test their snake oil against before the widespread release of the new OS... Absolutely zero sympathy.

64 points by zspitzer 2y ago

all my wireguard tunnels could not connect upon upgrade. disabling the macos firewall allowed me to use my tunnels again, fyi.

bomewish 2y ago
Tailscale affected?
- vigormortis 2y ago
  It is for me. I've had to disable it on my mbp and ios devices; otherwise DNS lookups choke.
- cassianoleal 2y ago
  Not for me.
evulhotdog 2y ago
I read somewhere about old ESET rules being in the macOS firewall blocked various udp traffic. Quick Google might get you more information.

move-on-by 2y ago

> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,” I would like to understand this better. Were there not any beta releases that these companies could have tested with in advance? Or were changes made between the beta and the release that broke things? Or something else?

Spivak 2y ago
This is the part I'm missing too. Major versions are the time to ship braking changes, did none of these companies bother to test their software that mucks deep in the plumbing of the OS?
- 1over137 2y ago
  It is very typical to file bugs against even the first beta and not see them fixed before GM, or even ever.
- RockRobotRock 2y ago
  Is there even an equivalent to WSUS on macOS that lets admins block an update until it's tested?
  - salmo 2y ago
    Yeah. There’s Jamf and similar tools. Companies often block major updates until their 100 agents all officially support it. Oh, and do cool things like not letting you change your background or whatever random settings some admin decides are good.
    - ripa 2y ago
      Yep, a lot of these policies seem to come from some random person scrolling through a list of supported options and arbitrarily making up values that are enforced on people. One of our policies enforce that screen savers must start after 20 minutes, and it’s not possible to reduce it (I have my personal on 3 minutes). Or the fact that it will constantly reset the UI notification volume to 100% and speaker output, even though have headphones almost always. Infuriating.
  - colechristensen 2y ago
    Yes, it's called MDM (Mobile Device Management) and lets admins set all kinds of policy on apple devices. There are several vendors out there that implement it.

musicale 2y ago

> And, somehow, the software update has broken the functionality of several security tools made by CrowdStrike, ... What terrible news – whatever shall we do?

appendix-rock 2y ago
Please look past the fact that CrowdStrike is today’s, or yesterday’s, cultural whipping boy. They make software, and its users would like it to work. It’s not a good thing.
- ronsor 2y ago
  And it's their responsibility to make sure it works by testing on pre-release OS builds and implementing fixes when necessary.
  - FireBeyond 2y ago
    And when they report bugs to the vendor, and Apple just black holes those bugs, as they do in probably 99.8%+ of bug reports? "Suck it up"?
    - floydnoel 2y ago
      find a workaround because you already know what is coming down the pipe? this isn't new to development, I've done it in my own apps for apple issues before. maybe they just need some more experienced developers?
      - ossobuco 2y ago
        > find a workaround because you already know what is coming down the pipe? this isn't new to development, I've done it in my own apps for apple issues before. I mean yes, ultimately if you want your app to be used, you'll have to do that, but wouldn't it be better if Apple stopped carelessly breaking backward compat with every update?

guidedlight 2y ago

These cybersecurity tools are like posting a contracted armed security guard to an airport departure lounge.

Someone 2y ago

> At this point, it’s unclear exactly what is the issue So, is this a bug in Sequoia or a change that affects these low-level tools? If the latter, they may not like it, but that’s par for the game on MacOS. (Tried reading https://x.com/patrickwardle/status/1836862900654461270 https://x.com/patrickwardle/status/1836862900654461270, referenced by sephamorr, but that link isn’t working for me)

replete 2y ago
There's a bug megatread on r/macos full of networking bugs that makes it clear that upgrading to sequoia is not a good idea just yet.
- SemioticStandrd 2y ago
  Not just networking issues, there are plenty of reports with external drives having problems as well.
  - replete 2y ago
    I usually wait for a .4 update before upgrading. One time around Catalina there was a bug that broke USB-C docks.. Oh cool none of my devices work. Interestingly in that thread, 'Intel' is not mentioned once.
    - whynotmaybe 2y ago
      This reminds me of a joke about "windows users waiting for the service pack while macos is always stable" that a friend always rubbed in my face whenever I had some issue with windows a decade ago. And that I just sent a message yesterday to my team to wait before installing sequoia... But now I'll use your target of .4.
      - replete 2y ago
        That's the trick for stability on MacOS, wait a few versions after a major. Done this for a few years now and I have had no problems. When they change OS APIs, it happens on a major point zero release. Another good reason to wait is many apps aren't ready in time for the changes. I'll install a point 2 or a point 3 if it looks like a good release, but it looks like this isn't one of them. My pro tip for finding out whether its a good upgrade or not is the macrumors article comments, I'll scan through and see what people are saying about the update.

jasonvorhe 2y ago

I don't see a single product listed there that actually improves security. I'd consider them "cover your ass for compliance" products. None of these vendors has a track record of delivering quality or actual protection without increasing the attack surface, as proven by past screwups of these companies. They even quote Crowdstrike in the first paragraph. macOS release dates are predictable and Apple ships developer previews and public betas. If these vendors can't update their products in time that doesn't speak for their processes, automated testing infrastructure nor care for their customers.

perryizgr8 2y ago

Yes, this is the right move that Windows should have done long ago. These are not security products; they are security theater. Chosen only for compliance or CYA reasons by people who don't fully understand the systems they are in charge of securing and administering. Break them again and again until people realize how useless they are.

mikl 2y ago

Always fun to see the spyware merchants whining about how Apple’s privacy protection efforts makes creeping on users difficult. Cry harder, dirtbags.

lxgr 2y ago

> “As a developer of macOS security tools, it’s incredibly frustrating to time and time again have to deal with (understandably) upset users (understandably) blaming your tools for breaking their Macs, when in reality it was Apple’s fault all along,” > On the day of macOS Sequoia’s release, a CrowdStrike sales engineer said in a Slack room for Mac admins that the company had to delay support for the new version of Mac’s operating system. “I’m very sorry to report that we will not be supporting Sequoia on day 1 in spite of our intention (and previous track record) to support the latest OS within hours of [General Availability],” the engineer said in the message, seen by TechCrunch. If only Apple had offered these clowns some sort of beta or developer preview version to test their snake oil against before the widespread release of the new OS... Absolutely zero sympathy.