Hacker News Reader

Comment by blub | Hacker News Reader

I'm glad that people are putting pressure on Apple to fix this and hope that they do.

That being said, I think many comments here are out of touch. We're talking about a specialized security feature which is not easily available on other platforms is only used by a minority of users and still works for most programs.

What exactly are your threat models that this is causing a problem for you? Are you sure that you can even use a mainstream OS if you need to block all outbound connections? If I had to have complete control over my outbound connections, I would use a hardware/software solution sitting between the computer and router.

Secondly, is this really bypassing VPNs or only the new firewall API? e.g. is it bypassing WireGuard?

View on HN

>What exactly are your threat models that this is causing a problem for you?

If I connect to a public wifi hotspot and use a VPN, I used to be under the general assumption that my network traffic would be sent through my network tunnel and not be accessible to other users of the same hotspot.

Agreed!

One of the points of having a VPN is to be able to run software without every single middle man on the network knowing what you are running.

For example, say someone hypothetically wanted to post a comment on twitter that, again, hypothetically, was politically inconvenient for some authority figure.

The fact they launched twitter at about the time that comment was posted might be something they would prefer to not have reported on the internet at all, and certainly not without encryption.

Generally, this falls into the general category of "I may disagree with what you say, but I will fight for your right to say it".

> without every single middle man on the network knowing what you are running

with a different chain of middle men, ftfy.

I can't find Patrick Wardle claiming that Apple apps aren't routed through the VPN. This claim was made my "Maxwell", but they didn't provide any proof.

Some VPNs were using kexts before Big Sur, some weren't. Wireguard for example is a normal AppStore app which integrates with the OS VPN support. It would suck to be confirmed that it's leaking traffic.

For what it's worth, a VPN will not protect you from threats on a hostile network.

Packet based VPN’s like Cisco’s AnyConnect still function identically as before: https://developer.apple.com/documentation/networkextension/a...

“ A virtual private network (VPN) is a form of network tunnel where a VPN client uses the public Internet to create a connection to a VPN server and then passes private network traffic over that connection. If you want to build a VPN client that implements a flow-oriented, custom VPN protocol—one that works with the data passing through a TCP connection rather than the packets used to transport that data—create an app proxy provider app extension. When the system starts a VPN configuration that uses your app proxy provider, it launches your app extension, instantiates your app proxy provider subclass within that app extension, and starts forwarding flows to your provider. Each flow represents either a TCP connection or a conversation over UDP. Your provider is expected to open a tunnel to a VPN server and forward each flow over that tunnel. Similarly, if your provider receives flow data from the tunnel, it should pass that back to the system via the appropriate flow. App proxy providers are one form of per-app VPN, the other being a Packet Tunnel Provider in source application mode. App proxy providers are supported in iOS on managed devices only, and in macOS for Mac App Store apps only.” https://developer.apple.com/documentation/networkextension/a...

More explanation here: https://twitter.com/lorisscandurra/status/132793682910295244...

"We're talking about a specialized security feature which is not easily available on other platforms is only used by a minority of users and still works for most programs"

I'm confused by this statement. We are talking about being able to implement firewalls and VPNs which can filter/redirect all outgoing connections. These are both abilities easily available on Windows and Linux.

I was referring to software firewalls. Obviously it's bad if a VPN is leaking traffic, but that's not confirmed yet... or at least I couldn't find any proof of that in the linked tweets.

Software firewalls like what comes by default on Windows since XP and Linux since... some version around 1997 I think?

Filtering any outbound traffic on those is either outright not supported or not worth attempting.

This is an interesting opinion, considering that iptables has been able to do this for decades, and nftables can, too. It is trivial to filter outgoing traffic and there are even convenient GUIs to do so.

The subject of this thread are application firewalls, like Little Snitch or https://github.com/evilsocket/opensnitch.

To be fair I haven't looked at the state of Linux app firewalls in years, maybe there's something better available, but *tables is not it.

Filtering outbound traffic using iptables and the Windows firewall is supported. In addition there are multiple 3rd party software firewalls for Windows which also support filtering outbound traffic.

The "firewalls" in the title of this thread refers to outbound application firewalls. There are products that behave like this on Windows, but they're typically part of a security suite which one may or may not want. Others are free and display ads or collect information about the user.

I've used two products in the past, NetLimiter and ZoneAlarm. Back then NL was just getting some basic firewall features, since its main feature was throttling the connection per app. I used ZA as a free product, but now I see they have a paid version. Last time I checked a couple of years ago I also found GlassWire, but I didn't purchase it because it kept being detected as infected by VirusTotal and the dev didn't have a clue what was wrong.

Frankly I don't know how trustworthy any of these apps are - this is a big problem with security software on Windows - you don't know if the anti-malware is going to behave like malware.

With root access you can bypass a VPN and firewall on Linux and Windows.

also, with root access, you can force traffic to go through a vpn on Linux and Windows.

root access is irrelevant here.

uhh. no. you can't.

If my app has root access, you can't force me to do anything.

> What exactly are your threat models that this is causing a problem for you?

I would like my computer to not connect to anyone or anything when it's powered on if I'm not running interactive apps that I specifically wish to use the network.

It's sort of like the bad old days with linux distros coming with like 47 listening services enabled by default. It took a while before they realized that defaulting things to "off" was the best move.

I encourage you to look at the pcaps coming out of a fresh macOS install with everything turned off: App Store, iCloud, analytics, FaceTime, iMessage. You'd be surprised how much it's doing when it's sitting there "doing nothing".

Then you can't use Windows or macOS or a mainstream Linux. They've been doing this for a long long time and they're not going to stop.

I would be surprised if Debian did anything like this. There is popularity-contest, but they are very explicit about it and it's opt-in. Other than that anything else would be considered as a bug.

> They've been doing this for a long long time

Apple has only been doing this for 3 major OS releases, or about two years.

On Windows you can run WPD[1] and turn it off, and also firewall the hosts it communicates with using the OS's built-in firewall.

Big Sur won't let you block Apple apps now.

[1]: https://wpd.app/

You should give https://www.w10privacy.de/english-home/ a try ;-)

It still works only for legitimate apps. Any malware will use this loophole to bypass firewalls https://twitter.com/patrickwardle/status/1327726496203476992

Little Snitch & co aren't anti-malware solutions even if they seem like they might work against that. Anything which is running on a malware-infected system can't be trusted.

Such firewalls are used for protection against asshole developers which want to collect analytics without asking for confirmation. Apple are one of the assholes and LS can only be an interim solution against the OS developer. This was bound to happen... and I guess only a HW solution will help now.

Little Snitch & co are part of a defense in depth strategy against malware and other threats.

Will it catch everything? No, obviously. Will it catch enough things to make it worth running? I guess that depends on your threat model, but many think it's worth it.

Reply on news.ycombinator.com