Hacker News Reader

Comment by bscphil | Hacker News Reader

> This makes me feel somewhat better, honestly. The fact that packet-level firewalls work is reassuring.

Yeah, actually it makes me feel like the complaints I was reading previously were inaccurate or at least overstated. If I understand the facts right, macOS has both a traditional firewall (like Linux does) and also a system-wide content blocking API (which Linux does not). If you make changes to the firewall, anything you block will be blocked, including requests from trusted Apple applications. Certain system applications bypass the content blocking API.

Honestly this seems entirely reasonable, in fact. They seem like two different tools for two different purposes. And given that most other operating systems don't have built in content-blocking APIs at all, as far as I know, I think the framing of Apple's decision as some kind of power grab is deeply misleading.

Let me know if I'm misunderstanding the substance of the Mullvad post.

View on HN

> Honestly this seems entirely reasonable

I want to agree with your optimistic view of this, but I can't, because I don't think reason was used in making the decision.

I think the reality is probably closer to this:

Product: "so we can't let users block our own apps. it might break things in weird ways and also they implicitly trust us already because we make their OS".

Engineers on the application firewall team: "ok cool, we'll disable users from blocking Apple apps".

Any freedom you're enjoying with PF isn't there because Apple decided it was a good idea. It's there because Apple decided to build on BSD.

I'm actually surprised MacOS even has PF (apparently since 2015, enhanced from other BSD implementations). I did a minimal amount of searching and found this now-relevant gem: https://manjusri.ucsc.edu/2015/03/10/PF-on-Mac-OS-X/

> If two firewalls, Application Firewall & PF, are both running, you may wonder whose rules take precedence. Let’s find out.

> ...

> So one can conclude that PF rules are applied first, then the rules for Application Firewall.

> Any freedom you're enjoying with PF isn't there because Apple decided it was a good idea. It's there because Apple decided to build on BSD.

It’s there because Apple decided it was a good idea. If they didn’t think it was a good idea, they wouldn’t have included it. Your next sentence even implies this when it admits that Apple’s inclusion of PF is only a few years old.

> I'm actually surprised MacOS even has PF (apparently since 2015, enhanced from other BSD implementations).

It's not like PF was billed as a hot new feature of the OS. I believe it's a happy accident that we got PF, and I won't be shocked if it goes away in the future.

Especially now that it's been publicly documented that it can block Apple apps.

The fact that all of this still has had to be deduced ad hoc in some reverse engineering-type paradigm also should give anyone pause. The fact packet filtering works is better than if it didn't but that's almost besides the point. The problem is Apple deliberately obfuscating important security details from the user. It's literally asserting privilege of itself over the user/device owner in an essential way, if not entirely through filtering protocol than through informing about the protocol.

> a system-wide content blocking API (which Linux does not

Technically, isn't that what apparmor does?

Reply on news.ycombinator.com