Hacker News Reader

The first firewall to do this should definitely lead with that in the headline.

Downvote? I'm confused. This whole "Apple gets to bypass firewalls" thing is IMO a huge deal.

Whoever figures out how to make a system-wide firewall that can block everything including "unblockable" Apple network traffic likely deserves (again: IMO) all the attention we can give them.

This already exists. Apple processes can bypass app-specific filters (NEFilterDataProvider), but not system-wide firewalls (like the built-in BPF), VPN configurations, etc.

I thought they DID bypass vpn connections.

Also, apple will routinely clear your pf rules when installing stuff.

No, they only avoid being filtered by per-process filters. They can't bypass packet filters, by design; system-wide VPN connections work the same way, and cannot be bypassed.

I’m marking this to remind myself to update my research. If anyone has references they are appreciated.

Reply on news.ycombinator.com