Hacker News Reader

Comment by jeroenhd | Hacker News Reader

I doubt this is a leak, it very much sounds like Apple is using QUIC to connect home and make the API work.

Not respecting the system firewall does seem like a flaw, but Apple has had a history of bypassing attempts at filtering network traffic. Firewalls have been blocked from working and Apple services have been made unblockable in later APIs. I'm not surprised in the slightest that Apple also bypasses your VPN to call home.

I don't know if this is a problem, though. If you buy Apple, you let Apple make the decisions for you, that's how the entire ecosystem is designed. You must trust Apple unconditionally and accept traffic sent home to adhere to their privacy settings, or you should not run macOS at all. Try to run Windows or Linux on it if you've bought your computer for the hardware quality, though the M1 makes that nearly impossible without sacrificing user experience.

View on HN

You're suggesting that Windows is equal to Linux as an alternative to MacOS if you favor control and privacy???

Windows is by far the worst of the three.

Not in this use case.

With regards to privacy and control, yes. There’s loads of telemetry you can’t turn off in Windows anymore, and you can’t even setup Windows 11 without an internet connection.

You can. Today I learned how. You just have to press Shift+F10 to access the console when it asks you to connect to a network and then enter 'OOBE\BYPASSNRO'. That is all. To skip the security questions set no password initially and then set it later using ctrl+alt+del.

Well TIL but that’s a bit silly. They should just give you a button.

Lol. If something in Linux took that much convoluted process, people would say it was totally unsuited to all but the most nerdy sadists.

Windows doesn't come close to Linux in terms of privacy, but Linux doesn't come close to Windows in terms of reliability and professional software support (Photoshop, MS Office, etc.) without hacks and Github scripts.

For the technically-minded Linux is an option, but for everyone else Windows at least allows you to firewall off any domain you choose. Sure, you'll probably break Windows Update in some way, but the Windows kernel doesn't try to bypass your settings (yet).

> "Linux doesn't come close to Windows in terms of reliability..."

I can't tell if you being extremely sarcastic or lack experience running both of these OS's...

Linux is quite reliable. Maybe even more reliable in day to day use. However it occasionally breaks for me in very subtle ways and when it does break, I have to use technical skills to resolve the issue. That doesn't happen to me on Windows or MacOS. For those reasons, I don't think I'd suggest Linux to anyone who I didn't feel would be able to resolve issues on their own.

I haven't really found windows to be that reliable, although I don't use it a lot. Lots of weird little issues and googling dll names, but maybe I'm just unlucky. a while back i tried installing vscode and it was literally just an all black window, until i installed directx or something along those lines. and that's just off the top of my head

I got my parents on Linux Mint after their desktop died, which I fixed, but they didn’t want to buy a new Windows license. They are absolutely not tech savvy, but only use the internet and some super basic document editing & viewing.

They got used to the system quickly and used it for 4 years, until the OS went out of LTS and I told them not to use it anymore… but still, they have no idea what a terminal is, no tech savvy, but still used it for their basic use-case for 4 straight years without issue! I didn’t even have to help them after the initial install. Couldn’t have been easier.

My experience, as well. I just set up my parents' Linux desktops to look and act like the systems they were used to and it's been fine for them for years. They've even added printers and scanners to their systems without my help.

I think it works for either very tech savvy (who tinker but know how to fix things) or completely not tech savvy people (who will never tinker and use the computer for very basic things).

If you're medium tech savvy then you run the risk of knowing how to break something but not fix it.

Installing regular OS upgrades has in turn broken, fixed, and broken hibernation again on my PC. Sound is another adventure that either goes great or it's a constant game of cat and mouse.

My Windows 10 install may be full of spyware I need to block, but the software works pretty flawlessly in comparison.

With the terrible state of Nvidia's drivers, my Linux install has kernel panicked more often than my Windows box has BSOD'd.

The only thing you said that I agree with is that Windows has better professional software support. Unfortunately, that's not what we're talking about. :/

In my experience, if someone's use cases would be well-suited by Chromebooks or ChromeOS, then desktop Linux will work just as well, if not better, for them.

Reliability-wise, desktop Linux is boringly stable these days as long as you don't insist on the bleeding edge by using Arch or Debian unstable.

The MS Office situation has gotten much better with the rise of online office suite web apps, including Office 365, as well as professional desktop software like SoftMaker's closed-sourced and misnomered FreeOffice[1] that has great compatibility with files written in MS Office's formats.

Lack of Photoshop is a problem, but if you're doing animation, special effects or video editing work, Linux has you covered because companies release Linux versions of their workstation software like DaVinci Resolve, Houdini, Autodesk Flame, Blender, Lightworks etc.

[1] https://www.freeoffice.com/en/

In what way is linux less stable than windows? Sure, on some shitty hardware, maybe. But I had much less random audio stack restart, visual glitches etc on a modern linux system, and then we don’t even talk about service reliability where linux’s server domination should be evidence in itsef of it being that much more stable.

That sounds like treacherous computing. And I've argued before, that this smells like a rental with the name of a "sale".

A computer does what its owner whats it to do. And when Apple or another company is directing its actions, tells me that what I have is a rental.

Either relinquish control, or put it on the market with the real name. It's not a sale.

I agree with this take 110%

As an aside, I’d also like to subscribe to “No as a service”.

Dude, literally the article says: data gets sent to private relay if you have it enabled. You can stop it from being sent by not turning it on.

What is apple meant to do? Just not provide the service at all?

Because private relay is vastly superior to a VPN for web content, which is what matters to most users?

The problem is that it's proof that PF firewall can't block all traffic. This essentially means one cannot trust PF to protect themselves from leaking traffic.

It seems entirely plausible that this is a simple implementation bug.

PF is not the thing that does actual networking, on any OS.

As far as I understand networking and firewalls like PF, you essentially have the lowest level, where the kernel/driver puts bytes onto the channel.

Then you have the various userspace networking interfaces for various transport mechanisms, TCP, UDP, QUIC, etc

Each one of those is doing

    <transport protocol specific thing>
    <send the bytes>

The <send the bytes> part is below where your firewall stuff is going to happen, so I'm going to guess (I have never written kernel level networking because that stuff seems like relentless misery) that it means that every transport implementation has to independently have some code that looks like

    packet_data = <build the packet>
    if (auto firewall = current_firewall()) {
        if (firewall->should_block(packet_data))
            return E_BLOCKED; // or whatever
    }
    kernel_send_the_bytes_yo(packet_data);

Or something like that, all super super pseudo code of course.

Anyway, if that general concept is vaguely accurate then that means every time someone brings up a new transport protocol that another opportunity for this to get missed. Not saying its good that such a thing is possible, or that not catching it is ideal, just saying it seems like a plausible path to this kind of bug happening - Hell, I'm not even sure it would be the first case of an OS missing PF, I have some vague recollection from the distant past?

Apple does tell you how to block this stuff if that’s your concern. Having highly opinionated defaults is required for “it just works” which millions of users really do want, but those same defaults will always annoy someone.

Circumventing a system firewall is not an opinionated default. By default, the firewall isn't enabled. Nothing requires the traffic to leak here, it just doesn't need to behave this way. This makes nothing simpler. And, this is undocumented behavior. Don't buy into the argument that this makes some UX better. It doesn't.

By default this feature is also disabled.

What happens when multiple features in conflict are both turned on is a classic UI problem. Quietly doing a compromise between them is the exact kind of opinionated default that I am talking about.

As a user you have made the choice to both enable private relay, and enable a VPN. Now PR isn't itself a VPN as such, but clearly there's some level of potential conflict in making such a decision. If you don't want Private Relay interfering with network traffic routing, pretty much it's job as advertised, for goodness sake just switch it off and the whole problem goes away.

There are exactly 0 reason why the private relay couldn't be routed within the VPN or vice versa. There's exactly 0 reasons to make the private relay traffic circumvent the firewall.

>There are exactly 0 reason why the private relay couldn't be routed within the VPN or vice versa.

You don't know that for sure, unless you know exactly how the Apple side of PR works, there could well be circumstances where that would cause problems. At the scale Apple operates at they must come across all sorts of weird an unusual configuration combinations.

There are 0 reasons for enabling private relay and also configuring a VPN, yet that's what the user did. In any case this is documented and Apple provides instructions how to block it.

The issue here is thinking that the VPN subsystem and firewall subsystem and how they work are the product from Apple's point of view. They're not, they're just implementation details. For Apple the intended high level user experience is the product, in this case the UX of the private relay service. If they need to bypass some subsystem to achieve a better more consistent high level user experience then that's what they will do.

>A computer does what its owner whats it to do.

If you've enabled Private Relay then it's doing exactly that.

When? Are you talking end user config in the preference pane?

My colleagues have implemented and validated firewalls on MacOS without issue.

If you run Windows or Linux you gain nothing. Apple just demonstrates some ability that operating systems have. They all have this ability. Apple’s benign use of it gives you no new information.

Stuff like this in-kernel with Linux is heavily discouraged and you'd be almost publicly shamed. If it's a problem with user-space, simply use something else.

With Mac, you can usually handle the user-space scenario. Not so much the kernel-space one.

That's what's great about Linux. You don't have to submit to somebody else's will if you don't want to. It takes more effort, but good things always come at some cost.

And yet Linux is a terrible choice for the vast majority of users, no amount of "user choice" will change this. Most users don't need choice, they need structure and guide rails.

Apple is arguably engineering computers and OS UX "correctly," e.g. better for most people.

Yep, if some linux kernel component would bypass iptables and called home, Linus would probably use some very very profound words, before denying the patch and effectively killing the "new feature".

Reply on news.ycombinator.com