←back to thread

Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

(twitter.com)
1183 points robenkleene | 3 comments | 20 Oct 20 15:51 UTC | HN request time: 0.764s | source
Show context
AlexandrB ◴[20 Oct 20 16:27 UTC] No.24839296[source]▶
Both major consumer OS vendors seem hell-bent on bringing the OS layer under their complete control. As a power user, it's very frustrating. Meanwhile "desktop" Linux still kind of sucks, just like it did 10 years ago. I don't have much hope of seeing a compelling, unified UX out of Linux in my lifetime.
replies(6): >>24839339 #>>24839436 #>>24839550 #>>24839643 #>>24839695 #>>24839842 #
nomel ◴[20 Oct 20 16:45 UTC] No.24839550[source]▶
> bringing the OS layer under their complete control

To me, it seems the purpose is almost always to protect the average user from malware. What do you think their reasoning is?

replies(2): >>24839739 #>>24839781 #
AlexandrB ◴[20 Oct 20 17:00 UTC] No.24839739[source]▶
So what if that is their reasoning? Freedom also means the freedom to make mistakes. We don't set a standard of "absolute safety" in many other (arguably more important) areas of our lives, so why do it here?
replies(1): >>24840165 #
1. nomel ◴[20 Oct 20 17:35 UTC] No.24840165[source]▶
Because a computer is an appliance for most people, with it working, and it being secure, being an absolutely critical feature.

I believe still have the option to disable SIP and make as many mistakes as you want. [1]

1. https://developer.apple.com/documentation/macos-release-note...

> Workaround: During development, you can temporarily disable System Integrity Protection to allow these deprecated kernel extensions to load.

replies(1): >>24840368 #
2. AlexandrB ◴[20 Oct 20 17:53 UTC] No.24840368[source]▶
The fact that you can still disable SIP is a good point and I hope that's always possible. The direction Apple is going thought suggests that an iPad-like experience is the eventual goal.
replies(1): >>24840874 #
3. nomel ◴[20 Oct 20 18:39 UTC] No.24840874[source]▶
The requirement of a developer account, or some entitlement, to get full access would really be unfortunate.