Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

Apple seems to do all kinds of weird networking _stuff_. For instance, during wakeup, your T2 equipped Macbook will wait for a DNS response and then use said DNS response to synchronize time via NTP before letting the user use the keyboard. Probably checking timestamps on signatures for the keyboard firmware, or something stupid like that. This only happens if it happens to have a default route.

Similarly, all macOS machines will test a DHCP supplied default route before applying it by trying to reach something on the internet. So if you happen to have some firewall rules that block internet access, no default route will be applied until the internet check times out.

I won't share the other sentiments about the above, but is it really that hard to document these behaviors?

Oh wow! This probably explains why every now and then when I wake my MacBook Pro from sleep it says no keyboard is connected! I thought I had some hardware problem on a basically brand new machine. Glad to hear it's only a stupid software problem!

If you're using Cisco Anyconnect, blame that for that particular keyboard issue.

Why not blame the idiotic decision to make this network check just to wake up?

I think the threat model here is that someone might've swapped out your keyboard to one that's spying on you, whilst you're out at a conference enjoying the more social aspects of such gatherings. At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

Huh? When I’m out socializing there’s no spying to do. But as soon as I get back I will just log in and the spying begins.

I’m so accustomed to flaky peripherals with Apple products I wouldn’t even be alarmed at the behavior.

I think you misunderstand.

The idea is that if your keyboard is replaced with a keyboard that has modified (hacked) firmware, your computer will refuse to let you use it.

To do this, it must obtain a cryptographic attestation from the keyboard firmware, proving that it has not been modified. Further, to avoid replay attacks it must include the current time in the message it signs. NTP is used by macOS to determine the current time, so as to verify the signature provided by the keyboard.

So, if NTP is slow to respond or time out, you are stuck waiting for your Mac to verify your keyboard's signature.

> Further, to avoid replay attacks it must include the current time in the message it signs.

Use a counter...?

I'm not trying to defend Apple here, just explain the mechanism to the parent.

Oh, okay. You said "must" so I was wondering if there was another important factor.