Apple's apps bypass firewalls like LittleSnitch and LuLu on macOS Big Sur

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by Spivak on Tuesday October 20, 2020 @04:46PM (#24842215)

Because it's not really "hiding the URL" despite what all the outrage bloggers tried to make it seem. It's by default (i.e. until you tap/click it) hiding the parts of the URL that the site controls. So paypal.amazon.citibank.scamsite.biz/secure/login/trustus will just show scamsite.biz.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by dumpsterdiver on Tuesday October 20, 2020 @08:16PM (#24843674)

My first instinct was to distrust the hide-until-click URL bar also, but you've illustrated clearly why it's a reasonable default. It mitigates the effect of malicious websites playing URL games, and allows the browser to more accurately convey to the user where they really are.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by dumpsterdiver on Tuesday October 20, 2020 @08:22PM (#24843710)

To drive your point home, paypal.amazon.citibank.scamsite.biz/secure/login/trustus will likely have a perfectly valid certificate, along with the trusted green closed-lock before the URL, implying that the site is "secure".

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by wool_gather on Wednesday October 21, 2020 @01:04PM (#24849799)

Safari does not behave as you've described. The subdomain (for example, 'gist' in 'gist.github.com') is displayed.

[ Parent | on HN ]

Re:Apple's apps bypass firewalls like LittleSnitch and LuLu ... by saagarjha on Wednesday October 21, 2020 @05:08PM (#24852201)

I suspect that Safari uses Public Suffix or similar for that.

[ Parent | on HN ]