They're improving the situation on developer certificate revocation checks, but they do still exempt their own apps from the app-specific content filter and VPN extensions, so you won't be able to block those with Little Snitch or similar firewalls.

System-wide VPNs should still tunnel everything, so it's not as much of a security disaster as it sounded like, but I still don't like that. It's my computer, I should be able to firewall whatever I want.

"System-wide VPNs should still tunnel everything, so it's not as much of a security disaster as it sounded like, but I still don't like that. It's my computer, I should be able to firewall whatever I want."

I always use a "slug"[1] to (re)inforce a VPN.

It's extremely difficult to go around it - certainly not by accident ...

[1] http://www.kozubik.com/pub/NetworkSlug/tip.html

If we're talking about laptops here, this means an additional piece of hardware. If you're carrying around an additional piece of network filtering hardware, you might as well just run the VPN client on that, too.

I'm looking into dual-wifi travel routers that will run OpenWRT (and thus give me root) and can do WireGuard at reasonable speeds. I've been meaning to do it for iOS devices anyway (these things phone home constantly, with no way to turn it off) and now it's going to be needed on Apple Silicon macs, too.

"If you're carrying around an additional piece of network filtering hardware, you might as well just run the VPN client on that, too."

Perhaps - and of course that point is well taken.

However, if the hardware device is complicated enough to actually run the VPN then you are back to wondering how it can fail, who can attack it and how things can accidently go around it.

Not so with a slug - it is a dead simple bridge that can't be seen on the network.

I assume you mean wired, then? So, for the usual connection of laptop on wifi, there would be an ethernet dongle, to the slug, to a wifi client bridge? Three external devices?

If you meant wifi, do you have configs available or hardware you recommend?