News for hackers. Stuff that matters.

A comment on Apple removes first-party firewall exemption in macOS 11.2 beta 2. Parent comment

Re:Apple removes first-party firewall exemption in macOS 11.... by lilyball on Wednesday January 13, 2021 @10:38PM (#25771583)
You make it sound so sinister, but yes of course Apple will use IPv6 if that’s the only (or best) route. That’s a good thing.

Where does “constantly freezes” come from? You didn’t mention that in your linked post. And if your computer “constantly freezes” with Apple blackholed, why wouldn’t it also be constantly freezing when your network connection doesn’t reach the internet? I’m pretty sure they use an apple.com URL for their reachability test, so your blackhole should be blocking that too.

[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by user3939382 on Wednesday January 13, 2021 @11:28PM (#25772014)
Why are they ignoring /etc/hosts if this is good behavior?
[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by judge2020 on Thursday January 14, 2021 @12:05AM (#25772325)
Are you also writing

  :: domain.example
Because the difference is gethostbynamev2 (the most likely function being used, or I suppose the Apple equivalent) looks up a ipv6 hostname before it looks up a ipv4 hostname, which means a "0.0.0.0 domain.example" entry won't override the result of ipv6 lookups.

  $ echo "0.0.0.0 cloudflare.com" | sudo tee -a /etc/hosts
  $ getent hosts cloudflare.com && getent ahosts cloudflare.com
  2606:4700::6810:85e5 cloudflare.com
  0.0.0.0         STREAM cloudflare.com
[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by user3939382 on Thursday January 14, 2021 @05:29AM (#25774691)
I disabled IPv6 altogether, and Apple’s processes are still finding a way to resolve their real IPs after my DNS and /etc/hosts resolved their domains to 0.0.0.0.

DNS should be enough, I shouldn’t have to black hole Apple’s entire /8 to stop macOS from phoning home when I’m not using the computer and no apps are running.

[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by lilyball on Friday January 15, 2021 @03:01AM (#25788192)
I suspect the number of macOS machines on networks with misconfigured DNS is far higher than the number of macOS machines whose admins want to prevent them from talking to Apple. So I’m glad they’re going to great lengths to preserve their ability to communicate with Apple even under adverse network conditions.
[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by user3939382 on Friday January 15, 2021 @05:50AM (#25789309)
I appreciate giving people the benefit of the doubt, but this feels overly charitable to me. I doubt they’re worried about accidentally misconfigured /etc/hosts files.

Much more likely is that they were aware of outbound firewalls like Little Snitch and want to evade user attempts to block their software, as discussed in the main article here.

[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by floatingatoll on Wednesday January 13, 2021 @11:56PM (#25772232)
Why are you using /etc/hosts to modify the behavior of the Apple resolver system? That’s not how macOS directory services work, and Apple only appears to offers it as a legacy backwards-compat stub with no guarantee of support or effectiveness for modern anything. It’s no surprise that it’s not an effective solution for you.
[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by judge2020 on Wednesday January 13, 2021 @11:53PM (#25772209)
Are you writing

  ::/0 domain.example
as well? It might using either AAAA DNS lookups or the equivalent of `getent hosts` which pulls v6 records first, which are only overridden if there is a v6 override for the hostname.

  $ getent hosts cloudflare.com && getent ahosts cloudflare.com
  2606:4700::6810:85e5 cloudflare.com
  104.16.133.229  STREAM cloudflare.com
  $ echo "0.0.0.0 cloudflare.com" | sudo tee -a /etc/hosts
  $ getent hosts cloudflare.com && getent ahosts cloudflare.com
  2606:4700::6810:85e5 cloudflare.com
  0.0.0.0         STREAM cloudflare.com
[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by jojobas on Wednesday January 13, 2021 @11:45PM (#25772140)
In their book a bit of malware might have modified /etc/hosts.

It's for your own good!

[ Parent | on HN ]