<story><title>Lulu – Mac open-source firewall that aims to block unknown outgoing connections</title><url>https://objective-see.com/products/lulu.html</url></story><parent_chain><item><author>webmobdev</author><text>Threre are no indications that Apple is willing to compromise and allow application firewalls to block Apple softwares that Apple believes should be able to access the internet, even if the user doesn&amp;#x27;t want it too.&lt;p&gt;It&amp;#x27;s a gross invasion of privacy, and a security risk.&lt;p&gt;(By the way, even in Lulu, some Apple system software - apsd, automount, helpd, mDNSResponder, mount_nfs, mount_url, ocspd, sntp, trustd - are whitelisted and cannot be blocked by the user even if they want to, and that&amp;#x27;s bit disappointing).</text></item><item><author>m463</author><text>I wonder how this works with respect to apple&amp;#x27;s &amp;quot;special exemptions&amp;quot; for its own applications.&lt;p&gt;(bypass NEFilterDataProvider)</text></item></parent_chain><comment><author>miles</author><text>&amp;gt; some Apple system software ... are whitelisted and cannot be blocked by the user even if they want to&lt;p&gt;There are currently 3 ways I know of to block them:&lt;p&gt;1. Exclusions Blaster &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.vallumfirewall.com&amp;#x2F;eblaster&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.vallumfirewall.com&amp;#x2F;eblaster&amp;#x2F;&lt;/a&gt;&lt;p&gt;2. Enabling Little Snitch 4.6 kext under Big Sur &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.obdev.at&amp;#x2F;support&amp;#x2F;littlesnitch&amp;#x2F;245913651253917&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.obdev.at&amp;#x2F;support&amp;#x2F;littlesnitch&amp;#x2F;245913651253917&lt;/a&gt;&lt;p&gt;3. Convoluted hack: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;tinyapps.org&amp;#x2F;blog&amp;#x2F;202010210700_whose_computer_is_it.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;tinyapps.org&amp;#x2F;blog&amp;#x2F;202010210700_whose_computer_is_it....&lt;/a&gt;</text></comment>
<story><title>Lulu – Mac open-source firewall that aims to block unknown outgoing connections</title><url>https://objective-see.com/products/lulu.html</url></story><parent_chain><item><author>webmobdev</author><text>Threre are no indications that Apple is willing to compromise and allow application firewalls to block Apple softwares that Apple believes should be able to access the internet, even if the user doesn&amp;#x27;t want it too.&lt;p&gt;It&amp;#x27;s a gross invasion of privacy, and a security risk.&lt;p&gt;(By the way, even in Lulu, some Apple system software - apsd, automount, helpd, mDNSResponder, mount_nfs, mount_url, ocspd, sntp, trustd - are whitelisted and cannot be blocked by the user even if they want to, and that&amp;#x27;s bit disappointing).</text></item><item><author>m463</author><text>I wonder how this works with respect to apple&amp;#x27;s &amp;quot;special exemptions&amp;quot; for its own applications.&lt;p&gt;(bypass NEFilterDataProvider)</text></item></parent_chain><comment><author>FabHK</author><text>Could you enlighten me what the gross invasion of privacy and the security risk is for the majority of users that do not hack their machine in a way that prevents those connections?&lt;p&gt;I&amp;#x27;m aware of Gatekeeper checking developer certificates upon opening apps over an unencrypted connection (so far; Apple is fixing that), but not sure where the gross privacy invasion or security risk is (in particular compared to existing alternatives, not some platonic ideal).&lt;p&gt;Here, FWIW, is what Apple says about Gatekeeper and Notarization. I&amp;#x27;d be eager to hear any evidence that this is incorrect.&lt;p&gt;&amp;gt; Gatekeeper performs online checks to verify if an app contains known malware and whether the developer’s signing certificate is revoked. We have never combined data from these checks with information about Apple users or their devices. We do not use data from these checks to learn what individual users are launching or running on their devices.
&amp;gt; Notarization checks if the app contains known malware using an encrypted connection that is resilient to server failures.&lt;p&gt;&amp;gt; These security checks have never included the user’s Apple ID or the identity of their device. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.&lt;p&gt;&amp;gt; In addition, over the the next year we will introduce several changes to our security checks:&lt;p&gt;* A new encrypted protocol for Developer ID certificate revocation checks&lt;p&gt;* Strong protections against server failure&lt;p&gt;* A new preference for users to opt out of these security protections&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;en-us&amp;#x2F;HT202491&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;en-us&amp;#x2F;HT202491&lt;/a&gt;</text></comment>