Slashdot Mirror
Apple Fixes 'Misleading' Leopard Firewall Settings
4 for 52 writes "ZDNet is reporting that Apple has fessed up to at least three serious design weaknesses in the new application-based firewall that ships with Mac OS X Leopard. The acknowledgment comes less than a month after independent researchers threw cold water on Apple's claim that Leopard's firewall can block all incoming connections. The firewall patches come 24 hours after a Mac OS X update that provided cover for at least 41 security vulnerabilities."
They won't be able to answer that any more than they know what to pick on the Firewall preferences screen.
So what Apple does is a little bit of deciding for the user what makes sense. The first step was going to an intelligent application level firewall that makes it a lot more functional and easier to use. The next was making some policies that allow services Apple considers "essential" to the whole Mac OS X user experience. And like it or not, Bonjour is an integral part of that.
Anyone who knows enough to know, for certain, that they don't want, e.g., Bonjour open, also knows how to use any of a number of free or commercial commandline or graphical options to set up ipfw or other network level protections any way they wish. That's the bottom line: anyone who knows enough to "know" they "really" want to disable all incoming connections can still easily do so.
This is about making security easy for typical, average users, while still keeping things that make the Mac experience "just work".
Now, I *do* wish that Apple had one more option: Block *everything*, but explain, hey, this is going to break some things like Bonjour, etc., so be SURE that you want to do this, and don't complain if all of a sudden your AppleTV syncing and iTunes sharing and automatic local machine discovery no longer work.
Apple describes all of this very explicitly here:
The 10.5.0 Application Firewall blocked all but:
Processes that are running as UID 0
mDNSResponder
The 10.5.1 Application Firewall blocks all but:
configd, which implements DHCP and other network configuration services
mDNSResponder, which implements Bonjour
racoon, which implements IPSec
So, while I haven't extensively tested yet, it does NOT appear to allow UID 0 processes, but rather only the above processes.
And from here:
My biggest concern about Leopard is the bug which causes it to delete files you're moving if the destination becomes unavailable. They forgot to put in a check to see whether the move completed correctly. So it just deletes them whether it finished or not. Is this behavior fixed with this update?
Give me Classic Slashdot or give me death!
A rather entertaining issue - if you have the firewall enabled and run Skype then quit it, then Skype gets horribly broken, and doesn't start again. Nobody can decide if it's Leopard cryptographically signing (and modifying) the Skype executable and tripping up Skype's own excessive intrusion detection, or Skype modifying its own executable and tripping up Leopard's checks that it's the same application being allowed access to the interweb. I suspect it's the former - as older installations of Skype got killed on my two recently upgraded machines in that way.
;-)
I had to re-download and install Skype, and now I have to run it with the firewall switched off. Pending a fixed Skype in 'a few weeks'. Aaaargh...
Time Machine doesn't work on my old-fashioned partitioned external hard disk (half is an NTFS partition for Windows backups...), the Leopard installer initially wouldn't detect my MacBook Pro's own hard disk, and my iMac got nearly deaded by the upgrade (fortunately I had SSH enabled, and was able to get in and run Software Update from the command line, and thus could install the important iMac updates). Oh, and it's all a little bit crashy. It's nearly fantastic - apart from those issues...
Tedious Bloggy Stuff - hooray?
http://docs.info.apple.com/article.html?artnum=306907
- Addresses a potential data loss issue when moving files across partitions in the Finder.
My mom says I'm cool.
The firewall patches come 24 hours after a Mac OS X update that provided cover for at least 41 security vulnerabilities.
:|
Yes, that was an update for Mac OS X 10.4. This patch is for Mac OS X 10.5. The two are essentially unrelated, so trying to imply that this represents some kind of patch frenzy is at least a little disingenuous.
The article blurb is misleading - the "41 security fixes" released in the Mac OS X update was part of 10.4.11.
The three issues in the 10.5 firewall were the only security fixes for 10.5.
The firewall is not an essential component on a UNIX system the way it is on Windows, because you can actually turn off all listening ports and go "dead" without having to firewall off internal services that can't run without a TCP port open.
Not all Unix systems. cf. OS X 10.5, which is a certified Unix.
A computer system with no open ports is just as secure whether it's firewalled or not.
Probably true on a modern system, but not a completely accurate statement. If there's flaws in the TCP stack, it doesn't matter if something's listening or not whena maliciously constructed packet blows things up before the "is something listening here" logic is hit.
Those options are still there. When you "print" something and it brings up the window with the option to "Save as PDF", click the downward facing black on blue triangle right next to the printer name and it'll expand the window and give you all the other options like duplexing, color matching, paper handling and so on. To get those other options, select the drop-down box with the name of the application you're printing from after hitting the triangle and you'll see the rest of the options. At least, that's how it works on my Brother HL-1650N Laser Printer using IPP printing.
Same problem here. The System Preferences tool doesn't really apply the IPv6 settings. Take a look at the ifconfig output in Terminal. Only lo0 has an IPv6 address.
Updates by default are not automatic. You will be prompted to accept them or not. Also, "restart" updates (about 50% or less) are marked so. See under "System Preferences"->"Software Update"
/Applications/Utilities/Console, and look under Logs->Software Update.log
/Library/Receipts/
You can manually start an update: [Apple-Menu]->Software Update
To see which updates have been installed, open
In some cases, you can re-install an update by
1) removing the corresponding "package" at
2) running Software Update again, which should list the offending/removed update.