MacOS sometimes leaks traffic after system updates

(mullvad.net)

216 points | by dulvui 5 hours ago ago

69 comments

  • thisislife2 2 hours ago

    > In this scenario the macOS firewall does not seem to function correctly and is disregarding firewall rules ... Some examples of apps that do this are Apple’s own apps and services since macOS 14.6, up until a recent 15.1 beta.

    This is not new - every time I update macOS, some of the system settings are changed to default including some in the firewall. And I have to painstakingly go through all of it and change it. Also, the few times I've reinstalled or updated macOS, I've always noticed that it takes longer for the installation if your system has access to the internet - so now I've made it a practice to switch of the router while installing or updating macOS or ios. (With all the AI bullshit being integrated everywhere in Windows, macOS and Android etc., I expect this kind of "offloading" of personal data, and downloading of data, to / from AI servers to keep increasing, especially during updates, to "prepare" for the new AI features in the newer OS updates. No internet means the installer is forced to skip it for later, saving you some valuable time, and hopefully you get to change the default setting before it starts up again. Whatever the claims of AI processing done on the Mac or iDevices itself, some "offloading" to their servers, will still happen, especially if the default settings - which you can change only after the OS is installed - also enables analytics and data collection.)

    (More here https://news.ycombinator.com/item?id=26418809 and on this thread - https://news.ycombinator.com/item?id=26303946 ).

    • hypeatei an hour ago

      > I've made it a practice to switch of the router while installing or updating macOS or ios.

      Why are you still using those OSes? That seems like a lot of work for something you paid for.

      • freehorse 11 minutes ago

        For me, because of the hardware.

    • Foivos 21 minutes ago

      How can you even install the update without access to the Internet?

      For years, I can not do the automatic updates, because it always fails with an error message along the lines of "Failed to personalise software, check your internet!", even though I have a perfectly working Internet connection. The only way to update is with a live USB and an ethernet connection. Everything else fails.

  • mgoetzke 4 hours ago

    it also leaks the audio of tabs before logging in.

    Even though I had disabled all 'restore' applications features, macos sometimes decides to 'start' browsers BEFORE logging in after a restart AND those start auto-playing audio from whatever was paused before the reboot (or many days before).

    Since then I went rather deep disabling that feature, but I never trusted it.

    • Jerrrrrrry 3 hours ago

      They want their TCP/IP stack and safari browser hot and ready for their demanders of instant gratification.

      In the long run, they barter this goodwill for "Safari is shit" credit until they and Google force the internet until a browser-turned App-Play-Store war.

      Both companies win, and can blame the other company - all while incentivising anti-competition behavior and benefiting from their own organizational, yet altruistic, self-interests happening to coincidentally collude in similar, yet distinctly more complicated cases of creating monopolies spanning multiple domains.

      The internet was captured, gamified, commoditized, and vertically integrated into a handful of giga-Corps.

      your mobile devices are essentially tracking devices you are addicted to, and the government is too interested in these shiny grandiose things and their use in facilitating government functions without any real consequence, they fail to see the systematic risks that they themselves have allowed to proliferate by not enforcing stricter laws for systematically - exploitable intersections of law, technology, and business.

      • lukan 3 hours ago

        "they fail to see the systematic risks"

        Or they also fail at providing a solution. Would you prefer diletantic government intervention in this area instead?

        • phoe-krk 3 hours ago

          The differences between governments and megacorps are dwindling and the two are becoming much more alike one another. We already live in global technofeudalism.

          • eru 3 hours ago

            Alas, no. By and large, governments are still vastly less competent than multinational corporations. MNCs also don't force you to pay taxes or buy their products.

            • kibwen 2 minutes ago

              > MNCs also don't force you to pay taxes

              So wrong. Every dollar that $FOO_COMPANY shovels to Google and Apple to spend on advertising is a dollar that you, the consumer, end up footing the bill for; a dollar that does not go towards improving the product you receive in any way whatsoever.

              The advertising industry itself is a tax on the price of everything.

            • lccerina 2 hours ago

              "MNC don't force you to pay taxes", well 30% fee on products bought, sorry "licensed", on their app stores seem like a tax to me

              • fl0id an hour ago

                this. also any profit margins sure are a "tax" in that comparison. Only you don't even get a public service for it, however bad it might be. For taxes, at least some of them are used for public services.

            • Fluorescence 2 hours ago

              > MNCs also don't force you to pay taxes or buy their products.

              MNCs are like local governments levying property taxes.

              e.g. you need a phone much like you have to live somewhere. Your "Tech Government" is determined by a highly constrained choice like your local civil government is determined by your zip code. Maybe you can move at great disruption and cost but it's only to the jurisdiction of another government and some variation of autocratic laws and taxes.

              However, you have no vote and there is no pretence at serving your interests. You are not a citizen but cattle to be farmed... just maximal exploitation to please the mighty Mammon.

            • phoe-krk 3 hours ago

              Governments are adopting the international outreach of megacorps.

              Megacorps are adopting the level of competence of governments.

              I see no contradiction here.

            • bookaway 41 minutes ago

              > governments are still vastly less competent than multinational corporations.

              Speaking of competence devoid of context misses the point. They are resembling each other greatly in the sense of misaligned incentives with their "users", which supersedes run-of-the-mill competence in terms of importance in this context. I'm not going to give points to some moron who is swimming competently in the wrong direction.

              > MNCs also don't force you to pay taxes or buy their products.

              An oddly naive comment given all that has been written about how Amazon operates, to give one example.

            • acdha an hour ago

              > By and large, governments are still vastly less competent than multinational corporations

              Is this something you know firsthand or something you think you know because a huge amount of money has gone into spreading that message for political purposes? Anyone who’s worked for or with a multi-national knows that they’re hardly as efficient as the marketing would have you believe, and anyone who’s looked at libertarian media knows that it’s almost entirely funded by rich people seeking tax & regulatory reductions, banking on you confusing their interests with your own.

            • throwaway19972 2 hours ago

              I never got this sentiment. Corporations as viewed from the inside are wildly incompetent—and that's before you consider profit inefficiency. I suspect this would be a lot more obvious if it weren't for the last seventy years of intentionally hampering government from competing with the market players directly. Once a product hits enshittification it benefits everyone (but shareholders, who contribute nothing to society) to nationalize the production and provide it at zero margin.

            • Jerrrrrrry 2 hours ago

              >MNCs also don't force you to pay taxes or buy their products.

              yeah, because the only kid bigger, told them to knock it off, as to not hamper their own racket.

              If you think a mega-corp won't go AWOL and attempt a Banana Republic/Dutch East India Company again, but with more proxies, lawyers, SAM's, and corrupt officials to "YAS" them into integration, then you really haven't been paying attention to what globalization is really about.

              The US had to ask for money back from the oil barons.

              Bezos/Musk/Zuck/{untold billionaires} will have much better bargaining chips when they possess the monopoly on surveillance, money, and influence, and have proxy chairs at the U.N.

              And I bet those countries would be better run in every way.

            • FollowingTheDao 2 hours ago

              You are "forced to pay taxes" to have schools and roads and rescue services and law and everything else that makes the United States still a mostly habitable place to live.

              Corporations do not force you to pay taxes YET. When the corporations get in total control and you cannot even vote just wait to see what a slave you are.

        • peoplefromibiza an hour ago

          > Would you prefer diletantic government intervention in this area instead

          what kind of answer is that exactly?

          I would much prefer they fix the issue, yes, the stuff I'm using is provided by Apple and it's been paid off in full, I don't know what made people believe that it's ok if software sucks...

          If a train company causes an accident they are considered liable if a software company leaks my data they should be considered liable, it's as simple as that, no need for this anti government stands that frankly make adults look like angry teenagers with a bad bladder

        • Jerrrrrrry 2 hours ago

            >"they fail to see the systematic risks"
            Or they also fail at providing a solution.
          
          Apple has no incentive to improve Safari. "It just works" is what their cultists paid to have the honor to parrot, and they enjoy the majority of web market share of people with actual wages and disposable income. That's why the sell culture, not their people's data (directly, yet).

          Since it's not "Safari" that's broken (since iPhones cost a lot of money, they cant break), the users will lie blame at the fault of the web developers, since they had gotten cozy within the comfortable, flexible, expected behaviors of Chrome, having enjoyed a hiatus from IE11 EOL pollyfills and jquery.

          Apple then made it easier to roll out an app than to grapple with the pitfalls, nuances, foot-guns, and gabbling documentation that Safari has carefully mal-compiled to shepherd both developers and their users into the Walled Garden.

          It's just the browser wars, but with higher stakes. And Microsoft already won.

          • acdha an hour ago

            If you’re referring to people as “cultists”, consider that your point might not be as strong as you think. If you have a non-emotional argument about a browser, try making it with logic and data rather than emotion. For example, demonstrate awareness of where the browsers rank on the features which web developers really need (Google’s devrel team likes to highlight PWA features almost nobody uses even on Chrome) and show why the “walled garden” metaphor applies more to a niche browser than the dominant one by a large margin.

      • gruez an hour ago

        >They want their TCP/IP stack and safari browser hot and ready for their demanders of instant gratification.

        Having short startup times is bad now? ...because of "instant gratification"? The rest of your rant might make sense in the broader context of what big tech is doing, but bringing it up in this thread and implying that it's part of a conspiracy where "The internet was captured, gamified, commoditized, and vertically integrated into a handful of giga-Corps" is unhinged.

    • Affric 4 hours ago

      I can’t think of anything I want less from a laptop than it playing sound when I open it… and yet apple bring it to me as though it’s a feature.

      • theshrike79 4 hours ago

        There are exactly zero situations where I would want my laptop be anything except fully muted when I open it.

        • andrepd 3 hours ago

          Configurability is also out of fashion nowadays, so you'll get that behaviour and enjoy it.

        • bayindirh 3 hours ago

          Your applications should catch the signal and pause. Safari, Apple Music and Spotify handle this well. Firefox needs a bugfix.

          • Faaak an hour ago

            Yet they still make a sound when powered on or resuming sleep (and curiously, when plugged into my usb-c monitor, keeps going to sleep and turning back on (with a nice sound) forever. No other laptop win or Linux does that)

            • bayindirh 39 minutes ago

              I actually tested my laptop before writing that comment. My laptop(s) make no sound even if I close the lid with playing audio (sans Firefox, as I said).

              I didn't test sleep/wake consciously while I docked my laptops, but I don't remember they start making sounds when they should be silent. Maybe you're seeing PowerNap cycles, but mine is not doing any noise in PowerNap, either.

              Need to test with leaving Firefox playing something and see what it does.

              ...all in all, interesting sentiments. I'm using these things for ~15 years at this point, and while they did funny things in the past, this was not one of them.

      • bayindirh 3 hours ago

        macOS sends a "pause" signal to all players when it sleeps, and any application which can handle that won't be playing any audio when the system wakes up. So if your audio continues the moment you open the lid, please file a bug report for that application.

        • Kbelicius 3 hours ago

          GP wrote nothing about sleep.

          • bayindirh 3 hours ago

            macOS sleeps the moment you close the lid, and wakes the moment you raise it a little. It's instantaneous, esp. ARM powered ones.

            • ta1243 an hour ago

              I've seen many situations where macos laptops with a closed lid continue to perform network tasks

              • bayindirh an hour ago

                That's PowerNap. Depending on your settings, your Mac wakes up briefly to check e-mails, updates and sleeps again. Normally it happens only during charging, but you can enable on battery power or disable it completely.

                Bluetooth and wireless radios stay on for a longer while because to keep everything connected if you are moving from room to room at home or at work, also it's made possible because all radios are higher end models with their independent processors.

            • Kbelicius 3 hours ago

              Sorry, mistook which post you were replying to.

              • bayindirh 3 hours ago

                Nah, no problems. Things happen. Have a nice day :)

      • latexr 4 hours ago

        That’s an unfair characterisation. It’s just restoring windows, some of which happen to be browser windows, which then load a website with auto-playing video or audio that (unsurprisingly) starts playing. No one is selling it as a feature to “play sound when waking up from sleep”. I bet that if you configured the browser to never auto-play, this wouldn’t happen.

        To clarify, because commenters seem to be misunderstanding my point: I’m not defending the functionality, I think it’s wrong. My sole quarrel is with the characterisation that Apple is selling it as a feature, when they’re not. Let’s not ascribe wrong (or at best unknown) motivations to behaviours, as that makes is less likely they will be fixed.

        • dspillett 3 hours ago

          No one is selling it as a feature, no, but I would still consider it an OS level bug, and a security one at that. Focusing on the browser is a step away from the point: if I'm not signed in, I don't want sound playing from any app⁰.

          I've had Windows do something similar, a media player deciding to unpause when coming up from hibernate (this was before Windows seemingly broke hibernate) and for some reason being at full volume, and it was a fair few seconds before I was able to login, get to that app, and hit pause again. It didn't leak anything sensitive (Hey everyone, this guy watches Stargate!) but it made me “that guy we all hate” on the train… Again it is the app that is responsible for making the sound, but I think at that point the OS shouldn't let it.

          <glasses tint="rose">I miss the times when laptops had physical volume sliders…</galsses>

          To me this has the feeling of making a mountain out of a molehill, but I don't think there is any denying that the molehill itself exists and to others it might be more than the very minor irritation it could be to me.

          > I bet that if you configured the browser to never auto-play, this wouldn’t happen.

          I bet that no matter how tightly you try to control that, some advertiser will find a way to override it to make sound play, and sods law says that will happen when you most want your waking laptop to be quiet. Blocking audio while not signed in at the OS level is a safer gate.

          ----

          [0] Actually, there is an exception there: if the machine has locked due to input inactivity, I want audio I'm listening to continue and notification pips to come through. There is a distinction between OS restarting (from [re]boot, wake, etc.) and local console not logged in due to input timeout, in how I'd prefer things to behave.

          • latexr 3 hours ago

            > No one is selling it as a feature, no

            That’s all I’m saying.

            > but I would still consider it an OS level bug

            I agree.

        • mgoetzke 3 hours ago

          To clarify it restores windows AFTER a reboot, BEFORE i login.

          What RIGHT does it have to create processes with a user BEFORE I authenticate to the machine ?

          • latexr 3 hours ago

            Yes, I understand, I have encountered that as well and I agree it shouldn’t happen.

            My only quarrel is with the other user implying Apple is selling this as a feature. I have my fair share of criticism of Apple and other tech companies, but let’s please not let blind hate take over and dilute arguments.

        • eptcyka 3 hours ago

          Does it matter if the end result is that the browser plays audio before you've authenticated your user session?

          • latexr 3 hours ago

            The characterisation matters, yes. Because when you ascribe wrong motivations out of perceived spite, it makes it less likely the people who can fix it want to do so.

            I’m not defending the bug, I’m replying to the post below it.

        • chx 3 hours ago

          I do not think the user particularly cares whether it was an intentional feature or an unfortunate byproduct of features and bugs when they open a laptop in a classroom or a meeting and it starts blaring the music they listened to before closing it.

          • Jerrrrrrry 3 hours ago

            Some areas of expertise require so much work, it nearly prevents the student from learning to appreciate the intent, the craft, itself.

            It's like being literally unable to dog

            Opening a laptop, even if the last activity was blaring obnoxious carnival music, should _allow_, not _demand_ the user to resume their last function - which was explicitly to _pause_ the laptop, by closing the lid.

            If I close the lid, I am done with the computer and video; it is obvious that I am done right now - the OS/browser would be alerted of LidDown, and I would expect the OS to tell the browser to Pause (via some new javascript media API that I am sure exists), pagefile ram if possible/needed, and dump all console.logs to a temp directory, in case restarting from hibernation goes awry.

            If I open the lid, I am attempting to use the computer. The previous quest can be pertinent or moot; but it would be oddly assumptive (against the ethos of general computing) to _automagically_ resume (especially a paused) playback just from first button press - at least give me the option to explore, format, or rename the thing.

            • AstralStorm 3 hours ago

              You're asking the OSes to actually implement proper session management and centralized leak controls?

              It has never happened before...

              • Jerrrrrrry 2 hours ago

                The thread shouldn't pause with AudioContext frozen in an "active" status. The thread unpauses, the AudioContext resumes before the next frame (whever thatll be) comes to remember to pause it.

                Windows 7 with Youtube can figure out - even with hibernation breaking audio/bluetooth on windows - then surely the most expensive company and OS 15 years later has made an inkling of progress (if that was ever their intention)

    • radicality 3 hours ago

      Damn, how is that possible? I imagine you have FileVault enabled, and if so this sounds like some security bypass?

      I was under the impression that until you provide the password after a reboot, the system should know nothing about you as all user data should be encrypted, so it should not know what apps you had open before reboot let alone start playing sound.

      • gruez an hour ago

        >Damn, how is that possible? I imagine you have FileVault enabled, and if so this sounds like some security bypass?

        If you're choosing "reboot" rather than "shut down", presumably you intend to continue using the machine, so it's reasonably safe to keep credentials around. AFAIK windows has the same feature.

    • f1shy 3 hours ago

      Somewhat loosely related, but I have something similar with the iPhone browser. Where opening the browser will shortly show the last page I had open (even I carefully closed it before closing the browser). Even if it never got me into trouble, I found that annoying as s. And could potentially make problems.

      • m-s-y an hour ago

        FWIW, what you’re seeing is likely just the cached thumbnail that iOS creates for the app-switcher UI, not an interactive web session.

        • DavideNL 25 minutes ago

          This is also the case for FaceTime; The last image the camera captured will stay visible in the app switcher like forever... so other people who use your iPad / iPhone can see it.

        • pornel an hour ago

          Yes, but still if you have somebody looking over your shoulder, it can leak whatever you've been looking at.

          There's a way to block that entirely for "secure' apps, but iOS could be smarter about this, and cache some stripped down view or expire that cache quicker.

    • commandersaki 2 hours ago

      What I don't understand is why browsers (in my case Brave) doesn't pause all playback after a restart?

    • cryptoz 3 hours ago

      How is this possible? I wouldn’t have thought that it could open your applications without you logging in? How does it know who you are? How does it know which applications to open? If you’re not logged in yet, is is just logging in for you automatically but not showing you?

      Seems like a huge security bug. This isn’t being exploited? Wild stuff.

      Reminds me of when you could hear a FaceTime call coming through but if you chose not to answer it, no worries! Your iPhone will turn on your camera anyway! And send your video to the calling party!

      • delfinom 2 hours ago

        Vast majority of all laptop and even phone usage is single user. They could literally be doing

        if macbook_has_only_one_account():

        preloadapps()

    • threeseed 3 hours ago

      I have never heard of anyone with this issue.

      The only explanation is that you restarted whilst having the "Open All Previous Application" checkbox enabled. And yes it will launch processes after you have logged in but before the Desktop is shown.

      Either that you or you have some launch daemon that is opening a browser.

      • eru 3 hours ago

        I also have this issue from time to time.

        > The only explanation is that [...]

        Please show some more imagination.

        • threeseed 2 hours ago

          Maybe you should use your imagination and read the second part of what I wrote.

          Which is that it could be a launch daemon. It's very common for third party apps to use their imagination and do dumb things on startup.

      • olyjohn 3 hours ago

        I've had similar experiences with MacOS. I uncheck that goddamn box all the time and still it relaunches previously opened applications half the time. If my application or computer crashes, I don't want the crashy application to open up at startup again. MacOS isn't perfect.

        • lupusreal 3 hours ago

          OSX is particularly lousy with remembering user preferences and configuration. I quit using it after I grew sick of raging at it forgetting what applications want different files to open with. I've never had this sort of problem on Linux.

          • jwells89 2 hours ago

            In my experience, when filetype associations change under macOS it’s because some app I’ve used recently has made those changes without asking me.

            I know some people are tired of all the prompts but I don’t think apps should be able to change those associations without first prompting the user.

      • jwells89 2 hours ago

        I’m very confident that it’s either this or the restore-after-crash feature that OP is seeing. I don’t think it’s anything specific to Safari, because I have never seen Safari opened before login when it’s not my default browser.

        That said, there should probably be a checkbox in system settings to disable login “prewarming”.

      • f1shy 3 hours ago

        I had this issue, and something similar in my old iPhone. I'm sure there are other explanations, because yours is not it.

  • nubinetwork 7 minutes ago

    The article has today's date on it, but I could swear I read this exact same article a month ago...

  • handsclean 2 hours ago

    The first boot after a macOS system update has long been bugged out. It launches a bunch of apps you didn’t even have open before updating, seems to be the 5-10 most recent apps you quit. Yes they were fully quit, yes I have the “resume” setting off. It also doesn’t do a resume, it launches them, i.e. tells them to create new windows, and it launches them before it finishes mounting disks, resulting in every update being followed by all my most used apps appearing out of nowhere and telling me all my config and data is gone. It doesn’t really matter, you just reboot again and you’re good, it’s just careless and makes the OS feel unstable. Maybe the firewall thing is unrelated, maybe it finally forces Apple to fix the bug, we’ll see.

    • trissylegs 5 minutes ago

      > yes I have the “resume” setting off

      I'm not sure what this setting does. The amount of times mac will jsut reopen everything anyway is frustration. I go look up how to stop it and the answer is always "Turn off this setting you already have off".

    • galad87 2 hours ago

      It seems to launch all the apps you had open when you pressed the "Update" button, even if that was 30 minutes before the installation began.

      • ahoka an hour ago

        Ah, that is so annoying. It actually opened stuff from yesterday once.