I am a soon-to-be MAC user, awaiting delivery of my new MAC Air laptop, with Big Sur OS, o/a Jan. 27. In the meantime I have been reading up on security, especially firewalls. As you all know, Windows Operating System (winOS) has a very effective firewall (FW) built right into itself. So does macOS. As delivered, the winOS FW is enabled. winOS does not make it easy for the user to disable its FW. Unlike Windows, the firewall in macOS, as delivered, is disabled. It is up to the user to enable it. WHY is macOS delivered with its FW disabled? I am still pondering that question. So far, the best comments I have found about this issue are in the HowToGeek's article at HERE. That article deals with several issues including: Why macOS FW isn't enabled by default Downsides of FWs Why you might want to enable macOS FW ==>How to enable & configure macOSFW As you all know, there are a several 3rd party FWs for winOS. So far I have uncovered only two for macOS: Lulu: see HERE and HERE. Lulu is a free "front-end" for macOS FW -- like Windows Firewall Control is for winOS FW. Little Snitch: see HERE and Here. Little Snitch is a not-free stand-alone FW for macOS. (While there are stand-alone FWs for winOS, such as Comodo's, they are all free, as far as I know.) I would VERY much appreciate comments and/or answers to the following questions: Q1: Besides Lulu & Little Snitch, are there any other 3rd party FWs for macOS? Q2: Given that I possibly will NOT run any anti-virus on my MAC***, should I enable the macOS FW AND/OR should I run a 3rd party FW? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** For those interested in WHY MACs don't need much added security, I suggest reading THIS article, et alia.
I didn't know that the firewall wasn't enabled in the macOS, sounds like a bad idea to me. On the other hand, without any third party tools, I believe that the Windows Firewall will also allow outbound connections. But anyway, you can also check out NetBarrier X9, but I believe it's integrated into Mac Internet Security X9, it's a bit unclear if you can stil use the standalone version without the AV. https://www.intego.com/antivirus-mac-internet-security
Hi, I have been using Mac's for 11 years now, but no idea why the FW is not enabled by default. But is is very easy to enable. I used Little Snitch for many years and found it to be a very good FW, albeit a little heavy on the alerts. I've had my new M1 MacBook Pro for a few weeks now and decided to put LULU on (as well as a few other of Objective-See's free tools). So far I really like LULU and its default settings. Some other FW's you can try are (I have not tried any of them)... http://www.oneperiodic.com/products/handsoff/ https://www.murusfirewall.com https://radiosilenceapp.com I have also used an AV (Bitdefender) since my first Mac. I came from the Windows world and just cannot see not running an AV. I have never seen a performance hit while using Bitdefender. I also have Malwarebytes installed (free version) and occasionally will run a scan with it. I would recommend running a 3rd party FW and a AV. Just my 2 cents Jim
Hands Off! and Radio Silence look pretty cool. And Hands Off! will even protect files but I do wonder if these apps can also work in silent or auto-block mode, too many alerts is never a good thing.
If I end up not liking LULU I will try Hands Off or Radio Silence, but I really think LULU will end up being all I need. Also if you are looking for something that protects files and are going to use an AV, Bitdefender has an option where you can protect files/folders. Jim
I must say that Bitdefender seems to have a quite simple GUI, I kinda like that. BTW, it would be cool if you could allow apps to access only certain folders, haven't found an app on Windows who can do that. With most apps it's an "all or nothing" approach at the moment.
I have very good luck with Bitdefender and have not seen any system performance hit. I don't recall any apps like that but is an interesting thought, I may have to look around for one. Jim
Yes, for example with SpyShelter you can protect folders, but if some app asks for reading/modifying permission, it will get access to ALL protected folders. Makes sense to give this permission to Win Explorer, but it makes less sense to give it to some not fully trusted download manager if you know what I mean.
That sounds like a really nice app for Windows. You should also check out some of the free tools at https://objective-see.com/index.html if you get the chance. Jim
Sandboxed apps on macOS (that is, most typically, apps purchased via the Mac App Store) by default only allow access to the app container directory and have to ask the user for permission to access other directories (see, for example, the App Sandbox in Depth article on developer.apple.com). For utilities that require broad file system access, this can be a little tiresome and such apps will instead ask for the user to enable the "Full Disk Access" entitlement under System Preferences > Security & Privacy > Privacy > Full Disk Access.
Yes this does sound kinda cool, I believe this works the same with UWP apps in Win 10. On the other hand, to me it's more about protecting only a couple of folders with important data, only trusted apps should be able to get access to them. But yes, it would be cool if apps could be designed in a way that they don't need full access to the file system, but it depends on the OS architecture.
Sorry forgot to reply, but yes I already knew about those tools. Would like to see more of these kind of specialized tools for the Mac, if you know any perhaps you can post them.
I'm sorry but I don't understand. What I meant is that I would like to know about tools similar to Process Explorer, AutoRuns, SpyShelter and AppCheck Anti-Ransomware for the macOS.
Back in the day I ran Intego NetBarrier on my PowerPC Mac. Now I run Lulu. Don't need additional security beyond it which is true for a UNIX computer. Just follow safe computing practice online and enjoy your Mac!
An AV is unnecessary because of the built in Guardian antimalware protection. It enforces Apple's App Store download policy by default and whether or not you keep it turned on, MacOS will flag any download that doesn't come from a trusted provider and block it from running. Its a lot more robust than what Windows has in responding to an unknown executable file. Chances of a Mac getting infected range from slim to none because of the strict Apple security.
