tl;dr: Emacs is not immune to Apple's Local Network Privacy nightmare.
In certain conditions, macOS blocks (Emacs) connections to systems on the same LAN (but it works in some other conditions in order to drive users crazy)
Connections to systems outside the same LAN are not affected.
The further way, the more trustworthy /s
For instance:
- Emacs + Apple's /usr/bin/ssh works
But:
- Emacs + Homebrew's /usr/local/bin/ssh fails. "No route to host".
What I really want is "Tramp" but to reproduce it's simpler and clearer to just hit Esc-x shell inside Emacs and then
bash$ /usr/local/bin/ssh -o ControlMaster=no other-system.local
ssh: connect to host other-system.local port 22: No route to host
bash$ /usr/bin/ssh -o ControlMaster=no other-system.local
Last login...
I also tested Apple's Terminal and iTerm2 instead of Emacs and the behavior is the same: as long as one element in the combination is signed by Apple, it connects. When there is none: No route to host. For instance: Apple's Terminal + Homebrew /usr/local/bin/ssh works.
Here's a sample log collected with log stream | grep -C 10 -i error.*com.apple.networkextension.*fail
2025-11-06 20:07:57.884131-0800 0x103b827 Error 0x0 222 0 nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEProcessInfo copyUUIDsFromExecutable:]: failed to get UUID for Single Arch
2025-11-06 20:07:57.884178-0800 0x103b827 Error 0x0 222 0 nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEProcessInfo copyUUIDsForExecutable:]_block_invoke: failed to get UUIDs for /Applications/Emacs 30.2.app/Contents/MacOS/Emacs-x86_64-10_14
2025-11-06 20:07:57.884540-0800 0x103b827 Default 0x0 222 0 nehelper: [com.apple.networkextension:] 0 UUIDs for Emacs-x86_64-10_14 are already in the cache
2025-11-06 20:07:57.884932-0800 0x103bb58 Error 0x0 222 0 nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEProcessInfo copyUUIDsFromExecutable:]: failed to get UUID for Single Arch
2025-11-06 20:07:57.884987-0800 0x103bb58 Error 0x0 222 0 nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEProcessInfo copyUUIDsForExecutable:]_block_invoke: failed to get UUIDs for /Applications/Emacs 30.2.app/Contents/MacOS/Emacs-x86_64-10_14
2025-11-06 20:07:57.885350-0800 0x103bb58 Default 0x0 222 0 nehelper: [com.apple.networkextension:] 0 UUIDs for Emacs-x86_64-10_14 are already in the cache
2025-11-06 20:07:57.885769-0800 0x103b827 Error 0x0 222 0 nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEProcessInfo copyUUIDsFromExecutable:]: failed to get UUID for Single Arch
2025-11-06 20:07:57.885816-0800 0x103b827 Error 0x0 222 0 nehelper: (NetworkExtension) [com.apple.networkextension:] +[NEProcessInfo copyUUIDsForExecutable:]_block_invoke: failed to get UUIDs for /Applications/Emacs 30.2.app/Contents/MacOS/Emacs-x86_64-10_14
There are a lot of pages on the Internet about the LNP disaster and Emacs is very far from the only one affected. For instance:
https://forums.macrumors.com/threads/local-network-access-nightmare.2448144/ (battery-draining site, don't leave tab open)
https://developer.apple.com/forums/thread/762917
- pages on Reddit and many other places.
This iOS feature is broken beyond repair on macOS, it was not ready to be transferred to macOS at all. Dunno about iOS itself but I doubt a lot of people use macOS on iOS!
The astute reader has noted that ssh's ControlMaster may in some cases be used as workaround by piggybacking on an existing, "Apple" connection.
tl;dr: Emacs is not immune to Apple's Local Network Privacy nightmare.
In certain conditions, macOS blocks (Emacs) connections to systems on the same LAN (but it works in some other conditions in order to drive users crazy)
Connections to systems outside the same LAN are not affected.
The further way, the more trustworthy /s
For instance:
But:
What I really want is "Tramp" but to reproduce it's simpler and clearer to just hit
Esc-x shellinside Emacs and thenI also tested Apple's Terminal and iTerm2 instead of Emacs and the behavior is the same: as long as one element in the combination is signed by Apple, it connects. When there is none:
No route to host. For instance: Apple's Terminal + Homebrew /usr/local/bin/ssh works.Here's a sample log collected with
log stream | grep -C 10 -i error.*com.apple.networkextension.*failThere are a lot of pages on the Internet about the LNP disaster and Emacs is very far from the only one affected. For instance:
https://forums.macrumors.com/threads/local-network-access-nightmare.2448144/ (battery-draining site, don't leave tab open)
https://developer.apple.com/forums/thread/762917
This iOS feature is broken beyond repair on macOS, it was not ready to be transferred to macOS at all. Dunno about iOS itself but I doubt a lot of people use macOS on iOS!
The astute reader has noted that ssh's
ControlMastermay in some cases be used as workaround by piggybacking on an existing, "Apple" connection.