You install a Mac app that is supposed to help you stay off YouTube, and macOS puts up a serious-looking warning about a system extension that wants to filter network content. That is a fair moment to stop and ask what you are agreeing to. This post is the plain answer. The onboarding links here on purpose, at exactly that screen.
A block you can walk around is not a block
OffMain’s whole deal is that your blocked sites stay closed until your own GitHub activity has earned the minutes to open them. So the first question is where the block should live.
The obvious answer is a browser extension. I can tell you from personal experience why that fails. The extension blocks Chrome, so you open Safari. Safari too? Firefox is a two-minute download. And the person doing the dodging is not some determined attacker. It is me, mid-morning, orbiting a task I do not want to start. A block that only covers one browser is a suggestion.
For the block to mean anything on a Mac, it has to sit below the browsers, at the level of the machine’s network connections. macOS has exactly one sanctioned way for an app to do that, and it requires the prompt you are looking at.
The filter is Apple’s machinery
The prompt is asking to enable a Network Extension content filter. The API is called NEFilterDataProvider, and it is the same system machinery that enterprise security products use to protect corporate Macs. This is not a driver I hacked together or a private hook into your network stack. Apple built the mechanism and the sandbox the filter runs in, and Apple decides what code inside that sandbox is allowed to touch.
The scary wording on the prompt is macOS being appropriately cautious about a powerful capability. Good. It should be.
It answers one question per connection
Here is what the filter sees: the domain a connection is going to. The hostname on the wire, nothing past it.
It cannot see inside the connection: not the page contents, not what you typed. It is not reading your email or your DMs. It gets asked one question, over and over: is this domain on your blocked list right now? It answers yes or no and gets out of the way.
The decision never leaves your Mac
That yes-or-no happens on your machine. The filter itself sends nothing anywhere. Not to our servers, not anywhere.
OffMain does have a backend, so let me be precise about what lives there: your GitHub activity (which repository an event came from and how much you did, never the contents of your work) and your contract (which sites you blocked, what your work pays, your balance). Your browsing is not on that list and never will be. The server pays out minutes; the Mac enforces the block. The two never trade notes about where you went. The full inventory is in What OffMain knows about you, and the formal version is the privacy policy.
It does not block native Mac apps
One honest limit, stated plainly. In the beta, the filter blocks your chosen sites machine-wide: every browser, every app that makes web connections. What it does not block is native Mac apps. A game installed through Steam will launch just fine.
I feel this one personally, because Steam has been one of my two escape hatches for about a decade. Native-app blocking on the Mac is something I want, but it is not built, and I am not going to promise it here so the install feels better. If the thing that eats your mornings is a desktop game, the Mac app alone will not save you, and I would rather you know that before the install, not after. What you get today is domain-level and machine-wide. That already closes the open-another-browser loophole, which was the one I used most.
You can check all of this, and you can leave
The extension is not hidden. macOS lists it under System Settings, where you can see it running and turn it off. Uninstall the app and the filter goes with it.
OffMain is not a jail and does not pretend to be one. You set up this deal with yourself, on purpose, with the exit clearly marked. The filter can hold a door closed until your work opens it. It cannot stop you from turning the filter off.
That part is still you.