Comment by ProllyInfamous
25 days ago
Just FYI on MacOS's default telemetry:
1) By default, every word (each character, actually) you input into Spotlight/Siri gets time-stamped and sent to `smoot.apple.com`
2) Even with a Pi-Hole blocking *.apple.com (i.e. using MacOS >> Networking >> DNS Server), on boot all modern Apple Silicon reaches out to security.apple.com (i.e. bypassing the user's manual-input DNS setting), using the DHCP-issued DNS IP [0]
pro-tip: use your router's DHCP to auto-issue your local Pi-Hole's IP address [as DNS] with your IP-leases; then you'll actually be able to block all *.apple.com traffic (using the PiHole which your DHCP issues to, by default)
[0] this is for security chip "lockout" detection (e.g.) and it is pervasive across NICs (i.e. it REALLY seeks any attempt for DNS resolution to security.apple.com)
> 1) By default, every word (each character, actually) you input into Spotlight/Siri gets time-stamped and sent to `smoot.apple.com`
Huh? How do you expect Apple to show live search results if they don't send what you're typing to their servers?
> 2) Even with a Pi-Hole blocking *.apple.com (i.e. using MacOS >> Networking >> DNS Server), on boot all modern Apple Silicon reaches out to security.apple.com (i.e. bypassing the user's manual-input DNS setting), using the DHCP-issued DNS IP [0]
From a quick google search, it seems to be if you enable "Find my" or pass word recovery with an Apple account. I think that's reasonable to expect if you enable these features.
>I think that's reasonable to expect if you enable these features.
This is the default behavior, without enabling anything (you cannot disable the T2 chip reaching out to security.apple.com), whether or not you have Find My™ enabled. You cannot disable this "feature."
If you take a brand new Apple computer and turn it on, literally the first DNS query it makes (before MacOS even begins to load) is to `security.apple.com` – with zero configuration – and you can never disable this behavior (it is embedded into Apple's T2 SoC).
Every boot thereafter, the Apple product attempts to re-query this host; if connected (and black-listed) the computer is immediately disabled.
----
Similarly, Microsoft has OS-level phone-homing which contacts host `spynet2.microsoft.com`, which is certainly an interesting naming scheme (at least they're open about it). This also ignores the user-supplied DNS (in Settings >> Networking >> NIC >> DNS ).
I wonder how legal it is to advertise support for user supplied DNS and phone home ignoring the setting.
1 reply →
>>Huh? How do you expect Apple to show live search results if they don't send what you're typing to their servers?
I don't want spotlight to show any online results in the first place, is there anyone here who does?
Settings -> Spotlight -> Turn off everything you don't want. The first few times you open it it even tells you this.
Admittedly I haven't confirmed that this results in no API calls in the latest few macOS releases but it definitely used to stop them, at least a few years ago.
11 replies →
I use it sometimes to quickly do currency conversion, I am assuming it does an online request to a currency exchange API. If that counts, then count me as a person who does want to see online results. But I did disable the web search results in Spotlight settings, that's just annoying
1 reply →
>...pro-tip...
Thank you for the detailed suggestion. I use LittleSnitch. pi-hole previously, I must take another look. Did you catch LG spying posts?
FYI:
LittleSnitch resolves DNS queries (i.e. it determines the IP address) before you have clicked ALLOW/DENY; so even if you DENY the host['s IP] connection, your DNS resolver has already seen the query.
Also, LittleSnitch does not block `security.apple.com` queries, which occur before this software has even loaded.
----
>Did you catch LG spying posts?
After last month's GamersNexus exposé, I went back and watched Citizen Four [0]: Ed says it plain and simply in this 2014 documentary, "you don't even need to be a high value target, anything that can listen WILL."
>>"Saying [if you have nothing to hide, then...] is like saying you don't care about free speech because you have nothing to say!" –Edward Snowden
[0] documentary about Snowden revelations; also see his book Permanent Record [1]
[1] <https://www.amazon.com/Permanent-Record-Edward-Snowden/dp/12...>
side note: I worked in data centers during the Snowden leaks, and the cover stories were always incredible ("the tech just doesn't exist to do that yet" is agency legalese, folks)...
This is ugly. Time for some more lawsuits probably.
The EULA (that you couldn't possibly read entirely) makes this all pretty "okay," in legalese.
I think it's time that we legislate EULAs, with terms similar to credit card offers (e.g: requiring that interest be listed clearly in large bold print on the front of all offers) that make them shorter and more understandable; obviously, data is "the new oil" so of course everything is opt-out (if at all possible), and you cannot trust settings (e.g: to survive an update).
----
After last year's Guest/Wifi breach (wireless access spanning across virtually all VLANs on same hardware), I'm at the point where my subnets are mostly offline (entirely disconnected). Plex is now added to the list (after last month's cryptominer intrusions), entirely local (no physical connection to interwebs, entirely separate access point for local streaming).
Agreed. Adhesion contracts that consumers cannot understand or meaningfully agree to should not be enforceable.