Comment by kvuj
25 days ago
> 1) By default, every word (each character, actually) you input into Spotlight/Siri gets time-stamped and sent to `smoot.apple.com`
Huh? How do you expect Apple to show live search results if they don't send what you're typing to their servers?
> 2) Even with a Pi-Hole blocking *.apple.com (i.e. using MacOS >> Networking >> DNS Server), on boot all modern Apple Silicon reaches out to security.apple.com (i.e. bypassing the user's manual-input DNS setting), using the DHCP-issued DNS IP [0]
From a quick google search, it seems to be if you enable "Find my" or pass word recovery with an Apple account. I think that's reasonable to expect if you enable these features.
>I think that's reasonable to expect if you enable these features.
This is the default behavior, without enabling anything (you cannot disable the T2 chip reaching out to security.apple.com), whether or not you have Find My™ enabled. You cannot disable this "feature."
If you take a brand new Apple computer and turn it on, literally the first DNS query it makes (before MacOS even begins to load) is to `security.apple.com` – with zero configuration – and you can never disable this behavior (it is embedded into Apple's T2 SoC).
Every boot thereafter, the Apple product attempts to re-query this host; if connected (and black-listed) the computer is immediately disabled.
----
Similarly, Microsoft has OS-level phone-homing which contacts host `spynet2.microsoft.com`, which is certainly an interesting naming scheme (at least they're open about it). This also ignores the user-supplied DNS (in Settings >> Networking >> NIC >> DNS ).
I wonder how legal it is to advertise support for user supplied DNS and phone home ignoring the setting.
Debian and Raspian both exhibit similar behavior (albeit, by fall-backing in-OS to the DHCP-supplied DNS server, unless you specifically disable this [e.g. by entering the DNS-IP into all DNS1 DNS2 fields]).
Curiously, a Pi-Hole (fresh bash install), intended to allow DNS control, also reaches out to the DHCP-supplied DNS (which can be annoying, if e.g. you have cascading PiHoles and one goes rogue on a subnet, using the local/undesired DNS resolver).
----
I remember when software was simple; even back in 2011, Microsoft Office installers were still "opt-in to data collection" – now-a-days, even open-source miracles like TrueNAS hide the data collection option deep in the GUI settings (wtf?!?! other than for monies).
>>Huh? How do you expect Apple to show live search results if they don't send what you're typing to their servers?
I don't want spotlight to show any online results in the first place, is there anyone here who does?
Settings -> Spotlight -> Turn off everything you don't want. The first few times you open it it even tells you this.
Admittedly I haven't confirmed that this results in no API calls in the latest few macOS releases but it definitely used to stop them, at least a few years ago.
Opt-out privacy isn't a policy an organization serious about Privacy - the sort Apple pretends to be - would adopt.
4 replies →
you realize this is very laborious. every time you install a new app - or sometimes when you update an app - you have to do it again.
also, search for "improve" in settings. I'll bet you didn't find "Help Apple Improve Search" in the results. Ironic on many levels.
5 replies →
I use it sometimes to quickly do currency conversion, I am assuming it does an online request to a currency exchange API. If that counts, then count me as a person who does want to see online results. But I did disable the web search results in Spotlight settings, that's just annoying
Yes, your example "counts" (as somebody desiring the online features of Spotlight).
But macOS makes it extremely difficult to search your local files (without using Spotlight) so you effectively cannot search your offline APFS without revealing your local queries (to Apple, at a minimum).
This seems wrong.
----
I've met several $100k+ tech geniuses who absolutely refuse to believe this behavior is normal/default – but a local PiHole (or simple internet searches) reveal this Truth (capital t, with respects to DFW).
While providing over-the-shoulder IT support, I saw a hardware designer for a tech company enter proprietary company information into his "local" Spotlight search (to find a CAD file he had recently designed, demonstrating that the computer was "working"); when I told him about smoot.apple.com (e.g: Spotlight local queries offloading) his face turned white – fortunately that company only has a few thousand customers (very niche hardware designs for BMS/power delivery management), and no "real" competition... but he still refuses to fully believe the levels of telemetry in 2026.
(I think the LG TV story last month "woke him up"; the Bitcoin Ledger embedded SoC SIM key-thefts via man in the middle attacks should bring out the last remaining tinfoil hats). Stay frosty.