Comment by ProllyInfamous
25 days ago
>I think that's reasonable to expect if you enable these features.
This is the default behavior, without enabling anything (you cannot disable the T2 chip reaching out to security.apple.com), whether or not you have Find My™ enabled. You cannot disable this "feature."
If you take a brand new Apple computer and turn it on, literally the first DNS query it makes (before MacOS even begins to load) is to `security.apple.com` – with zero configuration – and you can never disable this behavior (it is embedded into Apple's T2 SoC).
Every boot thereafter, the Apple product attempts to re-query this host; if connected (and black-listed) the computer is immediately disabled.
----
Similarly, Microsoft has OS-level phone-homing which contacts host `spynet2.microsoft.com`, which is certainly an interesting naming scheme (at least they're open about it). This also ignores the user-supplied DNS (in Settings >> Networking >> NIC >> DNS ).
I wonder how legal it is to advertise support for user supplied DNS and phone home ignoring the setting.
Debian and Raspian both exhibit similar behavior (albeit, by fall-backing in-OS to the DHCP-supplied DNS server, unless you specifically disable this [e.g. by entering the DNS-IP into all DNS1 DNS2 fields]).
Curiously, a Pi-Hole (fresh bash install), intended to allow DNS control, also reaches out to the DHCP-supplied DNS (which can be annoying, if e.g. you have cascading PiHoles and one goes rogue on a subnet, using the local/undesired DNS resolver).
----
I remember when software was simple; even back in 2011, Microsoft Office installers were still "opt-in to data collection" – now-a-days, even open-source miracles like TrueNAS hide the data collection option deep in the GUI settings (wtf?!?! other than for monies).