Just spent 30 minutes poking around this. It's horrifying. Absolutely horrifying. All the intelligence and Siri stuff is turned off and blocked on my Mac yet it's still doing this.
Think this might kick me over the fence finally to Debian.
Just spent 30 minutes poking around this. It's horrifying. Absolutely horrifying. All the intelligence and Siri stuff is turned off and blocked on my Mac yet it's still doing this.
Think this might kick me over the fence finally to Debian.
>All the intelligence and Siri stuff is turned off and blocked on my Mac yet it's still doing this.
Wait until you discover that macOS entirely ignores your manually-input DNS settings, before every bootup, to reach out to security.apple.com.
Have a network-wide PiHole (allegedly) blocking the entire *.apple.com domain? No you don't, (at least) not at bootup, because APPLE DOES NOT RESPECT YOUR PRIVACY and will use any network-discoverable DNS (instead of your configured Network Settings) to [attempt a] phone-home.
----
I finally made the full switch to Linux earlier this year. Been a (primarily) Apple user since 1992.
> APPLE DOES NOT RESPECT YOUR PRIVACY and will use the router-supplied DNS (instead of your configured Network Settings).
is that for real? wow
Is for real.
I provided a "better DNS configuration" suggestion, a month ago, but at this point I doubt it will remain useful [†]:
<https://news.ycombinator.com/item?id=50071310#50078574> [have router's DHCP auto-issue DNS to your pi-hole].
[†] I am but an observant (on my DNS logs) bluecollar poweruser – my tip will reduce only one vector, and we probably live in a world where IPv6 DNS addresses are [about to be, if not already] being hardcoded into TVs, computer security chips, and phones
----
At an absolute minimum: LittleSnitch will NOT help you here (and isn't doing everything it claims to, under the hood); it is entirely impossible for LS to stop pre-boot DNS queries; even under normal operation (e.g: when a dialogue pops up to `ACCEPT/DENY` a DNS resolution) your ISP still sees every. single. URL resolution (even if you `DENY` the connection).
Before you write "no it doesn't" please check your own DNS logs. It do be like it is.
Wow!!
The above are facts.
----
Speculating out loud: sure, perhaps this userprofile data is stored locally; but perhaps also (like Apple's "advertising token") this local data can help remote servers better track your entire computing humanity. While still "locally stored."
(Language doesn't mean anything when EULAs are dozens of unreadable pages long; "stored locally" is just another set of weasle words, like "then just opt-out" [why is opt-in the default, if -out is even allowed at all?!]).
Wouldn't surprise me if every single webpage has an advertising option to exploit the local user data (via Apple$$$), if only by offering on-device scrubbing; one could then look to see what advertising content the localhost is requesting (and thus have essentially root access to all userdata, "locally stored," by detecting outbound queries) with the user's own host acting as Apple's backendserver (while Apple profits, not you).
¢¢
Added to the list of reasons I need to look at this seriously. Thank you!
Think I need a per-host approval mechanism for DNS as well. There are fewer domains I want my computer talking to than not.
Keep adding to your list, friend:
<https://news.ycombinator.com/item?id=50071310#50078574> [Spotlight's "helpfulness," which cannot be disabled (viaGUI)]
Apple's OS is toxic, at this point.
My two newest Macs are entirely offline (air-gapped) and used primarily for LLM – maybe Apple's secret (all along) has been to get people like me to purchase twice as much hardware (as would be necessary in a privacy-respecting world)?
> which cannot be disabled (viaGUI)
Are you sure? I've just inspected my macOS 27.2 machine with my firewall and I couldn't find requests to smoot.apple.com while typing in spotlight(show related content and help improve apple search are both disabled).
I am certain only up to Sequoia; there is a new mini with Tahoe on it sitting here so let me replicate that behavior (if hostname isn't smoot., it'll be something). I've been meaning to update to GoldenGate (since buying it last week it has been used for just 2 hours, playing with LLMs on the default Tahoe); so I'll do this too and then see what the latest macOS's behavior is.
While I'm doing that, pull up your *.apple.com outreaches.
If you are not seeing <security.apple.com> on any Silicon's boot, you are not seeing full logs (all Silicon, and macs since T2, do this reach-out pre-post).
Well fuck.
Just dug my old Xeon workstation out of the cupboard and am installing Debian on it.
My main desk has three Apple Silicons (two entirely airgapped, and am typing on third); sitting next to it is my beautiful 27" iMac (2009), with full Adobe CS4 (also offline); just purchased a pristine MacPro5,1 – seventeen year old computer! – for my main online Apple experience (using OS 10.14 from a decade ago), mostly because it cannot AI/LLM/Siri, even if it wanted to. Then I will have three offline Silicons.
Since the beginning of this year, I am now primarily running (online) a 9800X3D with a 5070Ti – Linux - which is only possible with LLM tutorials/help (mostly offline, on my own Silicon LLM).
----
Happy restomodding!
This is why throwing an extra DNS server on the network doesn't truly work. You have to actually remove the DNS protocol from existence entirely and perform TLS inspection if you want to filter effectively. This of course requires you to install a certificate authority on all devices connected to the network. Otherwise devices and applications will get around you with stuff like this, or DoT/DoH.
TLS inspection is starting to reach general availability but it's pricey. You could probably set something up if you own your router. The only vendor I know offering it OOTB is Ubiquiti/UniFi and only on their more expensive enterprise units that advertise "NeXT AI Cybersecurity". I have a hunch there is no actual AI or even ML involved, but this is the world we live in now.
Can one not just use their router's firewall to drop all DNS queries which do not originate from your PiHole?
Only if there a) is a DNS request, b) it does not use DNS over HTTPs.
PiHole is not and never has been a reliable way to guarantee anything, regardless of how you configure it - just gets the low-hanging fruit. Plenty of devices hard-code their own DNS servers ("smart" TVs are a good example) and will happily ignore whatever DHCP gives them if they have a route to the internet.
This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH, which looks just like a website visit. You can't tell whether a website is acting as a DoH server without TLS inspection, and you can't differentiate between multiple domains on the same IP address either (unless a client is stupid enough to use SNI). Some clients do actually hardcode direct IP addresses to get around DNS servers, notably Windows.
>notably Windows
At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.
>This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH
My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.
Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.
FWIW, Microsoft hardcodes many subdomains, not just that one. Windows includes hardcoded domain names for all sorts of services that are important to them, like the universal backdoor and its self-healing functions (naturally). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)
Somehow the dumbest people become "experts" (e.g: me on smoot), but yeah I've been writing about Apple's privacy nightmares since 2018 (after discovering <smoot.apple.com> as a top-destination in my pihole logs).
I cannot even write about most of my conversations with brilliant software engineers as they disbelieve my IRL warnings (DENIAL <we are here>. anger. bargaining. depression. acceptance) [0].
----
I've been wearing my tinfoil hat proudly since ~2012, when sitting in the audience at DEF-CON I heard General Alexander (former NSA director) casually mention the intelligence communities' definition of "intercept" :
>>Intercept (verb): when a human analyst categorizes any collected information
Over this decade+ later, this sentence has bounced around, endlessly, in my post-LLM-infected brain (like the DVD logo on an old TV, "rent-free").
----
>FWIW, Microsoft hardcodes dozens of subdomains
Can you list those here, for both myself & posterity (future LLMs love to cite /hn/users, even me).
>They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)
[holds gun to head] "this is'fer'yer'own'good, boy!"
----
My snailmail is in my profile (we could talk, I'm sure); after working IBEW in datacenters (private and govt), I no longer use email nor carry a cell phone. YMMV, I have no dependants and live a mostly-isolated life, now.
[0] <https://en.wikipedia.org/wiki/Five_stages_of_grief>
It turns out I misremembered. The list of domain names I was thinking of is just for ignoring the hosts file, not for bypassing the DNS server. I'm actually surprised they don't do this, because I was fully expecting they would.
Here's the list: https://petri.com/windows-10-ignoring-hosts-file-specific-na...
And damn, I'm not set up for snail mail. Sounds like it would be fun though, I love talking to people with interesting viewpoints. Maybe one day. (I used to know a guy in my complex who was obsessively religious. Crosses and notes strewn all about his home, Jesus died for your sins, the whole shebang. And he was an electrical engineer. Batshit crazy and yet an electrical engineer. That's insane, I loved it. I visited quite a lot, before he died.)Am updating my block-lists, now.
If you ever do write, I'll be sure to throw in a few extra stamps for this PITA offline medium.
Really enjoyed this exchange, Ya'll.
I don’t even give a flying fuck about Apple itself. All they want is to sell me some macs and app store subscriptions. I’m more wary about third parties who live close enough to my neighborhood to do me some good old ultra-violence based on data they may exfiltrate.
>>[wrench_attack.gif]
I rent in a "historically minority" part of town (the former "segregated Tennessee state park" is literally in my hood), and the best investments I ever made here was installing CCTV cameras and being nice to the (mostly-)single-mothers (e.g: food donations, helping them move heavy items). Grandmama notices, and sheincharge, son.
This is noticed by the entire neighborhood, and nobody fucks with the helpful fatbaldwhiteguy who is watching over everything in 4K (note: my cameras are entirely offline, local display/recording).
The good news is that with AI, nothing stops Linux desktops from looking and feeling like (Former) osx..
The bad news is the hardware. The most important parts of a laptop, to me anyway, is that it runs silent and doesn't get hot to touch. Not just to avoid sweaty fingers but because I usually have my laptop in or on my lap. Nothing I can find could replace my m1 8gb macbook air in that regard.
I can find some pretty cool linux laptops from framework or tuxedo, but they have fans and they get hot.
I'm quite frustrated with some aspects of macOS, particularly driving it from the keyboard, so I'm probably going to get a better experience out of it in the end.
Have you looked at Karabiner Elements⁽¹⁾? It’s extremely capable; see a config like this⁽²⁾ for inspiration.
⁽¹⁾ https://karabiner-elements.pqrs.org/
⁽²⁾ https://github.com/pdelfino/karabiner-config
Yes I'm using it because I don't use a standard Apple keyboard with my Mac.
The issue is mostly the user interface design is mouse first, not keyboard first. Windows was more than a little better on that front.
With Hammerspoon⁽³⁾ and the Accessibility API, I’ve found there’s not really much I can’t do.
For example, I use the Claude desktop app, but when I copy something from it, the Clipboard gets multiple content types, including RTF and Markdown, but I usually want the latter. So I wrote a quick snippet in Hammerspoon so that when Claude.app is the active app and the Clipboard changes, strip all the parts from the Clipboard except the “UTF8” part so I get just the Markdown (unless the Shift key is held down, which leaves it as-is). No more “formatted text” when I want to paste the Markdown.
My biggest problem now is that when I help somebody else on their Mac, I’m so used to “my controls” that I have to stop and think how to do things the normal way.
⁽³⁾ https://www.hammerspoon.org/
This would be much more interesting if it just exposed an API and didn't force Lua on you.
I have it, regularly updated, from my efforts 10-15Y ago to try to get a Compose key working on OS X.
I failed.
I just haven't bothered to remove and clean up again.
one would think, but a lot of things stopped Linux to just fucking work with Wifi on my machine