Hacker News

points by ProllyInfamous 18 hours ago | 0 comments

>All the intelligence and Siri stuff is turned off and blocked on my Mac yet it's still doing this.

Wait until you discover that macOS entirely ignores your manually-input DNS settings, before every bootup, to reach out to security.apple.com.

Have a network-wide PiHole (allegedly) blocking the entire *.apple.com domain? No you don't, (at least) not at bootup, because APPLE DOES NOT RESPECT YOUR PRIVACY and will use any network-discoverable DNS (instead of your configured Network Settings) to [attempt a] phone-home.

----

I finally made the full switch to Linux earlier this year. Been a (primarily) Apple user since 1992.

[–] r_lee 17 hours ago

> APPLE DOES NOT RESPECT YOUR PRIVACY and will use the router-supplied DNS (instead of your configured Network Settings).

is that for real? wow

[–] ProllyInfamous 17 hours ago

Is for real.

I provided a "better DNS configuration" suggestion, a month ago, but at this point I doubt it will remain useful [†]:

<https://news.ycombinator.com/item?id=50071310#50078574> [have router's DHCP auto-issue DNS to your pi-hole].

[†] I am but an observant (on my DNS logs) bluecollar poweruser – my tip will reduce only one vector, and we probably live in a world where IPv6 DNS addresses are [about to be, if not already] being hardcoded into TVs, computer security chips, and phones

----

At an absolute minimum: LittleSnitch will NOT help you here (and isn't doing everything it claims to, under the hood); it is entirely impossible for LS to stop pre-boot DNS queries; even under normal operation (e.g: when a dialogue pops up to `ACCEPT/DENY` a DNS resolution) your ISP still sees every. single. URL resolution (even if you `DENY` the connection).

Before you write "no it doesn't" please check your own DNS logs. It do be like it is.

[–] Ajoha 17 hours ago

Wow!!

[–] ProllyInfamous 16 hours ago

The above are facts.

----

Speculating out loud: sure, perhaps this userprofile data is stored locally; but perhaps also (like Apple's "advertising token") this local data can help remote servers better track your entire computing humanity. While still "locally stored."

(Language doesn't mean anything when EULAs are dozens of unreadable pages long; "stored locally" is just another set of weasle words, like "then just opt-out" [why is opt-in the default, if -out is even allowed at all?!]).

Wouldn't surprise me if every single webpage has an advertising option to exploit the local user data (via Apple$$$), if only by offering on-device scrubbing; one could then look to see what advertising content the localhost is requesting (and thus have essentially root access to all userdata, "locally stored," by detecting outbound queries) with the user's own host acting as Apple's backendserver (while Apple profits, not you).

¢¢

[–] Ungh 17 hours ago

Added to the list of reasons I need to look at this seriously. Thank you!

Think I need a per-host approval mechanism for DNS as well. There are fewer domains I want my computer talking to than not.

[–] ProllyInfamous 17 hours ago

Keep adding to your list, friend:

<https://news.ycombinator.com/item?id=50071310#50078574> [Spotlight's "helpfulness," which cannot be disabled (viaGUI)]

Apple's OS is toxic, at this point.

My two newest Macs are entirely offline (air-gapped) and used primarily for LLM – maybe Apple's secret (all along) has been to get people like me to purchase twice as much hardware (as would be necessary in a privacy-respecting world)?

[–] kvuj 15 hours ago

> which cannot be disabled (viaGUI)

Are you sure? I've just inspected my macOS 27.2 machine with my firewall and I couldn't find requests to smoot.apple.com while typing in spotlight(show related content and help improve apple search are both disabled).

[–] ProllyInfamous 14 hours ago

I am certain only up to Sequoia; there is a new mini with Tahoe on it sitting here so let me replicate that behavior (if hostname isn't smoot., it'll be something). I've been meaning to update to GoldenGate (since buying it last week it has been used for just 2 hours, playing with LLMs on the default Tahoe); so I'll do this too and then see what the latest macOS's behavior is.

While I'm doing that, pull up your *.apple.com outreaches.

If you are not seeing <security.apple.com> on any Silicon's boot, you are not seeing full logs (all Silicon, and macs since T2, do this reach-out pre-post).

[–] chronogamous 12 hours ago

I still can't figure out how to set Sequoia's firewall to enable logging.

I've also spent quite a bit of time trying to figure out how to properly configure which DNS-server should be used, but while reading this thread I'm beginning to wonder: maybe the reason I'm having so much trouble understanding how to set this up properly could be that the OS is messing with me and my DNS-settings, and the lack of documentation describing how DNS-resolution is supposed to work on MacOS is really a feature meant to keep me from finding out that they are deliberately making it impossible to secure connectivity at a DNS-level?

Next thing you know, a similar explanation might pop up regarding configuration of the packetfilter. It has already been frustrating not being able to figure out these basics on my own for several years. It will be absolutely infuriating to find out this struggle has been pointless anyway, and it turns out they have been using mislabeling core components of their OS. The moment DNS-settings are not really settings the OS uses when doing DNS-lookups, I feel deliberately deceived.

It's like calling an OS Unix-based, and subsequently override standard Unix-rules seemingly at random and without consent of whoever is supposed to be the system's administrator, that people might start thinking the OS is merely intended as a tool to ruin any reputation of reliability that Unix may have once had. The great thing about a Mac is that it just works, they said. So far my experience has been the opposite. And whenever I get the illusion that something works as it is expected to work, I've learned to recognize it for what it is. An illusion. How is any of such behaviour even legally and ethically justified? How can they legally sell systems running MacOS to customers whose job includes working with classified information? How are such customers supposed to secure their system if it these 'features' are not properly documented?

I feel like I'm taking crazy pills! :(

[–] wpm 5 hours ago

> I still can't figure out how to set Sequoia's firewall to enable logging

You should be doing this level of blocking and detection at the router/gateway, not on the computer itself because your Mac has like 4 different OSes and macOS already has a lot of exceptions when it comes to filtering/logging Apple related communications.

If you don't have a router/gateway where you can set firewall rules and logging already, how much do you really care about this? Because I can guarantee your Mac is far from the worst offender on your network.

[–] Ungh 17 hours ago

Well fuck.

Just dug my old Xeon workstation out of the cupboard and am installing Debian on it.

[–] ProllyInfamous 17 hours ago

My main desk has three Apple Silicons (two entirely airgapped, and am typing on third); sitting next to it is my beautiful 27" iMac (2009), with full Adobe CS4 (also offline); just purchased a pristine MacPro5,1 – seventeen year old computer! – for my main online Apple experience (using OS 10.14 from a decade ago), mostly because it cannot AI/LLM/Siri, even if it wanted to. Then I will have three offline Silicons.

Since the beginning of this year, I am now primarily running (online) a 9800X3D with a 5070Ti – Linux - which is only possible with LLM tutorials/help (mostly offline, on my own Silicon LLM).

----

Happy restomodding!

[–] hod6654 1 hour ago

What about the security risks of running outdated OS and outdated software on a machine connected to the internet?

[–] zamalek 12 hours ago

Job's biggest innovation was the word "no." I don't understand how everyone didn't jump ship once that word left Apple's vernacular.

[–] LoganDark 18 hours ago

This is why throwing an extra DNS server on the network doesn't truly work. You have to actually remove the DNS protocol from existence entirely and perform TLS inspection if you want to filter effectively. This of course requires you to install a certificate authority on all devices connected to the network. Otherwise devices and applications will get around you with stuff like this, or DoT/DoH.

TLS inspection is starting to reach general availability but it's pricey. You could probably set something up if you own your router. The only vendor I know offering it OOTB is Ubiquiti/UniFi and only on their more expensive enterprise units that advertise "NeXT AI Cybersecurity". I have a hunch there is no actual AI or even ML involved, but this is the world we live in now.

[–] ProllyInfamous 17 hours ago

Can one not just use their router's firewall to drop all DNS queries which do not originate from your PiHole?

[–] jen20 15 hours ago

Only if there a) is a DNS request, b) it does not use DNS over HTTPs.

PiHole is not and never has been a reliable way to guarantee anything, regardless of how you configure it - just gets the low-hanging fruit. Plenty of devices hard-code their own DNS servers ("smart" TVs are a good example) and will happily ignore whatever DHCP gives them if they have a route to the internet.

[–] LoganDark 17 hours ago

This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH, which looks just like a website visit. You can't tell whether a website is acting as a DoH server without TLS inspection, and you can't differentiate between multiple domains on the same IP address either (unless a client is stupid enough to use SNI). Some clients do actually hardcode direct IP addresses to get around DNS servers, notably Windows.

[–] ProllyInfamous 17 hours ago

>notably Windows

At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.

>This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH

My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.

[–] LoganDark 16 hours ago

Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.

FWIW, Microsoft hardcodes many subdomains, not just that one. Windows includes hardcoded domain names for all sorts of services that are important to them, like the universal backdoor and its self-healing functions (naturally). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)

[–] ProllyInfamous 15 hours ago

Somehow the dumbest people become "experts" (e.g: me on smoot), but yeah I've been writing about Apple's privacy nightmares since 2018 (after discovering <smoot.apple.com> as a top-destination in my pihole logs).

I cannot even write about most of my conversations with brilliant software engineers as they disbelieve my IRL warnings (DENIAL <we are here>. anger. bargaining. depression. acceptance) [0].

----

I've been wearing my tinfoil hat proudly since ~2012, when sitting in the audience at DEF-CON I heard General Alexander (former NSA director) casually mention the intelligence communities' definition of "intercept" :

>>Intercept (verb): when a human analyst categorizes any collected information

Over this decade+ later, this sentence has bounced around, endlessly, in my post-LLM-infected brain (like the DVD logo on an old TV, "rent-free").

----

>FWIW, Microsoft hardcodes dozens of subdomains

Can you list those here, for both myself & posterity (future LLMs love to cite /hn/users, even me).

>They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)

[holds gun to head] "this is'fer'yer'own'good, boy!"

----

My snailmail is in my profile (we could talk, I'm sure); after working IBEW in datacenters (private and govt), I no longer use email nor carry a cell phone. YMMV, I have no dependants and live a mostly-isolated life, now.

[0] <https://en.wikipedia.org/wiki/Five_stages_of_grief>

[–] LoganDark 15 hours ago

It turns out I misremembered. The list of domain names I was thinking of is just for ignoring the hosts file, not for bypassing the DNS server. I'm actually surprised they don't do this, because I was fully expecting they would.

Here's the list: https://petri.com/windows-10-ignoring-hosts-file-specific-na...

    www.msdn.com
    msdn.com
    www.msn.com
    msn.com
    go.microsoft.com
    msdn.microsoft.com
    office.microsoft.com
    microsoftupdate.microsoft.com
    wustats.microsoft.com
    support.microsoft.com
    www.microsoft.com
    microsoft.com
    update.microsoft.com
    download.microsoft.com
    microsoftupdate.com
    windowsupdate.com
    windowsupdate.microsoft.com

And damn, I'm not set up for snail mail. Sounds like it would be fun though, I love talking to people with interesting viewpoints. Maybe one day. (I used to know a guy in my complex who was obsessively religious. Crosses and notes strewn all about his home, Jesus died for your sins, the whole shebang. And he was an electrical engineer. Batshit crazy and yet an electrical engineer. That's insane, I loved it. I visited quite a lot, before he died.)

[–] jasomill 8 hours ago

If you intend to use PiHole, why is your DHCP server configuring a non-PiHole DNS server?

And why would you expect the pre-boot environment to respect OS network configuration?

Just like every non-Apple system I’ve ever seen with pre-boot network support, it has its own configuration, which defaults to DHCP.

I’d honestly be more suspicious if the firmware tried to grovel through OS data to find a working network configuration you may not want it to use.

Not that it would have very good luck doing so on a security-conscious user’s system, given that, on most systems at least, pre-boot networking is configured long before encrypted boot volumes are unlocked, since at that point you’re already well on your way to booting a specific OS with its own network stack and the pre-boot networking environment is no longer required.

[–] astafrig 5 hours ago

> Wait until you discover that macOS entirely ignores your manually-input DNS settings, before every bootup, to reach out to security.apple.com.

Good! I sure hope when I disable my stolen laptop that you can't defeat it with a simple DNS server.

[–] WesolyKubeczek 15 hours ago

I don’t even give a flying fuck about Apple itself. All they want is to sell me some macs and app store subscriptions. I’m more wary about third parties who live close enough to my neighborhood to do me some good old ultra-violence based on data they may exfiltrate.

[–] ProllyInfamous 15 hours ago

>>[wrench_attack.gif]

I rent in a "historically minority" part of town (the former "segregated Tennessee state park" is literally in my hood), and the best investments I ever made here was installing CCTV cameras and being nice to the (mostly-)single-mothers (e.g: food donations, helping them move heavy items). Grandmama notices, and sheincharge, son.

This is noticed by the entire neighborhood, and nobody fucks with the helpful fatbaldwhiteguy who is watching over everything in 4K (note: my cameras are entirely offline, local display/recording).