5 ms·

> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy pers

> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective. Yes, and no. If you're using software that the state deems to be subversive or "dangerous", a developer certificate would make the nature of the software you are running pretty clear. They don't have to know exactly which program you're running, but just enough information to put you on a list. > You shouldn’t probably block ocsp.apple.com with Little Snitch or in your hosts file. I never asked them to do that in the first place, so I'll be blocking it from now on.

josephcsible 6y ago
> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816
- api 6y ago
  The hosts file works for now. Use 127.0.0.1 and ::1 on two separate lines. Used tcpdump to verify.
- ravenstine 6y ago
  Isn't that just with Big Sur? Also, I'm using the hosts file method.
  - anamexis 6y ago
    The OP is about Big Sur.
  - claudeganon 6y ago
    I don’t think it’s actually just in Big Sur. At the bottom of this post describing how to stop them from hiding traffic, they mention someone did a test on Catalina and ran into an issue with the Messages app: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....
  - mkskm 6y ago
    Apple deprecated kernel extensions like Little Snitch in Catalina, so if I had to guess it probably applies there as well.
- cute_boi 6y ago
  if they keep doing like this I will block their entire ASN .
  - iso947 6y ago
    Until they front it via cloudflare or aws. I got hit by AWS blocking when setting up a network in Russia for the 2018 World Cup - my unifi controller was on an ec2 instance that was blocked due to telegram shenanigans. Worked around the problem but shows that blocking an AS can lead towards an unusable computer.
  - WesolyKubeczek 6y ago
    They already are fronting much of their stuff via Akamai, so good luck doing that...
  - sneak 6y ago
    Apple is old enough that you need only block 17./8: they have a class A(!).
  - amelius 6y ago
    Or stop buying stuff that is broken-by-design in the first place.
  - fsflover 6y ago
    Do you think you are going to win the war against "your own" hardware?
- m463 6y ago
  It's worth noting that on ios you can never block anything - just have to put up with it.
  - sesuximo 6y ago
    ... and that apple wants to merge its operating systems
    - the_other 6y ago
      No they don’t. They keep adding new ones. They want to provide a consistent user experience across their ecosystem. Not the same thing.
      - andai 6y ago
        Unfortunately the consistency is moving in the direction of iOS rather than macOS.
  - delvinj 6y ago
    You can still block access by host by using an HTTP proxy like Fiddler or Charles. Settings > WIFI > Proxy
    - m463 6y ago
      I use adblockios and haven't upgraded because they unblocked the blocking. I keep hearing about charles, I wonder if it is special or if it doesn't really block everything.
- IfOnlyYouKnew 6y ago
  You also didn't ask them to put a clock in the top right corner. I hope that gets the same level of righteous exasperation. (Just discovered MacOS includes at least two fonts and a printer driver I never asked for. How dare they?)
  - saagarjha 6y ago
    The clock is where Notification Center lives, so you can’t get rid of it. (Of course that makes sense.)
  - deleted 6y ago
    [deleted]
- catlifeonmars 6y ago
  You could block still block it externally by running a dns sinkhole (a la PiHole) on the same network, provided that you can still configure the DNS resolver.
  - mkskm 6y ago
    That assumes the hostname will stay the same and not get overloaded by other essential services.
    - catlifeonmars 6y ago
      Yep. That seems to be within the realm of possibility though, no?
- LdSGSgvupDV 6y ago
  Maybe downgrade the macos would work. As I'm in old version of os, Little Snitch works quite well.
mkskm 6y ago
Privacy concerns aren’t the only reason to block it. It also makes software way more responsive. I was experiencing daily freezes that would disconnect my keyboard and mouse (particularly when waking the computer or connecting to an external display) on my 2020 MacBook Air before adding the entry to my hosts file which fixed the issue entirely. It was so pronounced and irreparable by Apple support technicians that I nearly ended up getting rid of the computer.
Bondi_Blue 6y ago
Besides blocking from the hosts file, you can try: sudo defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None sudo defaults write com.apple.security.revocation.plist OCSPStyle None

josephcsible 6y ago

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816

api 6y ago
The hosts file works for now. Use 127.0.0.1 and ::1 on two separate lines. Used tcpdump to verify.
ravenstine 6y ago
Isn't that just with Big Sur? Also, I'm using the hosts file method.
- anamexis 6y ago
  The OP is about Big Sur.
- claudeganon 6y ago
  I don’t think it’s actually just in Big Sur. At the bottom of this post describing how to stop them from hiding traffic, they mention someone did a test on Catalina and ran into an issue with the Messages app: https://tinyapps.org/blog/202010210700_whose_computer_is_it.html https://tinyapps.org/blog/202010210700_whose_computer_is_it....
- mkskm 6y ago
  Apple deprecated kernel extensions like Little Snitch in Catalina, so if I had to guess it probably applies there as well.
cute_boi 6y ago
if they keep doing like this I will block their entire ASN .
- iso947 6y ago
  Until they front it via cloudflare or aws. I got hit by AWS blocking when setting up a network in Russia for the 2018 World Cup - my unifi controller was on an ec2 instance that was blocked due to telegram shenanigans. Worked around the problem but shows that blocking an AS can lead towards an unusable computer.
- WesolyKubeczek 6y ago
  They already are fronting much of their stuff via Akamai, so good luck doing that...
- sneak 6y ago
  Apple is old enough that you need only block 17./8: they have a class A(!).
- amelius 6y ago
  Or stop buying stuff that is broken-by-design in the first place.
- fsflover 6y ago
  Do you think you are going to win the war against "your own" hardware?
m463 6y ago
It's worth noting that on ios you can never block anything - just have to put up with it.
- sesuximo 6y ago
  ... and that apple wants to merge its operating systems
  - the_other 6y ago
    No they don’t. They keep adding new ones. They want to provide a consistent user experience across their ecosystem. Not the same thing.
    - andai 6y ago
      Unfortunately the consistency is moving in the direction of iOS rather than macOS.
- delvinj 6y ago
  You can still block access by host by using an HTTP proxy like Fiddler or Charles. Settings > WIFI > Proxy
  - m463 6y ago
    I use adblockios and haven't upgraded because they unblocked the blocking. I keep hearing about charles, I wonder if it is special or if it doesn't really block everything.
IfOnlyYouKnew 6y ago
You also didn't ask them to put a clock in the top right corner. I hope that gets the same level of righteous exasperation. (Just discovered MacOS includes at least two fonts and a printer driver I never asked for. How dare they?)
- saagarjha 6y ago
  The clock is where Notification Center lives, so you can’t get rid of it. (Of course that makes sense.)
- deleted 6y ago
  [deleted]
catlifeonmars 6y ago
You could block still block it externally by running a dns sinkhole (a la PiHole) on the same network, provided that you can still configure the DNS resolver.
- mkskm 6y ago
  That assumes the hostname will stay the same and not get overloaded by other essential services.
  - catlifeonmars 6y ago
    Yep. That seems to be within the realm of possibility though, no?
LdSGSgvupDV 6y ago
Maybe downgrade the macos would work. As I'm in old version of os, Little Snitch works quite well.

mkskm 6y ago

Privacy concerns aren’t the only reason to block it. It also makes software way more responsive. I was experiencing daily freezes that would disconnect my keyboard and mouse (particularly when waking the computer or connecting to an external display) on my 2020 MacBook Air before adding the entry to my hosts file which fixed the issue entirely. It was so pronounced and irreparable by Apple support technicians that I nearly ended up getting rid of the computer.

Bondi_Blue 6y ago

Besides blocking from the hosts file, you can try: sudo defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None sudo defaults write com.apple.security.revocation.plist OCSPStyle None