6 ms·

So basically in that list you’re suggesting disabling the ability to download web content, syncing of address books, getting updated security signatures, connec

So basically in that list you’re suggesting disabling the ability to download web content, syncing of address books, getting updated security signatures, connecting to iCloud, downloading dynamic assets that many apps use to reduce initial size and provide non-binary updates, Siri keyword suggestions in Safari, Airdrop, Maps integration, push notifications for Messages, etc. Most Apple users will definitively want those on, and will break your system in subtle ways if you disable them. I wouldn’t make such assumptions about whatever you use the service or not. If you don’t use a service, it typically will have very little traffic if any at all.

mschuster91 5y ago
> Most Apple users will definitively want those on, and will break your system in subtle ways if you disable them. What happened to the good old days of "ask for user consent before phoning home"? I mean, Apple is miles ahead of Windows in that regard, but your average Linux or BSD setup won't phone home outside of repository downloads unless requested.
- boringg 5y ago
  I think you have your target demographics mixed up for MacOS and Linux. Once you reframe it in that light, you've answered your question. One is a poweruser who wants complete control of their environment, the other is a much broader user who wants a convenience of experience and safe environment. Trade offs to both of them. The only happy medium I would consider to your approach is that if MacOS had two set up routes, one defaulting as a power user turning everything off and then initiating things are you want and another as a general user. Maybe that would solve it (though would be a heavy lift I am sure).
- nouveaux 5y ago
  This is the Little Snitch[0] problem. If you have ever used Little Snitch, you will soon realize that 1) there is so much crap phoning home and 2) most people do not want to deal with giving permission to each and every one of these services. I have tried giving permission and at the end of the day, it's just not worth the time. For me, Little Snitch is great as a reporting tool but it's just too much work as a firewall. [0]https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
  - gcanyon 5y ago
    > most people do not want to deal with giving permission to each and every one of these services. It’s far worse than just annoying: if people have to give permission to a bunch of things they don’t understand, they will absolutely give permission to something they shouldn’t. You want the user to make a few decisions as possible, and every single one should be an actual decision: where the user knows what the options are, has an actual stake, and might legitimately choose either option depending on their preferences and circumstance. The more times they have to click “yes” without thinking, the more susceptible to malware they become.
    - least 5y ago
      I think this is a bit of an odd take, given that the alternative is that the computer just silently allows you to download content from anywhere. I don't think this makes someone any more susceptible to malware than they already were. Little Snitch is the sort of software that the average person wouldn't install, anyway. I understand the point, though. Going to just about any major website you will be pummeled with prompts to allow for a dozen different domains just to view one page, and it doesn't really give any indication of what those are used for. They have a what seems to be infinitesimally small list of connections that they do recognize and explain their use, but ultimately it's pretty useless for the vast majority of prompts. I'd like there to be a better way to deal with this, but I'm not really sure what the solution to it would look like. You can download blocklists and just silently allow other connections, but I don't think that's significantly better than just using a hosts file. The most useful thing Little Snitch does is alert me when individual applications try to phone home. For browsing the web it feels more like a chore.
      - gcanyon 5y ago
        > the computer just silently allows you to download content from anywhere How many times have you been asked to approve a download? How many of those times have you said "no"? If the answer is "hundreds" and "zero," what's the point? If the answer "hundreds" and "ten just in the past week," then that's exactly the point, and it serves a valuable purpose.
- josephg 5y ago
  Yep. I have a system tray CPU monitor running on both my Linux mint and mac computers. On mint when I don’t touch the computer it just sits at 0% basically all the time. On macos there’s always some junk flitting around doing who knows what. photoanalysisd, or sending telemetry for 3rd party apps, or iCloud syncing or something. It’s like the 2 E cores are there just to run apple’s bloaty crap. Shame those processes don’t limit themselves to E cores. Is there any way to turn all this stuff off?
aunty_helen 5y ago
>If you don’t use a service, it typically will have very little traffic if any at all. Like I said this was all from the last 3 hours and I haven't used any of those services listed. It's also missing the point a bit, I'm not bandwidth poor on a 3G connection trying to save my datacap. I don't want apple turning my laptop into a thinclient for their cloud systems. I don't want telemetry and meta data going to them every ~30 seconds (the little snitch icon flashes a red X every time something is blocked, it's on a per minute basis). Of all those services I use calendarsync. I miss having airdrop a little bit but everything else I don't need. Also, the way you've phrased some of those, especially the notarisation > getting updated security signatures is a bit disingenuous when there's a massive privacy implication in that it allows apple to know every single application I run on my computer. Most Apple users wouldn't agree to that if you stuck it in their face and the fact that it breaks the OS in subtle ways is a user hostile position to argue from. Hence why I'm giving up my Apple addicition.
sneak 5y ago
> getting updated security signatures AKA phoning-home to Apple what apps you launch in realtime, in an unencrypted manner visible to your ISP/hotel/government too. It also connects to all of that crap even if you have LS off, analytics off, iCloud/FaceTime/iMessage/AppStore off, et c. Press F8 and your serial number gets transmitted to Apple.
- azinman2 5y ago
  I guarantee you there are no unencrypted communications going to Apple.
  - aunty_helen 5y ago
    Hostname: ocsp.apple.com IP Addresses: 2600:1402:e::b833:965b 2600:1402:e::b833:9661 2600:1402:e::b833:9669 2600:1402:e::b833:966a + 17 more TCP Port: http (80) Protocol: TCP Connected: no Connects: 0 allowed, 7,359 denied First Activity: 2/11/21, 22:20 Last Activity: 5h 29m ago Yea sorry, sneak's right, it's still going port 80.
    - azinman2 5y ago
      Perhaps I'm wrong. I thought encrypted checks came out with Monterey? https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 (bottom) What data is actually going over OCSP? I thought it was only ever checking for revocation and not actually sending app data, and I believe only ever happens when you want to take an app out of quarantine versus every app launch. You can always disable gatekeeper if you so please.
      - sneak 5y ago
        It does check for revocation. Using the developer's unique certificate ID, which, for the vast majority of developers, uniquely identifies an app. Over unencrypted HTTP. OCSP over unencrypted http has not yet been replaced. I believe that the constellation of apps (identified by proxy by their developer IDs which are transmitted) can in a lot of cases uniquely identify a system, given a sufficient number of apps installed/used.

mschuster91 5y ago

> Most Apple users will definitively want those on, and will break your system in subtle ways if you disable them. What happened to the good old days of "ask for user consent before phoning home"? I mean, Apple is miles ahead of Windows in that regard, but your average Linux or BSD setup won't phone home outside of repository downloads unless requested.

boringg 5y ago
I think you have your target demographics mixed up for MacOS and Linux. Once you reframe it in that light, you've answered your question. One is a poweruser who wants complete control of their environment, the other is a much broader user who wants a convenience of experience and safe environment. Trade offs to both of them. The only happy medium I would consider to your approach is that if MacOS had two set up routes, one defaulting as a power user turning everything off and then initiating things are you want and another as a general user. Maybe that would solve it (though would be a heavy lift I am sure).
nouveaux 5y ago
This is the Little Snitch[0] problem. If you have ever used Little Snitch, you will soon realize that 1) there is so much crap phoning home and 2) most people do not want to deal with giving permission to each and every one of these services. I have tried giving permission and at the end of the day, it's just not worth the time. For me, Little Snitch is great as a reporting tool but it's just too much work as a firewall. [0]https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
- gcanyon 5y ago
  > most people do not want to deal with giving permission to each and every one of these services. It’s far worse than just annoying: if people have to give permission to a bunch of things they don’t understand, they will absolutely give permission to something they shouldn’t. You want the user to make a few decisions as possible, and every single one should be an actual decision: where the user knows what the options are, has an actual stake, and might legitimately choose either option depending on their preferences and circumstance. The more times they have to click “yes” without thinking, the more susceptible to malware they become.
  - least 5y ago
    I think this is a bit of an odd take, given that the alternative is that the computer just silently allows you to download content from anywhere. I don't think this makes someone any more susceptible to malware than they already were. Little Snitch is the sort of software that the average person wouldn't install, anyway. I understand the point, though. Going to just about any major website you will be pummeled with prompts to allow for a dozen different domains just to view one page, and it doesn't really give any indication of what those are used for. They have a what seems to be infinitesimally small list of connections that they do recognize and explain their use, but ultimately it's pretty useless for the vast majority of prompts. I'd like there to be a better way to deal with this, but I'm not really sure what the solution to it would look like. You can download blocklists and just silently allow other connections, but I don't think that's significantly better than just using a hosts file. The most useful thing Little Snitch does is alert me when individual applications try to phone home. For browsing the web it feels more like a chore.
    - gcanyon 5y ago
      > the computer just silently allows you to download content from anywhere How many times have you been asked to approve a download? How many of those times have you said "no"? If the answer is "hundreds" and "zero," what's the point? If the answer "hundreds" and "ten just in the past week," then that's exactly the point, and it serves a valuable purpose.
josephg 5y ago
Yep. I have a system tray CPU monitor running on both my Linux mint and mac computers. On mint when I don’t touch the computer it just sits at 0% basically all the time. On macos there’s always some junk flitting around doing who knows what. photoanalysisd, or sending telemetry for 3rd party apps, or iCloud syncing or something. It’s like the 2 E cores are there just to run apple’s bloaty crap. Shame those processes don’t limit themselves to E cores. Is there any way to turn all this stuff off?

aunty_helen 5y ago

>If you don’t use a service, it typically will have very little traffic if any at all. Like I said this was all from the last 3 hours and I haven't used any of those services listed. It's also missing the point a bit, I'm not bandwidth poor on a 3G connection trying to save my datacap. I don't want apple turning my laptop into a thinclient for their cloud systems. I don't want telemetry and meta data going to them every ~30 seconds (the little snitch icon flashes a red X every time something is blocked, it's on a per minute basis). Of all those services I use calendarsync. I miss having airdrop a little bit but everything else I don't need. Also, the way you've phrased some of those, especially the notarisation > getting updated security signatures is a bit disingenuous when there's a massive privacy implication in that it allows apple to know every single application I run on my computer. Most Apple users wouldn't agree to that if you stuck it in their face and the fact that it breaks the OS in subtle ways is a user hostile position to argue from. Hence why I'm giving up my Apple addicition.

sneak 5y ago

> getting updated security signatures AKA phoning-home to Apple what apps you launch in realtime, in an unencrypted manner visible to your ISP/hotel/government too. It also connects to all of that crap even if you have LS off, analytics off, iCloud/FaceTime/iMessage/AppStore off, et c. Press F8 and your serial number gets transmitted to Apple.

azinman2 5y ago
I guarantee you there are no unencrypted communications going to Apple.
- aunty_helen 5y ago
  Hostname: ocsp.apple.com IP Addresses: 2600:1402:e::b833:965b 2600:1402:e::b833:9661 2600:1402:e::b833:9669 2600:1402:e::b833:966a + 17 more TCP Port: http (80) Protocol: TCP Connected: no Connects: 0 allowed, 7,359 denied First Activity: 2/11/21, 22:20 Last Activity: 5h 29m ago Yea sorry, sneak's right, it's still going port 80.
  - azinman2 5y ago
    Perhaps I'm wrong. I thought encrypted checks came out with Monterey? https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491 (bottom) What data is actually going over OCSP? I thought it was only ever checking for revocation and not actually sending app data, and I believe only ever happens when you want to take an app out of quarantine versus every app launch. You can always disable gatekeeper if you so please.
    - sneak 5y ago
      It does check for revocation. Using the developer's unique certificate ID, which, for the vast majority of developers, uniquely identifies an app. Over unencrypted HTTP. OCSP over unencrypted http has not yet been replaced. I believe that the constellation of apps (identified by proxy by their developer IDs which are transmitted) can in a lot of cases uniquely identify a system, given a sufficient number of apps installed/used.