4 ms·

You turn on VPN meanwhile your OS, Adobe CC, Office, etc is busy phoning home with all kinds of fingerprintable if not personally identifiable data. Even Firef

You turn on VPN meanwhile your OS, Adobe CC, Office, etc is busy phoning home with all kinds of fingerprintable if not personally identifiable data. Even Firefox phones home with tons of data at launch and exit with telemetry off. Getting real anonymity online is way more complicated than I think most people realize. Then again maybe that’s fine, it depends on your threat model.

d11z 4y ago
I just have been using alternative firewall softwares such as simplewall (Windows) and Little Snitch (Mac). You can configure them such that you are alerted every time any process makes any form of network request, and either temporarily or permanently blacklist/whitelist as well as even have fine-grained control over specific hosts/domains/etc. Really a must have, for me.
- criddell 4y ago
  Do those firewalls block all network activity? Would a DNS lookup trigger an alert? I had an application that was phoning home and after some digging I found that it was doing so through DNS. It would lookup something like $KEY.some.domain.com and the response would decode to the value.
  - d11z 4y ago
    As far as I can tell it’s any and every network lookup or request. Frankly, ever since I started using them (several years ago) I’ve only been feeling more and more that it may be the only way forward. My data isn’t up for grabs for profiteering/aggregating/snooping on, sorry. EDIT: Your comment made me curious so I will do more due diligence and return with an update. EDIT2: So after not that much investigation--mostly just rereading what's shown on their project page (https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall) -- it confirms my belief that this adequately shields me from any and all networks without my knowledge or consent. In my opinion, it's kind of dystopian that The Industry basically operates on the assumption that most people will in fact just not care, but maybe more would care if it was presented as more of a choice than a concession. Like, I don't mind sharing for the purpose of analytics. I read through privacy policies (is this being an adult?) kind of frequently these days, and as much as I hate to say it, Apple is still probably what I consider the poster child for big tech data privacy, they are doing the absolute bare minimum by clearly and plainly disclosing what data is used for what and how, and it allows my mind some rest. EDIT3: Proof shown here https://github.com/henrypp/simplewall/issues/980 https://github.com/henrypp/simplewall/issues/980
    - criddell 4y ago
      Very cool. Thanks for digging in to this.
- user3939382 4y ago
  Little Snitch catches a lot but gives a blank check to large parts of macOS as not to cause weird behavior of the OS. Some of macOS's phone home calls don't use DNS and instead directly use random IP ranges belonging to Apple so that the only way to block them is to blackhole their ranges at the router. Unless you do that per interface, that means now iOS iMessage won't work and bunch of other things break when your phone is on wifi. Really fixing this problem is a complete PITA.
  - d11z 4y ago
    I can't really speak to this because I no longer own or can afford a Mac, I just know it did the trick for me in the past. The reality of our tangled mess that is data privacy issues is really almost grotesque at this point.
  - sneak 4y ago
    You can disable these "blank check" rules; I do. You can't use iMessage if you want privacy from Apple; trying to block phone-home to Apple while still using their hardware-serial-number-linked-services is silly. You have to give up iMessage, FaceTime, Handoff, iCloud, App Store, Apple Music, all of it if you want privacy from Apple (obviously).
- zikduruqe 4y ago
  Lulu is a great alternative also. https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html
autoexec 4y ago
> Even Firefox phones home with tons of data at launch and exit with telemetry off. Firefox drove me nuts with this. This article helped: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... That won't stop the OS or a bunch of other apps from making a bunch of connections, but at least you can beat firefox into submission
sneak 4y ago
Cracked Office works great if you deny 100% of all network connectivity via Little Snitch. Same for cracked Adobe CC. If you don't want to fly the black flag, buy a dongle for Davinci Resolve Studio and download LibreOffice; both also work fine with 100% of all network connectivity denied. You can disable all of the built-in LS rules for macOS services and never make/use an Apple ID (so, no App Store, no iCloud, no FaceTime, no iMessage, no Apple Music, etc) and your mac will still work to launch local apps just like it did in 1999. This is how I use mine. Note well that you must install LS on a fresh boot offline, before you connect the mac to the network, otherwise APNS will phone home from your IP with client certs that are linked to your hardware serial number. I give friends cash to order the new/fast BTO macs to their addresses on their payment cards, then go pick them up from them; you can't usually get the max-spec apple stuff for cash at the store.
- novok 4y ago
  You can actually at some stores get almost maxed out models, they have specific 'ultimate' configurations. Use the inventorywatch app to figure out whatever a store has in stock. Like the 16" M1 Max with 64GB & 4TB SSD is the 'ultimate' retail config for that model for example. https://worthbak.github.io/inventory-checker-app/ https://worthbak.github.io/inventory-checker-app/

d11z 4y ago

I just have been using alternative firewall softwares such as simplewall (Windows) and Little Snitch (Mac). You can configure them such that you are alerted every time any process makes any form of network request, and either temporarily or permanently blacklist/whitelist as well as even have fine-grained control over specific hosts/domains/etc. Really a must have, for me.

criddell 4y ago
Do those firewalls block all network activity? Would a DNS lookup trigger an alert? I had an application that was phoning home and after some digging I found that it was doing so through DNS. It would lookup something like $KEY.some.domain.com and the response would decode to the value.
- d11z 4y ago
  As far as I can tell it’s any and every network lookup or request. Frankly, ever since I started using them (several years ago) I’ve only been feeling more and more that it may be the only way forward. My data isn’t up for grabs for profiteering/aggregating/snooping on, sorry. EDIT: Your comment made me curious so I will do more due diligence and return with an update. EDIT2: So after not that much investigation--mostly just rereading what's shown on their project page (https://github.com/henrypp/simplewall https://github.com/henrypp/simplewall) -- it confirms my belief that this adequately shields me from any and all networks without my knowledge or consent. In my opinion, it's kind of dystopian that The Industry basically operates on the assumption that most people will in fact just not care, but maybe more would care if it was presented as more of a choice than a concession. Like, I don't mind sharing for the purpose of analytics. I read through privacy policies (is this being an adult?) kind of frequently these days, and as much as I hate to say it, Apple is still probably what I consider the poster child for big tech data privacy, they are doing the absolute bare minimum by clearly and plainly disclosing what data is used for what and how, and it allows my mind some rest. EDIT3: Proof shown here https://github.com/henrypp/simplewall/issues/980 https://github.com/henrypp/simplewall/issues/980
  - criddell 4y ago
    Very cool. Thanks for digging in to this.
user3939382 4y ago
Little Snitch catches a lot but gives a blank check to large parts of macOS as not to cause weird behavior of the OS. Some of macOS's phone home calls don't use DNS and instead directly use random IP ranges belonging to Apple so that the only way to block them is to blackhole their ranges at the router. Unless you do that per interface, that means now iOS iMessage won't work and bunch of other things break when your phone is on wifi. Really fixing this problem is a complete PITA.
- d11z 4y ago
  I can't really speak to this because I no longer own or can afford a Mac, I just know it did the trick for me in the past. The reality of our tangled mess that is data privacy issues is really almost grotesque at this point.
- sneak 4y ago
  You can disable these "blank check" rules; I do. You can't use iMessage if you want privacy from Apple; trying to block phone-home to Apple while still using their hardware-serial-number-linked-services is silly. You have to give up iMessage, FaceTime, Handoff, iCloud, App Store, Apple Music, all of it if you want privacy from Apple (obviously).
zikduruqe 4y ago
Lulu is a great alternative also. https://objective-see.org/products/lulu.html https://objective-see.org/products/lulu.html

autoexec 4y ago

> Even Firefox phones home with tons of data at launch and exit with telemetry off. Firefox drove me nuts with this. This article helped: https://support.mozilla.org/en-US/kb/how-stop-firefox-making-automatic-connections https://support.mozilla.org/en-US/kb/how-stop-firefox-making... That won't stop the OS or a bunch of other apps from making a bunch of connections, but at least you can beat firefox into submission

sneak 4y ago

Cracked Office works great if you deny 100% of all network connectivity via Little Snitch. Same for cracked Adobe CC. If you don't want to fly the black flag, buy a dongle for Davinci Resolve Studio and download LibreOffice; both also work fine with 100% of all network connectivity denied. You can disable all of the built-in LS rules for macOS services and never make/use an Apple ID (so, no App Store, no iCloud, no FaceTime, no iMessage, no Apple Music, etc) and your mac will still work to launch local apps just like it did in 1999. This is how I use mine. Note well that you must install LS on a fresh boot offline, before you connect the mac to the network, otherwise APNS will phone home from your IP with client certs that are linked to your hardware serial number. I give friends cash to order the new/fast BTO macs to their addresses on their payment cards, then go pick them up from them; you can't usually get the max-spec apple stuff for cash at the store.

novok 4y ago
You can actually at some stores get almost maxed out models, they have specific 'ultimate' configurations. Use the inventorywatch app to figure out whatever a store has in stock. Like the 16" M1 Max with 64GB & 4TB SSD is the 'ultimate' retail config for that model for example. https://worthbak.github.io/inventory-checker-app/ https://worthbak.github.io/inventory-checker-app/