5 ms·

Some very cursory googling suggests that `smoot.apple.com` is used for Spotlight. My guess is this is actually the "visual look up" feature recently added to iO

Some very cursory googling suggests that `smoot.apple.com` is used for Spotlight. My guess is this is actually the "visual look up" feature recently added to iOS and macOS, where Quick Look and other system apps will perform OCR on images, and will also attempt to recognize animals/plants/landmarks/etc and offer to look them up for you. Taking a look at System Settings, it seems the relevant part of the privacy information for Spotlight is here: > When you use Siri Suggestions, Look Up, Visual Look Up, when you type in Search, Safari search, #images search in Messages, or when you invoke Spotlight, limited information will be sent to Apple to provide up-to-date suggestions. Any information sent to Apple does not identify you, and is associated with a 15-minute random, rotating device-generated identifier. This information may include location, topics of interest (for example, cooking or basketball), your search queries, including visual search queries, contextual information related to your search queries, suggestions you have selected, apps you use, and related device usage data to Apple. This information does not include search results that show files or content on your device. ... > This information is used to process your request and provide more relevant suggestions and search results, and is not linked to your Apple ID, email address, or other data Apple may have from your use of other Apple services. My understanding is that any actual image recognition is done on-device, so the image itself (or any compressed/hashed version of it) is not sent to Apple. At worst, I suppose Apple might receive a list of features identified by the local image recognizer (i.e., "siamese cat", "eiffel tower") I'd be curious if disabling "Siri Suggestions" would disable this. It seems like it should. I think it's reasonable for very privacy-conscious people to be concerned about behavior like this, but it comes off as paranoid when you wildly jump to conclusions without doing even 5 minutes of research.

sneak 4y ago
> I'd be curious if disabling "Siri Suggestions" would disable this. It seems like it should. Siri Suggestions is disabled on the machine in question (and has been, though I just confirmed that it is off) and this still happened. I have manually disabled every Apple network service that I know of (in the OS UI), and have denied all network access (via LS) to a dozen+ OS processes that phone home.
kornhole 4y ago
Even if we trust Apple that this reading of our files is anonymous, we should not be forced to share any photo or other file details with them which they could use for their own purposes. I do not see why this article is flagged other than it can hurt Apple's PR.
- laborcontract 4y ago
  The article is rightfully flagged because it’s BS. The guy found something on little snitch and is suddenly exposing some dark company secret is the story? More like someone has decided to write an article seemingly with zero context or research on how the OS works, past and present. mediaanalysisd has been around since forever, a process most associated with Photos’ facial recognition but later expanded to other things like text and subject recognition. There are non nefarious reasons for mediaanalysisd to connect to the internet, like to update its models, which are run locally. > This information does not include search results that show files or content on your device As parent said, all content scanning is performed on device. The only time photos content and metadata is sent to Apple is when those photos are stored in iCloud Photos. With advanced data protection turned on, they do not have access to any metadata other than a checksum iirc.
  - kornhole 4y ago
    To give Apple the benefit of the doubt that this network connection is only updating the local SW models, is it possible to remove mediaanalysisd if someone does not trust it?
    - oneplane 4y ago
      You can disable it, just like any launchd process (similar to systemd units). The default is to have it automatic, and that default is part of the OS installation (which often means OS updates reset the defaults). To actually manage something that for the general consumer (for which it is targeted), you'd mostly be using MDM profiles. Those can be created, installed and managed for free, using both Apple software and third party software. This can be done using both up-to-date mobileconfig policies or on older operating system releases using MCX profiles (similar, but different and a bit older, more like GPOs). In practise, you might have a better experience doing either of the following: - Don't use the features that depend on this, this essentially makes it moot - Don't use the OS since it is catered towards a market that wants those features and expects them to work consistently on every device (or so Apple assumes), which results in considerable engineering effort being made by Apple to make the feature(s) work instead of not-work; any modification isn't assumed to be a user configuration but rather a defect that needs to be remedied (hence the "use MDM profiles" note). As for just the networking part, Apple lists a bunch of guides for network consumption which is mainly aimed at network administrators. Any outbound firewall in your network can be configured to block the traffic as desired. If it was purely about trust, this would also be the only 'correct' way as an 'untrusted' OS isn't suddenly trusted just because you turned off a daemon. Either you trust it enough to let it roll, or don't trust it and do the policies elsewhere (off-device). But that goes for any hardware/software. Addendum: this is the first page you'll find when you ask a search engine for ports used by macOS: https://support.apple.com/en-us/HT202944 https://support.apple.com/en-us/HT202944 which right at the top contains a link to https://support.apple.com/en-gb/HT210060 https://support.apple.com/en-gb/HT210060 which explicitly has an entry for *.smoot.apple.com. Since your image will need to be analysed to be able to do a lookup it will first have to extract features from it. If it finds something like an address or coordinate or text or anything that it can't resolve locally (i.e. because it is temporal data that couldn't be preloaded), it has to reach out to a service that is kept up to date. Those are the pages that are so easy to find, even Apple's chatbot on the support page redirects you there.
fsckboy 4y ago
> it comes off as paranoid when you wildly jump to conclusions without doing even 5 minutes of research. since your guess--*"this is actually the "visual look up" feature recently added to iOS and macOS, where Quick Look and other system apps will perform OCR on images, and will also attempt to recognize animals/plants/landmarks/etc and offer to look them up for you"--is entirely compatible with scanning the computer for "CP/etc", it seems to me that you are also jumping to conclusions.

sneak 4y ago

> I'd be curious if disabling "Siri Suggestions" would disable this. It seems like it should. Siri Suggestions is disabled on the machine in question (and has been, though I just confirmed that it is off) and this still happened. I have manually disabled every Apple network service that I know of (in the OS UI), and have denied all network access (via LS) to a dozen+ OS processes that phone home.

kornhole 4y ago

Even if we trust Apple that this reading of our files is anonymous, we should not be forced to share any photo or other file details with them which they could use for their own purposes. I do not see why this article is flagged other than it can hurt Apple's PR.

laborcontract 4y ago
The article is rightfully flagged because it’s BS. The guy found something on little snitch and is suddenly exposing some dark company secret is the story? More like someone has decided to write an article seemingly with zero context or research on how the OS works, past and present. mediaanalysisd has been around since forever, a process most associated with Photos’ facial recognition but later expanded to other things like text and subject recognition. There are non nefarious reasons for mediaanalysisd to connect to the internet, like to update its models, which are run locally. > This information does not include search results that show files or content on your device As parent said, all content scanning is performed on device. The only time photos content and metadata is sent to Apple is when those photos are stored in iCloud Photos. With advanced data protection turned on, they do not have access to any metadata other than a checksum iirc.
- kornhole 4y ago
  To give Apple the benefit of the doubt that this network connection is only updating the local SW models, is it possible to remove mediaanalysisd if someone does not trust it?
  - oneplane 4y ago
    You can disable it, just like any launchd process (similar to systemd units). The default is to have it automatic, and that default is part of the OS installation (which often means OS updates reset the defaults). To actually manage something that for the general consumer (for which it is targeted), you'd mostly be using MDM profiles. Those can be created, installed and managed for free, using both Apple software and third party software. This can be done using both up-to-date mobileconfig policies or on older operating system releases using MCX profiles (similar, but different and a bit older, more like GPOs). In practise, you might have a better experience doing either of the following: - Don't use the features that depend on this, this essentially makes it moot - Don't use the OS since it is catered towards a market that wants those features and expects them to work consistently on every device (or so Apple assumes), which results in considerable engineering effort being made by Apple to make the feature(s) work instead of not-work; any modification isn't assumed to be a user configuration but rather a defect that needs to be remedied (hence the "use MDM profiles" note). As for just the networking part, Apple lists a bunch of guides for network consumption which is mainly aimed at network administrators. Any outbound firewall in your network can be configured to block the traffic as desired. If it was purely about trust, this would also be the only 'correct' way as an 'untrusted' OS isn't suddenly trusted just because you turned off a daemon. Either you trust it enough to let it roll, or don't trust it and do the policies elsewhere (off-device). But that goes for any hardware/software. Addendum: this is the first page you'll find when you ask a search engine for ports used by macOS: https://support.apple.com/en-us/HT202944 https://support.apple.com/en-us/HT202944 which right at the top contains a link to https://support.apple.com/en-gb/HT210060 https://support.apple.com/en-gb/HT210060 which explicitly has an entry for *.smoot.apple.com. Since your image will need to be analysed to be able to do a lookup it will first have to extract features from it. If it finds something like an address or coordinate or text or anything that it can't resolve locally (i.e. because it is temporal data that couldn't be preloaded), it has to reach out to a service that is kept up to date. Those are the pages that are so easy to find, even Apple's chatbot on the support page redirects you there.

fsckboy 4y ago

> it comes off as paranoid when you wildly jump to conclusions without doing even 5 minutes of research. since your guess--*"this is actually the "visual look up" feature recently added to iOS and macOS, where Quick Look and other system apps will perform OCR on images, and will also attempt to recognize animals/plants/landmarks/etc and offer to look them up for you"--is entirely compatible with scanning the computer for "CP/etc", it seems to me that you are also jumping to conclusions.