3 ms·

Last I looked Apple updates are delivered over HTTP using a CDN. The packages are signed and secured in alternate ways, but the goal was to make it easy to allo

Last I looked Apple updates are delivered over HTTP using a CDN. The packages are signed and secured in alternate ways, but the goal was to make it easy to allow entities to proxy those connections (and or use DNS to replace the IP's) so they could keep a cache of packages on their local network rather than having to go upstream for them. This worked really well when I did some work at a uni and we wanted to avoid the onslaught of Apple devices all downloading updates at the same time from overwhelming our network.

Avamander 4y ago
A method like that should kinda never end up causing a denial of service. I also didn't drop any local port 80 traffic, which also makes that theory a bit less likely.
- jcrawfordor 4y ago
  Sticking to HTTP enables transparent caching. So it's not that MacOS/iOS try to connect to anything on the local network, they just connect directly to Apple via HTTP which allows the local network to hijack the connection and serve a locally cached copy instead. This kind of thing is more common than you might think on corporate and institutional networks because it can produce appreciable savings in bandwidth to the internet. Squid is a very common open-source solution for transparent forward proxy, but there are commercial products that are more common. This kind of "friendly MITM" is sort of the baby that goes out with the bathwater on mandatory HTTPS, although I am personally of the opinion that it's not a big enough deal to block mandatory HTTPS---but there is debate there.
- ArchOversight 4y ago
  During installation HomePod's reach out to validate they are running the latest version as required by the iOS device you are setting them up with, and they do all kinds of connectivity checks cause they don't work on captive portal networks either. I am betting one of those checks fails because its on a network that blocks port 80.

Avamander 4y ago

A method like that should kinda never end up causing a denial of service. I also didn't drop any local port 80 traffic, which also makes that theory a bit less likely.

jcrawfordor 4y ago
Sticking to HTTP enables transparent caching. So it's not that MacOS/iOS try to connect to anything on the local network, they just connect directly to Apple via HTTP which allows the local network to hijack the connection and serve a locally cached copy instead. This kind of thing is more common than you might think on corporate and institutional networks because it can produce appreciable savings in bandwidth to the internet. Squid is a very common open-source solution for transparent forward proxy, but there are commercial products that are more common. This kind of "friendly MITM" is sort of the baby that goes out with the bathwater on mandatory HTTPS, although I am personally of the opinion that it's not a big enough deal to block mandatory HTTPS---but there is debate there.
ArchOversight 4y ago
During installation HomePod's reach out to validate they are running the latest version as required by the iOS device you are setting them up with, and they do all kinds of connectivity checks cause they don't work on captive portal networks either. I am betting one of those checks fails because its on a network that blocks port 80.