3 ms·

Wait until OP discovers smoot.apple.com ... which literally sends every single Spotlight keystroke back to Apple. My simple solution to blocking Apple's bullsh

Wait until OP discovers smoot.apple.com ... which literally sends every single Spotlight keystroke back to Apple. My simple solution to blocking Apple's bullshit is simply to DNS-blackhole *.apple.com ; thanks for the info on icloud-content.com , which I've added to my blacklist. Also consider: health.apple.com ; configuration.apple.com ; icloud.com ; apple.akamaiedge.com ; apple-dns.com ; apple-cloudkit.com ; iphonesubmissions.apple.com ; idiagnostics.apple.com ; configuration.ls.apple.com ; cdn-apple.com ; and MANY MORE! >But then hOW WiLl yOu GeT SoFtWare uPDAtEs? I download them manually from Apple.

eviks 3y ago
Wouldn't it be easier to unblock some sites for updates instead of doing it manually?
zshrc 3y ago
Curious, do you use anything iCloud or Apple services like iMessage then? I imagine this breaks stuff…
- ProllyInfamous 3y ago
  It breaks ALL THE THINGS (no, I do not use these Apple services; SMS and calls only). Pi-hole allows one local DNS to provide different resolutions to each client (e.g. you could have different rules for your iPhone VS computers) — but I do not differentiate against my blacklist responses. On my networks, *.apple.com (&c) resolve immediately into the trashcan.
  - zshrc 3y ago
    So why Apple instead of something like a Pixel with GrapheneOS? Again, curious.
    - sebastiennight 3y ago
      To be fair, you don't really control where the GrapheneOS Pixel sends traffic either. I wish there was a firewall similar to Little Snitch for phones. The only options I've seen where flimsy workarounds using the VPN service to act as a DNS filter, but then, you've got no real VPN.
      - ProllyInfamous 3y ago
        Just FYI, Little Snitch DOES NOT BLOCK DNS QUERIES — it just prevents your Mac from initiating connections to the resolved IP. e.g: if a client using Little Snitch enters new.incriminating.website into their web browser, the computer still initiates a DNS query to AND receives the IP of said URL — it is at THIS POINT that the Little Snitch dialogue pops up and asks "should we allow a connection to this server/IP?" If this nuance is unclear to you, than just know that Little Snitch only prevents your computer from initiating connections to IP addresses, allowing the DNS resolution to happen without any user input. ---- Many people do not believe this until I show them their "blocked" URLs, as noted by a locally-running PiHole [which sees the "blocked" domain names, and resolves an IP... if you don't have PiHole rule blocking the hostname].
        sebastiennight 3y ago
        You are correct. I do, however, use a VPN service whose DNS servers I trust, so that is fine by me.
      - fsflover 3y ago
        > I wish there was a firewall similar to Little Snitch for phones. This reminds me how people on Windows always fight with their own computer (e.g., to disable the telemetry) instead of switching to an OS that respects you. Same here. My phone won't prevent me from installing anything I want (including Little Snitch) and will not attempt to send any data somewhere.
        sebastiennight 3y ago
        What phone can you install Little Snitch (a MacOS app) on?
    - ProllyInfamous 3y ago
      Legacy — my iPhone is circa 2012 [from my pre-PiHole, fanboi days]. When it dies, I plan to get a Lightphone (or perhaps even simpler, a la early 2000's flip phone). I have no lifelong plans for utilizing either Google or MSFT products.
      - SllX 3y ago
        I have no plans to emulate your setup, but mad props to you for putting the phone back into iPhone.
vdaea 3y ago
>Wait until OP discovers smoot.apple.com ... which literally sends every single Spotlight keystroke back to Apple. How else will you search for stuff on the internet without sending your query to the internet?
- ProllyInfamous 3y ago
  Personally, by visiting a search engine / LLM. I'm just-now beginning a nascent journey into running my own local LLM.
  - vdaea 3y ago
    It seems that you are suggesting that iphones should contain a database of every site on the internet so they can run search queries locally, which is a bit weird, not to mention it would make it impossible for spotlight to show recent results such as football scores.
    - ProllyInfamous 3y ago
      My point is, that even "disabling" spotlight outbound searches, keystrokes for local searches shouldn't still be sent into the iCloud [which they still are]. Not everybody uses Spotlight for global search. Disabling this "feature" should actually disable it.
FirmwareBurner 3y ago
>Wait until OP discovers smoot.apple.com ... which literally sends every single Spotlight keystroke back to Apple But what about the hill Apple fans were willing to die on, about Apple being the most privacy focused company? Doesn't this fact go against that PoV?
- tremarley 3y ago
  Marketing can make most people believe anything
  - hulitu 3y ago
    Sometimes you will find very interesting info in the EULA/TOS. At least i found it in Apple's TOS. So the work phone is only used for authentication.
- dmonitor 3y ago
  Spotlight search is a live web search. It displays results as you type.
  - FirmwareBurner 3y ago
    So just like the Windows start menu search that HN says is the devil's anti-feature, but when Apple does it, it's suddenly a great feature? Do you smell that? I smell double standards and hypocrisy.
    - mrguyorama 3y ago
      Spotlight doesn't even give you a big warning in the form of massive sponsored segments that make it clear that This Is A Web Thing Now, like the start menu search does. I had no idea that spotlight was doing this, because I only ever use spotlight to find apps or files on my local machine, and consider the web searching to be an anti-feature. If I use the search bar on my machine, I am consciously choosing not to be searching the web.
Zetobal 3y ago
I can't follow you want to search the internet but not send anything to the internet?
- GrumpySloth 3y ago
  I want to search the local computer, to launch an app, not search the internet.
  - Zetobal 3y ago
    You can deactivate online search...
    - ProllyInfamous 3y ago
      My PiHole "determines... this is NOT the case" [read in MauryP's voice]. So I have all my telemetry and search options "DISABLED," and PiHole still sinks hundreds of *.apple.com requests, daily (mostly to smoot/icloud).
JackGreyhat 3y ago
Would you be willing to share your full list?
- ProllyInfamous 3y ago
  Not in its entirety, but these are some of the more helpful "global" non-default rules I employ on some of my "more restrictive" / "less advertising" / "less tracking" PiHoles DNS resolvers: [BLACKLIST]: (\.|^)google-analytics\.com$ (\.|^)googlesyndication\.com$ (\.|^)googletagservices\.com$ (\.|^)google\.com$ (\.|^)douclick\.net$ (\.|^)doubleclick\.net$ (\.|^)facebook\.com$ (\.|^)fb\.com$ (\.|^)fbcdn\.net$ (\.|^)googleapis\.com$ (\.|^)disqus\.com$ (\.|^)gstatic\.com$ (\.|^)apple-dns\.net$ (\.|^)salesforceliveagent\.com$ (\.|^)salesforce\.com$ (\.|^)force\.com$ (\.|^)apple\.news$ getpocket.com reddit.com [WHITELIST]: youtube-ui.l.google.com maps.googleapis.com maps.gstatic.com streetviewpixels-pa.googleapis.com

eviks 3y ago

Wouldn't it be easier to unblock some sites for updates instead of doing it manually?

zshrc 3y ago

Curious, do you use anything iCloud or Apple services like iMessage then? I imagine this breaks stuff…

ProllyInfamous 3y ago
It breaks ALL THE THINGS (no, I do not use these Apple services; SMS and calls only). Pi-hole allows one local DNS to provide different resolutions to each client (e.g. you could have different rules for your iPhone VS computers) — but I do not differentiate against my blacklist responses. On my networks, *.apple.com (&c) resolve immediately into the trashcan.
- zshrc 3y ago
  So why Apple instead of something like a Pixel with GrapheneOS? Again, curious.
  - sebastiennight 3y ago
    To be fair, you don't really control where the GrapheneOS Pixel sends traffic either. I wish there was a firewall similar to Little Snitch for phones. The only options I've seen where flimsy workarounds using the VPN service to act as a DNS filter, but then, you've got no real VPN.
    - ProllyInfamous 3y ago
      Just FYI, Little Snitch DOES NOT BLOCK DNS QUERIES — it just prevents your Mac from initiating connections to the resolved IP. e.g: if a client using Little Snitch enters new.incriminating.website into their web browser, the computer still initiates a DNS query to AND receives the IP of said URL — it is at THIS POINT that the Little Snitch dialogue pops up and asks "should we allow a connection to this server/IP?" If this nuance is unclear to you, than just know that Little Snitch only prevents your computer from initiating connections to IP addresses, allowing the DNS resolution to happen without any user input. ---- Many people do not believe this until I show them their "blocked" URLs, as noted by a locally-running PiHole [which sees the "blocked" domain names, and resolves an IP... if you don't have PiHole rule blocking the hostname].
      - sebastiennight 3y ago
        You are correct. I do, however, use a VPN service whose DNS servers I trust, so that is fine by me.
    - fsflover 3y ago
      > I wish there was a firewall similar to Little Snitch for phones. This reminds me how people on Windows always fight with their own computer (e.g., to disable the telemetry) instead of switching to an OS that respects you. Same here. My phone won't prevent me from installing anything I want (including Little Snitch) and will not attempt to send any data somewhere.
      - sebastiennight 3y ago
        What phone can you install Little Snitch (a MacOS app) on?
  - ProllyInfamous 3y ago
    Legacy — my iPhone is circa 2012 [from my pre-PiHole, fanboi days]. When it dies, I plan to get a Lightphone (or perhaps even simpler, a la early 2000's flip phone). I have no lifelong plans for utilizing either Google or MSFT products.
    - SllX 3y ago
      I have no plans to emulate your setup, but mad props to you for putting the phone back into iPhone.

vdaea 3y ago

>Wait until OP discovers smoot.apple.com ... which literally sends every single Spotlight keystroke back to Apple. How else will you search for stuff on the internet without sending your query to the internet?

ProllyInfamous 3y ago
Personally, by visiting a search engine / LLM. I'm just-now beginning a nascent journey into running my own local LLM.
- vdaea 3y ago
  It seems that you are suggesting that iphones should contain a database of every site on the internet so they can run search queries locally, which is a bit weird, not to mention it would make it impossible for spotlight to show recent results such as football scores.
  - ProllyInfamous 3y ago
    My point is, that even "disabling" spotlight outbound searches, keystrokes for local searches shouldn't still be sent into the iCloud [which they still are]. Not everybody uses Spotlight for global search. Disabling this "feature" should actually disable it.

FirmwareBurner 3y ago

>Wait until OP discovers smoot.apple.com ... which literally sends every single Spotlight keystroke back to Apple But what about the hill Apple fans were willing to die on, about Apple being the most privacy focused company? Doesn't this fact go against that PoV?

tremarley 3y ago
Marketing can make most people believe anything
- hulitu 3y ago
  Sometimes you will find very interesting info in the EULA/TOS. At least i found it in Apple's TOS. So the work phone is only used for authentication.
dmonitor 3y ago
Spotlight search is a live web search. It displays results as you type.
- FirmwareBurner 3y ago
  So just like the Windows start menu search that HN says is the devil's anti-feature, but when Apple does it, it's suddenly a great feature? Do you smell that? I smell double standards and hypocrisy.
  - mrguyorama 3y ago
    Spotlight doesn't even give you a big warning in the form of massive sponsored segments that make it clear that This Is A Web Thing Now, like the start menu search does. I had no idea that spotlight was doing this, because I only ever use spotlight to find apps or files on my local machine, and consider the web searching to be an anti-feature. If I use the search bar on my machine, I am consciously choosing not to be searching the web.

Zetobal 3y ago

I can't follow you want to search the internet but not send anything to the internet?

GrumpySloth 3y ago
I want to search the local computer, to launch an app, not search the internet.
- Zetobal 3y ago
  You can deactivate online search...
  - ProllyInfamous 3y ago
    My PiHole "determines... this is NOT the case" [read in MauryP's voice]. So I have all my telemetry and search options "DISABLED," and PiHole still sinks hundreds of *.apple.com requests, daily (mostly to smoot/icloud).

JackGreyhat 3y ago

Would you be willing to share your full list?

ProllyInfamous 3y ago
Not in its entirety, but these are some of the more helpful "global" non-default rules I employ on some of my "more restrictive" / "less advertising" / "less tracking" PiHoles DNS resolvers: [BLACKLIST]: (\.|^)google-analytics\.com$ (\.|^)googlesyndication\.com$ (\.|^)googletagservices\.com$ (\.|^)google\.com$ (\.|^)douclick\.net$ (\.|^)doubleclick\.net$ (\.|^)facebook\.com$ (\.|^)fb\.com$ (\.|^)fbcdn\.net$ (\.|^)googleapis\.com$ (\.|^)disqus\.com$ (\.|^)gstatic\.com$ (\.|^)apple-dns\.net$ (\.|^)salesforceliveagent\.com$ (\.|^)salesforce\.com$ (\.|^)force\.com$ (\.|^)apple\.news$ getpocket.com reddit.com [WHITELIST]: youtube-ui.l.google.com maps.googleapis.com maps.gstatic.com streetviewpixels-pa.googleapis.com