7 ms·

My Mac contacted 63 different Apple owned domains in an hour, while not is use

167 points by rpgbr 1y ago

thomassmith65 1y ago
With Apple, you want to block *.apple.com and white-list subdomains as you need them. If instead you black-list apple subdomains, the battle will never end.
- fortran77 1y ago
  Why use Apple at all if it’s so user-hostile? (I’m a Windows user.)
  - plutoh28 1y ago
    If I recall correctly, Windows isn’t very user-friendly either.
    - like_any_other 1y ago
      Humor.
      - uncircle 1y ago
        It cannot be humor as it doesn't have, at the end of the comment, the tag /s
        erikerikson 1y ago
        Thank you for ending yours with /s
  - greenavocado 1y ago
    Windows telemetry is way more insane Small sample of telemetry and spying domains (out of date): https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke... https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/extra.txt https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke... https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/update.txt https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke... https://raw.githubusercontent.com/Strappazzon/teleme7ry/master/src/rules.txt https://raw.githubusercontent.com/Strappazzon/teleme7ry/mast...
    - zeeZ 1y ago
      That "small sample of telemetry and spying domains" also contains login pages and update downloads, among others. You're just saying everything Microsoft is telemetry and spying, here are all their domains.
      - st3fan 1y ago
        Same with all those Apple domains. This is the world we live in now. Operating systems and most applications are now backed by cloud services.
    - potato-peeler 1y ago
      How does one verify all those domains are not essential to the OS?
      - ImJamal 1y ago
        Microsoft explains what all (most?) of the domains are for https://learn.microsoft.com/en-us/windows/privacy/windows-11-endpoints-non-enterprise-editions https://learn.microsoft.com/en-us/windows/privacy/windows-11...
        potato-peeler 1y ago
        Thanks. I think some apps do need to connect to Microsoft to deliver services like update and antivirus. Some are used by the products itself to maintain reliability like maps and store. Others are diagnostics, which can still be manually turned off. Not sure why one would maintain a dedicated hosts file to block endpoints if they can simply configure this on app level itself.
  - lipowitz 1y ago
    How do you get all the bloatware off and de-metric your Windows? With Apple it is one criminal instead of an oligarchy of crime.
    - MegaDeKay 1y ago
      Installing LTSC takes you a long way towards that goal.
  - bmacho 1y ago
    Probably in exchange of some privacy it gives its users time/money?
  - cynicalsecurity 1y ago
    Why use Apple or Windows at all if they are so user-hostile? (I’m a Linux user.)
    - jitl 1y ago
      (Bluetooth) audio never works consistently for me on Linux, especially after wake from sleep I have like a 10% chance to get crackling/stuttering
    - deleted 1y ago
      [deleted]
  - onedognight 1y ago
    1) The ads in my start menu all come from one domain. 2) One is less than 63. 3) Profit?
  - SimianSci 1y ago
    Anybody who has done similar checks for windows will see an order of magnitude more connections being made. As someone who got their start managing windows devices, and who has gone through the painful steps of mapping out what each such connection is meant for, I was suprised to see that there was ONLY 63 connections being made in an hour for this article. The last time I mapped such connections for a windows device, we had measured about 200+ similar connections within a single hour.
    - MegaDeKay 1y ago
      To be fair, "about 200+" is far from "an order of magnitude" of 63.
  - exe34 1y ago
    Their hardware is quite nice - I have a mac book air from mid-2012 myself. (Although I moved to Nixos linux in 2016).
  - LorenDB 1y ago
    Why use Windows at all since it's more user-hostile in terms of overt advertising and telemetry-gathering? (I'm a Linux user.) (slight /s here but I'm also serious)
  - deleted 1y ago
    [deleted]
deleted 1y ago
[deleted]
footlose_3815 1y ago
I'm curious what Microsoft and Ubuntu's experience is as well, so there's a frame of reference. I skimmed that list, and Devil's Advocate; It seems like most of that is functional, stuff that they want to update in the background to make sure you have a better experience when you're back? On the flip, I guess we think Apple is up to something shady? My last understanding was that they were firm they didn't sell user data. Did this change?
- sybercecurity 1y ago
  My initial thought as well. May be overly chatty, but there may be a good intention behind it like "system seems to be idle for a while, now would be a good time to check for updates" I'd wager Windows does something similar. Linux distros may do it, but also may not since they may not be obsessed with happy eyeball problems and user perception of speed/latency.
- roblabla 1y ago
  A default linux install is incredibly silent on the network. You might be seeing some mDNS stuff, gnome/firefox may do some requests to detect captive portals, but overall the amount of network traffic is pretty small and manageable. It's important to note that, generally speaking, Linux software does not come with default-enabled telemetry, and for those that do, distros like Debian will routinely patch out phoning home and telemetry from the software they package.
  - st3fan 1y ago
    That is only because there is barely any open source software for Linux that is backed by cloud services. Now install Spotify, VSCode, Steam for Linux and you will see the same kind of chatter with backend services.
    - SkyeCA 1y ago
      > That is only because there is barely any open source software for Linux that is backed by cloud services. Some of us would call this a feature. I am quite happy to have control over my computer and the data on it without having to trust third party cloud services.
npteljes 1y ago
Honestly, the list looks legit. Computers nowadays are semi-remotely-managed appliances. Internet is presumed, offline is not first, and offline is absolutely not exclusive. >I have been trying to minimize to the extent possible the reach of big tech into my life. I don't think this goal is possible, or worthwhile, on a big tech offering like a Mac + macOS. It can certainly be tried, but the user needs to be prepared for unforeseen consequences, and the override of the settings. It is like plugging in the ears to have a quieter life, in the middle of a metropolis. In the end, the context won't change. The direction of the platforms are clear, and the zeitgeist is bigger than all of us. The first option with a real impact is leaving the ecosystem. Although, blocking some domains could be a good first step towards that. Rome wasn't built in a day.
- deleted 1y ago
  [deleted]
- TheNewsIsHere 1y ago
  As a counterpoint - There are a lot of Apple services that get contacted because they can be contacted, not because they need to be. For example, I don’t use Home/HomeKit but it phones home to Apple several times a day if I allow it. The same with Apple News, Weather, etc. You can prevent this in various ways but not out of box. It’s possible to run macOS without an Internet connection. I value this, but it’s impractical and unnecessary for most people and most environments.
  - npteljes 1y ago
    What's the value for you of disabling these connections, like the Home/HomeKit contact?
simondotau 1y ago
The way I see it is either you trust Apple or you don’t. To be clear, I think it’s perfectly reasonable to arrive at either conclusion, as it relates to your own needs and security posture. Personally I choose to trust them. My trust is not blind, and they could lose my trust very quickly. But as it stands right now, they have my trust. If you say that you don’t trust Apple, I don’t see how you could tolerate running any of their software. Relying on an operating system made by a company I don’t trust seems wildly irresponsible to me.
- lapcat 1y ago
  > The way I see it is either you trust Apple or you don’t. That's so obviously a false dichotomy.
  - simondotau 1y ago
    That’s what you disagree with? If anything, I was expecting someone to insist that it’s not unreasonable to run software from a company you don’t trust. That’s an easy argument to steel-man, because there are many ways to run untrusted software safely. But if you think that trust itself is a false dichotomy, I’d love to hear what that sounds like. I’m struggling to think of a good faith steel-man of this assertion.
    - lapcat 1y ago
      > But if you think that trust itself is a false dichotomy, I’d love to hear what that sounds like. I’m struggling to think of a good faith steel-man of this assertion. There are obviously levels of trust. I'm truly baffled that you're struggling with this. Your trust in a person, or a company, can increase or decrease over time. You can trust someone with some tasks but not with other tasks. Again, this is so incredibly obvious, I'm not sure why I have to point it out.
      - simondotau 1y ago
        What you’re describing is an assessment of risk associated with using untrusted software. There are absolutely levels of risk. I don’t trust Nintendo, but I don’t need to trust them in order to play Mario.
jitl 1y ago
Would it really be better if there was one domain used for everything? If you want to turn off your Mac doing things like syncing data with the screen off, you can: https://support.apple.com/en-in/guide/mac-help/mh40774/15.0/mac/15.0 https://support.apple.com/en-in/guide/mac-help/mh40774/15.0/...
al_borland 1y ago
While this seems like a lot, in some ways this is what user's expect. Push notifications should be coming all the time, assuming the system is on. Most users expect various maintenance services to run when the system idle so it doesn't interfere with their active use of the system. When users open apps like Weather (or view a widget), they expect it to already be up to date without having to manually refresh or wait for data to load when the app launches. I'm sure some fat can be trimmed, and it may not all be user-centric, but a lot of this had to do with the expectations users have these days with the data being always up to date, instantly available, and proactive about alerting them to things they may want to know about, like rain coming to your area in 30 minutes. One of my big pet peeves is when I pick up my phone in the morning, go to open an app, and it starts updating, so I need to wait for the download/install. It just had 8 hours on a charger to do that, and instead it seems to wait until it's taken off the charger and unlocked. With auto-updates on, I'd much rather this happen when placed on the charger and inactive, than actively in use and off the charger. The same can be said for a lot of things on the desktop. This ends up mostly being a question of transparency and user control. Which then becomes a question of how much time/money to they invest in features for 1% of users? Now how much time do they invest in those same features when the 99% will stumble in there, turn a bunch of stuff off, then call support and ask why their weather widget isn't updating?
- neogodless 1y ago
  When Microsoft has telemetry: * Windows is a spyware machine - how can anyone use it? Year of Linux baby! When Apple has telemetry: * It's working as expected. So... to be fair, is there a thorough comparison of the two? How are they the same, and how are they different?
  - jamesy0ung 1y ago
    Apple is nowhere near as evil as Microsoft, so I’m willing to put up with it.
    - righthand 1y ago
      Apple has been involved in all the same government spying programs as Microsoft. They do not offer any services or products with E2E encryption that they do not control the key too.
SimianSci 1y ago
Polling domains when attached to the network like this doesnt suprise me in the least. Apple's ecosystem has often been praised for its tight integration, and this consistent network connectivity is the result. Anybody who has worked with large scale services that rely on messaging services to ensure people get timely notifications and data, knows that you need services which are continuously polling endpoints to check and see if they have new information. Organizations like Apple who service billions of devices cannot rely on a "push data to system only when something has updated" type of system, as such a system doesnt operate at their scale. They have to operate a system where individual clients are assumed to have an unreliable connection to the service, and where the client does the legwork of checking for new data stored in a centralized system. This is what you are seeing in the article. Domains like [gdmf.apple.com] which govern device management, are where the declarative device management system is checking Apple's various databases to see if they need to update their configuration.
- brookst 1y ago
  The article’s author would apparently be happier if everything were on a single domain with just ports or paths to separate services. Thinking about the number of DNS names seems kind of silly.
  - lapcat 1y ago
    This is an extremely uncharitable interpretation of the article. The number was just intended to illustrate the amount of communication that occurs.
    - yaris 1y ago
      The amount of communications would be better illustrated by the number of connections made in a period of time, maybe complemented with the amount of data transferred up/down. Making a 1000 connections towards one domain name with different URLs does not fundamentally differ from making 1000 connections each towards a separate domain name (which names can be the same server, just with a bunch of IPs).
zevon 1y ago
Does anybody know if all the Apple remote connection things happen on the MacOS level? I'm mostly using Asahi on my personal Macbook these days instead of MacOS and I'm curious if that cuts off everything or just many things.
- SimianSci 1y ago
  Most of these connections are a result of the MacOS software and its particular resource needs. I am no Asahi Linux expert and would defer to a maintainer for specifics, but im led to believe that any Apple Silicon mac requires that they still communicate some base hardware information during initial install due to activation requirements that Apple has for its silicon.
st3fan 1y ago
What is the problem with this?
- SimianSci 1y ago
  There is no problem with this if you have any understanding of modern platforms and accept the current paradigm we all live in. I imagine such things might be shocking to people who dont understand how connected the world is at this point, or who may have been living under a metaphorical rock when it comes to their computing.
- gchamonlive 1y ago
  It's the problem with the benevolent dictator. It's no problem as long as the dictator is benevolent. Also benevolence is a matter of reference. Something that might be ok for most, might not be for you. There is also the question of ownership. Do you really own something you bought if you don't control its behaviour? Is it even moral to sell stuff to customers if they won't fully own it, or if the nature of ownership could change over time without user's having a say in it?
  - st3fan 1y ago
    thanks that is just a random rant do you think it is a problem that the "benevolent dictator" operating system contacts an endpoint to keep its anti-malware list up to date?
    - deleted 1y ago
      [deleted]
    - gchamonlive 1y ago
      Do you have the option to change the list if you want to maintain your own? What happens if it starts blacklisting legit applications because it poses a threat to Apple's business model?
  - brookst 1y ago
    Can you explain how it would be less of a problem if Apple out every service begins one DNS name? That’s the complaint, right? Too many DNS names?
oneplane 1y ago
TL;DR: not really all that exciting. Apple also publishes a list of domains, ports and protocols and what they are needed for. The side-effects of filtering them usually means something doesn't work right or doesn't work at all (push messages, software updates, buying stuff, anti-theft - which will fail closed!). > I have been trying to minimize to the extent possible the reach of big tech into my life That's how integrated services on connected devices work; why the surprise? You can't both have a connected experience that works while also not connecting to hosted services that provide that functionality. This isn't just Apple, anything that has any connected (cloud or anti-theft or otherwise) will need to function like this. If your version of big tech is anything that provides managed services, you might as well get off the internet as it doesn't really provide that much value without it. That applies to basic services as well: - Want email? Either go big or go home since you'll be attacked and spammed so much that unless you essentially learn to become an MSP for email for yourself it's not really feasible (and that includes all the GitHub projects we've seen on self-hosting; it's great as a one-off or hello-world demo, yet maintenance and knowledge is still required - time people aren't willing to invest) - Want search engines? Extremely expensive to run, so you're going to consume one or not use one at all. - Want to communicate with other people? They might use scary big tech and there is nothing you can do about it short of not communicating with other people (but that's antithetical to your wish to communicate with others). - Want to communicate with business services? They might require you use known quantities such as specific operating system versions and configurations, certain apps, or they might not service you at all (banks, insurance, medical, transit etc.) Can you apply a lot of time and energy to work around all of this? Possibly! But you end up not having much time left to do the things you actually wanted to do in your life. It essentially ends up similarly to what al_borland wrote: most large workflows and processes (regardless of governmental, for-profit businesses etc) don't want to make intensive exceptions just so 0.001% of their customers can be 'different', on one hand because it's not sustainable (you end up having one process for 99.99% of the users and many, just-as-expensive variations to that process for a bunch of individuals), on the other hand because it's not profitable (spending for one flavour and getting all the return on it vs. spending and getting practically no return on it).
- npteljes 1y ago
  I don't get it either. Everything that is connected does this, if not specifically built for online privacy. If OP wants to limit the reach of big tech into their life, they need to get off big tech. Or prepare for a lifetime of workarounds.
realreality 1y ago
I use a slow cellular connection and noticed some apple service (I could never figure out which one, even after installing an outgoing firewall) was aggressively uploading some large blob every time the mac woke from sleep, which made the whole connection useless for up to half an hour. At some point, apple must've fixed this "bug", but the experience -- and apple's increasingly obtrusive software -- convinced me to switch to linux.
- vbezhenar 1y ago
  My Macbook used to grind CPU for 10-20 minutes after every power on. That happened with literally fresh install and it does it every time. I don't know why does it do that. May be some indexing? This lack of transparency was one of the reasons for me switching to Linux too. I don't want my OS to do anything at all in background, that I didn't explicitly configured to. I want to be in full control of my software. Linux is far from perfect, but much better.
  - zamfi 1y ago
    Huh, which process was doing this grinding on your MacBook?
    - cguess 1y ago
      In my experience this is usually Spotlight indexing files/checking previous indexes etc. If you have any backup software running that will do it too.
    - vbezhenar 1y ago
      Generally it's mds_stores, but sometimes there are other ones which I don't remember atm. But mds_stores is the biggest offender.
- npteljes 1y ago
  Lack of transparency is almost a feature for these systems, and definitely something that serves the vendor, not the user. My daily driver is a Linux for the same reason - there is just so much less bullshit going on, and if I want to find something out, I can.
lapcat 1y ago
Little Snitch can detect and block connections at the process level. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html
- JulianWasTaken 1y ago
  As can the (FOSS) LuLu: https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
- RobT7k 1y ago
  Some Apple Apps can bypass Little Snitch though. https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816
  - lapcat 1y ago
    That was fixed long ago.
    - derefnull 1y ago
      work with virtual machines shows: not all traffic may be intercepted by little snitch
- tetraodonpuffer 1y ago
  that works in a lot of cases, but unfortunately it seems sometimes you get these popups about nsurlsessiond (for example) where you know where the connection goes, but no idea where it comes from (especially if it's trying to connect to to some generic AWS hostname) And as much as you can use little snitch for programs you install, these days it seems an endless whack-a-mole to block Apple's stuff as there's so many requests all the time. The more time goes by, the more it seems that the concept of "personal" computer is gone: there's nothing "personal" about it anymore, it's the computer plus an amorphous blob of online services one has no control over.
  - 1y ago
Ardren 1y ago
For fun, compare and contrast the comments here to this post on Windows 10 from 5 days ago: https://news.ycombinator.com/item?id=44208050 https://news.ycombinator.com/item?id=44208050
- brookst 1y ago
  This article: Apple’s OS relies on a lot of services to deliver its features! That article: Microsoft reports every click you make Is that the comparison you’re making?
  - deleted 1y ago
    [deleted]
  - deleted 1y ago
    [deleted]
  - joshstrange 1y ago
    No. This article: My Mac contacted 63 different Apple owned domains in an hour, while not is use > while not in use That is not "Apple reports every click you make", _very_ different from Microsoft. These requests seem like they are all for background tasks to keep data up to date when the user goes to use it. Now can you see a difference between that and _reporting_ on what you are doing?
    - idoubtit 1y ago
      > These requests seem like they are all for background tasks to keep data up to date when the user goes to use it. Where did you get this information? Is it just a guess based on what Apple declared about these domains? In the article, there is no info about the content sent to these Apple owned domains. For all we know, MacOS could send detailed reports on the user's activity.
      - brookst 1y ago
        I mean it could be sending your actual thoughts based on undocumented long range EEGs. But the burden of proof is on those who claim something works differently than documented.
Avamander 1y ago
It's even better that quite a few of those connections are unencrypted (and are actively used by some vendors to profile devices).
- SimianSci 1y ago
  From my understanding this isnt correct. While a DNS resolution may or may not be encrypted, which is highly dependent on the local client's environment. Data being sent to apple is not being sent via DNS, as these DNS connections are only the beginning of negotiating a conneciton to Apple's servers. The connections themselves where data is transfered, are negotiated using TLS and thus encrypted. The only point where this is not the case would be system probes, such as captive-portal check, OCSP, or NTP, but none of these would be capable of portraying anything more than simple metadata, like your ip address.
  - Avamander 1y ago
    > Data being sent to apple is not being sent via DNS Obviously I'm talking about what follows the name resolution. > The connections themselves where data is transfered, are negotiated using TLS and thus encrypted. They're not, as I said there are quite a few unencrypted ones. Last time I couldn't even set up a HomePod without allowing insecure connections. > but none of these would be capable of portraying anything more than simple metadata, like your ip address. Just the captive portal check alone contains things like the User-Agent, which has plenty more than just your IP.
jbrooks84 1y ago
Is this the first time you are monitoring traffic of any modern consumer devices connected to the Internet?
- owebmaster 1y ago
  Have you tried GNU/Linux?
  - SkyeCA 1y ago
    Given the state of modern tech enthusiasts? The answer for many is likely no, no they have not.
  - brookst 1y ago
    If you built up a Linux system to have similar functionality (single user account across systems that syncs user data, automatically backs up to a cloud, syncs photos and videos, sends all traffic through an anonymizing relay, receives push notifications for essentially all apps, etc), would it contact fewer services?
    - beeflet 1y ago
      To some extent. You could do a lot of the syncing with a decentralized system like syncthing. You could use GPS for time. Tor for anonymization and additional firewall-punching.
      - brookst 1y ago
        GPS isn’t great indoors. Tor just stuffs things through a tunnel. You could do the same on a Mac with a VPN and say it’s just connecting to one service. And by the time you get to nightly backups and photo sharing across computers, I think it’d be pretty similar.
  - os2warpman 1y ago
    I've tried to use it as my daily driver multiple times since 1997 but ultimately for me personally and the security posture I have chosen to adopt the utility of being able to copy and paste from my phone to my desktop without having to deploy and secure my own infrastructure outweighs any paranoiac doomsday delusions someone may try to implant in my mind.
mark_l_watson 1y ago
As so many other people have also said, many Apple services like iCloud sync require a lot of network I/O. I use two iPads, one with 64G of storage and the other with 1 terabyte of storage. Applications and data frequently get offloaded and reloaded on my old iPad. I appreciate hand-off, and accept the overhead for supporting that. Most data is encrypted at rest on Apple's servers and during transport. Check their documentation.
- throw564367h 1y ago
  Same with Xiaomi products. Their products are all integrated together and communicate with one another.
this_user 1y ago
Apple is the new Microsoft. They have pretty much saturated their target market. And since there is nothing much new to do, teams justify their existence in the org by changing existing things and adding unneeded functionalities that ultimately make the user experience progressively worse.
- tl 1y ago
  Apple has been the new Microsoft long enough, I've begun to suspect the current environment cannot support a new Apple. Joel Spoksky's 2004 "How Microsoft Lost the API War" [1] applies to Apple's 2019 introduction of SwiftUI. Some of the AI companies are trying, but the more favorably I think of a competitor in that market, the less likely they are to build consumer hardware. [1]: https://www.joelonsoftware.com/2004/06/13/how-microsoft-lost-the-api-war/ https://www.joelonsoftware.com/2004/06/13/how-microsoft-lost...
dusted 1y ago
they must have missed one, I'm sure they can index 64 domains.. unless 0 means "don't do anything". Just be glad they didn't opt for a 16 bit register for the call home functionality :D
nkotov 1y ago
Apple has a nice list here where you can see what it connects to and why: https://support.apple.com/en-us/101555 https://support.apple.com/en-us/101555
hoppp 1y ago
If you want to block Apple domains, why buy a Mac? Vendor lock in and tracking is all part of the Apple experience.
DavideNL 1y ago
Somewhat related; This week i configured Keyboard Maestro to turn off Wi-Fi and Bluetooth when my MacBook (M1 Pro) goes to sleep, and re-enable them on wake. This has had a huge impact on the battery drain while not being used. Even when the lid is closed. Would recommend.
1vuio0pswjnm7 1y ago
One of the things that really put me off about Apple's computers, namely their pre-installed OS, was how "chatty" they have become when attached to a local network, let alone the internet. As such, I stopped buying Apple. I have not owned a Mac since the G4 days. I never attached it to the internet. I would use TCP/IP and a crossover cable to move files. I always see a high vollume of traffic from other peoples' Apple computers on the wire that is not intitiated by the computer owner. To my sensibilities, this is cringeworthy. Because there is no way to turn if off. The computer owner has no control over it. Apple fans can argue this is useful and convenient. That may be true. But that does not explain why it is mandatory, on by default and impossible to disable. I am not against useful options and convenience. I am in favor of control. When I compile and install a NetBSD image the amount of mandatory network traffic is zero. It is up to me to decide what to enable. That's how I like it.
- yencabulator 1y ago
  I am often in remote locations with very little bandwidth and modern software is an utter pain. Silent 2 GB downloads starting in the background!

167 points by rpgbr 1y ago

With Apple, you want to block *.apple.com and white-list subdomains as you need them. If instead you black-list apple subdomains, the battle will never end.

fortran77 1y ago
Why use Apple at all if it’s so user-hostile? (I’m a Windows user.)
- plutoh28 1y ago
  If I recall correctly, Windows isn’t very user-friendly either.
  - like_any_other 1y ago
    Humor.
    - uncircle 1y ago
      It cannot be humor as it doesn't have, at the end of the comment, the tag /s
      - erikerikson 1y ago
        Thank you for ending yours with /s
- greenavocado 1y ago
  Windows telemetry is way more insane Small sample of telemetry and spying domains (out of date): https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke... https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/extra.txt https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke... https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/update.txt https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocke... https://raw.githubusercontent.com/Strappazzon/teleme7ry/master/src/rules.txt https://raw.githubusercontent.com/Strappazzon/teleme7ry/mast...
  - zeeZ 1y ago
    That "small sample of telemetry and spying domains" also contains login pages and update downloads, among others. You're just saying everything Microsoft is telemetry and spying, here are all their domains.
    - st3fan 1y ago
      Same with all those Apple domains. This is the world we live in now. Operating systems and most applications are now backed by cloud services.
  - potato-peeler 1y ago
    How does one verify all those domains are not essential to the OS?
    - ImJamal 1y ago
      Microsoft explains what all (most?) of the domains are for https://learn.microsoft.com/en-us/windows/privacy/windows-11-endpoints-non-enterprise-editions https://learn.microsoft.com/en-us/windows/privacy/windows-11...
      - potato-peeler 1y ago
        Thanks. I think some apps do need to connect to Microsoft to deliver services like update and antivirus. Some are used by the products itself to maintain reliability like maps and store. Others are diagnostics, which can still be manually turned off. Not sure why one would maintain a dedicated hosts file to block endpoints if they can simply configure this on app level itself.
- lipowitz 1y ago
  How do you get all the bloatware off and de-metric your Windows? With Apple it is one criminal instead of an oligarchy of crime.
  - MegaDeKay 1y ago
    Installing LTSC takes you a long way towards that goal.
- bmacho 1y ago
  Probably in exchange of some privacy it gives its users time/money?
- cynicalsecurity 1y ago
  Why use Apple or Windows at all if they are so user-hostile? (I’m a Linux user.)
  - jitl 1y ago
    (Bluetooth) audio never works consistently for me on Linux, especially after wake from sleep I have like a 10% chance to get crackling/stuttering
  - deleted 1y ago
    [deleted]
- onedognight 1y ago
  1) The ads in my start menu all come from one domain. 2) One is less than 63. 3) Profit?
- SimianSci 1y ago
  Anybody who has done similar checks for windows will see an order of magnitude more connections being made. As someone who got their start managing windows devices, and who has gone through the painful steps of mapping out what each such connection is meant for, I was suprised to see that there was ONLY 63 connections being made in an hour for this article. The last time I mapped such connections for a windows device, we had measured about 200+ similar connections within a single hour.
  - MegaDeKay 1y ago
    To be fair, "about 200+" is far from "an order of magnitude" of 63.
- exe34 1y ago
  Their hardware is quite nice - I have a mac book air from mid-2012 myself. (Although I moved to Nixos linux in 2016).
- LorenDB 1y ago
  Why use Windows at all since it's more user-hostile in terms of overt advertising and telemetry-gathering? (I'm a Linux user.) (slight /s here but I'm also serious)
- deleted 1y ago
  [deleted]

deleted 1y ago

[deleted]

footlose_3815 1y ago

I'm curious what Microsoft and Ubuntu's experience is as well, so there's a frame of reference. I skimmed that list, and Devil's Advocate; It seems like most of that is functional, stuff that they want to update in the background to make sure you have a better experience when you're back? On the flip, I guess we think Apple is up to something shady? My last understanding was that they were firm they didn't sell user data. Did this change?

sybercecurity 1y ago
My initial thought as well. May be overly chatty, but there may be a good intention behind it like "system seems to be idle for a while, now would be a good time to check for updates" I'd wager Windows does something similar. Linux distros may do it, but also may not since they may not be obsessed with happy eyeball problems and user perception of speed/latency.
roblabla 1y ago
A default linux install is incredibly silent on the network. You might be seeing some mDNS stuff, gnome/firefox may do some requests to detect captive portals, but overall the amount of network traffic is pretty small and manageable. It's important to note that, generally speaking, Linux software does not come with default-enabled telemetry, and for those that do, distros like Debian will routinely patch out phoning home and telemetry from the software they package.
- st3fan 1y ago
  That is only because there is barely any open source software for Linux that is backed by cloud services. Now install Spotify, VSCode, Steam for Linux and you will see the same kind of chatter with backend services.
  - SkyeCA 1y ago
    > That is only because there is barely any open source software for Linux that is backed by cloud services. Some of us would call this a feature. I am quite happy to have control over my computer and the data on it without having to trust third party cloud services.

npteljes 1y ago

Honestly, the list looks legit. Computers nowadays are semi-remotely-managed appliances. Internet is presumed, offline is not first, and offline is absolutely not exclusive. >I have been trying to minimize to the extent possible the reach of big tech into my life. I don't think this goal is possible, or worthwhile, on a big tech offering like a Mac + macOS. It can certainly be tried, but the user needs to be prepared for unforeseen consequences, and the override of the settings. It is like plugging in the ears to have a quieter life, in the middle of a metropolis. In the end, the context won't change. The direction of the platforms are clear, and the zeitgeist is bigger than all of us. The first option with a real impact is leaving the ecosystem. Although, blocking some domains could be a good first step towards that. Rome wasn't built in a day.

deleted 1y ago
[deleted]
TheNewsIsHere 1y ago
As a counterpoint - There are a lot of Apple services that get contacted because they can be contacted, not because they need to be. For example, I don’t use Home/HomeKit but it phones home to Apple several times a day if I allow it. The same with Apple News, Weather, etc. You can prevent this in various ways but not out of box. It’s possible to run macOS without an Internet connection. I value this, but it’s impractical and unnecessary for most people and most environments.
- npteljes 1y ago
  What's the value for you of disabling these connections, like the Home/HomeKit contact?

simondotau 1y ago

The way I see it is either you trust Apple or you don’t. To be clear, I think it’s perfectly reasonable to arrive at either conclusion, as it relates to your own needs and security posture. Personally I choose to trust them. My trust is not blind, and they could lose my trust very quickly. But as it stands right now, they have my trust. If you say that you don’t trust Apple, I don’t see how you could tolerate running any of their software. Relying on an operating system made by a company I don’t trust seems wildly irresponsible to me.

lapcat 1y ago
> The way I see it is either you trust Apple or you don’t. That's so obviously a false dichotomy.
- simondotau 1y ago
  That’s what you disagree with? If anything, I was expecting someone to insist that it’s not unreasonable to run software from a company you don’t trust. That’s an easy argument to steel-man, because there are many ways to run untrusted software safely. But if you think that trust itself is a false dichotomy, I’d love to hear what that sounds like. I’m struggling to think of a good faith steel-man of this assertion.
  - lapcat 1y ago
    > But if you think that trust itself is a false dichotomy, I’d love to hear what that sounds like. I’m struggling to think of a good faith steel-man of this assertion. There are obviously levels of trust. I'm truly baffled that you're struggling with this. Your trust in a person, or a company, can increase or decrease over time. You can trust someone with some tasks but not with other tasks. Again, this is so incredibly obvious, I'm not sure why I have to point it out.
    - simondotau 1y ago
      What you’re describing is an assessment of risk associated with using untrusted software. There are absolutely levels of risk. I don’t trust Nintendo, but I don’t need to trust them in order to play Mario.

jitl 1y ago

Would it really be better if there was one domain used for everything? If you want to turn off your Mac doing things like syncing data with the screen off, you can: https://support.apple.com/en-in/guide/mac-help/mh40774/15.0/mac/15.0 https://support.apple.com/en-in/guide/mac-help/mh40774/15.0/...

al_borland 1y ago

While this seems like a lot, in some ways this is what user's expect. Push notifications should be coming all the time, assuming the system is on. Most users expect various maintenance services to run when the system idle so it doesn't interfere with their active use of the system. When users open apps like Weather (or view a widget), they expect it to already be up to date without having to manually refresh or wait for data to load when the app launches. I'm sure some fat can be trimmed, and it may not all be user-centric, but a lot of this had to do with the expectations users have these days with the data being always up to date, instantly available, and proactive about alerting them to things they may want to know about, like rain coming to your area in 30 minutes. One of my big pet peeves is when I pick up my phone in the morning, go to open an app, and it starts updating, so I need to wait for the download/install. It just had 8 hours on a charger to do that, and instead it seems to wait until it's taken off the charger and unlocked. With auto-updates on, I'd much rather this happen when placed on the charger and inactive, than actively in use and off the charger. The same can be said for a lot of things on the desktop. This ends up mostly being a question of transparency and user control. Which then becomes a question of how much time/money to they invest in features for 1% of users? Now how much time do they invest in those same features when the 99% will stumble in there, turn a bunch of stuff off, then call support and ask why their weather widget isn't updating?

neogodless 1y ago
When Microsoft has telemetry: * Windows is a spyware machine - how can anyone use it? Year of Linux baby! When Apple has telemetry: * It's working as expected. So... to be fair, is there a thorough comparison of the two? How are they the same, and how are they different?
- jamesy0ung 1y ago
  Apple is nowhere near as evil as Microsoft, so I’m willing to put up with it.
  - righthand 1y ago
    Apple has been involved in all the same government spying programs as Microsoft. They do not offer any services or products with E2E encryption that they do not control the key too.

SimianSci 1y ago

Polling domains when attached to the network like this doesnt suprise me in the least. Apple's ecosystem has often been praised for its tight integration, and this consistent network connectivity is the result. Anybody who has worked with large scale services that rely on messaging services to ensure people get timely notifications and data, knows that you need services which are continuously polling endpoints to check and see if they have new information. Organizations like Apple who service billions of devices cannot rely on a "push data to system only when something has updated" type of system, as such a system doesnt operate at their scale. They have to operate a system where individual clients are assumed to have an unreliable connection to the service, and where the client does the legwork of checking for new data stored in a centralized system. This is what you are seeing in the article. Domains like [gdmf.apple.com] which govern device management, are where the declarative device management system is checking Apple's various databases to see if they need to update their configuration.

brookst 1y ago
The article’s author would apparently be happier if everything were on a single domain with just ports or paths to separate services. Thinking about the number of DNS names seems kind of silly.
- lapcat 1y ago
  This is an extremely uncharitable interpretation of the article. The number was just intended to illustrate the amount of communication that occurs.
  - yaris 1y ago
    The amount of communications would be better illustrated by the number of connections made in a period of time, maybe complemented with the amount of data transferred up/down. Making a 1000 connections towards one domain name with different URLs does not fundamentally differ from making 1000 connections each towards a separate domain name (which names can be the same server, just with a bunch of IPs).

zevon 1y ago

Does anybody know if all the Apple remote connection things happen on the MacOS level? I'm mostly using Asahi on my personal Macbook these days instead of MacOS and I'm curious if that cuts off everything or just many things.

SimianSci 1y ago
Most of these connections are a result of the MacOS software and its particular resource needs. I am no Asahi Linux expert and would defer to a maintainer for specifics, but im led to believe that any Apple Silicon mac requires that they still communicate some base hardware information during initial install due to activation requirements that Apple has for its silicon.

st3fan 1y ago

What is the problem with this?

SimianSci 1y ago
There is no problem with this if you have any understanding of modern platforms and accept the current paradigm we all live in. I imagine such things might be shocking to people who dont understand how connected the world is at this point, or who may have been living under a metaphorical rock when it comes to their computing.
gchamonlive 1y ago
It's the problem with the benevolent dictator. It's no problem as long as the dictator is benevolent. Also benevolence is a matter of reference. Something that might be ok for most, might not be for you. There is also the question of ownership. Do you really own something you bought if you don't control its behaviour? Is it even moral to sell stuff to customers if they won't fully own it, or if the nature of ownership could change over time without user's having a say in it?
- st3fan 1y ago
  thanks that is just a random rant do you think it is a problem that the "benevolent dictator" operating system contacts an endpoint to keep its anti-malware list up to date?
  - deleted 1y ago
    [deleted]
  - gchamonlive 1y ago
    Do you have the option to change the list if you want to maintain your own? What happens if it starts blacklisting legit applications because it poses a threat to Apple's business model?
- brookst 1y ago
  Can you explain how it would be less of a problem if Apple out every service begins one DNS name? That’s the complaint, right? Too many DNS names?

oneplane 1y ago

TL;DR: not really all that exciting. Apple also publishes a list of domains, ports and protocols and what they are needed for. The side-effects of filtering them usually means something doesn't work right or doesn't work at all (push messages, software updates, buying stuff, anti-theft - which will fail closed!). > I have been trying to minimize to the extent possible the reach of big tech into my life That's how integrated services on connected devices work; why the surprise? You can't both have a connected experience that works while also not connecting to hosted services that provide that functionality. This isn't just Apple, anything that has any connected (cloud or anti-theft or otherwise) will need to function like this. If your version of big tech is anything that provides managed services, you might as well get off the internet as it doesn't really provide that much value without it. That applies to basic services as well: - Want email? Either go big or go home since you'll be attacked and spammed so much that unless you essentially learn to become an MSP for email for yourself it's not really feasible (and that includes all the GitHub projects we've seen on self-hosting; it's great as a one-off or hello-world demo, yet maintenance and knowledge is still required - time people aren't willing to invest) - Want search engines? Extremely expensive to run, so you're going to consume one or not use one at all. - Want to communicate with other people? They might use scary big tech and there is nothing you can do about it short of not communicating with other people (but that's antithetical to your wish to communicate with others). - Want to communicate with business services? They might require you use known quantities such as specific operating system versions and configurations, certain apps, or they might not service you at all (banks, insurance, medical, transit etc.) Can you apply a lot of time and energy to work around all of this? Possibly! But you end up not having much time left to do the things you actually wanted to do in your life. It essentially ends up similarly to what al_borland wrote: most large workflows and processes (regardless of governmental, for-profit businesses etc) don't want to make intensive exceptions just so 0.001% of their customers can be 'different', on one hand because it's not sustainable (you end up having one process for 99.99% of the users and many, just-as-expensive variations to that process for a bunch of individuals), on the other hand because it's not profitable (spending for one flavour and getting all the return on it vs. spending and getting practically no return on it).

npteljes 1y ago
I don't get it either. Everything that is connected does this, if not specifically built for online privacy. If OP wants to limit the reach of big tech into their life, they need to get off big tech. Or prepare for a lifetime of workarounds.

realreality 1y ago

I use a slow cellular connection and noticed some apple service (I could never figure out which one, even after installing an outgoing firewall) was aggressively uploading some large blob every time the mac woke from sleep, which made the whole connection useless for up to half an hour. At some point, apple must've fixed this "bug", but the experience -- and apple's increasingly obtrusive software -- convinced me to switch to linux.

vbezhenar 1y ago
My Macbook used to grind CPU for 10-20 minutes after every power on. That happened with literally fresh install and it does it every time. I don't know why does it do that. May be some indexing? This lack of transparency was one of the reasons for me switching to Linux too. I don't want my OS to do anything at all in background, that I didn't explicitly configured to. I want to be in full control of my software. Linux is far from perfect, but much better.
- zamfi 1y ago
  Huh, which process was doing this grinding on your MacBook?
  - cguess 1y ago
    In my experience this is usually Spotlight indexing files/checking previous indexes etc. If you have any backup software running that will do it too.
  - vbezhenar 1y ago
    Generally it's mds_stores, but sometimes there are other ones which I don't remember atm. But mds_stores is the biggest offender.
npteljes 1y ago
Lack of transparency is almost a feature for these systems, and definitely something that serves the vendor, not the user. My daily driver is a Linux for the same reason - there is just so much less bullshit going on, and if I want to find something out, I can.

lapcat 1y ago

Little Snitch can detect and block connections at the process level. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html

JulianWasTaken 1y ago
As can the (FOSS) LuLu: https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
RobT7k 1y ago
Some Apple Apps can bypass Little Snitch though. https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816
- lapcat 1y ago
  That was fixed long ago.
  - derefnull 1y ago
    work with virtual machines shows: not all traffic may be intercepted by little snitch
tetraodonpuffer 1y ago
that works in a lot of cases, but unfortunately it seems sometimes you get these popups about nsurlsessiond (for example) where you know where the connection goes, but no idea where it comes from (especially if it's trying to connect to to some generic AWS hostname) And as much as you can use little snitch for programs you install, these days it seems an endless whack-a-mole to block Apple's stuff as there's so many requests all the time. The more time goes by, the more it seems that the concept of "personal" computer is gone: there's nothing "personal" about it anymore, it's the computer plus an amorphous blob of online services one has no control over.
- 1y ago

Ardren 1y ago

For fun, compare and contrast the comments here to this post on Windows 10 from 5 days ago: https://news.ycombinator.com/item?id=44208050 https://news.ycombinator.com/item?id=44208050

brookst 1y ago
This article: Apple’s OS relies on a lot of services to deliver its features! That article: Microsoft reports every click you make Is that the comparison you’re making?
- deleted 1y ago
  [deleted]
- deleted 1y ago
  [deleted]
- joshstrange 1y ago
  No. This article: My Mac contacted 63 different Apple owned domains in an hour, while not is use > while not in use That is not "Apple reports every click you make", _very_ different from Microsoft. These requests seem like they are all for background tasks to keep data up to date when the user goes to use it. Now can you see a difference between that and _reporting_ on what you are doing?
  - idoubtit 1y ago
    > These requests seem like they are all for background tasks to keep data up to date when the user goes to use it. Where did you get this information? Is it just a guess based on what Apple declared about these domains? In the article, there is no info about the content sent to these Apple owned domains. For all we know, MacOS could send detailed reports on the user's activity.
    - brookst 1y ago
      I mean it could be sending your actual thoughts based on undocumented long range EEGs. But the burden of proof is on those who claim something works differently than documented.

Avamander 1y ago

It's even better that quite a few of those connections are unencrypted (and are actively used by some vendors to profile devices).

SimianSci 1y ago
From my understanding this isnt correct. While a DNS resolution may or may not be encrypted, which is highly dependent on the local client's environment. Data being sent to apple is not being sent via DNS, as these DNS connections are only the beginning of negotiating a conneciton to Apple's servers. The connections themselves where data is transfered, are negotiated using TLS and thus encrypted. The only point where this is not the case would be system probes, such as captive-portal check, OCSP, or NTP, but none of these would be capable of portraying anything more than simple metadata, like your ip address.
- Avamander 1y ago
  > Data being sent to apple is not being sent via DNS Obviously I'm talking about what follows the name resolution. > The connections themselves where data is transfered, are negotiated using TLS and thus encrypted. They're not, as I said there are quite a few unencrypted ones. Last time I couldn't even set up a HomePod without allowing insecure connections. > but none of these would be capable of portraying anything more than simple metadata, like your ip address. Just the captive portal check alone contains things like the User-Agent, which has plenty more than just your IP.

jbrooks84 1y ago

Is this the first time you are monitoring traffic of any modern consumer devices connected to the Internet?

owebmaster 1y ago
Have you tried GNU/Linux?
- SkyeCA 1y ago
  Given the state of modern tech enthusiasts? The answer for many is likely no, no they have not.
- brookst 1y ago
  If you built up a Linux system to have similar functionality (single user account across systems that syncs user data, automatically backs up to a cloud, syncs photos and videos, sends all traffic through an anonymizing relay, receives push notifications for essentially all apps, etc), would it contact fewer services?
  - beeflet 1y ago
    To some extent. You could do a lot of the syncing with a decentralized system like syncthing. You could use GPS for time. Tor for anonymization and additional firewall-punching.
    - brookst 1y ago
      GPS isn’t great indoors. Tor just stuffs things through a tunnel. You could do the same on a Mac with a VPN and say it’s just connecting to one service. And by the time you get to nightly backups and photo sharing across computers, I think it’d be pretty similar.
- os2warpman 1y ago
  I've tried to use it as my daily driver multiple times since 1997 but ultimately for me personally and the security posture I have chosen to adopt the utility of being able to copy and paste from my phone to my desktop without having to deploy and secure my own infrastructure outweighs any paranoiac doomsday delusions someone may try to implant in my mind.

mark_l_watson 1y ago

As so many other people have also said, many Apple services like iCloud sync require a lot of network I/O. I use two iPads, one with 64G of storage and the other with 1 terabyte of storage. Applications and data frequently get offloaded and reloaded on my old iPad. I appreciate hand-off, and accept the overhead for supporting that. Most data is encrypted at rest on Apple's servers and during transport. Check their documentation.

throw564367h 1y ago
Same with Xiaomi products. Their products are all integrated together and communicate with one another.

this_user 1y ago

Apple is the new Microsoft. They have pretty much saturated their target market. And since there is nothing much new to do, teams justify their existence in the org by changing existing things and adding unneeded functionalities that ultimately make the user experience progressively worse.

tl 1y ago
Apple has been the new Microsoft long enough, I've begun to suspect the current environment cannot support a new Apple. Joel Spoksky's 2004 "How Microsoft Lost the API War" [1] applies to Apple's 2019 introduction of SwiftUI. Some of the AI companies are trying, but the more favorably I think of a competitor in that market, the less likely they are to build consumer hardware. [1]: https://www.joelonsoftware.com/2004/06/13/how-microsoft-lost-the-api-war/ https://www.joelonsoftware.com/2004/06/13/how-microsoft-lost...

dusted 1y ago

they must have missed one, I'm sure they can index 64 domains.. unless 0 means "don't do anything". Just be glad they didn't opt for a 16 bit register for the call home functionality :D

nkotov 1y ago

Apple has a nice list here where you can see what it connects to and why: https://support.apple.com/en-us/101555 https://support.apple.com/en-us/101555

hoppp 1y ago

If you want to block Apple domains, why buy a Mac? Vendor lock in and tracking is all part of the Apple experience.

DavideNL 1y ago

Somewhat related; This week i configured Keyboard Maestro to turn off Wi-Fi and Bluetooth when my MacBook (M1 Pro) goes to sleep, and re-enable them on wake. This has had a huge impact on the battery drain while not being used. Even when the lid is closed. Would recommend.

1vuio0pswjnm7 1y ago

One of the things that really put me off about Apple's computers, namely their pre-installed OS, was how "chatty" they have become when attached to a local network, let alone the internet. As such, I stopped buying Apple. I have not owned a Mac since the G4 days. I never attached it to the internet. I would use TCP/IP and a crossover cable to move files. I always see a high vollume of traffic from other peoples' Apple computers on the wire that is not intitiated by the computer owner. To my sensibilities, this is cringeworthy. Because there is no way to turn if off. The computer owner has no control over it. Apple fans can argue this is useful and convenient. That may be true. But that does not explain why it is mandatory, on by default and impossible to disable. I am not against useful options and convenience. I am in favor of control. When I compile and install a NetBSD image the amount of mandatory network traffic is zero. It is up to me to decide what to enable. That's how I like it.

yencabulator 1y ago
I am often in remote locations with very little bandwidth and modern software is an utter pain. Silent 2 GB downloads starting in the background!