8 ms·

Disable sharing of Spotlight searches with Apple

244 points by teacup50 12y ago

mtrpcic 12y ago
While fixing spotlight is a good idea (especially if you're opening it a lot in public), please don't blindly execute code without reading it first. While this code isn't malicious, running misc. third party code without reading it first is a bad idea for everyone.
- morganvachon 12y ago
  The fact that the entire source code is displayed on the page for all to read seems to have escaped you. You make a valid point in general, but the site in question practically screams the same message. I don't get why you have a problem with this particular project.
  - equoid 12y ago
    The fact that most people could look at that code and have no real clue what it actually does seems to have escaped you. This is in any event not the entire source code, as most of the work is done by function calls which most people would not know how to validate.
    - morganvachon 12y ago
      If the potential user doesn't understand what the script does, they have no business running it in the first place, so it's a moot point.
  - jarcoal 12y ago
    I think he means you should at least read the code on the other end of that URL to make sure it matches what's on the site.
    - pilsetnieks 12y ago
      Plus you should read what's downloaded to your machine before executing it, since there's also no guarantee that what's been served to your browser will be served to your curl.
    - morganvachon 12y ago
      That's just it: It does. Line for line, character for character (even space for space, which is important in Python). I wouldn't say what I did above without having diffed the file against the code displayed first. I just don't get the mentality here sometimes; someone creates a helpful script, puts the source code on their site for you to read and study, and the first instinct is to assume they have malicious intent before even taking a few minutes to read over it first. Hell, I'm no programmer but I know enough about the basics to follow exactly what the code does. It took me all of five minutes to decide that it flips two switches and nothing more. That the programming gods here can't or won't do that is telling. I get being paranoid about random scripts, but this one is on display for all to see before running. There is literally nothing hidden, yet you all act as if the author is trying to secretly take over your machines. It would be funny if it wasn't so pathetic.
  - reedloden 12y ago
    Please read http://www.djm.org.uk/protect-yourself-from-non-obvious-dangers-curl-url-pipe-sh/ http://www.djm.org.uk/protect-yourself-from-non-obvious-dang... (https://news.ycombinator.com/item?id=8385213 https://news.ycombinator.com/item?id=8385213).
  - jboy55 12y ago
    Actually what is displayed is not necessarily the same as what would be executed if you ran that script. You are viewing one piece of code , you will be executing a different file. In fact, you can view the github code, and see the code displayed is embedded into index.html (with syntax highlighting). If anyone is at all concerned with their privacy, they should never blindly run a script like that.
    - morganvachon 12y ago
      Copy the text displayed in the code block on the page, diff it against the fix-macos.py file in the curl link. It is character for character the same code. Why am I the only one not too lazy to do this?
      - jboy55 12y ago
        Today it is, tomorrow? A month from now? When the original dev ignores the site, and someone hacks his pw, changes the code, what then? I cannot seriously listen to anyone who "cares" about privacy, then asks their users to download and execute unknown code.
        morganvachon 12y ago
        Is the link in the curl line binary, compiled, non-human-readable code? No? Then your argument has no merit. It's a plaintext python script. Download it, parse it, if it checks out, run it. If it doesn't check out or you don't understand it, don't. It doesn't matter if it's today, a month from now, or a year from now. If the code checks out, and you feel like it will help you, run it. Or don't, and no one will care. Or are you seriously going to tell me that you feel you can't trust a 75 line script you just fully vetted, but you can trust, say, the Linux kernel, despite the fact that you didn't manually parse the millions of lines of code in it? If that really is your argument, then I can only imagine that you stop on green and go on red out in the real world, because that's pretty damn fucked up.
        jboy55 12y ago
- deleted 12y ago
  [deleted]
- itg 12y ago
  Especially when you can do the same thing by going into system preferences. What a click bait title that leads people to run a script.
- brudgers 12y ago
  Running miscellaneous second party code is also becoming increasingly problematic from a privacy standpoint...e.g. Windows 8 and Android [with Google services installed] also want to phone home.
- geographomics 12y ago
  There's always the danger of this attack, as well: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
  - hk__2 12y ago
    Here it’s even worse because you don’t see the content of the script you’re executing.
    - jonknee 12y ago
      What do you mean? The content is the majority of the web page... You can copy it from there, or if you're paranoid you can run: curl https://fix-macosx.com/fix-macosx.py Before the suggested: curl -o https://fix-macosx.com/fix-macosx.py && /usr/bin/python fix-macosx.py That said, at this stage just set the correct preferences. I had already done that before seeing this script, it's pretty simple.
      - dmix 12y ago
        ...This should just be the instructions: 1) $ curl -o https://fix-macosx.com/fix-macosx.py 1a) Review fix-macosx.py 2) $ /usr/bin/python fix-macosx.py
- moloch 12y ago
  It's the same security model as downloading a binary and running it.
- arrrg 12y ago
  It’s not “fixing” anything. It’s changing a preference people can have different opinions about.
jackmaney 12y ago
This reminds me that I should really get around to figuring out how to disable spotlight altogether. It can occasionally peg my CPU.
- mwfunk 12y ago
  mdutil -a -i off Or, 'man mdutil' if you would rather not type in commands suggested by random people on the Internet. :)
ahassan 12y ago
What exactly does this enable/disable?
- dewey 12y ago
  I suggest you read the section called "Why do we need this?" on the linked page ;)
sksk 12y ago
It took me a while to figure out what is being disabled in the code and why I need to care. I care about privacy but I would like to understand what I am giving up. If I understand it correctly, the code disables 'Spotlight Suggestions' and 'Bing Websearches'. You can do it in the GUI easily. Just go to System Preferences -> Spotlight -> Search Results tab (uncheck the above 2). Bing Websearch is clear enough but it took me a while to figure out what Spotlight Suggestion is. It looks like it gives you movie recommendations. If there is more to the code, I would like to know what else I should disable. Also, ideally would like to know what I am giving up by disabling them.
- serve_yay 12y ago
  It's explained in the sidebar
comex 12y ago
You could also just go into Spotlight settings yourself and uncheck "Bing Web Searches" and "Spotlight Suggestions", rather than executing some random script. The "About Spotlight Suggestions & Privacy" button even tells you what to uncheck.
Ricapar 12y ago
The Python script is a bit unnecessary. Go to System Preferences > Spotlight. Uncheck items you don't like to have searched and displayed for you.
etjossem 12y ago
For those interested, here's the specific language Apple offers to explain what Spotlight is doing. I didn't see it elsewhere so I figured I'd post it. From the Spotlight preferences pane: "When you use Spotlight, your search queries, the Spotlight Suggestions you select, and related usage data will be sent to Apple. Search results found on your Mac will not be sent. If you have Location Services on your Mac turned on, when you make a search query to Spotlight the location of your Mac at that time will be sent to Apple. Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine. These searches are not stored by Microsoft. Location, search queries, and usage information sent to Apple will be used by Apple only to make Spotlight Suggestions more relevant and to improve other Apple products and services." "If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results tab in the Spotlight preference pane found within System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac." "You can turn off Location Services for Spotlight Suggestions in the Privacy pane of System Preferences on your Mac by clicking on “Details” next to System Services and then deselecting “Spotlight Suggestions”. If you turn off Location Services on your Mac, your precise location will not be sent to Apple. To deliver relevant search suggestions, Apple may use the IP address of your Internet connection to approximate your location by matching it to a geographic region." "Information collected by Apple will be treated in accordance with Apple’s Privacy Policy, which can be found at www.apple.com/privacy."
- kingnight 12y ago
  Could this be considered overthinking it? A domain, a python script, to effectively achieve tapping a couple toggles in sys prefs? And this is quite difficult for the average non terminal using person. > This site _criticizes_ Apple for certain privacy-invading features of Mac OS X and teaches users how to fix them. So, obviously, the site is not approved by Apple. Snark!
  - ptomato 12y ago
    Not to mention that it encourages possibly not technically inclined users to execute random scripts from the internet, which should be a capital crime.
jdechko 12y ago
I'm actually a little more curious about the specifics. What data is transmitted? Because spotlight can search the web, so that's going to transmit data to 3rd parties. Is the data associated with the user or is it anonymously transmitted? Also, I can't remember because it's been so long since I installed the beta, but is there an option during setup that asks for permission to collect usage data as in iOS (which would be checked in a default installation? If so, does that preference include this data?
gicmo 12y ago
If you bring up the Spotlight search window it will even tell you: "In addition to searching your Mac, Spotlight now shows suggestions from the Internet, iTunes, App Store, locations nearby, and more. To make suggestions more relevant to you, Spotlight includes your approximate location with search requests to Apple. You can change this in Preferences. Learn more…" Clicking on "Learn more" also tells you how to disable it. The python script is neat but a bit exaggerated IMHO.
- revelation 12y ago
  I actually clicked the learn more, and it took me to a help site that somehow didn't exist. Failed to load. Then I manually went into Spotlight settings, and was presented with a bunch of checkboxes that offer zero indication as to privacy implications. How am I to magically tell that the "Movies" option won't send my query to some Apple IMDB proxy? Sorry, but this script is spot on. This should not be enabled by default, and the privacy implications need to be spelt out in every single detail. It should be a legal requirement, really.
  - eridius 12y ago
    > [...] that offer zero indication as to privacy implications There's a very prominent button labelled > About Spotlight Suggestions & Privacy on the Spotlight preferences window. If you're worried about the privacy of your searches, you can click that, and you get a detailed description of exactly what's going on, and how to disable it (to wit, uncheck "Spotlight Suggestions" and "Bing Web Searches").
    - eropple 12y ago
      This is literally the first I've heard of this, and I upgraded yesterday. I didn't see whatever warning supposedly appears on the first use of Spotlight because--as I always do--I hit it and started typing. The idea that having a button in the bowels of a preference menu is sufficient is...I don't want to say "nuts", but I'm thinking it pretty hard. I'm not happy. Not unhappy enough to subject myself to a Linux desktop, but Apple is making it closer and closer with every release.
rockshassa 12y ago
am i the only one wondering what MENU_OTHER is?
- RKearney 12y ago
  It's for unknown filetypes that are matched by your search query which don't fall under any of the other categories.
digitalzombie 12y ago
I use Alfred... http://www.alfredapp.com/ http://www.alfredapp.com/
ChuckMcM 12y ago
There is a war on going in search. You can see it in Google's quarterly results where this last quarter they spent nearly a billion dollars on paid distribution (aka people they pay to send them searches that they can monetize rather than people who just show up at Google.com or one of their properties). It stuns me that Apple hasn't bitten the bullet and built a search engine yet since they could make more on it than Google is paying them to send queries there way but that is just Apple. But the spotlight 'net search' like Ubuntu's Unity search box gives those folks something to sell to Google and Google is buying. It is perhaps easier than building your own search engine but not as profitable once you get above a few million queries a day.
- carlesfe 12y ago
  Well, maybe the recent approaches to duckduckgo and their reaffirmation on user privacy are hints at the future of Apple and DDG... just a thought
- eridius 12y ago
  Based on Apple's past history, they do not want to sell your personal data. That's Google's modus operandi, and common for other companies too, but Apple has demonstrated time and time again that they are focused on the user. To that end, there's 2 things going on here: 1. Apple added functionality called Spotlight Suggestions, which pulls in data from the internet, including things like iTunes and App Store results, wikipedia results, movie showtimes, etc. It's basically a form of the specialized search results you get in search engines (such as Google, Bing, and, yes, even DuckDuckGo) where it tries to extract semantic meaning from your query and give you the result inline. This is generally considered very useful for search engines, and Apple decided they wanted Spotlight to have this behavior. I think this makes sense. Spotlight is basically Sherlock 2.0, so this finally restores behavior that Sherlock (and Watson before it) had (although Sherlock/Watson required you to explicitly search the various providers, whereas Spotlight decides when to do the searches based on its own interpretation of the query). The privacy implication here is that searches used with Spotlight Suggestions are sent to Apple, so they can improve Spotlight Suggestions. This is something that web search engines already have, and is important for making the functionality behave better. This data is not shared with anyone else, sold, or monetized. And yes, I believe Apple when they say that. Also to note, this is basically exactly what already happens with Siri. Your Siri queries are sent to Apple (so they can actually be answered), and that information is used to make Siri better. 2. The second part of this is Bing Web Searches. It appears most queries don't even go to Bing. I tried a random sampling of queries and never saw any search results. The Privacy button states that "Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine", which makes it sound like Bing only even sees the search if Spotlight determines that it can't handle this query with local data or Spotlight Suggestions. Which is to say, this does not mean that Microsoft sees every search you do. It seems they only see some searches, which are for "common words and phrases". Also, according to this, "These searches are not stored by Microsoft", which suggests that Apple's contract with Microsoft puts restrictions on them regarding how they can use the search. --- Ultimately, Apple only cares about what makes the user experience better. They're in the hardware business. That's where their money comes from. And they're successful precisely because whenever they're given the choice between something that might make more money, vs something that makes the user experience better, they choose the latter every single time. And monetizing searches does not make the user experience better.
leepowers 12y ago
Is there a way to undo? Let's say I run this script, but don't like the results. How do I undo and revert to a previous system state?
- nkozyra 12y ago
  Just modify these lines in the dict/list: {'enabled' : True, 'name' : 'MENU_WEBSEARCH'}, {'enabled' : True, 'name' : 'MENU_SPOTLIGHT_SUGGESTIONS'}, And re-run.
mukmuk 12y ago
I disabled both Spotlight Suggestions and Bing yet Spotlight -- via SpotlightNetHelper -- still attempts to connect to api.smoot.apple.com:443 and wu.apple.com:80. Can anyone explain this?
- pilsetnieks 12y ago
  Location services? Edit: I think that you have to disable Location service for Spotlight separately in Privacy settings.
  - mukmuk 12y ago
    Good thought, but I disabled that too. Edit: Twitter discussion regarding one of these issues. Note that Spotlight is doing this despite all relevant settings disabled (spotlight suggestions, bing, privacy, and logging). https://twitter.com/marczak/status/481818945318428673 https://twitter.com/marczak/status/481818945318428673
    - pilsetnieks 12y ago
      wu.apple.com is an address associated with location service requests. If you've disabled location for spotlight, it's possible that it was something else requesting the location. No idea about that smoot thing, though.
      - blantonl 12y ago
        A quick fix would be to add wu.apple.com to your hosts file with an address of 127.0.0.1 - not long term and certainly not an overall fix.
click170 12y ago
I strongly encourage anyone concerned about their privacy to start using a firewall that filters (or at least monitors) outbound traffic by default. And not just the packets, but the web requests. You would very likely be alarmed by what your phone is doing and who it's talking to without you knowing. iPhone or Android.
- iamdave 12y ago
  Recommended tools? I've gotten by for a while on Little Snitch. Good enough for a single user on a home network?
  - click170 12y ago
    I use a Sophos Home Edition UTM. It's mostly Open Source with some proprietary bits sprinkled on top. It also comes with AV software, though I won't speak to the efficacy of said AV software. I would like to build an equivalent fully-FOSS system, but haven't had time to do that yet. It would of course need to be Ansibled (or equivalent).
jhh 12y ago
Cool, there are python bindings for some Apple APIs? I wasn't aware.
- micampe 12y ago
  Pretty much all of them https://pythonhosted.org/pyobjc/ https://pythonhosted.org/pyobjc/
- dustinfarris 12y ago
  Hah! Really, this is the main take-away from the entire OP and discussion.
ebbv 12y ago
Executing random scripts from the web is far, far worse than anything Spotlight is doing. Oi vey.
0x0 12y ago
It's missing a default value for "DEVELOPER" (whatever that is)
rch 12y ago
Feels like Apple is the new Sony. No more MBPs for me.
al2o3cr 12y ago
Breaking news: searching on Google sends your query to a third-party server! FILM AT 11!
- userbinator 12y ago
  Yes, and most if not everyone who uses a computer understands that Google searches the Internet. Spotlight was mainly for local search, so they would not expect that their queries for local files be sent outside of their computer.
mwfunk 12y ago
I applaud them for publicizing the implications of the default privacy settings for Spotlight, but hyperbolic titles like the one used here hurt their credibility unnecessarily. I know some people think that using hyperbole for effect is a thing. They tend to be very young, smart people who are starting to realize what they're capable of but are still trapped on the wrong side of the Dunning-Kruger curve. The most common defense people give is that they assume the reader or listener knows that the hyperbole shouldn't be taken literally, and that they're really trying to convey how strongly they feel about their much more reasonable actual opinion on the matter. However, to me (and, I would hope, to most people), hyperbole in technical discussions means that the person is either immature in a way that makes them less credible, or that they are lying to me and assume I'm dumb enough to believe them. Or it's clickbait, or all of the above. I don't think the author(s) of this site are any of those things, but I also know that Yosemite as a whole is not designed to take away 100% of your privacy, which is what the title implies. This is also what turns me off about a lot of FSF propaganda, and most politicians regardless of their beliefs.
- dstein64 12y ago
  > I don't think the author(s) of this site are any of those things, but I also know that Yosemite as a whole is not designed to take away 100% of your privacy, which is what the title implies. This is also what turns me off about a lot of FSF propaganda, and most politicians regardless of their beliefs. Are your referring to the title of the HN submission, "Mac OS X Yosemite – No Privacy, by Design"? That text does not appear on the website. The website refers to "parts of Mac OS X which are invasive to your privacy."
  - mwfunk 12y ago
    Yep. I could be wrong here, but I thought that HN had a policy where the titles used are taken verbatim from the page being linked to, unless they're so completely terrible that an alternative title is needed. If the HN title doesn't come from the site, then my apologies to the authors for harping about this.
    - 12y ago
13throwaway 12y ago
I noticed iOS 8 has been doing this too via api.smoot.apple.com
enlightenedfool 12y ago
The first time I clicked spotlight after upgrade to yosemite, I was clueless what to do with the pop-up. closed, clicked spotlight several times until i realized i need to start typing and then saw the cursor. something weird about the whole UI changes. I prefer the old look and glossy icons. what's up with flat everything. The first thing I did was disabling the web search in spotlight.
deadweight3 12y ago
I have zero issue with this, and it's clearly labelled and explained. Of all the breaches in my privacy, this isn't one I'm worried about. Google gets 100% of my searches and email messages, so it's a question of who you trust.
- GrantS 12y ago
  To each his own, but I just want to point out that your examples of web searches and email require that SOME third party be involved because they are, by definition, attempts to reach a computer somewhere else on the internet. In contrast, searching the local files on one's own computer or launching applications on one's own computer are private, local events that need not be shared with any third party. Inherently private stuff just happens to leak out into the world now because Spotlight does web search too.
  - deadweight3 12y ago
    Everything you put on your computer should be assumed to be public the moment you connect to the internet. With air gap jump technology starting to become proven, you should assume that all digital content is public. To think otherwise is hubris and stupidity all wrapped up with a tiny little bow. Every company and government agency has been compromised to one degree or another, and targeted attacks are 100% effective given even slight competence on the part of the hacker. I've been around since before the modem, I've seen everyone hacked. Regardless, it doesn't matter. It's simply ignorant to bitch about this, when the NSA literally intercepts all of this and exploits or introduces exploits into the software you use. This is fact. Apple at it's worst will present you an advertisement, big fucking whoop. Seriously, what is the risk? Annoyance? The NSA can wrap you around a pole and make it appear you were snorting 12kilos of coke a day. I am quite literally baffled by the sentiment on HN when I see people up in arms over convenience like this trumped up as if it were in violation of your rights. They added a 'learn more' link and explain what is going on. Yet the same people simply ignore the actual threat, repeatedly. Cowards. Keep fighting them windmills. Because the real enemy fights back.
    - 12y ago
unknownBits 12y ago
They will need to put a knife on my throat to buy that Apple sucking nightmare. But, definitely a cool fix if you're unfortunate enough owning one:)
cheriot 12y ago
"Verification is required. Please click Billing Info to approve your billing information for use in the iTunes Store. If you cancel you will not be able to buy until you have approved your billing information." For a FREE upgrade? I'm sure Apple has data showing that people with a credit card on file are more likely to buy paid apps/songs/etc, but this is fucking annoying.
- NSCFType 12y ago
  One of the payment types is 'None'. http://i.imgur.com/oCqZf2b.png http://i.imgur.com/oCqZf2b.png
hayksaakian 12y ago
Real Question: Does anyone consider OS-native search that queries your local computer AND the web to be useful? As the default in ubuntu, it is actively confusing, and distracting. At least from my point of view, if I'm searching for something using my OS search, that means I want to find something ON MY computer. If I want to find something online, I will look online (google, etc.). The workflow from OS -> OS Search -> Browser -> Search is often slower than Alt-tabbing to the browser that is already open, pressing Ctrl+T and typing your query. This approach of combined search might make sense on mobile, where cloud storage is the norm, but on a personal computer, it is an insane default.
- userbinator 12y ago
  I certainly maintain a distinction between the two, and definitely never want queries for local files to leave the machine as they can contain sensitive information. Apple mentions that the local results of queries won't be sent, but the query itself will.
- SoftwareMaven 12y ago
  It may be confusing to people today. It will be expected behavior by the next generation. The real issue is what is "local" and what is "remote" is blurring. We see it with things like Google Docs, where they are "my" documents, and I want something like Spotlight to be able to search them, but they aren't local. What we have today is two problems: First, we are in the middle of the transition. People are needing to learn new behaviors. That's always hard. Second, it isn't seamless yet. While I haven't tried it, I highly doubt my Google Docs would show up in the my Spotlight search. The fragmentation increases confusion.
boynamedsue 12y ago
"We believe in telling you up front exactly what’s going to happen to your personal information and asking for your permission before you share it with us." [1] -- Tim Cook, CEO Apple [1] http://www.apple.com/privacy/ http://www.apple.com/privacy/
Tehnix 12y ago
First off, how on earth did people expect it not to contact the outside world, when given Spotlight Suggestions or Bing Searches (both are pretty clearly marked in sections, and it's also clear that neither are local)? Second off, a common user wouldn't care for the "privacy loss" that this might be for some of you. That is why they made it opt-out instead of opt-in. If it was opt-in, nearly no one would use it, because if it's useful, why wasn't it enabled by default?
Yadi 12y ago
Ah this is an awesome fix! Haha thanks!
grey-area 12y ago
An alternative method which doesn't involve running untrusted code: 1.Open System Preferences > Spotlight 2. Uncheck Spotlight suggestions, Bing web searches and any other options you're not interested in
atmosx 12y ago
If someone wants a fine grained control of outgoing connection on OSX, I'd propose to use LittleSnitch[1]. It's extremely stable, well made, worth it's money IMHO. I've used since version 1.x upgrading happily on every version. That said, it takes time and some Googling to make sure that every connection initiated from your system is legal but for security aware users is a very interesting managing and reporting tool. [1] http://www.obdev.at/products/littlesnitch/index.html http://www.obdev.at/products/littlesnitch/index.html
boynamedsue 12y ago
It appears that you also need to uncheck "Include Spotlight Suggestions" in Safari. It's in Safari/Preferences/Search and located in "Smart Field Search."

244 points by teacup50 12y ago

While fixing spotlight is a good idea (especially if you're opening it a lot in public), please don't blindly execute code without reading it first. While this code isn't malicious, running misc. third party code without reading it first is a bad idea for everyone.

morganvachon 12y ago
The fact that the entire source code is displayed on the page for all to read seems to have escaped you. You make a valid point in general, but the site in question practically screams the same message. I don't get why you have a problem with this particular project.
- equoid 12y ago
  The fact that most people could look at that code and have no real clue what it actually does seems to have escaped you. This is in any event not the entire source code, as most of the work is done by function calls which most people would not know how to validate.
  - morganvachon 12y ago
    If the potential user doesn't understand what the script does, they have no business running it in the first place, so it's a moot point.
- jarcoal 12y ago
  I think he means you should at least read the code on the other end of that URL to make sure it matches what's on the site.
  - pilsetnieks 12y ago
    Plus you should read what's downloaded to your machine before executing it, since there's also no guarantee that what's been served to your browser will be served to your curl.
  - morganvachon 12y ago
    That's just it: It does. Line for line, character for character (even space for space, which is important in Python). I wouldn't say what I did above without having diffed the file against the code displayed first. I just don't get the mentality here sometimes; someone creates a helpful script, puts the source code on their site for you to read and study, and the first instinct is to assume they have malicious intent before even taking a few minutes to read over it first. Hell, I'm no programmer but I know enough about the basics to follow exactly what the code does. It took me all of five minutes to decide that it flips two switches and nothing more. That the programming gods here can't or won't do that is telling. I get being paranoid about random scripts, but this one is on display for all to see before running. There is literally nothing hidden, yet you all act as if the author is trying to secretly take over your machines. It would be funny if it wasn't so pathetic.
- reedloden 12y ago
  Please read http://www.djm.org.uk/protect-yourself-from-non-obvious-dangers-curl-url-pipe-sh/ http://www.djm.org.uk/protect-yourself-from-non-obvious-dang... (https://news.ycombinator.com/item?id=8385213 https://news.ycombinator.com/item?id=8385213).
- jboy55 12y ago
  Actually what is displayed is not necessarily the same as what would be executed if you ran that script. You are viewing one piece of code , you will be executing a different file. In fact, you can view the github code, and see the code displayed is embedded into index.html (with syntax highlighting). If anyone is at all concerned with their privacy, they should never blindly run a script like that.
  - morganvachon 12y ago
    Copy the text displayed in the code block on the page, diff it against the fix-macos.py file in the curl link. It is character for character the same code. Why am I the only one not too lazy to do this?
    - jboy55 12y ago
      Today it is, tomorrow? A month from now? When the original dev ignores the site, and someone hacks his pw, changes the code, what then? I cannot seriously listen to anyone who "cares" about privacy, then asks their users to download and execute unknown code.
      - morganvachon 12y ago
        Is the link in the curl line binary, compiled, non-human-readable code? No? Then your argument has no merit. It's a plaintext python script. Download it, parse it, if it checks out, run it. If it doesn't check out or you don't understand it, don't. It doesn't matter if it's today, a month from now, or a year from now. If the code checks out, and you feel like it will help you, run it. Or don't, and no one will care. Or are you seriously going to tell me that you feel you can't trust a 75 line script you just fully vetted, but you can trust, say, the Linux kernel, despite the fact that you didn't manually parse the millions of lines of code in it? If that really is your argument, then I can only imagine that you stop on green and go on red out in the real world, because that's pretty damn fucked up.
        jboy55 12y ago
deleted 12y ago
[deleted]
itg 12y ago
Especially when you can do the same thing by going into system preferences. What a click bait title that leads people to run a script.
brudgers 12y ago
Running miscellaneous second party code is also becoming increasingly problematic from a privacy standpoint...e.g. Windows 8 and Android [with Google services installed] also want to phone home.
geographomics 12y ago
There's always the danger of this attack, as well: http://thejh.net/misc/website-terminal-copy-paste http://thejh.net/misc/website-terminal-copy-paste
- hk__2 12y ago
  Here it’s even worse because you don’t see the content of the script you’re executing.
  - jonknee 12y ago
    What do you mean? The content is the majority of the web page... You can copy it from there, or if you're paranoid you can run: curl https://fix-macosx.com/fix-macosx.py Before the suggested: curl -o https://fix-macosx.com/fix-macosx.py && /usr/bin/python fix-macosx.py That said, at this stage just set the correct preferences. I had already done that before seeing this script, it's pretty simple.
    - dmix 12y ago
      ...This should just be the instructions: 1) $ curl -o https://fix-macosx.com/fix-macosx.py 1a) Review fix-macosx.py 2) $ /usr/bin/python fix-macosx.py
moloch 12y ago
It's the same security model as downloading a binary and running it.
arrrg 12y ago
It’s not “fixing” anything. It’s changing a preference people can have different opinions about.

jackmaney 12y ago

This reminds me that I should really get around to figuring out how to disable spotlight altogether. It can occasionally peg my CPU.

mwfunk 12y ago
mdutil -a -i off Or, 'man mdutil' if you would rather not type in commands suggested by random people on the Internet. :)

ahassan 12y ago

What exactly does this enable/disable?

dewey 12y ago
I suggest you read the section called "Why do we need this?" on the linked page ;)

sksk 12y ago

It took me a while to figure out what is being disabled in the code and why I need to care. I care about privacy but I would like to understand what I am giving up. If I understand it correctly, the code disables 'Spotlight Suggestions' and 'Bing Websearches'. You can do it in the GUI easily. Just go to System Preferences -> Spotlight -> Search Results tab (uncheck the above 2). Bing Websearch is clear enough but it took me a while to figure out what Spotlight Suggestion is. It looks like it gives you movie recommendations. If there is more to the code, I would like to know what else I should disable. Also, ideally would like to know what I am giving up by disabling them.

serve_yay 12y ago
It's explained in the sidebar

comex 12y ago

You could also just go into Spotlight settings yourself and uncheck "Bing Web Searches" and "Spotlight Suggestions", rather than executing some random script. The "About Spotlight Suggestions & Privacy" button even tells you what to uncheck.

Ricapar 12y ago

The Python script is a bit unnecessary. Go to System Preferences > Spotlight. Uncheck items you don't like to have searched and displayed for you.

etjossem 12y ago

For those interested, here's the specific language Apple offers to explain what Spotlight is doing. I didn't see it elsewhere so I figured I'd post it. From the Spotlight preferences pane: "When you use Spotlight, your search queries, the Spotlight Suggestions you select, and related usage data will be sent to Apple. Search results found on your Mac will not be sent. If you have Location Services on your Mac turned on, when you make a search query to Spotlight the location of your Mac at that time will be sent to Apple. Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine. These searches are not stored by Microsoft. Location, search queries, and usage information sent to Apple will be used by Apple only to make Spotlight Suggestions more relevant and to improve other Apple products and services." "If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results tab in the Spotlight preference pane found within System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac." "You can turn off Location Services for Spotlight Suggestions in the Privacy pane of System Preferences on your Mac by clicking on “Details” next to System Services and then deselecting “Spotlight Suggestions”. If you turn off Location Services on your Mac, your precise location will not be sent to Apple. To deliver relevant search suggestions, Apple may use the IP address of your Internet connection to approximate your location by matching it to a geographic region." "Information collected by Apple will be treated in accordance with Apple’s Privacy Policy, which can be found at www.apple.com/privacy."

kingnight 12y ago
Could this be considered overthinking it? A domain, a python script, to effectively achieve tapping a couple toggles in sys prefs? And this is quite difficult for the average non terminal using person. > This site _criticizes_ Apple for certain privacy-invading features of Mac OS X and teaches users how to fix them. So, obviously, the site is not approved by Apple. Snark!
- ptomato 12y ago
  Not to mention that it encourages possibly not technically inclined users to execute random scripts from the internet, which should be a capital crime.

jdechko 12y ago

I'm actually a little more curious about the specifics. What data is transmitted? Because spotlight can search the web, so that's going to transmit data to 3rd parties. Is the data associated with the user or is it anonymously transmitted? Also, I can't remember because it's been so long since I installed the beta, but is there an option during setup that asks for permission to collect usage data as in iOS (which would be checked in a default installation? If so, does that preference include this data?

gicmo 12y ago

If you bring up the Spotlight search window it will even tell you: "In addition to searching your Mac, Spotlight now shows suggestions from the Internet, iTunes, App Store, locations nearby, and more. To make suggestions more relevant to you, Spotlight includes your approximate location with search requests to Apple. You can change this in Preferences. Learn more…" Clicking on "Learn more" also tells you how to disable it. The python script is neat but a bit exaggerated IMHO.

revelation 12y ago
I actually clicked the learn more, and it took me to a help site that somehow didn't exist. Failed to load. Then I manually went into Spotlight settings, and was presented with a bunch of checkboxes that offer zero indication as to privacy implications. How am I to magically tell that the "Movies" option won't send my query to some Apple IMDB proxy? Sorry, but this script is spot on. This should not be enabled by default, and the privacy implications need to be spelt out in every single detail. It should be a legal requirement, really.
- eridius 12y ago
  > [...] that offer zero indication as to privacy implications There's a very prominent button labelled > About Spotlight Suggestions & Privacy on the Spotlight preferences window. If you're worried about the privacy of your searches, you can click that, and you get a detailed description of exactly what's going on, and how to disable it (to wit, uncheck "Spotlight Suggestions" and "Bing Web Searches").
  - eropple 12y ago
    This is literally the first I've heard of this, and I upgraded yesterday. I didn't see whatever warning supposedly appears on the first use of Spotlight because--as I always do--I hit it and started typing. The idea that having a button in the bowels of a preference menu is sufficient is...I don't want to say "nuts", but I'm thinking it pretty hard. I'm not happy. Not unhappy enough to subject myself to a Linux desktop, but Apple is making it closer and closer with every release.

rockshassa 12y ago

am i the only one wondering what MENU_OTHER is?

RKearney 12y ago
It's for unknown filetypes that are matched by your search query which don't fall under any of the other categories.

digitalzombie 12y ago

I use Alfred... http://www.alfredapp.com/ http://www.alfredapp.com/

ChuckMcM 12y ago

There is a war on going in search. You can see it in Google's quarterly results where this last quarter they spent nearly a billion dollars on paid distribution (aka people they pay to send them searches that they can monetize rather than people who just show up at Google.com or one of their properties). It stuns me that Apple hasn't bitten the bullet and built a search engine yet since they could make more on it than Google is paying them to send queries there way but that is just Apple. But the spotlight 'net search' like Ubuntu's Unity search box gives those folks something to sell to Google and Google is buying. It is perhaps easier than building your own search engine but not as profitable once you get above a few million queries a day.

carlesfe 12y ago
Well, maybe the recent approaches to duckduckgo and their reaffirmation on user privacy are hints at the future of Apple and DDG... just a thought
eridius 12y ago
Based on Apple's past history, they do not want to sell your personal data. That's Google's modus operandi, and common for other companies too, but Apple has demonstrated time and time again that they are focused on the user. To that end, there's 2 things going on here: 1. Apple added functionality called Spotlight Suggestions, which pulls in data from the internet, including things like iTunes and App Store results, wikipedia results, movie showtimes, etc. It's basically a form of the specialized search results you get in search engines (such as Google, Bing, and, yes, even DuckDuckGo) where it tries to extract semantic meaning from your query and give you the result inline. This is generally considered very useful for search engines, and Apple decided they wanted Spotlight to have this behavior. I think this makes sense. Spotlight is basically Sherlock 2.0, so this finally restores behavior that Sherlock (and Watson before it) had (although Sherlock/Watson required you to explicitly search the various providers, whereas Spotlight decides when to do the searches based on its own interpretation of the query). The privacy implication here is that searches used with Spotlight Suggestions are sent to Apple, so they can improve Spotlight Suggestions. This is something that web search engines already have, and is important for making the functionality behave better. This data is not shared with anyone else, sold, or monetized. And yes, I believe Apple when they say that. Also to note, this is basically exactly what already happens with Siri. Your Siri queries are sent to Apple (so they can actually be answered), and that information is used to make Siri better. 2. The second part of this is Bing Web Searches. It appears most queries don't even go to Bing. I tried a random sampling of queries and never saw any search results. The Privacy button states that "Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine", which makes it sound like Bing only even sees the search if Spotlight determines that it can't handle this query with local data or Spotlight Suggestions. Which is to say, this does not mean that Microsoft sees every search you do. It seems they only see some searches, which are for "common words and phrases". Also, according to this, "These searches are not stored by Microsoft", which suggests that Apple's contract with Microsoft puts restrictions on them regarding how they can use the search. --- Ultimately, Apple only cares about what makes the user experience better. They're in the hardware business. That's where their money comes from. And they're successful precisely because whenever they're given the choice between something that might make more money, vs something that makes the user experience better, they choose the latter every single time. And monetizing searches does not make the user experience better.

leepowers 12y ago

Is there a way to undo? Let's say I run this script, but don't like the results. How do I undo and revert to a previous system state?

nkozyra 12y ago
Just modify these lines in the dict/list: {'enabled' : True, 'name' : 'MENU_WEBSEARCH'}, {'enabled' : True, 'name' : 'MENU_SPOTLIGHT_SUGGESTIONS'}, And re-run.

mukmuk 12y ago

I disabled both Spotlight Suggestions and Bing yet Spotlight -- via SpotlightNetHelper -- still attempts to connect to api.smoot.apple.com:443 and wu.apple.com:80. Can anyone explain this?

pilsetnieks 12y ago
Location services? Edit: I think that you have to disable Location service for Spotlight separately in Privacy settings.
- mukmuk 12y ago
  Good thought, but I disabled that too. Edit: Twitter discussion regarding one of these issues. Note that Spotlight is doing this despite all relevant settings disabled (spotlight suggestions, bing, privacy, and logging). https://twitter.com/marczak/status/481818945318428673 https://twitter.com/marczak/status/481818945318428673
  - pilsetnieks 12y ago
    wu.apple.com is an address associated with location service requests. If you've disabled location for spotlight, it's possible that it was something else requesting the location. No idea about that smoot thing, though.
    - blantonl 12y ago
      A quick fix would be to add wu.apple.com to your hosts file with an address of 127.0.0.1 - not long term and certainly not an overall fix.

click170 12y ago

I strongly encourage anyone concerned about their privacy to start using a firewall that filters (or at least monitors) outbound traffic by default. And not just the packets, but the web requests. You would very likely be alarmed by what your phone is doing and who it's talking to without you knowing. iPhone or Android.

iamdave 12y ago
Recommended tools? I've gotten by for a while on Little Snitch. Good enough for a single user on a home network?
- click170 12y ago
  I use a Sophos Home Edition UTM. It's mostly Open Source with some proprietary bits sprinkled on top. It also comes with AV software, though I won't speak to the efficacy of said AV software. I would like to build an equivalent fully-FOSS system, but haven't had time to do that yet. It would of course need to be Ansibled (or equivalent).

jhh 12y ago

Cool, there are python bindings for some Apple APIs? I wasn't aware.

micampe 12y ago
Pretty much all of them https://pythonhosted.org/pyobjc/ https://pythonhosted.org/pyobjc/
dustinfarris 12y ago
Hah! Really, this is the main take-away from the entire OP and discussion.

ebbv 12y ago

Executing random scripts from the web is far, far worse than anything Spotlight is doing. Oi vey.

0x0 12y ago

It's missing a default value for "DEVELOPER" (whatever that is)

rch 12y ago

Feels like Apple is the new Sony. No more MBPs for me.

al2o3cr 12y ago

Breaking news: searching on Google sends your query to a third-party server! FILM AT 11!

userbinator 12y ago
Yes, and most if not everyone who uses a computer understands that Google searches the Internet. Spotlight was mainly for local search, so they would not expect that their queries for local files be sent outside of their computer.

mwfunk 12y ago

I applaud them for publicizing the implications of the default privacy settings for Spotlight, but hyperbolic titles like the one used here hurt their credibility unnecessarily. I know some people think that using hyperbole for effect is a thing. They tend to be very young, smart people who are starting to realize what they're capable of but are still trapped on the wrong side of the Dunning-Kruger curve. The most common defense people give is that they assume the reader or listener knows that the hyperbole shouldn't be taken literally, and that they're really trying to convey how strongly they feel about their much more reasonable actual opinion on the matter. However, to me (and, I would hope, to most people), hyperbole in technical discussions means that the person is either immature in a way that makes them less credible, or that they are lying to me and assume I'm dumb enough to believe them. Or it's clickbait, or all of the above. I don't think the author(s) of this site are any of those things, but I also know that Yosemite as a whole is not designed to take away 100% of your privacy, which is what the title implies. This is also what turns me off about a lot of FSF propaganda, and most politicians regardless of their beliefs.

dstein64 12y ago
> I don't think the author(s) of this site are any of those things, but I also know that Yosemite as a whole is not designed to take away 100% of your privacy, which is what the title implies. This is also what turns me off about a lot of FSF propaganda, and most politicians regardless of their beliefs. Are your referring to the title of the HN submission, "Mac OS X Yosemite – No Privacy, by Design"? That text does not appear on the website. The website refers to "parts of Mac OS X which are invasive to your privacy."
- mwfunk 12y ago
  Yep. I could be wrong here, but I thought that HN had a policy where the titles used are taken verbatim from the page being linked to, unless they're so completely terrible that an alternative title is needed. If the HN title doesn't come from the site, then my apologies to the authors for harping about this.
  - 12y ago

13throwaway 12y ago

I noticed iOS 8 has been doing this too via api.smoot.apple.com

enlightenedfool 12y ago

The first time I clicked spotlight after upgrade to yosemite, I was clueless what to do with the pop-up. closed, clicked spotlight several times until i realized i need to start typing and then saw the cursor. something weird about the whole UI changes. I prefer the old look and glossy icons. what's up with flat everything. The first thing I did was disabling the web search in spotlight.

deadweight3 12y ago

I have zero issue with this, and it's clearly labelled and explained. Of all the breaches in my privacy, this isn't one I'm worried about. Google gets 100% of my searches and email messages, so it's a question of who you trust.

GrantS 12y ago
To each his own, but I just want to point out that your examples of web searches and email require that SOME third party be involved because they are, by definition, attempts to reach a computer somewhere else on the internet. In contrast, searching the local files on one's own computer or launching applications on one's own computer are private, local events that need not be shared with any third party. Inherently private stuff just happens to leak out into the world now because Spotlight does web search too.
- deadweight3 12y ago
  Everything you put on your computer should be assumed to be public the moment you connect to the internet. With air gap jump technology starting to become proven, you should assume that all digital content is public. To think otherwise is hubris and stupidity all wrapped up with a tiny little bow. Every company and government agency has been compromised to one degree or another, and targeted attacks are 100% effective given even slight competence on the part of the hacker. I've been around since before the modem, I've seen everyone hacked. Regardless, it doesn't matter. It's simply ignorant to bitch about this, when the NSA literally intercepts all of this and exploits or introduces exploits into the software you use. This is fact. Apple at it's worst will present you an advertisement, big fucking whoop. Seriously, what is the risk? Annoyance? The NSA can wrap you around a pole and make it appear you were snorting 12kilos of coke a day. I am quite literally baffled by the sentiment on HN when I see people up in arms over convenience like this trumped up as if it were in violation of your rights. They added a 'learn more' link and explain what is going on. Yet the same people simply ignore the actual threat, repeatedly. Cowards. Keep fighting them windmills. Because the real enemy fights back.
  - 12y ago

unknownBits 12y ago

They will need to put a knife on my throat to buy that Apple sucking nightmare. But, definitely a cool fix if you're unfortunate enough owning one:)

cheriot 12y ago

"Verification is required. Please click Billing Info to approve your billing information for use in the iTunes Store. If you cancel you will not be able to buy until you have approved your billing information." For a FREE upgrade? I'm sure Apple has data showing that people with a credit card on file are more likely to buy paid apps/songs/etc, but this is fucking annoying.

NSCFType 12y ago
One of the payment types is 'None'. http://i.imgur.com/oCqZf2b.png http://i.imgur.com/oCqZf2b.png

hayksaakian 12y ago

Real Question: Does anyone consider OS-native search that queries your local computer AND the web to be useful? As the default in ubuntu, it is actively confusing, and distracting. At least from my point of view, if I'm searching for something using my OS search, that means I want to find something ON MY computer. If I want to find something online, I will look online (google, etc.). The workflow from OS -> OS Search -> Browser -> Search is often slower than Alt-tabbing to the browser that is already open, pressing Ctrl+T and typing your query. This approach of combined search might make sense on mobile, where cloud storage is the norm, but on a personal computer, it is an insane default.

userbinator 12y ago
I certainly maintain a distinction between the two, and definitely never want queries for local files to leave the machine as they can contain sensitive information. Apple mentions that the local results of queries won't be sent, but the query itself will.
SoftwareMaven 12y ago
It may be confusing to people today. It will be expected behavior by the next generation. The real issue is what is "local" and what is "remote" is blurring. We see it with things like Google Docs, where they are "my" documents, and I want something like Spotlight to be able to search them, but they aren't local. What we have today is two problems: First, we are in the middle of the transition. People are needing to learn new behaviors. That's always hard. Second, it isn't seamless yet. While I haven't tried it, I highly doubt my Google Docs would show up in the my Spotlight search. The fragmentation increases confusion.

boynamedsue 12y ago

"We believe in telling you up front exactly what’s going to happen to your personal information and asking for your permission before you share it with us." [1] -- Tim Cook, CEO Apple [1] http://www.apple.com/privacy/ http://www.apple.com/privacy/

Tehnix 12y ago

First off, how on earth did people expect it not to contact the outside world, when given Spotlight Suggestions or Bing Searches (both are pretty clearly marked in sections, and it's also clear that neither are local)? Second off, a common user wouldn't care for the "privacy loss" that this might be for some of you. That is why they made it opt-out instead of opt-in. If it was opt-in, nearly no one would use it, because if it's useful, why wasn't it enabled by default?

Yadi 12y ago

Ah this is an awesome fix! Haha thanks!

grey-area 12y ago

An alternative method which doesn't involve running untrusted code: 1.Open System Preferences > Spotlight 2. Uncheck Spotlight suggestions, Bing web searches and any other options you're not interested in

atmosx 12y ago

If someone wants a fine grained control of outgoing connection on OSX, I'd propose to use LittleSnitch[1]. It's extremely stable, well made, worth it's money IMHO. I've used since version 1.x upgrading happily on every version. That said, it takes time and some Googling to make sure that every connection initiated from your system is legal but for security aware users is a very interesting managing and reporting tool. [1] http://www.obdev.at/products/littlesnitch/index.html http://www.obdev.at/products/littlesnitch/index.html

boynamedsue 12y ago

It appears that you also need to uncheck "Include Spotlight Suggestions" in Safari. It's in Safari/Preferences/Search and located in "Smart Field Search."