7 ms·

For those interested, here's the specific language Apple offers to explain what Spotlight is doing. I didn't see it elsewhere so I figured I'd post it. From the

For those interested, here's the specific language Apple offers to explain what Spotlight is doing. I didn't see it elsewhere so I figured I'd post it. From the Spotlight preferences pane: "When you use Spotlight, your search queries, the Spotlight Suggestions you select, and related usage data will be sent to Apple. Search results found on your Mac will not be sent. If you have Location Services on your Mac turned on, when you make a search query to Spotlight the location of your Mac at that time will be sent to Apple. Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine. These searches are not stored by Microsoft. Location, search queries, and usage information sent to Apple will be used by Apple only to make Spotlight Suggestions more relevant and to improve other Apple products and services." "If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results tab in the Spotlight preference pane found within System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac." "You can turn off Location Services for Spotlight Suggestions in the Privacy pane of System Preferences on your Mac by clicking on “Details” next to System Services and then deselecting “Spotlight Suggestions”. If you turn off Location Services on your Mac, your precise location will not be sent to Apple. To deliver relevant search suggestions, Apple may use the IP address of your Internet connection to approximate your location by matching it to a geographic region." "Information collected by Apple will be treated in accordance with Apple’s Privacy Policy, which can be found at www.apple.com/privacy."

kingnight 12y ago
Could this be considered overthinking it? A domain, a python script, to effectively achieve tapping a couple toggles in sys prefs? And this is quite difficult for the average non terminal using person. > This site _criticizes_ Apple for certain privacy-invading features of Mac OS X and teaches users how to fix them. So, obviously, the site is not approved by Apple. Snark!
- ptomato 12y ago
  Not to mention that it encourages possibly not technically inclined users to execute random scripts from the internet, which should be a capital crime.
  - sitkack 12y ago
    What like downloading a tarball over http? Watch your own binary/source traffic for a day, we are downloading random ass executable content all day long.
    - ptomato 12y ago
      That's not something non technically inclined users do, nor should they.
- micampe 12y ago
  Yes. One single annotated screenshot would have been simpler, more explicit in what it does, it wouldn't have trained users to execute random code from the internet, and at the same time taught them how to revert the changes.
- ljfuller 12y ago
  Howdy. Author here. By way of introduction, I'm also the author of PLCrashReporter (https://www.plcrashreporter.org/ https://www.plcrashreporter.org/), ported Java 6 to Mac OS X (a.k.a Soylatte), and -- this might lower some folk's estimation of me here -- started the MacPorts project almost 15 years ago at Apple, along with co-workers Jordan Hubbard and Kevin Van Vechten. That slightly snarky disclaimer you quoted actually has a serious backstory; the language came from https://fixubuntu.com https://fixubuntu.com (whose AGPL code was used here), and it was added after Ubuntu sent a legal demand that "Ubuntu" be removed from the fixubuntu domain name and website: http://arstechnica.com/information-technology/2013/11/canonical-abused-trademark-law-to-target-a-site-critical-of-ubuntu-privacy/ http://arstechnica.com/information-technology/2013/11/canoni... I actually toned down the snark -- just slightly -- from the original disclaimer. It's remarkably easy to miss Spotlight's privacy disclosure in Yosemite -- the instant you start typing in the Spotlight search box, the disclosure disappears, and seemingly stays gone. There's no single "local search only" toggle, and you have to cross-reference the documentation provided in System Preferences against the list of "Search Results" to figure out which of the options actually sends your queries to Apple. I wanted something simple, that I knew worked, and I could just tell family to run themselves, so I put this together. It's a convenient way to apply the settings, a jumping-off point for a more involved effort to resolve some of the other remaining privacy issues on Yosemite, and a handy way to get the privacy message across. If you're interested in chipping in on the OS X privacy front, there's a lot more to look at than just Spotlight; my next goal is to get https://github.com/fix-macosx/sslsplit https://github.com/fix-macosx/sslsplit transparently capturing traffic in a Yosemite VM so that we can start nailing down exactly what is being sent from the myriad of daemons (and spotlight!) that are sending data outwards in a default configuration. I'm very sympathetic to the "random internet code" issue, so I struck a balance by: 1) Displaying the source inline in the page (of course, there's no guarantee that it matches the downloaded code, but the goal here is to highlight the important of knowing what you're running). 2) Making the actual script URL a clickable link, so that folks that don't blindly execute curl scripts (myself included) can easily download the script and examine it. 3) Used a variation of the usual pipe approach (curl -O … && ./…) so that anyone downloading it would actually have a copy of what they just ran. 4) Serve the whole lot over TLS. Cheers, Landon
gress 12y ago
So, the title, as well as being innuendo, is false - it's not 'by design' it is 'by default', and only for search terms. I think it's fair enough to point out that these search terms are transmitted to Apple. It's also reasonable to complain that the option is hidden, and the terms and conditions where this is pointed out are glossed over. This site, however, is counterproductive theater designed to look hackerish and scary, as well as to mislead users. It commits exactly the same error as Apple is accused of committing - it hides the fact that there is a simple UI to control this function, and that users should be educated to make the choice for themselves. Whoever did this is making things worse.

kingnight 12y ago

Could this be considered overthinking it? A domain, a python script, to effectively achieve tapping a couple toggles in sys prefs? And this is quite difficult for the average non terminal using person. > This site _criticizes_ Apple for certain privacy-invading features of Mac OS X and teaches users how to fix them. So, obviously, the site is not approved by Apple. Snark!

ptomato 12y ago
Not to mention that it encourages possibly not technically inclined users to execute random scripts from the internet, which should be a capital crime.
- sitkack 12y ago
  What like downloading a tarball over http? Watch your own binary/source traffic for a day, we are downloading random ass executable content all day long.
  - ptomato 12y ago
    That's not something non technically inclined users do, nor should they.
micampe 12y ago
Yes. One single annotated screenshot would have been simpler, more explicit in what it does, it wouldn't have trained users to execute random code from the internet, and at the same time taught them how to revert the changes.
ljfuller 12y ago
Howdy. Author here. By way of introduction, I'm also the author of PLCrashReporter (https://www.plcrashreporter.org/ https://www.plcrashreporter.org/), ported Java 6 to Mac OS X (a.k.a Soylatte), and -- this might lower some folk's estimation of me here -- started the MacPorts project almost 15 years ago at Apple, along with co-workers Jordan Hubbard and Kevin Van Vechten. That slightly snarky disclaimer you quoted actually has a serious backstory; the language came from https://fixubuntu.com https://fixubuntu.com (whose AGPL code was used here), and it was added after Ubuntu sent a legal demand that "Ubuntu" be removed from the fixubuntu domain name and website: http://arstechnica.com/information-technology/2013/11/canonical-abused-trademark-law-to-target-a-site-critical-of-ubuntu-privacy/ http://arstechnica.com/information-technology/2013/11/canoni... I actually toned down the snark -- just slightly -- from the original disclaimer. It's remarkably easy to miss Spotlight's privacy disclosure in Yosemite -- the instant you start typing in the Spotlight search box, the disclosure disappears, and seemingly stays gone. There's no single "local search only" toggle, and you have to cross-reference the documentation provided in System Preferences against the list of "Search Results" to figure out which of the options actually sends your queries to Apple. I wanted something simple, that I knew worked, and I could just tell family to run themselves, so I put this together. It's a convenient way to apply the settings, a jumping-off point for a more involved effort to resolve some of the other remaining privacy issues on Yosemite, and a handy way to get the privacy message across. If you're interested in chipping in on the OS X privacy front, there's a lot more to look at than just Spotlight; my next goal is to get https://github.com/fix-macosx/sslsplit https://github.com/fix-macosx/sslsplit transparently capturing traffic in a Yosemite VM so that we can start nailing down exactly what is being sent from the myriad of daemons (and spotlight!) that are sending data outwards in a default configuration. I'm very sympathetic to the "random internet code" issue, so I struck a balance by: 1) Displaying the source inline in the page (of course, there's no guarantee that it matches the downloaded code, but the goal here is to highlight the important of knowing what you're running). 2) Making the actual script URL a clickable link, so that folks that don't blindly execute curl scripts (myself included) can easily download the script and examine it. 3) Used a variation of the usual pipe approach (curl -O … && ./…) so that anyone downloading it would actually have a copy of what they just ran. 4) Serve the whole lot over TLS. Cheers, Landon

gress 12y ago

So, the title, as well as being innuendo, is false - it's not 'by design' it is 'by default', and only for search terms. I think it's fair enough to point out that these search terms are transmitted to Apple. It's also reasonable to complain that the option is hidden, and the terms and conditions where this is pointed out are glossed over. This site, however, is counterproductive theater designed to look hackerish and scary, as well as to mislead users. It commits exactly the same error as Apple is accused of committing - it hides the fact that there is a simple UI to control this function, and that users should be educated to make the choice for themselves. Whoever did this is making things worse.