Hacker News Reader

Comment by sneak | Hacker News Reader

> You can turn off all the telemetry in macOS and they ask you if you want it on when you setup the computer.

That's false. You can turn off OS analytics but there is tons of telemetry built into almost every Apple app, separate from that, that you cannot disable. It tells you about it on first app launch. Open Maps, for example, and it will tell you about the unique, rotating identifier it uses to track your searches. Opting out of OS analytics does not disable telemetry for the other Apple services now deeply integrated in the OS. Even disabling these features doesn't prevent the mac from talking to the services, such as in the case of Siri.

Additionally gatekeeper OCSP checks on app launches serve as telemetry in practice, and this has no preference or setting to disable it.

View on HN

Exactly. But at least pre-Big-Sur you could use Little Snitch to block Apple apps from sending things, but now that's no longer possible. :(

If you have an intel mac, you can still install LS 4.x (once you have booted into recovery to permit the kext) on Big Sur. HN user miles pointed this out recently, and it is awesome.

https://www.obdev.at/support/littlesnitch/245913651253917

It's 5.x that uses the new restricted APIs.

I'm going to contact the developers and ask for an ARM build of 4.x so the same trick will work on M1, at least until Apple forbids all kexts some time in the future.

This is deal breaker for me and lots of security conscious professionals. I have foreseen this "Apple goal" in the past and the only thing thats keeping me to use MacOS is Little Snitch and Mullvad VPN combination. Sadly in Linux world there is no commercially viable option for access rules per app basis and I don't understand why. I don't have answer for another question: As a business I learned from Apple that keeping tight security and protecting your intellectual property is big thing. How on earth big business is complicit in this telemetry approach from Microsoft, Google and Apple? If you are business captured metadata is enough to know important metrics about your company and this may work against you in the long term. Thats why I am against cloud based apps (like Figma), and I am furious with Sketch for not providing collaboration solution and bragging about "Mac Only" approach.

It's because it's very time-consuming but ultimately it's more security theater than any meaningful benefit. An attacker has many ways to easily bypass tools like Little Snitch and they only have to succeed at one of them, whereas you have to hope that you take time away from your job to successfully block all of them.

If you're trying to prevent data exfiltration, you don't trust the client at all — confine it to a dedicated locked-down system on a restricted network which only allows egress to the minimal subset of trusted services. That's a much more winnable battle than trying to prevent every possibility on a general purpose computer running tons of things which are allowed to connect to the internet and legitimately uses lots of outside services.

Similarly, a lot of the data breaches you hear about are caused by people with legitimate access saving the data somewhere insecurely. Spending time on that is a lot more beneficial to most organizations than tracking every TCP socket.

Thanks for your comment. You described exactly what I am going to do. + Hardware Firewall/Vpn.

They’re working on the OCSP issue and I would say it’s more of a disclosure bug than telemetry, which implies intent. You’re right about Maps but you’re saying it’s “almost every app,” do you know of others? Because I’m pretty sure it’s not “almost every app,” and moreover in Maps it’s required to deliver the functionality, so I’m also not sure I would call it telemetry.

Stocks. Weather. News. Maps (has a unique ID across multiple interactions to serve as explicit telemetry). App Store (sends device serial). TV (sends device serial). iMessage (sends device serial).

Telemetry doesn't imply intent. Many things serve great as telemetry that aren't intended to be such. There's no way to limit the way the raw data collected can be mined later, offline.

Do you have resources on the data collection these apps do? I'm interested in digging deeper.

tcpdump them, or read the data/privacy disclosure link at the bottom of the first launch pane of any of them.

https://github.com/kholia/OSX-KVM if you need an easy way to fire up a fresh install.

I never use those apps so I wasn't fully aware that they did this. Seems like it's for advertising though. I've had ad tracking turned off on their platforms for years.

It's not for advertising and there is no preference setting to disable this tracking.

What is it for, then? And where is it described in their policy?

Additionally gatekeeper OCSP checks on app launches serve as telemetry in practice, and this has no preference or setting to disable it.

This is just a check that the developer's certificate hasn't been revoked or expired. I wouldn't call it telemetry.

Apple has said they're working on allowing users to opt-out of Gatekeeper checks if that's what people want.

Details—https://eclecticlight.co/2020/11/16/checks-on-executable-cod...

> This is just a check that the developer's certificate hasn't been revoked or expired. I wouldn't call it telemetry.

It's an unencrypted network transmission of a unique identifier, at the time of an app launch, that maps to a single app for 99% of cases (due to the fact that almost all developers publish only a single app). That's objectively telemetry no matter what you call it, irrespective of the intent of the designers.

Approximately 0% of all users of macOS will change this setting, so Apple adding a preference toggle (that defaults to "send my local app launches to Apple via the network") is irrelevant from a privacy perspective.

As the article states [1], Apple is changing to an encrypted connection, the IP addresses are no longer logged and the checks never included the Apple ID of the user or the identity of the user's device. Definitely not telemetry.

[1] For those concerned with protecting their privacy, Apple makes it clear that “these security checks have never included the user’s Apple ID or the identity of their device”, and that it has stopped logging IP addresses.

The commitment to encrypt is "within the next year". That means it's been telemetry for the last two years, and will likely continue to be so until the next major macOS release, approximately a year from now.

The fact that Apple isn't logging the IPs any longer is irrelevant. The data is unencrypted, and your ISP and their ISP and everyone in between can log the data.

The fact that it doesn't include the Apple ID or device identity is similarly irrelevant. The IP address also communicates unique identifiers to other services (including at Apple), so the IP address is sufficient unique identifier in this instance. Additionally, even if one doesn't have any access to those other records mapping the IP address to the user (held by Apple, the carrier, and many others), simply monitoring the specific set of apps that are opened (again, because the data is unencrypted) is sufficient in many cases to fingerprint and uniquely identify the device.

>That's objectively telemetry no matter what you call it, irrespective of the intent of the designers.

There's no objective definition of "telemetry" that I know of, though, and this is a purely functional feature implemented straightforwardly. They are moving towards encrypting the requests, too.

Whether or not you can toggle something is absolutely relevant from a privacy perspective. Gatekeeper is something that should be on by default anyways, and I personally am more concerned about my endpoint security than Apple getting pinged with a signature when I open an app.

Reply on news.ycombinator.com