Hacker News Reader

Comment by aunty_helen | Hacker News Reader

In reality, you just don't realise how much bloatware osx has. Install a firewall and watch as studentd or 100 other services you never use contacts apple.

Edit: List of most recent and trying not to include things that may be useful to me syncdefaultsd, nsurlsessiond, apsd, cloudd, transparencyd, mapspushd, cloudphotod, akd, parsec-fbf, appstoreagent, AddressBookSourceSync, com.apple.iCloudHelper.xpc, familycircled, trustd, AssetCacheLocatorService.xpc, imagent, indentyservicesd, com.apple.sbd, studentd, airportd, configd, parsecd, com.apple.geod.xpc, com.apple.geod.xpc, avconferenced, rapportd, trustd, remindd, helpd, syspolicyd

Long list right.... that's from the previous 3 hours.

View on HN

So basically in that list you’re suggesting disabling the ability to download web content, syncing of address books, getting updated security signatures, connecting to iCloud, downloading dynamic assets that many apps use to reduce initial size and provide non-binary updates, Siri keyword suggestions in Safari, Airdrop, Maps integration, push notifications for Messages, etc.

Most Apple users will definitively want those on, and will break your system in subtle ways if you disable them. I wouldn’t make such assumptions about whatever you use the service or not. If you don’t use a service, it typically will have very little traffic if any at all.

> Most Apple users will definitively want those on, and will break your system in subtle ways if you disable them.

What happened to the good old days of "ask for user consent before phoning home"?

I mean, Apple is miles ahead of Windows in that regard, but your average Linux or BSD setup won't phone home outside of repository downloads unless requested.

I think you have your target demographics mixed up for MacOS and Linux. Once you reframe it in that light, you've answered your question. One is a poweruser who wants complete control of their environment, the other is a much broader user who wants a convenience of experience and safe environment. Trade offs to both of them.

The only happy medium I would consider to your approach is that if MacOS had two set up routes, one defaulting as a power user turning everything off and then initiating things are you want and another as a general user. Maybe that would solve it (though would be a heavy lift I am sure).

This is the Little Snitch[0] problem. If you have ever used Little Snitch, you will soon realize that 1) there is so much crap phoning home and 2) most people do not want to deal with giving permission to each and every one of these services.

I have tried giving permission and at the end of the day, it's just not worth the time. For me, Little Snitch is great as a reporting tool but it's just too much work as a firewall.

[0]https://www.obdev.at/products/littlesnitch/index.html

> most people do not want to deal with giving permission to each and every one of these services.

It’s far worse than just annoying: if people have to give permission to a bunch of things they don’t understand, they will absolutely give permission to something they shouldn’t.

You want the user to make a few decisions as possible, and every single one should be an actual decision: where the user knows what the options are, has an actual stake, and might legitimately choose either option depending on their preferences and circumstance.

The more times they have to click “yes” without thinking, the more susceptible to malware they become.

I think this is a bit of an odd take, given that the alternative is that the computer just silently allows you to download content from anywhere. I don't think this makes someone any more susceptible to malware than they already were. Little Snitch is the sort of software that the average person wouldn't install, anyway.

I understand the point, though. Going to just about any major website you will be pummeled with prompts to allow for a dozen different domains just to view one page, and it doesn't really give any indication of what those are used for. They have a what seems to be infinitesimally small list of connections that they do recognize and explain their use, but ultimately it's pretty useless for the vast majority of prompts.

I'd like there to be a better way to deal with this, but I'm not really sure what the solution to it would look like. You can download blocklists and just silently allow other connections, but I don't think that's significantly better than just using a hosts file.

The most useful thing Little Snitch does is alert me when individual applications try to phone home. For browsing the web it feels more like a chore.

> the computer just silently allows you to download content from anywhere

How many times have you been asked to approve a download? How many of those times have you said "no"?

If the answer is "hundreds" and "zero," what's the point? If the answer "hundreds" and "ten just in the past week," then that's exactly the point, and it serves a valuable purpose.

My response was mostly to your last sentence, "The more times they have to click 'yes' without thinking, the more susceptible to malware they become." There exists a dichotomy of you click on a link, it loads the page or begins the download or alternatively, you click the link, Little Snitch checks its filters and if it doesn't have a rule set, it'll prompt you to set one. In no case is the second one going to make someone more susceptible to malware, because the worst case scenario, where someone approves every single download, results in exactly identical outcomes as the person who does not have Little Snitch installed.

I agree broadly with your point that prompt fatigue or decision fatigue is problematic and should be avoided when possible. I think this is a problem in particular with Little Snitch even, which doesn't do enough to provide. However, the point of Little Snitch is to allow someone to monitor and control the traffic at a granular level and the consequence of providing that utility is the frequent prompts whenever you're visiting a new site. To Obdev's credit, silent mode exists and you can set it to deny or allow all traffic without a prompt (and evaluate the traffic at your leisure).

Yep. I have a system tray CPU monitor running on both my Linux mint and mac computers. On mint when I don’t touch the computer it just sits at 0% basically all the time. On macos there’s always some junk flitting around doing who knows what. photoanalysisd, or sending telemetry for 3rd party apps, or iCloud syncing or something. It’s like the 2 E cores are there just to run apple’s bloaty crap. Shame those processes don’t limit themselves to E cores.

Is there any way to turn all this stuff off?

>If you don’t use a service, it typically will have very little traffic if any at all.

Like I said this was all from the last 3 hours and I haven't used any of those services listed. It's also missing the point a bit, I'm not bandwidth poor on a 3G connection trying to save my datacap.

I don't want apple turning my laptop into a thinclient for their cloud systems. I don't want telemetry and meta data going to them every ~30 seconds (the little snitch icon flashes a red X every time something is blocked, it's on a per minute basis).

Of all those services I use calendarsync. I miss having airdrop a little bit but everything else I don't need.

Also, the way you've phrased some of those, especially the notarisation

> getting updated security signatures

is a bit disingenuous when there's a massive privacy implication in that it allows apple to know every single application I run on my computer.

Most Apple users wouldn't agree to that if you stuck it in their face and the fact that it breaks the OS in subtle ways is a user hostile position to argue from. Hence why I'm giving up my Apple addicition.

> getting updated security signatures

AKA phoning-home to Apple what apps you launch in realtime, in an unencrypted manner visible to your ISP/hotel/government too.

It also connects to all of that crap even if you have LS off, analytics off, iCloud/FaceTime/iMessage/AppStore off, et c.

Press F8 and your serial number gets transmitted to Apple.

I guarantee you there are no unencrypted communications going to Apple.

Wanna bet? Apple still hasn't yet made good on their promise of encrypting OCSP (the making of which I would like to believe is my fault).

the making of which I would like to believe is my fault

How so?

https://news.ycombinator.com/item?id=25078034

Hostname: ocsp.apple.com

IP Addresses: 2600:1402:e::b833:965b

  2600:1402:e::b833:9661

  2600:1402:e::b833:9669

  2600:1402:e::b833:966a

  + 17  more

TCP Port: http (80)

Protocol: TCP

Connected: no

Connects: 0 allowed, 7,359 denied

First Activity: 2/11/21, 22:20

Last Activity: 5h 29m ago

Yea sorry, sneak's right, it's still going port 80.

Perhaps I'm wrong. I thought encrypted checks came out with Monterey?

https://support.apple.com/en-us/HT202491 (bottom)

What data is actually going over OCSP? I thought it was only ever checking for revocation and not actually sending app data, and I believe only ever happens when you want to take an app out of quarantine versus every app launch. You can always disable gatekeeper if you so please.

It does check for revocation. Using the developer's unique certificate ID, which, for the vast majority of developers, uniquely identifies an app. Over unencrypted HTTP.

OCSP over unencrypted http has not yet been replaced. I believe that the constellation of apps (identified by proxy by their developer IDs which are transmitted) can in a lot of cases uniquely identify a system, given a sufficient number of apps installed/used.

Jesus Christ, thank you. People act as if bullshit like TV and FaceTime are perfectly innocuous binaries without 6478 daemons molesting your memory irrespective of deliberate use & permissions.

I agree with the previous person that Windows has more bloat. I don't want the 3-5 3rd party games it pre-installs and several other things. I also agree with you though. For me, All the Apple software is stuff I don't use so when I get a new Mac the first thing is removing Mail, Maps, Contacts, Pages, Photos, Calendar, Facetime, Reminders, AppleTV, Music, Keynote, and more and then removing the bloat widgets like News, Stocks, etc...

> removing Mail, Maps, Contacts, Pages, Photos, Calendar, Facetime, Reminders, AppleTV, Music, Keynote, and more and then removing the bloat widgets like News, Stocks, etc

All of the things in your list are just apps that can be removed with one click. My partner’s PC comes pre-installed with masses of hidden spyware. I know the kneejerk reaction is to bash Apple for everything - but the two are totally not comparable.

Many of those are useful to me even if you don’t care about them…which proves your point: there’s no reasonable (and sometimes none at all) way to pick and choose.

Opt-in is no longer seen as a reasonable solution?

You’re automatically “opting in” whether you want to or not, so it’s hard to see what’s optional here.

Does it make a difference if you disable all of the iCloud stuff in settings? I let it sync most of my stuff so it moves between platforms, but I always assumed it wouldn't phone home for services where syncing is disabled. If it does this anyway, seems like a mistake.

Hey so I’ll be getting my first MacBook Pro in a couple weeks, so I’m still learning the details about OS X. I’m coming from a windows / Linux background.

I thought the OS shipped with its own firewall? Would you recommend using a third party firewall despite having its own?

Little Snitch https://www.obdev.at/products/littlesnitch/index.html

Windows and Linux user for 25 years [EDIT Windows for 25, Linux for 20, to be more precise], heavy macOS user (in addition to those) for the last 10 or so.

If it has a firewall of any kind, I've never noticed nor interacted with it. I've also never installed a third party firewall.

Firewalls can do two things, mainly. Block inbound connections, block outbound connections. The macOS firewall is mainly intended for the former. Many folks want to prevent the latter (e.g. blocking phone home connections).

Get little snitch. This is a firewall that dosen't care what apple thinks is useful.

There was some controversy in the previous year because apple tried to deprecate the firewall hooks and allow their junk passed the replacement they offered.

I'm leaving apple for linux as we speak for two reasons, privacy and they can't help but mess with shit every time they release an update.

The most recent, this week they released an update and now their airport service listens on port 5000 making a conflict with running a dev flask service locally.

s/airport/airplay

> I'm leaving apple for linux as we speak for two reasons, privacy and they can't help but mess with shit every time they release an update.

"Mess with shit" was what drove me to Linux by around 2015. It seemed like every major MacOS upgrade torched my Eclipse-based Java dev environment, generally requiring a reinstall.

I mean, you can turn that off. Is changing a port such a showstopper?

I’ve flip flopped for years, (I was using freebsd more than 20 years ago, genuinely ran Solaris 10 with my own build of kde4 on a hp probook, etc) but last time I tried to use Linux for work I got defeated by a conference suite projector at a client and it cost us a big contract. The happy path (for me anyway) is doing all actual dev work on Linux vms and using macOS as your browser/im/terminal client — which it’s great at.

And it works with those stupid little projector dongles at clients when you’re trying to pitch them 6 figures of consulting ;)

> I’ve flip flopped for years, (I was using freebsd more than 20 years ago, genuinely ran Solaris 10 with my own build of kde4 on a hp probook, etc) but last time I tried to use Linux for work I got defeated by a conference suite projector at a client and it cost us a big contract. The happy path (for me anyway) is doing all actual dev work on Linux vms and using macOS as your browser/im/terminal client — which it’s great at.

It takes about one time of "this didn't work and it's your fault for using Linux" in a business context to break one of using Desktop Linux (or BSD, et c.), I think. I doubt similar stories are uncommon. I've got one, certainly.

At least if MacOS or Windows breaks, you're not the asshole. And it doesn't hurt that they in fact do break less often (well, Win10 with its abrupt, unexpected, and slow forced updates was a real problem for a while, but otherwise)

>There was some controversy in the previous year because apple tried to deprecate the firewall hooks and allow their junk passed the replacement they offered.

Funny how framing something that's true (allowing apple software to bypass firewalls) is seen as a controversy. See previous discussion on hn: https://news.ycombinator.com/item?id=24838816

Lulu is as good as Little Snitch and free. It's by Objective-See. https://objective-see.com/products/lulu.html

There are multiple firewall options, but it's worth noting that Apple can circumvent them at a kernel-level if they want to phone home. You should think long and hard about how much you trust Apple before switching everything over.

The pf firewall is unaffected and can stop any calls to Apple.

Apple ships the pf fireball by default. It's a powerful firewall (same as OpenBSD AFAIK) but the way Apple configures it is very permissive. You can use a utility like Murus to configure it to your liking, although the configuration is rather complicated. It's also a network-level firewall, not an application-level firewall.

If you'd like an application-level firewall, you can check out Lulu or Little Snitch. Back when Little Snitch still(?) installed kernel extensions, it was found to be quite insecure—there were talks at DEFCON about it. Lulu is a lesser-known alternative.

s/fireball/firewall/

The OS firewall can only block incoming traffic (but not Apple's I believe) and has almost no configuration options.

Some popular third party solutions that are actually useful are Little Snitch [0], LuLu [1], and AdGuard [2].

[0] https://www.obdev.at/products/littlesnitch/index.html

[1] https://objective-see.com/products/lulu.html

[2] https://adguard.com/en/adguard-mac/overview.html

Mac OS comes with pf installed. This can block inbound and outbound traffic. There is a utility called Murus that manages this with a GUI, https://www.murusfirewall.com

Thanks, forgot about pf! Murus seems the perfect middle-ground for when day-to-day management through commandline tools is too much (I lasted for about a week!), but GUI tools sometimes too restrictive.

But that's 1st party vs. 3rd party, big difference!

I can't tell if this is a defense or outrage? 1st party seems worse as, depending on the purpose, it might be harder to remove.

Reply on news.ycombinator.com