Apple's whitelist of the 250k auto-completable domains in iOS | Hacker News Reader

Apple's whitelist of the 250k auto-completable domains in iOS

cdn.smoot.apple.com

373 pointsvarenc172 comments

This is an interesting little example of how "systemic" happens, or can happen.

The list exists initially to support a feature, a utilitarian reason. Then, being in the list has SEO value or some such. The list becomes a legitimacy or authority test. It affects traffic, sales.

Maybe other stuff piggybacks this list. Anyone who needs a list of important domain names uses it. Ordering search results, caching, testing, crawling... More dynamics unrelated to Apple's original purpose.

Meanwhile, Apple continues to treat the list as a relatively unimportant thing... Just a clunky little hack that enables autocomplete. At some point, willfully ignorant of a whole industry of professional services out there promising to get you on list.

Yes, nice to see we've come full circle at last from Karp, Mills and Postel maintaining the official HOSTS.TXT throgh the "free internet era" and back to a nice sanitised, official list of what's on the internet.

Ok, maybe I am missing something here. The link points to a list Apple is hosting without any context.

Does anyone know why this list is hosted and what it is used for?

Is it even used?

Edit: some 7 year old posts suggest it was used by Spotlight.

I also am a little amazed it loaded and scrolls smooth on Firefox mobile...

When I type "analog.com" into the search bar, I can imagine a way for autocomplete to go wrong. This list would prevent it from going wrong.

Can't say the same for Firefox on Windows, on a powerful PC :/

That's because Firefox on desktop parses JSON.

For context, see my buried comment explaining how I found this here: https://news.ycombinator.com/item?id=30906482

In summary: I don't have any indication it's in current use. I saw this URL in intercepted traffic from an iOS 13 device. I suspect it was used at some point but not anymore. I bet iOS 15 still uses something similar but doesn't use this particular URL (perhaps one with more obscurity/protection).

p.s. I also found this list of spelling corrections/autocompletes: https://cdn.smoot.apple.com/static/static_corrections_dict/2...

Some examples:

   {"q":"hackernews","c":{"hackerneww":0,"hackernees":0,"hackernee":0}}
   {"q":"ycombinator","c":{"ycomi":0,"ycombinatir":0}}
   {"q":"apple store","c":{"apple stire":0,"apple stoe":0,"apple stoee":0,"aple st":0,"aplle":0,"aple":0}}

The link https://cdn.smoot.apple.com/static/spotlight_suggestions_sto... is interesting.

It's a binary file, but if you look at the hex dump there's a list of vaguely "bad" words near the end including "whorehouse," "Zipperheads," "unabomber". I have no idea what format it is, though.

My competitor is in this list and I'm not, even though my site is more popular. There even are some small Dutch campings, municipalities and regional football clubs on this list. It's a strange list for sure.

My website is in there but with a typo (people often make that mistake) :( The website with typo doesn't exist.

Can you buy the domain and redirect them?

Periodically searching this list for purchasable domains seems like something scammers would be very very interested in. Honestly, apple should be making sure every one of these URLs goes to a live website and that the website is still exactly the website they intended it to be.

> and that the website is still exactly the website they intended it to be.

How could they realistically do that?

I am sure they can find a way with tens of billions in quarterly revenue.

Billions in quarterly revenue doesn't allow Apple to solve the halting problem. I can't begin to imagine how they would do what you're suggesting. They need to detect when a website changes in kind, but ignore day-to-day changes or normal UI revamps.

There is a service called Visualping that basically does this. It takes a screenshot and sends you a “diff”. You can set it and say by what % things need to change.

They could use a similar tool plus human review to maintain the list.

I'm honestly unclear on how you can't see how Apple could solve this with billions. It is definitely a "throw money at it" situation, no question.

Moderation is a hard problem because it isn't just a matter of someone filtering between the polite posts and the less polite posts, it's a matter of filtering between the polite posts and the content that will sear your soul, no joke.

But that's not what this is. This is just, is the website still there and look correct? With the correct software setup it's roughly a person-month by my estimate to gets eyes on every site in the list.

(Though most people usually don't set write this sort of software very well, making someone laboriously click this, scroll around some, click some more, click a tiny radio button, click the tiny submit button, wait for the next thing to load, etc. It'll be longer & more work with this style. Someday I hope to have the chance to write some sort of classification program and implement the UI I've wanted for a while, which amounts to "right -> ham, left -> spam", and everything as pre-rendered as I can get it before it gets to the human. I'm sure some people out there have done something like this, but it makes me honestly sad how few I've seen.)

> Billions in quarterly revenue doesn't allow Apple to solve the halting problem.

That would be a good point if this were the halting problem. It's not. It's a list of domains that you're suggesting to users.

For starters, a VERY basic solution might be to look up the domain name ownership information and see if that has changed. If so, flag for review.

Secondly, you can store the public SSL certificate and make sure that's still the same. If it changes, flag for review.

Thirdly, screencap the site, save it, periodically re-cap and compare how similar the images are. If it changes, flag for review.

> I can't begin to imagine how they would do what you're suggesting.

Did you try?

> They need to detect when a website changes in kind, but ignore day-to-day changes or normal UI revamps.

The solution doesn't need to be perfect, it needs to be good enough.

If you make a curated list, you become responsible for it ?

So I guess the question is, what is the alternative?

The only realistic option I can think of is some combination of:

• Make autocomplete operate on a blacklist instead of whitelist, with a more limited goal of only removing e.g. known porn sites.

• Make the list of potential matches machine-generated, without human intervention. (Aside, are we sure the current list isn't just the 250K most-visited sites on the internet, or something like that?)

Either of these would remove culpability since it's no longer a curated list. And yet, would that make it more safe in a meaningful way?

Why should Apple avoid autocompletion of porn site domains? That’s an area rampant with scam sites, especially similar domains. Plus “everyone” looks at porn so the benefits would be widespread.

If Apple wants to protect users then autocompleting porn site domains seems like the place to start, not avoid.

The absence of porn domains raises the question of Apple’s intent.

> Why should Apple avoid autocompletion of porn site domains?

Because if I’m sharing my screen on a business call, and I start typing something into my browsers’s address bar, I don’t want it to autocomplete something nsfw which just happened to share the same first letter.

By that logic it should also exclude the /jobs page of your competitors website. And probably also social media sites.

There's no such thing as "machine-generated, without human intervention". Even something as seemingly simple as "most-visited websites" involves measuring choices. (Fundamentally, this is indeed about responsibility. Until a non-human gets some form of citizenship, they have none.)

Furthermore, we now know that in practice "machine-generated" seems to be even worse, because too many people are fooled by the "the machine did it" 'excuse'. (Like you seem to be doing here ?)

For instance : https://thedataist.com/book-review-automating-inequality/

1: Whois every site on the list.

2: Did the owner information change since last time?

2n: No action required. Maybe select some sites randomly to have a human compare, but it's probably fine.

2y: Have a human check the site. Did it simply get purchased by another (similar) organization, or is it no longer relevant to its original purpose?

3: Do the needful.

Oh, using whois seems reasonable!

It's been a long time since whois returned any useful information about the ownership of most domains, unfortunately.

One of my old domains is on the list. It was a relatively popular blog years ago, once it expired it immediately got picked up by a spammer. This list is garbage.

Solid point.

Which is the cause, and which the effect? Was apple's incorrect autocorrect causing them to go to the wrong place initially, or did they autocorrect list get built from the incorrect attempts?

I had an issue where it was actually redirecting me to an entirely different website. wbay[.]com would get redirected to ebay[.]com. There was a whole thread about it: https://news.ycombinator.com/item?id=23646158 https://news.ycombinator.com/item?id=23651334

mailboxapp.com (long dead/euthanised) is there, but mailbox.org (kicking) isn’t.

It might be a list that was made by each company request? Based on some form or authentication or as such? And the companies who didn’t approach Apple aren’t there. Just guessing. But I can imagine Apple doing such hacky things, though most of those remain behind the orchard curtain.

Judging by the quality of some of the websites the chance that their webmasters / marketing teams will ever know the existence of a list like this is close to 0%.

FWIW, I am on the list, and I certainly did not ask Apple for that honor ;P. (Also on that list: some scam that is pretending to be me, lol.)

Neither I nor my largest competitor are on the list, which is fair enough. However a now-defunct domain which my competitor previously used for their hiring portal is on the list. Weird!

I'm curious to see how this changes over time, so I threw together a quick repo with a GitHub action to watch the endpoint.

https://github.com/b0o/apple-autofill-domains

My bet is it's a manual update process once in a blue moon

Interesting! Perhaps it could even post a comment to an issue so people can subscribe to it.

Good idea! I’ve created an issue[0] that can be subscribed to, I will implement the feature soon.

[0]: https://github.com/b0o/apple-autofill-domains/issues/1

Random q: why fetch depth 20?

That’s actually a bug, thank you. It will break as soon as the last modification to the data file is more than 20 commits behind HEAD. I used 20 because it made the workflow function (it was working on my local machine but not when I pushed to GitHub because the default depth is 1). I need to update it to check for the last commit that modified the json file rather than searching through the entire commit history.

You should be careful with the cron intervals because GitHub eventually just disabled one of the actions that I wrote that worked exactly like this. I was generating a list of the YouTube's dynamic ad-serving domains.

Ha! This explains why I always get "cookieandkate.com" suggested when I want to visit another site that starts with "cookie". I was extremely frustrated that it suggested that site with higher priotity than the one I actually visit mostly every day. And I had never myself gone to that site.

Now I know why...

That's very strange, you'd expect Apple to provide a good UX by suggesting a website from your bookmarks, history and then their list. I wonder whether that's an oversight or an intentional implementation.

Safari does use your bookmarks and your history, but at some point the history expires so some sites I go to rarely don’t autocomplete and I add bookmarks when I notice.

Also it sometimes is too slow to pick up that I don’t want to go where it autocompleted, I hit go, then immediately hit back and typed more characters in to get the actual site I wanted. I could go and edit my history, but that process is a little clunky on my phone.

That's exactly the behaviour I have when using iOS.

I see. OP replies saying their history somehow expired, and the page wasn't bookmarked to begin with. So I stand corrected. Thank you

It does - some people always browse in Private Mode or have History off

Interesting side-note: there are only two *.ai domains on this entire list:

1. "tempo.ai", which doesn't actually resolve

2. "web.ai", an http-only site that looks kind of like a cross between a geocities website and a parked spam page, with the content allegedly last revised almost 20 years ago (2003)

I wonder how old this list is.

When I type “web.” it autocompletes to “web.archive.org”, I don’t think this list is up to date at all.

Probably stuff in your own history takes precedence?

Looks like it, my device autocompletes web. to web.whatsapp.com

Instead of doing any thoughtful analysis of this list, I'm treating it as a random web ring and clicking through to an eclectic bunch of sites.

Currently on websites starting with 'joe'.

Because Internet entropy is fun. More fun than a recommendation engine.

You reminded me of StumbleUpon. I miss that service dearly, or maybe I just miss that general era of the Internet.

Fascinating. I know of an organization that abandoned (other than redirects) their original domain name about 4 years ago and adopted a new domain name. The old domain name is in the list (with about 30 subdomains!), but the new domain is not in the list at all. This makes me wonder how (if) the list is updated.

Interesting that the list contains URLs to piracy torrent sites (thepiratebay, etc.) and the Silk Road darknet market (defunct since 2013).

The other .onions are Silk Road 3 (Created 2015) and the Hidden Wiki which Wikipedia eventually refused to link to.

These addresses are Onions v2 and now disabled in Tor.

hah I see we both discovered the same lists! Did you get these from traffic interception too? I didn't find any hits for these on Google but not surprised you beat me to it of course. I'm a long time fan of your apple-hacking blog posts.

For others, here's the other ones found:

- "correction_dict_url": "https://cdn.smoot.apple.com/static/static_corrections_dict/2..."

- "crowdsourcing_blacklist_url": "https://cdn.smoot.apple.com/static/crowdsourcing_blacklist_u..."

- "crowdsourcing_whitelist_url": "https://cdn.smoot.apple.com/static/crowdsourcing_whitelist_u..."

- "spotlight_model_resources": "https://cdn.smoot.apple.com/static/spotlight_model_resources..."

- "spotlight_stopword.map": "https://cdn.smoot.apple.com/static/spotlight_suggestions_sto..."

- "spotlight_phrase_dictionary.map": "https://cdn.smoot.apple.com/static/spotlight_suggestions_phr..."

- "silhouette_topic_mapping": "https://cdn.smoot.apple.com/static/silhouette_topic_mapping/..."

- "silhouette_whitelisted_topics": "https://cdn.smoot.apple.com/static/silhouette_whitelisted_to..."

- "silhouette_config": "https://cdn.smoot.apple.com/static/silhouette_config/5/silho..."

- "dictionary_resources_url": "https://cdn.smoot.apple.com/static/dictionary_resources_url"

Also I just realized that the source of all these doesn't require auth either and you can just view it here: https://api.smoot.apple.com/bag (but requires a spoofed user-agent if you use cURL)

I pulled it from running strings on SafariServices.

zombo.com is there :-)

Of course it is, you can do anything at zombo.com

It looks like the list is very old. Tutanota.de is on it, but we've switched to using tutanota.com years ago...

Hey thanks for making a great email service!

250k is off by one, actually 249999 entries:

  $ curl -s https://cdn.smoot.apple.com/static/autofill_tld_whitelist_url | jq '.tlds|length'
  249999

Hah I appreciate your accuracy.

I got 250k by running this:

   $ curl https://cdn.smoot.apple.com/static/autofill_tld_whitelist_url | jq | wc -l
   250004

And then I naively assumed with the extra JSON brackets the total would be 250k but I wasn't thorough enough!

I noticed that tiktok.com is missing, so this list might have been compiled sometime before 2019. I wonder if you could write a script that pinpoints the exact month or even day.

I wrote a script: https://github.com/ndbroadbent/autofill_tld_whitelist_url_ag...

This attempts to scan WHOIS records for random domains in the list and try to find the most recent "registered at" date for a domain.

It's very unreliable. The whois-parser Ruby gem thought that giants.it was created on 2020-11-03 09:00:01, but I checked the record and it looks like it was actually created on 2009-09-28 11:00:43.

It looks like nature-in-art.org.uk was first registered on 21-Jul-2019

I don't know if this would provide any useful information. It would take at least a year for a brand new domain to make it into this list. And I don't know if the "created at" date can be trusted, maybe it gets reset whenever a domain is transferred, or lapses and then gets renewed.

In conclusion, I don't think this idea works at all.

Anyone know how this list was created or how often it gets updated?

My hunch was that it originated well before iOS, and could be traced back to forking KHTML, but if that hunch was right I can’t find any way to validate it.

Agreed. Some of the domains there were popular 10-15 years ago, but are now relatively obscure. Meanwhile, high traffic domains that have emerged over the past few years are missing. Compare "pricerunner.com" and "tiktok.com" for example.

The list was at least updated after iOS:

I've found wiibrew.org and hackmii.com in there which are both Wii homebrew sites that became popular around 2008/2009 and probably declined in popularity starting in ~2012/2013.

Then there's also wiiu-developers.nintendo.com and wiiudaily.com which probably didn't exist before late 2012 or early 2013 when the WiiU was released.

This an interesting question. Skimming the list it seems that - at least - it is not based solely on popularity (like the Alexa 1 million list for example).

I see lots of websites for small German towns, which should only have a couple of visitors per week.

Of the blogs and personal websites I read - some popular, some less so - only paulgraham.com is there.

I suspect the list is biased to official and very old domains.

To add another data point: I couldn't find "substack" on there, and it's been around since 2017.

At this moment, Last-Modified HTTP header reads `Wed, 30 Mar 2022 02:27:02 GMT` (5 days back).

The strangest thing about this list for me is that it contains multiple .onion addresses. It also seems to have been at least somewhat filtered for "objectionable" content (porn etc.).

I assume it must have come from user searches at some point?

There are also seven pirate bays.

My guess actually is that iOS/Apple no longer uses this particular list. I found this by intercepting traffic on an older jailbroken iOS 13 device. Given how old some of the domains in the list are, I'd guess that iOS 15 no longer uses it. I also never actually saw my phone fetch this list, I just saw this URL in another configuration response.

tl;dr; I bet it'll never get updated. (but some similar list at a more hidden/protected location likely will be)

p.s. this list of common spelling corrections is interesting too: https://cdn.smoot.apple.com/static/static_corrections_dict/2...

Oddly enough, tier 1 cell carriers that have agreements with Apple aren't immune to being forgotten by Apple.

The list has "orange.co.il" (now NXDOMAIN) but not "partner.co.il". Partner (one of 4 main cell networks in Israel) used to be called Orange but they terminated that agreement with Orange FR years ago (which I'm guessing is why they can't redirect "orange.co.il" either).

I'm curious if this control over auto-complete can help direct users to websites that are favored or approved by Apple, and eventually change people's opinion of which sites are "good".

In a way it's a slight step towards allowing or disallowing visiting certain websites. Is the owner of the phone allowed some control here?

And i assume there are no adult content providers in that list. Who will autocomplete that for me :(

I agree! Typing on mobile with only one hand is the worst!

"smoot" dot apple dot com?

Doubtless named for The Smoot-Hawley Tariff Act which raised or lowered taxes? Anyone? Anyone?

Raised tariffs, not taxes. It's an important difference, doubly so with regards to Smoot-Hawley because the whole point was to protect American companies (and therefore jobs) from foreign competition (of course, it did not work...).

(It was a Ferris Bueller's Day Off reference. Blame Ben Stein.)

... and I have not yet seen Ferris Bueller, so I didn't get the reference. Consider us even ;)

I see tons of DNS requests for this domain blocked by AdGuard. I wonder what it's for.

https://apple.stackexchange.com/questions/157424/what-are-ap...

Could be further immortalization of Oliver Smoot, “a fraternity pledge to Lambda Chi Alpha, who in October 1958 lay down repeatedly on the Harvard Bridge (between Boston and Cambridge, Massachusetts) so that his fraternity brothers could use his height to measure the length of the bridge, which summed to "364.4 Smoots ± 1 ear"

https://en.wikipedia.org/wiki/Smoot

I cannot find this url in the list, https://victorantos.github.io/typeahead.js/examples/

I have the very strong feeling that this is is powered by https://register.apple.com/placesonmaps/ – at least as a hint. As soon as you have officially registered your Apple Maps entry (with an website URL) that website gets on the list.

e: This is reinforced since we updated our domain/URLs from a ccTLD to a gTLD not long ago, also claiming the Maps entry, and the list reflects the gTLD domain!

Ugh, I guess that's why the iOS browsers all suck so hard with autocomplete?

I always long for Firefox's url bar, it easily beats everything else since Firefox 2 came out or so. Nowadays you have to un-configure two layers of "let's put a search bar in your URL bar" but then it's still just amazing. Especially compared to google, which obviously doesn't have an incentive to have you skip searching on google.com... and apparently apple doesn't want to you complete just any old urls, but only apple approved ones?! This seems like such a useless kind of (soft, but still) gate-keeping...

It seems like a useful privacy feature to me. I don't want Apple or Firefox to pass every site I visit every time I visit it to Google, Apple or any other company under US law.

Yes, although in principle this kind of list should only be necessary for fresh browsing profiles (plus people who don't keep a local browsing history). Once you've used the browser for a while, autocomplete should predominantly be powered by your local browsing history anyway.

Firefox on Android e.g. used to (or still has – I'm not sure what the state is nowadays after the rewrite) have a similar (although somewhat smaller) list of popular domains which it would use for providing autocomplete results if it couldn't find anything in your history, but local history always had priority.

I switched to Firefox about a year ago but I'm really missing the autocomplete from Chrome. I guess sharing my entire digital life with Google had some upside after all.

Joking aside - Firefox makes some strange choices and the I wish mobile and desktop could (optionally) share more of my browsing history. Maybe they do but the autocomplete doesn't behave the same across devices.

> Ugh, I guess that's why the iOS browsers all suck so hard with autocomplete?

No. Contrary to popular belief, browsers on iOS aren’t all Safari skins. They all use WebKit, but there’s a vast amount of functionality in a web browser that isn’t handled by the rendering engine. This is one example.

Non-Safari browsers on iOS are free to use whatever address bar implementation they like. If Firefox on iOS has a crap address bar, that is 100% down to Firefox.

>No. Contrary to popular belief, browsers on iOS aren’t all Safari skins.

I know some people hate Apple for both good and bad reasons, but it's pretty wild to me people think Apple does this. I mean right out the gate that would be pretty illegal, no?

...what are you talking about?

Every browser you use is forced by App Store policy to run off of the system WebView, which is Safari...other features being part of the browser doesn't change being forced into using that engine.

> Every browser you use is forced by App Store policy to run off of the system WebView, which is Safari

No. It’s WebKit. Not Safari. That was the whole point of this subthread.

What are you talking about lol

It would not be illegal. In fact the iPhone launched with only Safari.

Because Apple is selling the hardware device, they can decide what software they ship on it. This is not specific to phones, it’s true of all hardware. There’s no feature to load arbitrary browsers onto a PlayStation, for example.

> There’s no feature to load arbitrary browsers onto a PlayStation, for example

Not anymore. https://en.wikipedia.org/wiki/OtherOS

That feature has been dead for over ten years.

I specifically meant letting you download, say, Google Chrome, and it's not actually Chrome but Safari. Unless I'm misunderstanding what that person described, which is totally possible.

right, it's just about the rendering part. so yeah, firefox can do that. I haven't really paid attention to this since I don't personally use apple devices. I'll make sure to pay attention to it though next time I use my girlfiend's ipad. I already installed firefox on there just to have a sane browsing experience, but it wasn't specifically for the autocompletion.

I am guessing that this list has not been updated in years - or at least properly validated.

For example, search for “nytimes.com”. Many of the subdomains haven’t been used in years - and are to blogs that were retired 6 or so years ago.

I was at first guessing this this might have had as a (partial) data source the hsts static preload list[1]. But, a domain I know we never submitted to it was on there while one which was submitted (but has since aged out) is not. Also these lists are so absurdly large

[1] https://cs.chromium.org/chromium/src/net/http/transport_secu...

Here is the autocomplete in action using Typeahead.js https://victorantos.github.io/typeahead.js/examples/

Even with `xz --best`, you can only compress this down to 25% of its original size. I guess a more specialized text compressor that can get this to less than 10% would allow 2-3x more domains to be included.

OP here. I found this URL by intercepting traffic on my older jailbroken iOS device. It's possible that a more recent version of iOS doesn't use it. This url, among others, was returned in some configuration-fetching call to https://api.smoot.apple.com/bag (which requires auth)

Here's some other ones:

- "correction_dict_url": "https://cdn.smoot.apple.com/static/static_corrections_dict/2..."

- "crowdsourcing_blacklist_url": "https://cdn.smoot.apple.com/static/crowdsourcing_blacklist_u..."

- "crowdsourcing_whitelist_url": "https://cdn.smoot.apple.com/static/crowdsourcing_whitelist_u..."

- "spotlight_model_resources": "https://cdn.smoot.apple.com/static/spotlight_model_resources..."

- "spotlight_stopword.map": "https://cdn.smoot.apple.com/static/spotlight_suggestions_sto..."

- "spotlight_phrase_dictionary.map": "https://cdn.smoot.apple.com/static/spotlight_suggestions_phr...

- "silhouette_topic_mapping": "https://cdn.smoot.apple.com/static/silhouette_topic_mapping/..."

- "silhouette_whitelisted_topics": "https://cdn.smoot.apple.com/static/silhouette_whitelisted_to..."

- "silhouette_config": "https://cdn.smoot.apple.com/static/silhouette_config/5/silho..."

- "dictionary_resources_url": "https://cdn.smoot.apple.com/static/dictionary_resources_url?..."

Thanks a lot for the tip. I am going to add this to domainstats.com

What is this for, and what should I do to get on, or off the list?

> What is this for

Presumably to auto complete URLs, like "go" to "google.com", in Safari's address bar.

I assume it's for pre-populating the address bar suggestions. Even on a fresh browser with no history, users probably want 'nyti' to complete to 'nytimes.com', for example.

https://nyt.com

For some reason I thought the NY Times didn't own nyt.com. I chose a poor example, apparently!

It looks like something not on this list gets suggested in mobile Safari, but not autocompleted (so on top of the screen it will show as a clickable link, but you will not see the complete url in the address field and be able to just go to it by hitting "enter").

My employer is in this list, along with their main competitor. However, said competitor's domain is incorrect and links to a much smaller unrelated page.

How do you tell safari to ignore this list? When i want to go to discord safari insists on discoverykids.com.

I (think) i have turned off all search-suggestions in settings.

Wikileaks.org etc are in there. Leaving them out would be wrong IMHO. I'm not sure what to make of having them in there though.

You should "make of" it that Apple consider it a popular domain people try and navigate to

You think apple are above censorship at the behest of politicians?

Considering most of us didn't know about this list either, there simply wasn't anyone to ask for the censorship.

Various politicians have made their feelings known beyond any doubt. Note the lack of, say, pornhub etc in this list. Someone has sanitized it somehow and didn't pre-emptively censor wikileaks. That's a good thing, I guess?

Interesting.

There are several furry art communities listed, but Fur Affinity is not. Fur Affinity is the largest and most popular of these by a fair margin.

Unrelated to the furry websites the above, there are some nsfw websites listed but other, more popular ones are strangely missing. (The word "porn" does not appear in the list.)

redditenhancementsuite.com is also listed... which I did not expect.

I suspect this list is run through a keyword filter and a blacklist before anything is added.

There is however several sites that redirect to "erotic film" and blatant porn sites (the domain name also references porn, so it's not like someone scooped up another random domain here). So, probably not manually curated...

How can I get my domain added to this list? I would be great visibility for a upcoming Product.

funny, I checked the different forums I hang around and the only one in the list is the smallest (in terms of user counts). Though maybe it's the most well-known/infamous outside of its direct niche?

This thread wouldn't be complete without the mention of AOL Keywords.

How does one get access to the direct URL to such a file?

If you're here, you've made it big.

Funny enough this website is on the list.

Oh, my website is not in it... Bummer

rip parsec

rthtdhdh

> stallman.org, fsf.org, gnu.org

Keep your friends close and your enemies closer.

> breitbart.com, stormfront.org

Lulz.

Assuming this is a list for Apple's autocomplete feature on Safari and other apps, what damage can a hacker do if they were to maliciously update this file?

Homoglyph Attacks come to mind. Replace legitimate domains like nytimes.com with ones that look identical but lead to phishing sites. (The hacker would have to build those convincing phishing sites as well, of course...)

Not much if you use a password manager that checks the domain before auto filling and/or use U2F tokens as your 2nd factor.

The threat model isn’t too different from other things that can happen if a malicious user is on the same network as you. The scale would be different though.

Whitelist is a controversial / potentially offensive term, can it be changed please to allow list to make it inclusive please.

It's literally the name of the resource:

https://cdn.smoot.apple.com/static/autofill_tld_whitelist_ur...

That's a hoax just like the "ok hand gesture" = "white power" debate. It started as a joke on 4ch, now everyone (even big tech) believes in it because of a few thousand (social) media reposts.

You’re saying that the debate about the terms “whitelist” and “blacklist”, and presumably also “master” and “slave”, is a hoax?

Oh good grief.

In the same way that "master recording" or "master branch" or "mastering" are somehow not inclusive?

You'd be surprised how many people get offended (usually on behalf of others) by this these days ...

Is that really necessary when the origin and usage of both words have nothing to do with race?

Reply on news.ycombinator.com