Hacker News Reader

Comment by jjcon | Hacker News Reader

For the record I don’t believe Apple is collecting that info - having said that I think the biggest issue with Apple is that it is not possible to fully audit and determine what they collect and what they don’t. Just because they aren’t constantly sending hashes over the internet after viewing each photo in finder doesn’t mean that similar data isn’t collected at all over the many encrypted connections apple maintains with their servers and Mac computers.

It would be colossally stupid for them to betray user trust in that way as it would almost certainly come out eventually, but that doesn’t change the trust problem they ultimately do have.

View on HN

"For the record I don't believe Apple is collecting that info - having said that I think the biggest issue with Apple is that it is not possible to fully audit and determine what they collect and what they don't."

This begs the question why is it not possible. I monitor the traffic on the computers I own which means I have sometimes to decrypt traffic from applications and then re-encryot before sending from the loopback to the local network I own and then over the wire onto "the internet". I like to know what data applications are sending or trying to send. I like to have control over it. That's not unreasonable in the slightest.

Yet, in the "tech" company model of computer network use, the computer owner is discouraged, e.g., scary browser warnings, SSL errors, connection failures, etc., from placing any trust in themselves. Instead it advocates, if not effectvely mandates, placing trust (and fees, i.e., for "domain names") in some other entity, e.g., Apple, other "Certificate Authorities", etc. The mere act of questioning this model is often attacked by "tech" workers commenting online. Watch it happen in the replies.

Under this model, it is as if the the computer and local network owner does not also own the traffic. Who owns the computer. Who owns the local network. Who own the data. Who should be allowed to view it and control it. If anything, one would think the computer and network owner should be allowed to prevent any third party, including Apple, if they so choose, from initiating remote connections and sending data from the computer owner's computer.

Even after purchase Apple believes it is entitled to collect data from someone else's computer, over someone else's network. And it also believes no computer purchaser ever has an interest in seeing what data is being collected, by monitoring the traffic, let alone an interest in preventing these connections. There is no option provided to globally disable all phoning home to Apple, to indicate "No, thank you."

It was not always like this, folks. I owned older Apple computers that never made such assumptions. The computer belonged to the purchaser. Generally, firewalls were not used to block software pre-installed on the computer by Apple. The so-called "tech industry" has moved the needle and tried to normalise what is IMHO an entirely different scenario.

It may be disingenuous to claim that Apple only seeks to know how purchasers of their computers are using them.

The first reason is that Apple does not ask purchasers for permission to do this surveillance. It just makes it a default.

The second reason is that if purchasers applied the same standard to Apple, it is unilkely Apple would agree to such surveillance of its own computers.

Imagine hypotethically that purchasers shared data with Apple but every time Apple used the data, Apple computers would automatically make outbound connections from Apple's computers, over Apple's internal local network, through Apple's firewalls, over the internet, to purchasers computers so the purchasers could "understand how Apple was using their data".

Imagine further that Apple had no control over these connections, and that Apple was not allowed to "MiTM" the outbound connections made from Apple's computers to purchasers' computers to see what data/information was being sent.

What if purchasers argued that by using TLS certificates they controlled they were "only trying to protect the security of their ecosystem", e.g., the collection of entities with whom they share data. What if purchasers argued they were only trying to protect Apple against "MiTM attacks"^1 where, e.g., a third party might learn about Apple's activities, namely how Apple uses the data Apple gathers from Apple computer purchasers.

The point is that Apple might have concerns about others, including its hardware customers, knowing when and how it is using its own computers. Similarly, purchasers might have concerns about others, including Apple, knowing when and how how they are using their own computers.

1. "Tech" companies, acting as intermediaries, will claim they are using TLS to protect web users from third parties, the "MiTM", but curiously the "MiTM" never includes the "tech" companies themselves. In practice the "MiTM" actually includes the web user. WTF. In response to a web user who does not portray himself as a "developer" nor a "security researcher"^2 stating they wish to "MiTM" their own connections, a "tech" worker commenting in response might be dismissive.

2. https://www.bounteous.com/insights/2016/11/17/using-charles-...

> I like to know what data applications are sending or trying to send

Good luck with that. Unless you are running a Commodore 64 it is unlikely that a single person can understand, inspect and make decisions on modern operating systems or even individual applications.

There was a small window in which you had the option to use your computer as a 'digital typewriter' and 'sometimes send a fax', but expected and supplied functionality this day and age relies on many small components being heavily interconnected, much in the same way that social circles are interconnected, social networks (the digital variant) are based on critical mass (not technical prowess, legal status or privacy) and the amount of people that have narrow/well-defined use cases for their computers are at an all-time low making them less and less significant to cater to.

If you had a Apple computer with 10.3 or newer, this was the norm. If you had macOS 9 with iTools, it was the norm as well (for a bit until it got dropped in favour of MobileMe).

The old times weren't better, just different (and much less feature-rich). Great for a few power users, bad for everyone else.

> Good luck with that. Unless you are running a Commodore 64 it is unlikely that a single person can understand, inspect and make decisions on modern operating systems or even individual applications.

This is defeatist, and ignores the second-order advantages of Free and Open Source software. You don't need a Commodore 64, you need a decent GNU/Linux distro.

In practice, it's far less common for FOSS to contain code that works against the user's interests, as the vendor/developer has no veil of ambiguity and no deniability. Only one person needs to find the troublesome code, and they can make the rest of us aware. Everyone knows this, so FOSS malware is rarely released in the first place.

FOSS isn't a silver bullet (see Firefox's telemetry) but it's not the case that there's nothing you can do but use user-hostile proprietary software for everything.

> This is defeatist, and ignores the second-order advantages of Free and Open Source software.

That's both a gross misrepresentation of what I wrote, and completely wrong too. It doesn't matter how open your software sources are if you run it on closed hardware. And unless you go back to ancient hardware, it will be closed enough that you do not get what you think you are getting.

At the same time, it's also just realistic: if you buy something that is made to cater to a market segment that expects a lot of complex systems to appear to work together in a seamless way, supporting many features requiring many thousands of top-tier engineers to build and maintain for many years, then you, a solo user, are not likely to be able to contain the same amount of knowledge and time to see every detail and component of such a system. So no, the product, the context and biology will not allow you to contain such a system in a single mind.

Same goes for what you call user-hostile. If you ask a user which OS is more user-hostile out of a list that contains any Linux-distribution, but also Windows and macOS, it doesn't matter what is technically measures, what matters is that the user will call out that Linux distribution for being user-hostile. Again, it's not about wat is technically possible, what has been done, or what some individual does for themselves, it's about the giant user base that the commercial giants are targeting with their products.

As for telemetry: just because alarmists alarm about it all day long doesn't mean it's universally bad. What is bad is going it for user profiling and not telling about it, but if I need to know how my software is performing, I know ahead of time that asking my user base is a waste of time. Either I'll need automated reporting of things like crashes, performance measurements and spindumps, or I can't do much to make the software better. There are too many configurations and situations out there to realistically cover using some imagination and testing. Even on Debian, popcon is super useful, and people who complain about their stuff not making it on disk 1 are usually also the ones not submitting. You get what you pay for, and if you don't supply how you use the product, chances are you're not going to get an improvement you like. That is a choice to make, but removing it completely "because telemetry bad" is kinda dumb.

> It doesn't matter how open your software sources are if you run it on closed hardware.

It matters a great deal. This thread is about the behaviour of Finder, a proprietary software application.

More broadly, while it's true that most modern hardware prevents the user from having full control, it's also the case that much is won by using only Free and Open Source software.

(Last year the FSF got their servers onto fully Free Software BIOS software, but this took considerable effort as well as the use of hardware from 2012. [0])

> So no, the product, the context and biology will not allow you to contain such a system in a single mind.

Agreed, but while a total understanding of the system is one way to achieve confidence that it isn't built to work against your interests, it isn't the only way.

> If you ask a user which OS is more user-hostile out of a list that contains any Linux-distribution, but also Windows and macOS, it doesn't matter what is technically measures, what matters is that the user will call out that Linux distribution for being user-hostile.

Again this is defeatism. Free Software desktop operating systems have some usability issues, but in my experience they're much more approachable than many people seem to think. This is especially true now that a web browser is enough to enable most of what desktop computers are used for. It's not as if the non-Free operating systems are perfect either.

FOSS operating systems aren't in such a good place on mobile as they are on desktop and server, unfortunately.

> As for telemetry: just because alarmists alarm about it all day long doesn't mean it's universally bad. What is bad is going it for user profiling and not telling about it

Yes, I don't think anyone disagrees. HackerNews folks give Firefox a hard time over its telemetry precisely because the user isn't given a choice. They aren't even told it's going to happen, as I recall. It's particularly grating considering Mozilla's self-promotion as being uniquely pro-user.

> You get what you pay for

In terms of spying on their users, Debian is far better behaved than Microsoft, despite that Debian's offering is available free of charge and Microsoft's is not.

[0] https://www.fsf.org/blogs/sysadmin/closing-in-on-fully-free-...

> Good luck with that

A couple years ago I was able to intercept every connection on an Android with a mirrored switch port and Wireshark+ a root certificate. We shouldn’t be discouraging people from controlling their own machines. Certificate pinning might be trickier, I haven’t played with it yet.

It's not a case of what is technically possible, it's a case of swimming against the current while you could also choose to swim somewhere else. If you choose something that is not what you want, and you also accept that the world isn't static, but is constantly moving and due to the way it is interconnected you have to keep up at least a little bit, you will be unhappy no matter how hard you try to turn the thing you didn't want into something you did want.

It might make much more sense to just get the thing you wanted in the first place, right?

> you could also choose to swim somewhere else

Agreed, we have to pick our battles. Personally I pick this one. We should exercise as much control as technically possible over these devices that are intimately linked to every aspect of our lives.

Eh… it depends on what you think is good and bad. It’s not clear to me that surveillance capitalism will be a long term good. Gadgets and social media are fun, but digital feudalism will be (is?) a lot less fun and rewarding.

No, it doesn't. The case here is "buy a consumer device, get consumer results". If you were to expect different results, that doesn't mean that the world is wrong, it means that you bought something you didn't want.

>Even after purchase Apple believes it is entitled to collect data from someone else's computer, over someone else's network.

They are collecting data on how their software in used. Also this article is talking about a visual search feature that uses Apple's servers to search for things in your images. Apple is just as much entitiled to do this as a multiplayer game connecting to game servers. You choose to use the software and you choose to permit it onto your network.

>e.g., scary browser warnings, SSL errors, connection failures, etc., from placing any trust in themselves

These tech companies are trying to improve the security of their ecosystem. TLS is paramount in them modern world to protect people from MitM attacks.

It's freaking annoying that you can't use an Apple device without being connected to Apple.

There should be a law against that sort of thing, for hardware that you fully paid for.

While not specifically that, the EU's Digital Markets Act is moving things in that direction. I recommend reading the full text of the legislation, it has many gems.

I agree, that's why I don't buy them. All of my computers are 9+ years old and run fully up to date Linux or Windows.

I’m not sure what would make you think that Windows is even in the slightest better.

In fact it is proven that not only is Microsoft deeply in bed with the whole US Government, but the amount of vulnerabilities and flaws and outright back doors that have been publicly exposed in Windows is wildly larger.

I don’t even understand this immense focus on criticizing Apple, as valid as it is, when people use Android and Windows and Google services that are all shown as clear hangar door sized vulnerabilities.

It really kind of boggles my mind. Apple is constantly being out under pressure by the government and is constantly pushing increasing security and privacy features, as imperfect as they may be, but that is in comparison to Windows and Android, folks.

The CSAM thing did irreparable damage to Apple’s reputation. We foolishly trusted them as benevolent dictators of the walled garden. They demonstrated why that can’t work. Everyone is fallible, nobody deserves absolute trust.

Not sure why you think this only extends to Apple: https://www.microsoft.com/en-us/photodna

and I'm sure if I searched I could find the same thing for Google, Facebook and others too.

I didn't say it only extends to Apple. They differentiated themselves on privacy. That's a difficult position to hold because you can't ever make a misstep. Apple did, and they can never recover.

They announced their plans, people objected and they listened. I don’t get what the problem is?

People wanted to believe they were incapable of considering or even conceiving of such a thing, so anti-thetical to the narrative they built sparring with some US law enforcement agencies...

And by "listened" you mean "postponed until people forgot", right?

The problem is that Apple considered it at all. They could have easily not listened and then we'd be stuck with no alternative. We know these things happen in secret, the fact they even suggested it publicly means that internally at least part of their leadership thinks it is ok.

I use Linux but have a barebones Windows 10 install for one stupid stressful game that doesn't work on Linux due to anticheat. I audibly groan when rebooting to Windows to play.

With that said I can still use Windows without a Microsoft account.

> With that said I can still use Windows without a Microsoft account.

It sounds like you may not realize that you have never needed an Apple account (i.e. an Apple ID, which might call an "iCloud account") to use macOS. No magic tricks are required, although some Apple services will naturally not be avaiable.

Can you install homebrew without an Apple account? The last time I owned a mac (some years ago) it seemed as though I was required to have an Apple account to download the 'developer tools' required for homebrew to operate.

> With that said I can still use Windows without a Microsoft account.

Only because you are a power-user and know the magic trick to perform when installing Windows to avoid signing in with a Microsoft account.

Can you name/link even one such backdoor?

Wow! Did you know you can run Linux on modern hardware? It's faster that way, and doesn't change the amount of telemetry reported.

Modern hardware has backdoors that can't be disabled.

Is there any proof that such potential backdoors are practical and not theoretical? Have you considered non x86 hardware. If you were made of money for example Talos II or other more reasonable priced options?

So does older hardware, nothing was gained here.

Why? They all still accomplish what I need them to.

For a given task, newer computers are more efficient than old computers. My 20 watt Intel NUC easily fills a role that I used to fill with a 200 watt surplus PC.

Whether or not an upgrade for efficiency is worth it is subjective though.

Modern hardware isn't much faster.

2023 hardware is much faster than 2014 hardware.

So much so that 2023 laptops often trounce 2014 desktops, with a fraction of the power budget and cooling capacity.

It was true that power stagnated for a long time but it's finally back on the upturn.

The Windows installer won't even proceed without an internet connection and creating a Microsoft account, how is that any better?

Maybe that changed with 11, but disconnecting all networking on setup was the easiest way to set Windows 10 up without being pestered to enter your Microsoft ID.

Current versions of Windows 11 installer require modifications (for example with RUFUS) to be able to install without internet

You can. It's just if you do disconnect from Apple entirely, then certain features like Visual Lookups break - unsurprisingly.

Not sure why there is this persistent myth that you can only use Apple tech if "connected" to Apple.

> There should be a law against that sort of thing, for hardware that you fully paid for.

So, if Apple were to say you didn’t fully pay for the hardware, it would be OK?

You can wipe it and install Linux and use the hardware you paid for unencumbered.

So do you mean use the software you paid for? (Fair)

Or am I missing a nuance.

Edit: Or are you referring to iDevices.

> You can wipe it and install Linux and use the hardware you paid for unencumbered.

Not all the hardware, or at least not yet if you're on Apple Silicon.

Apple doesn’t place any restrictions on doing this, in fact they have set it all up to make install Linux as convenient as possible without directly adding drivers to Linux.

Mainline Linux can now run all the critical features of apple silicon laptops and the remaining stuff like power management is really just waiting on someone to work out what the best way to modify Linux to support it would be.

Asahi Linux works decently well on Apple silicon Macs today.

I was responding to this:

> You can wipe it and install Linux and use the hardware you paid for unencumbered.

My point is, it works. In fact, it works fairly well. Some people use it as a daily driver.

Not all drivers are finished though, which is what I meant by "not all the hardware". By installing Asahi you are deliberately choosing to not use the GPU, not having brightness control and a few other things are missing.

With that in mind, my point stands: by installing Linux on an Apple Silicon machine, you cannot "use the hardware you paid for unencumbered."

Better than Linux on the vast majority of Windows laptops due to hardware stability and less variability.

Running Linux on it is not the solution, as there is no documentation. Volunteers have been reverse engineering the GPU, but they still don't know whether their assumptions are all correct.

Also, is the Linux support actually official? Considering the above, I think not. I can't vote with my wallet for a company that has no clear map for the future, for my particular usecases.

Yes, iDevices are another problem. And yes, paying for the software when you use only the hardware is a problem too.

Too many problems with this company. I honestly can't understand why so many other hackers are happy being tethered and parent-controlled by Apple.

> I honestly can't understand why so many other hackers are happy being tethered and parent-controlled by Apple.

Obviously it varies from person to person.

Some just don't care about this at all and/or don't consider it an issue.

Some are just really used to it, or invested in the platforms, and don't want to waste time moving.

Some will just find much worse experiences for their taste anywhere else.

There are likely other personas in this story, these are just off the top of my head.

I haven't used Apple in 5-8 years. I prefer to build my desktops and don't use my phone much, so Android is sufficient.

Frankly, I do not understand the disdain for Apple. They built their stack. That should be admired. Also, it's one ecosystem in the market.

Don't like it? Buy something else.

Amazing, isn't it - people love to act like if you don't buy an Apple device they will send jack booted thugs to confiscate your non-Apple tech. Sigh...

Yes, fair, thanks for the reminder.

I don't think more government regulation for such a specific reason is a good idea. Just don't buy their products.

At some point this "voting with your wallet" argument gets ridiculous. How realistic is going through life without one of these slaveware devices? (defining slaveware as hardware or software that treats you as a slave to the corporation that made it) Most people are coerced to using it, not even knowing the difference, forcing you to use the slaveware as well.

Do you really think the general consumer knows about any technical details of the products they buy, and if they did, they would care enough to chose the less-comfortable option for no perceived gain? This almost never works, and I think you know that.

Do you really think the general consumer knows any medical details of the vaccines they buy? Should we regulate misinformation?

We regulate vaccines, don't we? If you're so opposed to government regulation, vaccines are a very strange example to bring up.

  > There should be a law against that sort of thing, for hardware that you fully paid for.

Why? That sounds like exactly the type of issue that the market will fix, by buying from a different vendor.

It seems the market isn't what you tink it is. At the same time, people also don't understand that the issue isn't what they think it is.

There is a vocal minority on most of these things:

- Powerusers and "learnt just enough to be dangerous" users complain about products not being targeted towards their wishes

- Privacy alarmists don't like what they can't control

- Commercial interests don't like having to pay for things, but do like getting paid for their own things

Technically all correct, but in practise this is nearly all in the same bucket as fastfood, sugar, air pollution etc. It's something that affects everyone, but it's much easier to deny it, ignore it, and just go with the nice, easy, comfortable, and profitable paths.

  > It seems the market isn't what you tink it is.

Then what is it?

I think that the market is an opportunity for companies to compete on features, price, service, and quality. Is that incorrect?

If Apple is not competing on features, then shouldn't the market provide an alternative company that does? Specifically, Apple requires a network connection to its servers to used basic functionality yet consumers do not like this. Other companies provide devices that do not require a network connection to its servers to used basic functionality, though possibly at a higher price (doubtful) or lower quality, or worse service. But the opportunity does exist.

I'm happy to hear where either my understanding is wrong, or where the market is failing.

Just look around you, do you see any critical mass on both the vendor or consumer side that does something the way you describe it?

Every time someone comes up with some confident theory on markets or how things should be, or how bad the things are as they currently are, they forget that the reality is 'the market' (whatever their definition happens to be at that time) did not, in fact, change due to either supply or demand.

So when you were to say "the market demands offline devices, and the big companies are failing because they don't deliver that", you're either talking about a theoretical market, or about a different market, but not about the mass consumer electronics market. Because the big companies aren't failing, and regardless of the demand, no significant portion seems to be supplied.

  > Just look around you, do you see any critical mass on both the vendor or consumer side that does something the way you describe it?

Yes, I do. I personally want a phone with a stylus. Samsung makes one. Somebody else wants a phone with a good camera - Apple and Samsung both make phones with terrific cameras. Somebody else wants a small phone. That's where Palm Phone and Unihertz fill the niche. Others want inexpensive phones, there is a flood of inexpensive Chinese phones. Others want security, or battery life, or E-ink screens. All of that is available. What segment do you feel is underserved?

You're missing your own point: none of those do what you described in your reply. I'm not talking about what is there, I'm talking about what you proposed should be there but isn't there.

> If Apple is not competing on features, then shouldn't the market provide an alternative company that does? Specifically, Apple requires a network connection to its servers to used basic functionality yet consumers do not like this.

So where is this proposed product? Where is the significant contender that satisfies all alarmists, privacy advocates and commercial interests, making this 'problem' not a problem?

There can't be conflicting truths, either we have a problem ("lack of product-market fit" or however we name it), or we don't ("market supplies products that fit").

Yes consumers have so much power against cartels /s

Then that's a failure of this particular market, not markets in general, no?

Or do you dispute that a market-based economy is the proper form for designing, selling, and buying goods and services?

Consumer choice doesn't work to affect shit.

For example many people want smaller phones. However manufacturers all decided to make them bigger instead.

To function in society I need a phone, so I either buy one that needs 2 hands to be operated or be an outcast and have major problems having a normal life with no access to banking, communication and so on.

What's wrong with the Unihertz Atom, or the Palm Phone for that matter? They are both solid devices. They're not Samsung or Apple, but that's the point. The large manufacturers decided that you are not their target market, so stop buying from them. There exist smaller manufacturers that supply what you want.

> It would be colossally stupid for them to betray user trust in that way

Yes. Unless, of course somebody is pointing a gun to their heads and forcing them, like the US government was already caught doing to other companies.

I can think of lots of examples where the US gov secretly forced companies to hand over data they were already collecting, but not really any situations where the gov secretly forced companies to start collecting data they weren’t already. Are there examples of the second?

Does this count? https://en.wikipedia.org/wiki/Room_641A

Interesting. Do you have any more info I could read regarding that.

Ever heard about the CLOUD Act? Or the PATRIOT Act?

Reply on news.ycombinator.com