macOS 26 breaks custom DNS settings including .internal | Hacker News Reader

macOS 26 breaks custom DNS settings including .internal

gist.github.com

390 pointsadamamyl209 comments

One of those 'woke up to MacOS updates' and finding none of my dockers are reachable via dnsmasq (which I use), and low and behold, an update silently breaks custom dns resolution. Hopefully Apple will listen to the bug report I've made. Hold off on updating if you use this…

Open articleView on HN

Papercuts like this are why I moved away from macOS.

I will say, I don't love the use of LLMs to write these bug reports. It's probably fine if reviewed, but at least review for things like "worked on macOS 25", which obviously didn't exist. If that wasn't caught, how sure are you that the rest of the report is accurate? We all want the bugs fixed, but people are going to start throwing out the obviously LLM written reports rather than have to validate each claim, since the author probably didn't.

Using LLMs for any kind of writing is unethical, with the narrow exception of translation. If you didn't take the time to compose your words thoughtfully then you aren't owed the time to read them.

There is a huge difference between using an llm and just blindly dumping it's output on someone verbatim.

I think it's fine to have an llm write a first or second draft of something, then go through and reword most of it to be in your own voice.

at this point I really think its better to read broken english than have to read some clanker slop. it immediately makes me want to just ignore whatever text i'm reading, its just a waste of time

I do wonder, we had pretty good (by some measure of good) machine translations before LLMs. Even better, the artifacts in the old models were easily recognized as machine translation errors, and what was better, the mistranslation artifacts broke spectacularly, sometimes you could even see the source in the translation and your brain could guess the intended meaning through the error.

With LLMs this is less clear, you don’t get the old school artifacts, instead you get hallucinations, and very subtle errors that completely alter the meaning while leaving the sentence intact enough that your reader might not know this is a machine translation error.

and not just artifacts/hallucinations, the worst thing about is the fact that its basically "perfect" English, perfect formatting, which makes it just look like grey slop, since it all sounds the same and its hard to distinguish between the slop articles/comments/PRs/whatever.

and it will also "clean up" the text to the point where important nuances and tangents get removed/transformed into some perfect literature where it loses its meaning and/or significance

The LLM presents a perverse incentive here - It is used for perceived efficiency gains, most of which would be consumed by the act of rewriting and redrafting. The alienness of the thoughts in the document is also non-condusive to this; Reading a long document about something you think you know but did not write is exhausting and mentally painful - This is why code review has such relatively poor results.

Quite frankly, while having an LLM draft and rewriting it would be okay, I do not believe it is reasonable to expect that to ever happen. It will be either like high school paper plagarism (Just change around some of the sentences and rephrase it bro), or it will simply not even get that much. It is unreasonable with what we know about human psychology to expect that "Human-Rewrites of LLM drafts", at the level that the human contributes something, are maintainable and scalable; Most people psychologically can't put in that effort.

>The LLM presents a perverse incentive here - It is used for perceived efficiency gains, most of which would be consumed by the act of rewriting and redrafting.

It might give efficiency gains for the writer, but the reader has to read the slop and try to guess at what it was intending to communicate and weed out "hallucinations". That's a big loss of efficiency for the reader.

I completely agree - The efficiency gains are purely from a selfish standpoint.

I just can't seem to square up that the same people that complained left-and-right about "code smells" are the same ones that are shitting out slop code and are proud they shipped 50k lines of code in a week. It's going to be a maintenance nightmare for someone else. I'm not sure how anyone coming in is going to learn a codebase written by LLMs when it's 10x more code than is reasonably needed to solve the problem.

I don't think that's fine, I think that's an example of why using LLMs to write is unethical and creates no value.

The purpose of written language is to express your thoughts or ideas to others. If you're synthesizing text and then refining it you're not engaging in that practice.

If one is trying to avoid plagiarism, starting with an AI draft and polishing it to avoid signs of its true origins is not a good method.

> If you didn't take the time to compose your words thoughtfully then you aren't owed the time to read them.

Apply this argument to code, to art, to law, to medicine.

It fails spectacularly.

Blaming the tool for the failure of the person is how you get outrageous arguments that photography cant be art, that use of photoshop makes it not art...

Do you blame the hammer or the nail gun when the house falls down, or is it the fault of the person who built it?

If you dont know what you're doing, it isnt the tools fault.

I of course expect my lawyer and doctor to thoughtfully apply their knowledge to help me. Why should they be any different?

I do apply it to those, and I don't see how it "fails" at anything.

Presenting synthesized words as original thought isn't using a tool, it's laziness at best.

“compose thoughtfully” != layman terminology

Lawyers thoughtfully write laws that other lawyers understand. I’m not sure why that’s confusing.

That's very elitist and unfair to people who previously struggled to form their words but now have a better chance at doing so.

I disagree, because those aren't their words.

Do we care about words or thoughts? Many folks are more interested in semantic meaning than character sequences. To each their own of course.

One problem I see with the broader use of LLMs these days is the death of literacy.

For example, you chose to read my response and attack the vocabulary as if that was the point I was trying to make. This is a misunderstanding. I am purposefully reusing the word choice of the comment I'm replying to.

I was trying to very concisely point out that if an LLM is generating your writing it is not your words or your thoughts that you're trying to communicate.

How'd you learn to write?

An elitist attitude towards plagiarists is common.

Also elitist attitudes towards people for whom English isn’t a native language, elitist attitudes towards people with dyslexia and other conditions that make writing difficult, and elitist attitudes towards people with lower education levels.

The BBC used to encourage its announcers to use Received Pronunciation, which was associated with high social class.

The solution to this form of elitism was not to make everyone speak RP, but to encourage non-RP accents, which is more common in the modern BBC.

Your comment seems elitist by encouraging the use of artifice to fit better into an elitist world, rather than breaking down elitism.

Using LLM is perfect for writing documentation which is something I always had problems with it.

As someone who has dealt with projects with AI-generated documentation... I can't really say I agree. Good documentation is terse, efficiently communicating the essential details. AI output is soooooooo damn verbose. What should've been a paragraph becomes a giant markdown file. I like reading human-written documentation, but AI-slop documentation is so tedious I just bounce right off.

Plus, when someone wrote the documentation, I can ask the author about details and they'll probably know since they had enough domain expertise and knowledge of the code to explain anything that might be missing. I can't trust you to know anything about the code you had an AI generate and then had an AI write documentation for.

Then there's the accuracy issue. Any documentation can always be inaccurate and it can obviously get outdated with time, but at least with human-authored documentation, I can be confident that the content at some point matched a person's best understanding of the topic. With AI, no understanding is involved; it's just probabilistically generated text, we've all hopefully seen LLMs generate plausible-sounding but completely wrong text enough to somewhat doubt their output.

Classic perfect/good.

The choice is not usually “have humans write amazing top notch documentation, or use an LLM”.

The choice is usually “have sparse, incomplete, out-of-date documentation… or use an LLM”.

And my claim is that the latter is better.

Cool, so just ignore documentation then. Problem solved for everyone.

I dont see how that solves anything.

We wouldn't have these silly arguments?

* Projects can focus on code first, and do best-effort on docs for low cost * Most of us get reasonable quality documentation, much better than what some poor developer would turn out in spare moments * You are spared from the outrage of imperfect documentation

Gah hopefully the meaning was clear from context, but I just realized I said "latter" when I meant "former". Inconsistent human documentation is better than miles upon miles of AI-slop documentation.

Given that people have access to LLMs themselves, publishing their output in lieu of good documentation (no matter how sparse) seems like it’s mostly downside.

Probabilistically generated text is light years better than my human generated mess. I know my limits and documentation is one of them.

This immediately invalidates a software or technical project for me. The value of documentation isn't the output alone, but the act of documenting it by a person or people that understand it.

I have done a lot of technical writing in my career, and documenting things is exactly where you run into the worst design problems before they go live.

I disagree with the downvotes, but let me put it differently: if you don’t understand, have reviewed and be ready to own all of LLM output (the thoughtful part), then you aren’t owned the time to read them. If you didn’t try to reign in the verbose slop that’s the default for LLMs, I don’t want to read it.

Maybe the poster is running a local LLM.. you’d think that a SOTA model would have surmised that an overnight MacOS upgrade can only be a minor version.

Yes, for the time being the final report should probably come from us (but endless opportunity along the way to clarify thinking and understand industry standard terms).

I'm used to papercuts on every OS, but at least with a Linux box I can roll it back. Usually it's as easy as picking the previous boot menu entry (with NixOS, the whole system rolls back that way). I find macOS acceptable enough for my laptop, but I'm doing most of my real work in Linux containers anyway.

Its my strong belief that using AI in any capacity which does not upfront state "the following content was generated by artificial intelligence" is never acceptable. In most situations, allowing an AI to wield your name gives off the scent of "My time is more valuable than yours, so I've automated writing to you." It is quite disgraceful. If your use-case would be materially harmed by an upfront disclosure of AI generated content, then you need to take a good, hard think on what that means for what you're doing (then again, maybe you're not interested in thinking anymore and that's how you got to this point in your life).

It’s good-faith arbitrage. Until everyone automatically suspects everything to be LLM generated and there is zero trust, anyone doing this is eroding the good faith that lets them get away with it in the first place.

> state "the following content was generated by artificial intelligence"

"… but reviewed by a human / me for accuracy."

I agree with you when you are talking with a human in good faith. I disagree when it comes to large corporations and government officials. Often times theres a lot of red tape you have to get through and create documents that nobody on their side is actually reading. Usually this is just to discourage people from completing the action they are trying to accomplish. LLM generated content has gotten me back improperly held taxes and generated multiple extension requests where the receiver just had to check a box that they got it.

The position I think I can most simplify my beliefs in to is "it should have taken you longer to write something than the person receiving it is going to spend reading it."

That position still fits your scenario, where if they're not actually caring enough to read it then you don't need to care enough to write it, but for something like this targeted at a technical audience it's a higher bar.

Also of course the accuracy of the writing is relevant in both cases, which is something LLMs are absolutely worse than humans at, as noted in some of the comments here this article had the LLM hallucinate the existence of macOS 25 which is a mistake no human would have made while writing such an article entirely by hand.

How far do you take this policy?

1. Am I allowed to ask an AI to proofread a draft for grammatical errors?

2. Am I allowed to ask an AI to proofread a draft for technical errors?

3. In both #1 and #2, am I allowed to ask the AI to suggest revisions, or is it only allowed to point out what's wrong and why?

4. If I write a sentence like "Lucy's laughter ___ her underlying anxiety" and I'm having trouble coming up with the right word to fill in the blank, can I give the sentence to an AI and ask it for a list of possible options?

5. While brainstorming, can I use an AI as a souped up rubber duck before I begin writing?

Not parent commenter, but my answer is "no to all".

...then I guess my next question would be, why? How do you feel about spellcheck? Should mobile users turn off autocorrect unless they disclose that it's turned on?

I don't really understand your philosophy if you're opposed to an LLM pointing out when someone got the tense wrong.

Who said anything about spellcheck?

GP said they weren't okay with someone using an AI to check for grammatical errors. If they would be okay with using software to check for spelling errors, I'd be interested to know why they're making that distinction. And I'd like to know what they think of autocorrect, which at least on the iPhone uses an on-device LLM nowadays.

"AI" can mean anything with machine learning. Spellchecker can use some sort of machine learning too. But what people mean when they say "AI" is LLM chatbot. But a spellchecker highlights mistakes, it doesn't suggest to rewrite the text arbitrarily like an LLM chatbot. So I totally understand how you can be for one and not other

By the way autocorrect on the iphone got worse recently, bunch of times it "corrected" the word to a wrong one for me

Wow, you’re arguing. What about predictive T9?

In general, I think those use cases are fine.

But... AI generated content is a slippery slope. Someone earlier today asked me to "review" a 50 page document they had completely generated with AI yet obviously not reviewed themselves. It is embarrassing.

This happened to me recently at work, I just ignored the request, but I was tempted to feed it to copilot and just send them the response.

Sending someone something that'll take them longer to read than it took you to write is taking the piss.

I think that's a good rule of thumb for AI-generated output.

What does attributing to AI get you over if the content stays the same?

> Papercuts like this are why I moved away from macOS.

It's been this way for decades. Microsoft was known for preserving backwards compatibility, while Apple was known for being willing to break stuff.

The differences aren't that extreme in reality: Microsoft breaks stuff more than it used to, while Apple has become comparatively more conservative than once upon a time.

Every OS has papercuts like this. Want me to write a story about Linux or Windows that is equally painful? Pick your poison .. i've dealt with it all.

Sure, when was the last time a Linux update overwrote your DNS resolver settings?

A month ago my debian 13 laptop out of the complete blue decided it wanted zero DNS. Might have been an update that did it I am not sure.

I was unable to resolve it and ended up reinstalling.

A trivial search can find examples of Linux updates breaking all sorts of things, like wifi and other drivers/firmware.

Doesnt systemd fuck with resolv.conf?

Also, I have had many system updates that broke my X11 config

Today, literally today. My pihole updated, broke its own dns, stopped working, and broke dns for every device on my network.

Pihole's not an OS, it's an application/service.

PiHole is a Linux kernel now?

macOS ain’t kernel either, XNU is the kernel of macOS. what is it you are comparing.

You must be using some flavor that doesn't have systemd, at least. Or a Linux from a decade ago.

> but people are going to start throwing out the obviously LLM written reports rather than have to validate each claim,

So nothing will change as Apple is renown for throwing out reports?

macOS 26 has to be the most breaking version so far, its problems and intended breaking changes making my app dev life so hard this year. Just to name a few:

- Reference Presets no longer allow setting arbitrary SDR nits, making it impossible to natively unlock 1600nits of brightness on MacBook Pros or 2000nits on Studio Display XDR which breaks my Lunar app [0] (this seems to be intended, no idea what hurt Apple that they had to block this under SIP)

- The orange microphone dot indicator and its very colored friends can no longer have their brightness changed for dimming them, which made my YellowDot app useless [1] (I guess this is for privacy, I still think this could have a setting guarded under TouchID like Accessibility Permissions works)

- Floating non-titled windows don't accept mouse events (thankfully this got fixed) [2]

- Gamma table changes don't work on MacBook Neo and M5 Pro/Max which breaks Sub-zero Dimming and dimming external monitors that don't support DDC (thankfully, Apple is looking into it) [3]

- The resizing area thing on very rounded windows which drives everyone nuts, I had to add custom resize handlers to some of my windows

- The `com.apple.SwiftUI.Drag-` temporary file paths that get generated for any file that gets dragged from a drag&drop handler which makes it impossible to get to the original file when dragging images from Clop [4] or file shelf apps like Yoink, Dropover etc.

- NSImage returning different pixel count for .size than what the image actually has, breaking workflows that depended on that to determine the image DPI

[0] https://lunar.fyi/#xdr

[1] https://github.com/FuzzyIdeas/YellowDot/issues/18

[2] https://developer.apple.com/forums//thread/814798

[3] https://developer.apple.com/forums/thread/819331

[4] https://lowtechguys.com/clop

Ah I was wondering why I couldn't get past 600 nits on my M5 why it worked great on my M1. Guess I'll just have to live without it for now

It's still possible with the older forced HDR + Gamma tone-mapping logic, but it has its limitations. The native unlocking was miles better.

As a hobbyist music producer with an interface always connected, that microphone indicator is so annoying and unnecessary. I can't believe it can't just be disabled outright. I like macOS but it's too opinionated and some of those opinions SUCK.

Yeah I can see that being a source of annoyance for situations like yours. However, I welcome it from a privacy perspective. The indicator alerts the user if some nefarious application covertly enables the microphone.

Yeah, I fully understand why it's there — and also why it's not optional — but I hate that it's not optional.

There are rumors iOS 27 will be a sort of Snow Leopard update with no new features [1]. Just bug fixes and performance improvements.

Hopefully Apple will do the same for macOS 27.

[1] https://www.macrumors.com/2026/03/15/ios-27-will-reportedly-...

> Just bug fixes and performance improvements.

So more bugs and no improvements, just like Google.

> The orange microphone dot indicator and its very colored friends can no longer have their brightness changed for dimming them, which made my YellowDot app useless [1] (I guess this is for privacy

It absolutely is for privacy, to stop malware or trojan programs from obscuring their accessing the camera or microphone.

> Reference Presets no longer allow setting arbitrary SDR nits, making it impossible to natively unlock 1600nits of brightness on MacBook Pros or 2000nits on Studio Display XDR which breaks my Lunar app [0] (this seems to be intended, no idea what hurt Apple that they had to block this under SIP)

OLED displays are widely expected this year. Not wanting to have to deal with "my battery life is an hour and a half instead of 10, what's going on!? Replace my battery!" nonsense is probably the remainder.

I had a nice wrapper on blueutil so I could do “hp” and “btoff” which meant turn on bluetooth and connect my headphones, or shut off bluetooth. I used this 5x a day. They just decided to randomly remove that API which was me fixing their clunky horrible bluetooth workflow.

Re: Yellowdot, have you considered setting a LUT to the display that maps the color of the recording dot to black, then setting a LUT to every other window that maps the same color to a nearby similar color?

Not a macOS user, but I feel like that might still work.

It could, but there's no possibility to apply a LUT to a realtime framebuffer on macOS. But it would have been a clever solution if it was possible.

Still wishing for the day apple is split into the hardware and the software company. I want their silicon, but I will never use their (arguably terrible) operating system. If I can't run my own kernel and kernel modules then it's a device that I don't own. Firmware is alright in some cases, but my laptop next to me is running core boot just to prove a point.

But you can run your own kernel on Macs, no? Isn‘t driver support the issue?

Maybe Apple Hardware would write Linux drivers to sell their hardware for servers. Intel contributes to Linux kernel. AMD contributes to Linux kernel. Nvidia contributes to Linux kernel. A lot of hardware manufacturers support Linux to some extent. It's no longer reverse-engineered wild west.

Not on new silicon and asahi linux is still pretty damn far from being able to use it seriously. I do appreciate the effort, but I am just saying that it would be a lot better if you know, apple sold the hardware so vendors could build laptops with apple silicon.

Apple literally made step by step instructions for compiling and running your own kernel on Apple silicon. Not sure how you think asahi Linux works otherwise. Sure the drivers are anywhere from bad to non existent but that’s not the same thing as being unable to run your own kernel.

This is news to me, where can I find this? I was under the assumption that most of asahi linux was reverse engineered. It's the reason why they're also stuck on M3?

Edit: I can only find 3rd party resources. The only first party is for older macbooks (intel based)

Driver support is pretty hard when nothing is documented and security features limit reverse engineering. Hardware companies either document their hardware properly, or they write drivers for third party operating systems, or both.

macOS is not perfect but I don't think anyone could seriously argue that it is terrible.

It’s pretty bad. IPC doesn’t work reliably any more. The window manager is unusable. Spotlight misses results and also pegs the cpu, killing battery.

Finder is bad enough on its own, but the 1:N mapping from logical directories to filesystem directories (like photos, home, applications, etc) makes it essentially unusable without spotlight.

Notifications are flaky as hell (missing phone calls and messages from contacts, but displaying explicitly blocked spam sms).

Copy paste between devices has never worked right.

Which part of the OS is not terrible in your experience?

Edit: also, compatibility with video games (even ones released for macos) is abysmal. It’s much worse than Linux’s ability to run the Windows version of MacOS native releases!

> Edit: also, compatibility with video games (even ones released for macos) is abysmal. It’s much worse than Linux’s ability to run the Windows version of MacOS native releases!

Linux can run Windows native games because Valve has shoved millions and millions into perfecting Proton.

And I still wonder why Apple hasn't just dumped a billion on Valve's door to build a similar tool for macOS.

Apple’s ‘Game Porting Toolkit’ is basically Proton; they just haven’t made a GUI for it.

The issue with that it requires the dev to do a "port". Proton requires absolutely nothing.

Are you sure? Port may be in the name, but it seemed like people were using it like Proton, random users trying it with various games. Not sure if this is still happening. There was also Whisky, but that's been abandoned. "Wine Supercharged... with the power of Apple's Game Porting Toolkit."

It seemed like you could just play games with it, but that Apple didn't want you using it that way.

Apple highlights a different use case than Valve, but the underlying program is equivalent.

They’re both forks of wine ( https://www.winehq.org ) - the game porting toolkit's main addition is that it'll also convert Vulkan shaders to Metal.

Setup is more of a hassle because it's not integrated into Steam, or into the OS as a handler for .exe files, etc. But you can install the Windows version of Steam using the game porting toolkit, and then download & launch windows games from there.

I suspect the main reason they don't want to pitch this as an end-user feature is that it’s dependent on their x86->ARM translation layer, which they probably want to ditch in a few years. But it’s there for now!

Which part of the OS is not terrible in your experience?

Not OP, but accessibility tools on mac put other desktop OSes to shame.

(arguably terrible) operating system

macOS has made some arguably poor design choices, but it makes it hard to take someone seriously when they state the whole OS is terrible.

It's the worst OS we have.. except for all the others.

It could be just me, but every time I tried to do something I sat thinking that I am not the target audience for this thing. I don't like the UI, I hate not being able to talk to the hardware the way I can on linux (uart took me way too long to get working), I am angry that I am not able to run kvm, I hate not being able to replace the desktop and fix bugs myself. That's what makes it terrible for me.

MacOS IMHO is no longer a viable OS for people like us(who know what this website even is). MacOS26 along with Windows11 are enshittifying and in some ways it's glorious to see. I do feel bad for non-IT people though, Linux is daunting to them...I get it.

With my setup (GhosTTY, tmux, nvim) I don't have any problems honestly. When working with UI stuff I use rectangle to get a bit of the tiling behavior I was used to on i3, but nowadays I need that less and les because of browsers adding split view within themselves.

Battery is great and everything feels snappy even after the PC being powered on for weeks.

Fair enough, thanks for clarifying your distaste for macOS. Sounds like any closed source OS just isn’t for you. :-)

So you're upset an operating system that is called macOS is not in fact Linux. Gotcha.

pretty much, it's unix and I want it to be unix, but I get the worst parts of linux and windows combined.

I see you. These folks trying to talk you into liking MacOS are missing the point. You’re being perfectly clear about not liking it, and why — it’s not built for you. And that sucks, ‘cause their hardware is top-notch. It’s true pain.

Apple really is leaving everyone else years behind in making hardware. Yet they’ve never done what I would consider obvious geek-friendly things to MacOS. I’m sad about it too, and I wish the OS were better.

Yeah, if it was Linux it might actually be usable!

I'm not sure how Apple acolytes can say this stuff seriously what with the deluge of complaints and completely broken features and terrible UI their own kind have been posting about it recently. You can't accept that Apple could possibly do wrong?

what with the deluge of complaints and completely broken features and terrible UI their own kind have been posting about…

Remind me which OS we were talking about again? Because it sounds like all of them. OS usage as a team sport is just dumb.

I agree linux is just as bad, but at least I can fix it! Especially now in the age of AI I have fixed 30-40 issues with KDE that were bothering me and now they're gone.

The reason why I don't upstream is because.. it's AI and half the changes are very opinionated. However, my enjoyment and productivity went up a lot. My KDE is closer to hyprland than anything and I love it.

I agree linux is just as bad, but at least I can fix it!

I for sure see the appeal. Even if macOS desktop were open source, though, I doubt I'd do much about my complaints. For my use cases, I don't want to turn OS maintenance into a hobby, and whatever complaints I might have aren't big enough to go to the trouble to begin with.

Bespoke user land does have its temptations, though. Maybe I'll finally get off my butt and load up a distro on that old 2012 MBP that doesn't get macOS updates anymore.

AI is a beast at figuring out the internals I picked up oh-my-pi from one of the posts on this site, it's cake compared to what it was even just a year ago.

I have spent a significant amount of time with all 3 OSes and Linux was by far the most functional and least broken. I haven't used Windows since Windows 10, though, but I have used macOS as recently as last year.

There's a reason macOS is the least-used OS behind Linux and Windows. If it was any less terrible, we would know.

Source? [1] states 12% for macOS and 3% for Linux.

[1]: https://gs.statcounter.com/os-market-share/desktop/worldwide...

Steam reports 3.4% for linux and 2% for macos (last montg. This month numbers are probably hit by systematic measurement errors).

https://store.steampowered.com/hwsurvey/

Also, the 16% “unknown” in the graph you linked to implies huge error bars on macos vs linux!

Steam stats aren't particularly meaningful in this context, because MacOS is largely unusable for gaming due to not being able to run most games.

Valve themselves have given up on supporting their games on Mac, likely due to the total lack of backwards compatibility.

That's desktop market share. I'm sure the comment you're replying to means overall usage including mobile and server, where Linux is far and away the leader.

Why would anyone compare market share of a desktop OS and include server / mobile / embedded?

Because they want to make Linux sound good I guess?

It's not quite the same, but I've moved to using *.localhost for all my local web dev work. All modern browsers will resolve *.localhost to 127.0.0.1 internally. No need to setup any DNS resolvers or edit your hosts file.

But that only really helps you when you're dealing with websites in a browser, and when you want the address to resolve back to your local machine. So it wont help you with other programs like python/wget/etc or any calls you make to getaddrinfo()

we have dev.our-root-domain.com in public DNS pointing to 127.0.0.1

I've run into resolvers that filter things like that to prevent dns rebinding attacks. And localhost (the hostname) does not work for CORS.

Best option is probably to set dev.our-root-domain.com in /etc/hosts

[1]: https://en.wikipedia.org/wiki/DNS_rebinding

Haven't had an issue yet, with a team scattered across US, Canada and UK. I'm sure it's possible - but so far we've been using this for about 3 years with no hiccups.

Definitely more common on corporate networks.

I guess most home users (remote employees) are probably either using their ISP's resolvers, or browser DoH (Dns-Over-HTTPS).

Good tip, I didn't realize the browser would automatically resolve any subdomain of localhost to 127.0.0.1/::1 as well these days.

I tested on Chrome but I assume this is true for Safari as well?

Just tried it on my Mac and sadly it doesn’t seem like it. I’m still on Sequoia, so possibly it does it on Tahoe, but probably unlikely. That’s a shame.

It’d be nice if someone on the Safari team added this though to match Chrome and Firefox!

It works in Tahoe.

The best part is that *.*.localhost is also supported, so you can finally just replace *.com for your prod domains with *.localhost.

ArchiveBox now uses this feature by default in the latest version to finally offer unique per-snapshot domain isolation, so we can safely replay archived JS without risking compromise of your whole archive.

Such an awesome feature, the barrier to do this used to be prohibitively high but now it "just works".

Yeah I've been doing this as well. I know it's a minor nit, but I wish that TLD was shorter. I've used *.local in the past but that has bitten me too many times.

> But that only really helps you when you're dealing with websites in a browser, and when you want the address to resolve back to your local machine. So it wont help you with other programs like python/wget/etc or any calls you make to getaddrinfo()

It works for me on Tahoe.

I run a setup like that on my (outdated) Yosemite machine to provide multiple private TLDs for local deployment/development needs.

I set that up in like 2014? Even back then it was known already that the quick /etc/resolver way was the deprecated way to do things. So I guess they finally killed that feature off?

The proper (more awkward) way is to use scutil directly (which then stores the settings in some binary plist somewhere, I assume).

Maybe try this and see if it still works afterwards?

Interesting - I run a nearly identical set, with many TLDs configured in `/etc/resolver/X` and dnsmasq handling the resolve and I have not had a single issue.

the resolver confs all contain this content:

    # /etc/resolver/example-private
    nameserver: 127.0.0.1
    domain example-private

I noticed in the author's bug report they do not include `domain`, which is documented in `man 5 resolver` as:

    # The domain directive is only necessary, if your local
    # router advertises something like localdomain and you have
    # set up your hostnames via an external domain.

In the real world though, I've found the `domain` setting to be required nearly every time. I wonder if adding it will resolve the issue?

Bit off-topic. I mostly use Linux and I'm of the opinion that it's miles better than Windows, but I don't fully understand why people say MacOS looks bad?

Ignoring the current Tahoe mess, MacOS felt relatively polished. I'm purely talking about UX here, as the OS is evidently buggy. The most popular Gnome themes are a re-impl of MacOS, so I can't be the only one.

It’s selection bias; the people who complain are the most visible online. Especially HN.

You don't know that, you could frame any genuine problem with any company as a selection bias.

When you say “You don’t know that”, you expect the people reading your comment to interpret it generously. A good interpretation of your comment is something like, “You’ve provided no reasoning to back up that argument” or “I think it’s unlikely that you have evidence to support your claims”. A bad interpretation of your comment is, “I can answer with certainty whether you have this specific piece of knowledge, and the answer is no.”

I encourage you to apply the same generosity to comments you read.

There’s no “Tahoe mess”. I’ve used it since 26.0 and it’s good. Different indeed, but good. People love complaining.

I'm glad that it's working well for you, but from the moment some users with M-series SoCs report laggy animations, something somewhere has to be wrong.

There's very valid reasons to have issues with Tahoe's changes. The dock being liquid glass is fine. But curving the windows to look like iPad apps, and not even adjusting the grab target appropriately for resizing the window is bad. Getting rid of the title bar so it's not clear where you can grab a window is bad. Apple Music hiding the volume slider behind another click is bad.

It straight up broke some interfaces too

https://lapcatsoftware.com/articles/2026/1/4.html

I'm with you, pre Tahoe I've never had an issue with iOS aesthetically, other than lack of customisation.

Then again I never understood the trend to remember fondly windows 98 and those kind of interfaces, maybe it's generational.

> Then again I never understood the trend to remember fondly windows 98 and those kind of interfaces, maybe it's generational.

I may have a generational bias (I am almost 49), but I think the fondness is due to lack of UI surprise. A button was a button, a menu was a menu with clear shortcuts, etc. There were no mystery scrollbars that required specific interactions to appear or expand. Don't get me wrong, I'm a happy-ish MacOS user and love screen size, clear fonts, etc that we get in the modern world, but I think we've all had moments of frustration when we had to go on a scavenger hunt in an app and cursed those who didn't leave well enough alone.

It's incredibly bloated. I don't want AI engine in my OS. I don't want Spotlight in my OS. I don't want my OS to load CPU for 10 minutes after boot for who knows what. I don't want my OS to ship with Chess app and lots of other irrelevant software. I don't want my OS to ship with Music app and bother me with subscription offers. I don't want my OS to ship with iCloud app.

They also do strange choices regarding shipped software. For example they ship ancient bash 3, apparently because they hate GPLv3 or something like that. I like GPLv3 and this choice makes macos user-hostile.

I don't know. I generally like the UX. The way full screen windows work is a bit unique but I ended up liking it once getting used to it and the related shortcuts. I don't like the lack of window tiling, though.

That said, I still prefer Linux. I think my biggest papercut there has been suspend/power management being broken in some way or another on both laptop and desktop for the last 8 years.

Window tiling was added in Tahoe. Rectangle is also free.

Yeah Tahoe has been mostly fine. I have all the liquid glass stuff turned off (via reduced transparency). The grab handles for window corner is annoying, but it doesn't mean the rest of the OS is not good.

There's bugs in the OS, like pretty much every OS, but I rarely interact with them should they manifest.

You can always tell where the attention to detail meter is at by the presence of needlessly widowed words in single lines of text.

"Your password is required to

There are many examples of the UX going backwards or getting unnecessarily reinvented with each release, which is attributed to the feature‑creep culture at Apple. One notable example would be the notification dialog.

I think you gotta actually try to use it as your main OS to hit some of the snags. It can browse the web just fine, but I couldn't get sshfs working. There were strange global keyboard shortcuts, rarely actually used, breaking common shortcuts like ctrl + left/right arrow (fixable, but not super trivially). Homebrew is better than nothing but pretty jank in practice. Repeatedly I'd see graphical stuff installed from there was declared broken and I was pressured to delete it, or I'd have to reapprove some security thing after an update and add it back to the dock. Just lots of friction everywhere. I couldn't seem to consistently keep windows the same size and in the same spots, but they were almost right which made it more maddening. It was like they'd slide around slightly after a reboot or changing monitors. Speaking of monitors, low DPI fonts on macOS look inexcusably horrible. The same monitors I've used for years displaying similar stuff just looked absolutely awful on macOS compared to GNU/Linux. I never was able to fix this. I suspect in their pushing of hidpi and their own hardware they've mangled and abandoned classic resolutions and fonts. This one can barely even be discussed online because everyone's drank the hidpi koolaid and will call you poor or perverse or something. There was also a horribly annoying issue when trying to use a MBP like a desktop. If left inactive too long, I couldn't seem to wake and unlock it with my external keyboard and mouse connected to a dock. I had to open the laptop lid, log in there, re-allow my input devices, then close the lid. I also had to repeatedly go through that wizard that tries to identify your keyboard layout by having you press the key beside each shift key, as if it'd never seen my keyboard before. I have used this same keyboard on GNU/Linux and Windows, there's no equivalent to that needed, I don't really get it.

It's all bad enough that I have a very expensive machine collecting dust until Asahi supports multi-monitors fully. It was a good reminder of how important software and familiarity is, and how much you stand to lose by just chasing after better specs at all costs. I really just wanted my exact usual setup with a spec bump (which I eventually got when I upgraded from my T440p to a T14 Gen 5).

As for positives of macOS... I like the unix-y bits, what's left of them. If I have to retrieve pictures off an old Mac for someone's funeral board, the find command I know and love is there, and a familiar shell as well. I just can't live in macOS full time. It's not good enough for me.

Solved this type of shenanigans some years ago with this.

New-UnboundInterface.sh - linux/rhel-like specific

    # create a bridge interface for Unbound
    # because Docker...
    IFTYPE=bridge
    IFNAME=unbound0
    IPADDR=10.53.0.1
    IPADDR6=fd53:fd53:fd53::1
    nmcli connection add type $IFTYPE ifname $IFNAME
    nmcli connection modify $IFTYPE-$IFNAME ip4 $IPADDR/32
    nmcli connection modify $IFTYPE-$IFNAME ipv4.dns $IPADDR
    nmcli connection modify $IFTYPE-$IFNAME ip6 $IPADDR6/64
    nmcli connection modify $IFTYPE-$IFNAME ipv6.dns $IPADDR6
    nmcli connection up $IFTYPE-$IFNAME

    firewall-cmd --new-zone=unbound --permanent
    firewall-cmd --zone=unbound --permanent --change-interface=$IFNAME
    firewall-cmd --zone=unbound --permanent --add-service=dns
    firewall-cmd --reload

00-localinterface.conf

    # should be placed in /etc/unbound/conf.d
    # bind to a specified IP address, allow access
    server:
            interface: 10.53.0.1
            interface: fd53:fd53:fd53::1
            access-control: 10.53.0.1/32 allow
            access-control: fd53:fd53:fd53::1/128 allow

91-allow-docker-containers.conf

    # allow queries from the Docker "bridge"
    server:
            access-control: 172.18.0.1/16 allow

A couple iOS versions ago, Apple broke self-signed certificates... crippling mobile development by preventing the use of HTTPS to communicate with a local server.

It makes you wonder why they were messing around in these areas at all at this point.

I don't know , I like macOS, mainly that zsh is readily available and I can (almost) do anything I can do on a linux box in a personal computer.

> https://feedbackassistant.apple.com/feedback/22280434 (that seems to need a login?).

All Feedbacks that you file are private to your own Apple Account.

*.localhost works out of the box doesn’t it? You don’t need dnsmasq at all to have multiple hostnames pointing to 127.0.0.1.

You often have internal private IPs you want to resolve to things that aren't localhost

*.example-private point is to have multiple machines using private addresses such as web.example-private in A 192.168.0.100 and db1.example-private in A 192.168.0.101.

If you just want to resolve 127.0.0.1 then you just resolve hostname "localhost" or use 127.0.0.1 directly.

Personally i don't bother configuring custom private dns zones, instead i use reserved MDNS *.local that autoconfigure everything using machine name (hostname) and DHCP address: somehostname.local in A <dhcp assigned ip>.

Apple container CLI configures internal domains (`container system dns`) by adding an internal resolver and it worked for me when I specified an actual domain previously handled by external DNS and it showed up as a custom resolver.

Here’s a GitHub comment showing someone on MacOS 26 with a `.test` domain, which you claim is broken: https://github.com/apple/container/issues/856#issuecomment-3... —- maybe you are configuring it incorrectly.

"The long-established behavior of encrypted DNS protocol settings from a profile overriding non-VPN domain-specific DNS settings has been confirmed internally from macOS 15.7.1 to macOS 26.5.:

"You will continute [sic] to run into the behavior of Quad9 DoT overriding the per-domain DNS settings so long as the profile is installed."

— there we have it from "privacy friendly" (whilst sneaking out age checks) Apple.

I've been using macOS since OS X Tiger and I wasn't aware of this feature.

I am not familiar with dnsmasq at all (is this machine-local?), but absolutely love my PiHole hardware — you can even create rules which intercept hard-coded-IP DNS request and/or httpsDNS. You can also hard-code/intercept .TLD to local service IPs.

Programs like LittleSnitch never really seem like "enough" for me, because the computer has to boot before DNS filtering comes online. It also has the design error (IMHO) of pre-resolving IP addresses before clicking Accept/Deny(all).

A great blockrule for your personal firewalls would be to ban (at top level) icloud.com, apple.com, &c; system updates can then be performed manually using guides like <http://www.mrmacintosh.com>. Of course: this breaks everything (in exactly the way I prefer to compute).

This works great (and I use it) internally but when you want things like your docker domains to work when you're on the go, it's annoying.

I have setup a VM running DNS on my laptop before ...

It is not too difficult to allow your PiHole to serve you globally (but does requiring opening some ports in your firewall == additional security risk).

There is a simple checkbox within the DNS's web interface to `Allow WAN Requests`. You'd then only run into issues of accessing your local IP addresses if those hosts aren't configured correctly within your network rulesets.

----

I am a user, not an expert; by trade, I am a blue collar electrician. I know very little about internet topology except how to use simple open-source hardware. Perhaps what you said makes sense (e.g. that you cannot use outside your network, some service(s)).

Yeah that can work, though at that point I start to consider just exposing my "internal" DNS to the world at large - who cares if secret_service.mydomain.net can be seen by everyone to resolve to 192.168.88.4?

You can also do VPN tricks, too.

>whocaresif?

I think my major concern here would be if people were going to websites which might be considered illegal within their jurisdiction (e.g. guest_DNS_user searches for out of state abortion providers — while you[r DNS] live[s] in Texas).

Perhaps the State sees guest_DNS_user's query to plannedparenthood.com, then decides your vehicle tag is worth tracking for potential out-of-state (via e.g. Flock cameræ)... or that you are guilty of facilitating an abortion for someone else... all because your DNS server provided IP resolution for guest_DNS_user to Planned Parenthood Colorado (et.al).

----

This would have been too far-fetched for me to have considered/written, even just a few years ago. It's all reality, now. Are you targetable enough?

DNS leaks are another reason I don't care for LittleSnitch (which pre-resolves IP address before the accept/deny pop-up even appears.

I used to use dnsmasq and etc/resolvers for stuff like dot dev or dit whatever back in the day.

These days I’m just using Caddy to do ..localhost for my web dev and it works like a charm.

This is exceptionally sloppy on Apple’s part.

Has anyone found a working workaround yet? I use dnsmasq for .local dev routing and held off updating after seeing this but curious if there is a viable path forward short of waiting for Apple to patch it.

holding off update seems like reasonable step till the patch comes. I also run a .local for apple containers though not docker.

Wouldn’t the workaround just be to have your local dns server enable recursive lookups, and point all your DNS queries to it?

What I'd suggest is using lvh.me, which always resolves to localhost, as do all it's subdomains. If you need a specific IP you can use nip.io.

If you want valid certs you can generate them with mkcert and add them to your system trust store.

> The only reliable workaround is to add entries manually to /etc/hosts, which bypasses mDNSResponder entirely. This is impractical for dynamic use cases (e.g. Docker container DNS, where host entries change frequently) and requires sudo for every change.

I suppose I'm lazy - I've always used /etc/hosts, but then again, I've never had use cases like those mentioned in the linked gist.

FYI the phrase is "lo and behold"

Thank you for the heads up.

I had to abandon Apple MacOS container because it has so many issues with networking and DNS. I'm looking forward to try it again if they can get it fixed.

https://github.com/apple/container/issues?q=is%3Aissue%20sta...

I am pretty sure this will get fixed as Amazon had depended on this feature to resolve internal domains through the ACME managed openvpn-service. Rather than overriding global DNS settings which may break on certain hotspot configurations.

Again? This happened like 6 or 7 years ago. I had so many issues with macOS in the few years I was forced to use a MacBook that I refused to use it. Not surprised to see this stuff still happening.

Seems bad that people feel forced to use GitHub to talk about Apple's bugs.

I never knew about this feature but it's so cool and I wish I knew it earlier. Sadly it seems features like these are being left to rot in MacOS because it's not what the average normie uses.

> none of my dockers

Containers ran using docker are called containers, not dockers.

I'm glad to find out it's not just me! My homelab has a lot of domains on .home.arpa, and I was getting issues related to this.

Another funny thing about Mac networking.

There's a game I play (Old School Runescape) that does network ticks every .6s. Mac does some sort of aggressive optimization on the network hardware/software, so network this infrequent doesn't keep the layers "hot", and you end up getting delayed ticks regularly, meaning you learn what should be happening in the game .2-.5s late. This optimization for (I assume) battery life makes the software not work as intended.

Playing anything that streams, like video, or triggering TCP connections (e.g. curl) at a more frequent clip while the game is running fixes the problem.

No way other than hacks that I've found to fix it, and I have no idea how you could report this to the right team at Apple to get it actually fixed.

Very interesting. I play RS3 and made a helper tool[0] for tracking ticks. I noticed increased jitter on my MBair (~50-150ms) compared to Windows, but I chalked it up to the air being on a wifi connection. I wonder if your explanation's the real reason.

[0]: https://files.catbox.moe/5n09lg.webm

Watch some twitch while you monitor it - will magically go away I suspect

Haaa. Confirmed. Went from 200-400ms (worse than I remembered) down to sub 30ms of jitter after putting on a stream. Thanks for the pointer

That sounds like the timer coalescing feature introduced in OS X 10.9 I think.

> Ah, the joys of waking up to find the Mac's done an overnight upgrade

Wait, it does that (from 15 to 26) without user interaction?

No.

No, it does not. It’ll bug the shit out of you to upgrade, but it won’t automatically do a major version upgrade. By default it will automatically do minor version upgrades (that can be turned off).

That’s what makes the LLM bug report make no sense in light of OP’s report here. Bug says it’s a regression from 25.x (which doesn’t exist), so maybe they mean 15.x? But OP says they “woke up” and it was upgraded and broken, but macOS doesn’t major version upgrades w/o user action. So which is it?

Phew.

If Asahi had the same battery life and performance as MacOS there is zero chance I would be running MacOS.

It does. I am getting 8-10 hours on my M1 Air.

Afaik ".internal" isn't reserved/defined anywhere, it's just a convention some people/devices use, and doesn't have anything to do with the root cause here (a custom resolve.conf or whatever it is called in macos changing after an update), no?

No. It is reserved.

https://www.icann.org/en/board-activities-and-meetings/mater...

A look on Google or Wikipedia would also clear that up faster than I can type this response https://en.wikipedia.org/wiki/.internal

Lo and behold, just FYI. Trying to help.

I still want to believe macOS 26 was vibe coded with Apple Intelligence and siri. Makes it easier to digest daily use

It also seemingly broke removing Safari cookies on a per website basis, something I often used to stop Google's scummy tracking across all their services if you just want to sign into YouTube.

Firefox + Google Container extension.

Why use Apple's browser when they don't actually care about your privacy?

Before others jump in: I already use Linux (and used to run FreeBSD as my desktop operating system).

Thanks for sharing your report, it's frustrating to see things like this break in minor patch updates. Small tip for GitHub Gist: set the file format to markdown (give it a .md extension) so that the markdown will be rendered and won't require horizontal scrolling :)

The report says it broke when updating from macOS 15 to 26, so not a minor patch update. I'm a bit surprised no one noticed this earlier though, since 26 has been out since September and in beta since June.

Ah great another reason to add to the many reasons not to use this OS. Semi serious question, is Apple looking to dump its existing customer base for a new, perhaps consumer not pro-sumer one?

Wait... someone is under the impression that Apple was ever good to its customers?

I thought we all just dealt with the overpriced hardware, the prisons, the control, that they are a US company that gives away data to the government(PRISM), has weak security(Pegasus), lies about hardware issues(butterfly keyboard and holding your phone wrong), deceptive marketing...

All so we can compile iOS apps.

If you arent compiling iOS apps... Do you not know about Fedora? Ofc Windows sucks, but we have Fedora.

Honest question: How would this affect me and the vast majority of macOS users who use the device for media consumption and productivity applications?

Next question: what reason would Apple have to make a change that would interfere with developers using their operating system?

Your “next question” seems very leading. Can you make your point more clear? What’s your answer to that question?

I don't understand your question since my question was honestly posed.

What might lead Apple to make a change that would reduce the audience of their devices. I don't develop on macOS but I know developers who do. Did they just make a mistake and they're gonna fix it?

I doubt it was an intentional change. A lot of bugs result from, "hmm, didn't think about that use case. Ooops." There's just the question of how long it'll be before they ship a fix. It seems like there ought to be an automated test for something like this, but Apple seems to be shedding QA as fast as Microsoft is.

(And apologies if it seemed that I was insinuating ill intent on your part.)

If you have ScreenTime turned on. Port :8080 is occupied and your ubuntu apt-get in a docker build gets hash mismatch because they obviously modified packets. Let alone I am having another issue of unable to delete a private key in Keychain Access.

The whole macOS thing is amateur

Port 5000 is also ocupied on macOS.

Why does macOS use ports above 1024 by default? There is a reason it is reserved to be used by OS services.

Tried to use one recently - but I can't get past all the unkillable CPU hogging processes. It's clear the actuaries are running the software development department.

Reply on news.ycombinator.com