Disable sharing of Spotlight searches with Apple
fix-macosx.com
fix-macosx.com
"When you use Spotlight, your search queries, the Spotlight Suggestions you select, and related usage data will be sent to Apple. Search results found on your Mac will not be sent. If you have Location Services on your Mac turned on, when you make a search query to Spotlight the location of your Mac at that time will be sent to Apple. Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine. These searches are not stored by Microsoft. Location, search queries, and usage information sent to Apple will be used by Apple only to make Spotlight Suggestions more relevant and to improve other Apple products and services."
"If you do not want your Spotlight search queries and Spotlight Suggestions usage data sent to Apple, you can turn off Spotlight Suggestions. Simply deselect the checkboxes for both Spotlight Suggestions and Bing Web Searches in the Search Results tab in the Spotlight preference pane found within System Preferences on your Mac. If you turn off Spotlight Suggestions and Bing Web Searches, Spotlight will search the contents of only your Mac."
"You can turn off Location Services for Spotlight Suggestions in the Privacy pane of System Preferences on your Mac by clicking on “Details” next to System Services and then deselecting “Spotlight Suggestions”. If you turn off Location Services on your Mac, your precise location will not be sent to Apple. To deliver relevant search suggestions, Apple may use the IP address of your Internet connection to approximate your location by matching it to a geographic region."
"Information collected by Apple will be treated in accordance with Apple’s Privacy Policy, which can be found at www.apple.com/privacy."
A domain, a python script, to effectively achieve tapping a couple toggles in sys prefs? And this is quite difficult for the average non terminal using person.
> This site _criticizes_ Apple for certain privacy-invading features of Mac OS X and teaches users how to fix them. So, obviously, the site is not approved by Apple.
Snark!
That slightly snarky disclaimer you quoted actually has a serious backstory; the language came from https://fixubuntu.com (whose AGPL code was used here), and it was added after Ubuntu sent a legal demand that "Ubuntu" be removed from the fixubuntu domain name and website:
http://arstechnica.com/information-technology/2013/11/canoni...
I actually toned down the snark -- just slightly -- from the original disclaimer.
It's remarkably easy to miss Spotlight's privacy disclosure in Yosemite -- the instant you start typing in the Spotlight search box, the disclosure disappears, and seemingly stays gone. There's no single "local search only" toggle, and you have to cross-reference the documentation provided in System Preferences against the list of "Search Results" to figure out which of the options actually sends your queries to Apple.
I wanted something simple, that I knew worked, and I could just tell family to run themselves, so I put this together. It's a convenient way to apply the settings, a jumping-off point for a more involved effort to resolve some of the other remaining privacy issues on Yosemite, and a handy way to get the privacy message across.
If you're interested in chipping in on the OS X privacy front, there's a lot more to look at than just Spotlight; my next goal is to get https://github.com/fix-macosx/sslsplit transparently capturing traffic in a Yosemite VM so that we can start nailing down exactly what is being sent from the myriad of daemons (and spotlight!) that are sending data outwards in a default configuration.
I'm very sympathetic to the "random internet code" issue, so I struck a balance by:
1) Displaying the source inline in the page (of course, there's no guarantee that it matches the downloaded code, but the goal here is to highlight the important of knowing what you're running).
2) Making the actual script URL a clickable link, so that folks that don't blindly execute curl scripts (myself included) can easily download the script and examine it.
3) Used a variation of the usual pipe approach (curl -O … && ./…) so that anyone downloading it would actually have a copy of what they just ran.
4) Serve the whole lot over TLS.
Cheers, Landon
Thank you for taking the time respond, and for your impressive body of work.
My knee-jerk reaction to everything about this site can definitely be attributed to ignorance. Something worth considering, in my opinion, for the goal of the project.
fix-osx: I didn't know it needed fixing (in the context of what this site declares is wrong). I am open to being wrong, and that it would need fixing, but my gut response is that it doesn't. It is not intended to attack/dispute your messaging, but rather explain how it could be read by someone unfamiliar with how it is indeed that way.
Expanding on that, I don't hold that OSX inherently betrays user privacy. While this can be considered a privacy leak by ux design (it is, I agree), it's not something that would lead me to the conclusion that the OS has no privacy by design. I'll be looking more into this now, however.
Regarding the disclaimer... That backstory certainly validates the tone, but a disclaimer for the disclaimer would be nice for the uninitiated :-
Best,
Just to clarify, the submission's title of "No Privacy, by Design" doesn't represent my own position; it's not a phrase that's used on fix-macosx.com.
If you really want to educate people, why not also provide directions on how to do it via the UI? Are you trying to scare people?
The privacy disclosure and instructions are perpetually available in spotlight settings by pressing the giant button labelled 'About Spotlight Suggestions & Privacy', which is probably the largest button in the entire OS.
Thanks for the awareness!
But your server is configured to allow SSLv3[0]
[0] https://www.ssllabs.com/ssltest/analyze.html?d=fix%2dmacosx....
In other words (assuming an attacker can modify a sufficient amount of SSL traffic in transit), they could decrypt the python source code, but they can't insert new data without triggering a MAC validation failure on the client.
I'd love to see this.
I've just about wrapped up support for correlating connections with the local responsible program (see branch macosx-process-info); I also need to put some thought into how to handle non-TCP traffic.
I'll be posting Yosemite setup instructions later today; my plan is to collect a corpus of data from a default installation. One thing I could really use help with is providing a web-based visualization of that data.
I think it's fair enough to point out that these search terms are transmitted to Apple. It's also reasonable to complain that the option is hidden, and the terms and conditions where this is pointed out are glossed over.
This site, however, is counterproductive theater designed to look hackerish and scary, as well as to mislead users. It commits exactly the same error as Apple is accused of committing - it hides the fact that there is a simple UI to control this function, and that users should be educated to make the choice for themselves.
Whoever did this is making things worse.
I know some people think that using hyperbole for effect is a thing. They tend to be very young, smart people who are starting to realize what they're capable of but are still trapped on the wrong side of the Dunning-Kruger curve. The most common defense people give is that they assume the reader or listener knows that the hyperbole shouldn't be taken literally, and that they're really trying to convey how strongly they feel about their much more reasonable actual opinion on the matter.
However, to me (and, I would hope, to most people), hyperbole in technical discussions means that the person is either immature in a way that makes them less credible, or that they are lying to me and assume I'm dumb enough to believe them. Or it's clickbait, or all of the above.
I don't think the author(s) of this site are any of those things, but I also know that Yosemite as a whole is not designed to take away 100% of your privacy, which is what the title implies. This is also what turns me off about a lot of FSF propaganda, and most politicians regardless of their beliefs.
Are your referring to the title of the HN submission, "Mac OS X Yosemite – No Privacy, by Design"? That text does not appear on the website. The website refers to "parts of Mac OS X which are invasive to your privacy."
It seems that's the intent expressed in the HN Guidelines (https://news.ycombinator.com/newsguidelines.html):
"Please don't do things to make titles stand out, like using uppercase or exclamation points, or adding a parenthetical remark saying how great an article is. It's implicit in submitting something that you think it's important. ... Otherwise please use the original title, unless it is misleading or linkbait."
>> That text does not appear on the website
> I could be wrong here
RTFA.
That particular title seems to be an editorial flourish on the part of the submitter -- that phrase does not appear on the actual site.
"In addition to searching your Mac, Spotlight now shows suggestions from the Internet, iTunes, App Store, locations nearby, and more. To make suggestions more relevant to you, Spotlight includes your approximate location with search requests to Apple. You can change this in Preferences. Learn more…"
Clicking on "Learn more" also tells you how to disable it. The python script is neat but a bit exaggerated IMHO.
Then I manually went into Spotlight settings, and was presented with a bunch of checkboxes that offer zero indication as to privacy implications. How am I to magically tell that the "Movies" option won't send my query to some Apple IMDB proxy?
Sorry, but this script is spot on. This should not be enabled by default, and the privacy implications need to be spelt out in every single detail. It should be a legal requirement, really.
There's a very prominent button labelled
> About Spotlight Suggestions & Privacy
on the Spotlight preferences window. If you're worried about the privacy of your searches, you can click that, and you get a detailed description of exactly what's going on, and how to disable it (to wit, uncheck "Spotlight Suggestions" and "Bing Web Searches").
The idea that having a button in the bowels of a preference menu is sufficient is...I don't want to say "nuts", but I'm thinking it pretty hard. I'm not happy. Not unhappy enough to subject myself to a Linux desktop, but Apple is making it closer and closer with every release.
> in the bowels of a preference menu
This is not the first time you've resorted to hyperbole in order to try and paint Apple in a bad light. It's not hidden anywhere. The moment you go to the Spotlight preferences, you see it.
What's more, the first time you see a search result that came from the internet, a) it should be obvious that means that your query must have gone to the internet, and b) the very first place you'd go in order to disable this behavior, the Spotlight Preferences Pane, is the same place that has this prominent button that gives you a detailed explanation.
> Not unhappy enough to subject myself to a Linux desktop, but Apple is making it closer and closer with every release.
It sounds to me like you're trying to invent reasons to hate Apple. This is a widely-advertised major feature of the OS (it was even in the WWDC keynote IIRC), with a very prominent warning explaining how Spotlight is different in this version of the OS and making it very easy to find out how to disable this behavior, with a very prominent button in preferences called "Privacy" that, again, explains what's going on and how to disable it. And yet you're trying to insinuate that Apple is trying to stealthily sneak in the behavior that sends your queries to them, without letting the user know, as if that was something they'd even want to do.
Really, this thread just looks like a bunch of paranoid conspiracy nuts, thinking Apple is out to steal your searches. I get it, privacy is important. I don't disagree. But you're* acting like they installed a keylogger on your computer (in point of fact, someone on IRC accused Apple of making "something that sends all of their local query keystrokes to Apple", which is a pure fabrication).
* that's the plural "you", not you personally
By the way, there's a perfectly good English word that means "plural you minus you personally," which is "they."
> By the way, there's a perfectly good English word that means "plural you minus you personally," which is "they."
If I was talking to you personally, one-on-one, I'd use "they". I used "you" because I was speaking to the larger audience of the people involved in this thread.
Based on the consistency of the delay, I assumed it was doing the quick local search for the top hit, and then deferring the more expensive searches (including internet-enabled searches) until it's decided that it's time to show the results window. So I tested it, sniffing http traffic, and while I didn't pinpoint which particular queries are sent by Spotlight, there was reliably a burst of HTTP traffic right before the results window was shown every time, and no noticeable HTTP traffic before then. This suggests that my assumption is correct, that it's not doing the internet-enabled search until it believes that the user is done typing.
Based on this, if you type your search and hit return immediately, then it won't have sent your query anywhere.
Going further, what makes you think I give a material shit about Apple's PR materials? I don't read about OS X releases, I upgrade when they show up because I trusted (past tense) Apple to do the right thing. Something you can bypass without even acknowledging it is at best sneaky. If Apple thought this was seriously all that and a bag of potato chips, an opt-in is real easy.
Be better than defending this, man. It's dirty.
And besides all that, apparently this issue doesn't even affect you. If you launch Spotlight, type "it", and hit Return, in order to launch iTerm, to the best of my knowledge, Spotlight won't have even sent your query to Apple. It had a local application result to deliver, and you accepted it without waiting for more results. From playing with it myself, and from watching patterns of network traffic, it appears to me that it doesn't even initiate the search unless it thinks you don't want the first result.
The only thing dirty here is your desire to publicly accuse Apple of bad behavior when you blindly installed a brand new major OS upgrade without reading anything about it, ignored the blatant message they gave you, ignored every single visual cue about how the functionality you were using has been radically changed, and then read on the internet that there was a possibility that your search queries might be sent to Apple and freaked out.
And I don't know what they're not asking me to opt into sending. That's the fucking problem. You can play with it all you want and fiddle with it however you like to determine you're okay with it, that's fine. I am blanket not okay with remote services receiving local anything by default. I got pissed when Ubuntu did it, I'm pissed when Apple does it.
> And I don't know [...] * That's the fucking problem*
Yes, that is the fucking problem. You're arguing very loudly about something you don't know anything about.
It was wrong when Ubuntu did it with the Amazon lens crap. It's wrong when Apple does it. They're not special.
"In addition to searching your Mac, Spotlight now shows suggestions from the Internet, iTunes, App Store, movie showtimes, locations nearby, and more. To make suggestions more relevant to you, Spotlight includes your approximate location with search requests to Apple."
Seems pretty clear to me. It also might be a subtle clue that you are getting various kinds of search results from the Internet.
There's also very easy-to-understand hand-holding built right into the UI to help you disable it, if you want to.
It's pretty obvious, for the non-obtuse at least, that if you extend the functionality of a feature such that it searches the Internet, that means it's going to actually search the internet, which means sending your search terms to external services.
It's at best shitty UX and at worst dirty.
Really what would you do with the UI to make this feature prominit enough to the user?
May point about the script was more that it also just disables the two things listed in the initial privacy info given by Apple, i.e. "MENU_WEBSEARCH" and "MENU_SPOTLIGHT_SUGGESTIONS" and having informative text with screenshots to which checkboxes to unselect on the website would have sufficed. At least you wouldn't be executing code from some random place on the internet.
curl https://fix-macosx.com/fix-macosx.py
curl -o https://fix-macosx.com/fix-macosx.py && /usr/bin/python fix-macosx.py
1) $ curl -o https://fix-macosx.com/fix-macosx.py
1a) Review fix-macosx.py
2) $ /usr/bin/python fix-macosx.pyDoes anyone consider OS-native search that queries your local computer AND the web to be useful?
As the default in ubuntu, it is actively confusing, and distracting. At least from my point of view, if I'm searching for something using my OS search, that means I want to find something ON MY computer. If I want to find something online, I will look online (google, etc.).
The workflow from OS -> OS Search -> Browser -> Search is often slower than Alt-tabbing to the browser that is already open, pressing Ctrl+T and typing your query.
This approach of combined search might make sense on mobile, where cloud storage is the norm, but on a personal computer, it is an insane default.
What we have today is two problems: First, we are in the middle of the transition. People are needing to learn new behaviors. That's always hard. Second, it isn't seamless yet. While I haven't tried it, I highly doubt my Google Docs would show up in the my Spotlight search. The fragmentation increases confusion.
Bing Websearch is clear enough but it took me a while to figure out what Spotlight Suggestion is. It looks like it gives you movie recommendations.
If there is more to the code, I would like to know what else I should disable. Also, ideally would like to know what I am giving up by disabling them.
Go to System Preferences > Spotlight. Uncheck items you don't like to have searched and displayed for you.
Oi vey.
In contrast, searching the local files on one's own computer or launching applications on one's own computer are private, local events that need not be shared with any third party.
Inherently private stuff just happens to leak out into the world now because Spotlight does web search too.
Regardless, it doesn't matter. It's simply ignorant to bitch about this, when the NSA literally intercepts all of this and exploits or introduces exploits into the software you use. This is fact. Apple at it's worst will present you an advertisement, big fucking whoop. Seriously, what is the risk? Annoyance? The NSA can wrap you around a pole and make it appear you were snorting 12kilos of coke a day. I am quite literally baffled by the sentiment on HN when I see people up in arms over convenience like this trumped up as if it were in violation of your rights. They added a 'learn more' link and explain what is going on. Yet the same people simply ignore the actual threat, repeatedly. Cowards.
Keep fighting them windmills. Because the real enemy fights back.
I'd rather be an idiot who gets angry about his TV phoning home to report every DVD and .avi file I've played (in the clear, for no apparent reason: there are no ads, recommendations or features of any kind on the set itself) than a defeatist who equates the futility of circumventing state surveillance with the futility of paying attention to one's outbound internet traffic.
I should have an active choice in how and who I expose my data. If LGe, Apple and friends can't be bothered asking people if they actually want their habits recorded, let alone bother to encrypt said data, expectations on storing, securing and using that data aren't exactly high.
It's not an irrational thing to weight the risk of state surveillance rummaging through my gmail to be a little less than some stupid home computer/router/NAS "feature" exploding and blowing me wide open to identify theft and financial fraud.
Theft and financia fraud? Do you search for you account numbers and passwords in spotlight???
When RealPlayer was grilled for bundling spyware which harvested the exact same data, why did their excuses ("hey we mentioned this in the EULA, plus you could've scrolled through the features and disabled it at install-time") not create the same placated reactions Apple seems to be achieving here?
"Opt-out of some part of this avalanche of b.s. information-leaking features serving little to zero actual benefit to the user" has always been a stupid, sleazy trend to monetize the very basics of computing and whilst I respect that most people don't give a damn and/or don't have the energy to give a damn, it's a user-hostile design pattern.
I switched to DuckDuckGo for the last couple of months. Works fine for 95% of my searches. The other 5 percent is related to local (to my country in Europe) searches, where Google is absolutely giving better results.
That said, it takes time and some Googling to make sure that every connection initiated from your system is legal but for security aware users is a very interesting managing and reporting tool.
1.Open System Preferences > Spotlight
2. Uncheck Spotlight suggestions, Bing web searches and any other options you're not interested in
Can anyone explain this?
Edit: I think that you have to disable Location service for Spotlight separately in Privacy settings.
No idea about that smoot thing, though.
You would very likely be alarmed by what your phone is doing and who it's talking to without you knowing. iPhone or Android.
It's mostly Open Source with some proprietary bits sprinkled on top. It also comes with AV software, though I won't speak to the efficacy of said AV software.
I would like to build an equivalent fully-FOSS system, but haven't had time to do that yet. It would of course need to be Ansibled (or equivalent).
To that end, there's 2 things going on here:
1. Apple added functionality called Spotlight Suggestions, which pulls in data from the internet, including things like iTunes and App Store results, wikipedia results, movie showtimes, etc. It's basically a form of the specialized search results you get in search engines (such as Google, Bing, and, yes, even DuckDuckGo) where it tries to extract semantic meaning from your query and give you the result inline. This is generally considered very useful for search engines, and Apple decided they wanted Spotlight to have this behavior.
I think this makes sense. Spotlight is basically Sherlock 2.0, so this finally restores behavior that Sherlock (and Watson before it) had (although Sherlock/Watson required you to explicitly search the various providers, whereas Spotlight decides when to do the searches based on its own interpretation of the query).
The privacy implication here is that searches used with Spotlight Suggestions are sent to Apple, so they can improve Spotlight Suggestions. This is something that web search engines already have, and is important for making the functionality behave better. This data is not shared with anyone else, sold, or monetized. And yes, I believe Apple when they say that.
Also to note, this is basically exactly what already happens with Siri. Your Siri queries are sent to Apple (so they can actually be answered), and that information is used to make Siri better.
2. The second part of this is Bing Web Searches. It appears most queries don't even go to Bing. I tried a random sampling of queries and never saw any search results. The Privacy button states that "Searches for common words and phrases will be forwarded from Apple to Microsoft's Bing search engine", which makes it sound like Bing only even sees the search if Spotlight determines that it can't handle this query with local data or Spotlight Suggestions.
Which is to say, this does not mean that Microsoft sees every search you do. It seems they only see some searches, which are for "common words and phrases". Also, according to this, "These searches are not stored by Microsoft", which suggests that Apple's contract with Microsoft puts restrictions on them regarding how they can use the search.
---
Ultimately, Apple only cares about what makes the user experience better. They're in the hardware business. That's where their money comes from. And they're successful precisely because whenever they're given the choice between something that might make more money, vs something that makes the user experience better, they choose the latter every single time. And monetizing searches does not make the user experience better.
The first time you initiate Spotlight after installing Yosemite, it gives you a very big message, explaining how Spotlight changed, explaining that it now sends search queries to the internet, and providing a big "Learn More" link that opens the built-in help document on the subject (I think it's https://help.apple.com/machelp/mac/10.10/index.html?localePa..., which I found via the (?) button in the Spotlight Preference Pane, but since I've already bypassed the warning I'm talking about I can't double-check).
Not only is the message very obvious and blatant, but Spotlight itself looks radically different than it used to (among other things, it's now a floating window in the center of the screen, instead of being attached to the magnifying glass button in the upper-right), so the risk of someone thinking it's exactly the same Spotlight as before is pretty low.
> Changing what it's supposed to do
What it's supposed to do is provide a good natural language search of any and all information it has available to it. This is what millions of customers use it for, and this is what Yosemite enhanced. Now it has more information available to it. Just as I can ask Siri "what is planet of the apes?" and she'll tell me about the movie, now I can ask Spotlight for "planet of the apes" and learn about the movie. This is great! It's bringing functionality from iOS back to the Mac, in a form that's generally easier to use (speaking to Siri is not always convenient), and doing it in a way that seamlessly integrates with the existing functionality.
I don't use Siri, either. I don't own an iPhone. You're more than welcome to have whatever internet-enabled hurf and/or durf you want, what I'm saying is that enabling it by default in what is a low-friction, high-usage tool that works on unconscious reflex is some real douchebaggery.
If you care so much about the possibility of a feature using the internet (as opposed to what would actually be a privacy violation, which is selling your information or queries to third parties, instead of, ya know, just using it to provide the functionality you're trying to use), then it's your responsibility to actually learn what this stuff is doing.
But you admitted to installing a brand new major OS update without reading anything at all about it. It's not Apple's fault that you chose to be so intentionally ignorant.
If you don't want the existing OS functionality to change, then don't install major OS updates. If you install major OS updates, then expect functionality to change. And the most cursory of searches would let you find out what's new and updated in the OS. Perhaps you should read the list to find out if any other functionality you use has been modified: http://www.apple.com/osx/all-features/
Besides and instant revenue loss, Apple would build an absolutely awful search engine so it's great news that they haven't tried yet. I mean, look at how awesome they did with mapping.
Second off, a common user wouldn't care for the "privacy loss" that this might be for some of you. That is why they made it opt-out instead of opt-in. If it was opt-in, nearly no one would use it, because if it's useful, why wasn't it enabled by default?
Please click Billing Info to approve your billing information for use in the iTunes Store. If you cancel you will not be able to buy until you have approved your billing information."
For a FREE upgrade? I'm sure Apple has data showing that people with a credit card on file are more likely to buy paid apps/songs/etc, but this is fucking annoying.
{'enabled' : True, 'name' : 'MENU_WEBSEARCH'},
{'enabled' : True, 'name' : 'MENU_SPOTLIGHT_SUGGESTIONS'},
Or, 'man mdutil' if you would rather not type in commands suggested by random people on the Internet. :)