Big Sur phones home bypassing a VPN or Little Snitch?

[FMiguelez]

According to this article, Big Sur phones home too much for basically anything, and apparently not even a VPN or LS can prevent it due to new APIs.

The privacy boat sailed a long time ago for most of us, so I'm not sure how serious this could be.

https://sneak.berlin/20201112/your-computer-isnt-yours/

[Michael Canavan]

The article is a hit piece. When you first open an application if you are online it sends a message to Apple querying whether it's notarized properly and not a virus, trojan horse or malware. Apple servers for whatever reason were down the other day and applications hung on opening. It's a soft disconnect, if you're not online it simply doesn't query the server. For anyone not using online services this would have been the solution. It's a good thing to know though, if you're having dodgy internet issues and you're having problems opening applications, then turning off wifi is the way to go.

I get the concern, but it's overblown, on other forums partisan Windows users are running with this as some proof that Apple are data thieves, when they're of course not perfect, but far from the sorts of data thieves that Google and Facebook are.

[dix]

According to this article, Big Sur phones home too much for basically anything, and apparently not even a VPN or LS can prevent it due to new APIs.

The privacy boat sailed a long time ago for most of us, so I'm not sure how serious this could be.

https://sneak.berlin/20201112/your-computer-isnt-yours/

Yeah, privacy issues are, perhaps naively, a very low priority for me.

But, and this may be OT, I did get bit by a very real Mac issue last month that was related to Apple servers. I didn't notice anyone here posting about it, but I was wondering if anyone else was affected.

After launching in the AM to start work everything on my cMP was impossibly sluggish. Fearing the worst, I was in the middle of booting in Safety Mode when I saw others on FB having the same problem (yes, booting into Safety Mode takes that long on my cMP that I got bored and was scrolling my phone with my other hand while waiting!). Turns out the glitch was effectively being streamed to us from Apple. It never occurred to me, again naively, that this was even possible.

macOS Big Sur launch appears to cause temporary slowdown in even non-Big Sur Macs
https://arstechnica.com/gadgets/2020/11 ... xbjpJ2p70M

Mac users couldn’t launch apps this afternoon after Apple verification server issue
https://www.theverge.com/2020/11/12/215 ... k3lgxxLIaU

In about an hour the issue was gone entirely - thankfully I saw the FB thread before I took radical steps to fix it. It made me wonder if Apple will be broadcasting more instability in the future, and if I should disconnect my Mac from the internet while working on tight deadlines.

[mikehalloran]

ut, and this may be OT, I did get bit by a very real Mac issue last month that was related to Apple servers. I didn't notice anyone here posting about it, but I was wondering if anyone else was affected.

Apple had a problem nearly 5 weeks ago. It has been fixed.

[dix]

ut, and this may be OT, I did get bit by a very real Mac issue last month that was related to Apple servers. I didn't notice anyone here posting about it, but I was wondering if anyone else was affected.

Apple had a problem nearly 5 weeks ago. It has been fixed.

Yeah, and it only lasted a few minutes. I'm just lucky I guess

Is it hubris to think it will remain fixed and/or to assume that a different debilitating issue couldn't be coming from Apple or elsewhere? I haven't seen anyone recommending we air-gap our Macs, but the thought has occurred. The next time I experience system-wide weirdness I'll be searching the internet for others experiencing the same thing simultaneously before I start local fixes or recovery operations for sure.

[waterstrum]

Yeah!
Feels a bit big brothery to me.
I appreciate the security concerns, but looks like my system can be shut or slowed down if Apple is having a bad day.
They want to check all of the apps I log in to each day?
Yikes!

[bayswater]

It's surprising how little discussion there is on this. The ARS article cited above seems to cover it best, but I'm wondering whether the "phone home" check happens every time an app is launched, or just the first time, or if a checksum has changed. That first time has been happening one way or another for a long time with OS X.

If it checks every time, it would be good to know why, when it has already been checked, and has not been altered since the first check.

And, regardless of this issue, does Little Snitch still do anything useful in up to date OS versions?

[monkey man]

Ha!

Same 3 questions I've had in my mind too, Stoivo.

1) Every launch or first-time-only as has happened previously?
2) If every time, why?
3) Is LS' efficacy compromised in the latest OS versions?

[FMiguelez]

Hi, Nicky.

Yes, while it doesn't explicitly say so, the wording in the article suggests Big Sur does phone home EVERY time you open an app.

And in Big Sur new APIs apparently render LS useless (as well as VPNs for this purpose). As to the why, I suppose it's anybody's guess, but the FBI's displeasedness was mentioned in one of the article's new additions as a cause for Apple to turn off encryption for iPhone backup in iCloud (which is set to do by default).

Hmmm.... They've got us all by the cojones with a tight grip, it seems!

Also, "they" (big brother) probably already have all there is to know and have about us all by now... It's probably too late for our generation to worry about privacy.

BTW, the article has been updated a couple of times with some interesting additions.

[monkey man]

Hi, Nicky.

Yes, while it doesn't explicitly say so, the wording in the article suggests Big Sur does phone home EVERY time you open an app.

Ridiculous!

And in Big Sur new APIs apparently render LS useless (as well as VPNs for this purpose).

Unbelievable, 'Nandito. I'd like to think Apple won't cave the way "everyone" else has 'though. We'll have to wait and see.

I mean, sure, not that many peeps run LS or similar, but VPN's have been all-the-rage of late, and even TV commentators recommend using them. If Apple prevents the use of VPN's, I can guarantee you that it'll lose many customers. Heck, even me possibly, and that's saying something 'cause I've been an Apple die-hard since the '80s even 'though I could only afford my first one in 1999.

Hmmm.... They've got us all by the cojones with a tight grip, it seems!

Fakebook, InstantGlam, TwitStar and Frugal maybe, but surely not Apple? Thus far I've been happy with the company's attitude regarding security and collection of (anonymised) data as an aid to product improvement. If things turn out as the article predicts, then yeah, we're all screwed.

Also, "they" (big brother) probably already have all there is to know and have about us all by now... It's probably too late for our generation to worry about privacy.

For most maybe, but I've been careful. Never joined or posted in PooToob, FakeBook, InstantGlam or TwitStar. Not once, so I have to conclude that I'm better-off than most, at least so far. If Apple does this •••• then as I suggested, I'd likely look elsewhere which would be both tragic and painful from my POV.

Thanks for sharing, bud.

[bayswater]

Looking at the updates to the articles makes me want to see someone's else's take on the situation. I have trouble placing much trust in this writer.
E.G.
"The good news is that Apple has, just today, publicly committed, presumably in response to this page, to:
- deleting the IP logs
- encrypting the communication between macOS and Apple to prevent the privacy leak
- giving users an option of disabling these online checks that leak what apps you’re opening and when."

That pretty much deflates the whole issue, no?

[monkey man]

I thought the same thing, Stoivo, but does that cover the data collection by such things as iChat (I think that's what it's called - never used it) and iCloud (never used it either)?

For good measure, I posted this article in the GearSlutz Apple Silicon thread to see what the boffins over there have to say.