Live data from Hacker News

macOS phones home when previewing local image files [video]

youtube.com

21–26 of 26 posts

Re: macOS phones home when previewing local image files [video]

#21
post #18

Earlier quoted context omitted.

Agree with gp that this is a astonishingly huge logical leap by the author. I would guess the author left the default “report metrics to apple” on, and apple is noting that “a user leveraged the photo preview feature for the first time in X days.” I do wish these metrics were optin but I somewhat get the decision from a PM standpoint, and to their credit Apple presents this choice to the user during the setup process…

Analytics are off, as is iCloud, the App Store, Siri Suggestions, and every other Apple service there is a knob exposed for. Live Text is on, because the machine was recently updated to Ventura and it defaults to on and it never asked if I wanted it. (It's a brand new preference setting.) If you're going to call someone lazy, look first into what it takes to MITM a TLS connection from an Apple system service to Apple…

Maybe media codec checks then, or a bug that ignores the metrics setting. We can go all day at this until someone finishes the research.

> It seems you are unaware. It's not trivial these days.

I know very well what it takes, thats why I said Apple does not likely make this easy. The last time I tried was a few releases ago: disable SIP, write a frida hook to disable pinning, maybe a couple hours the first time you do it. If I were in a pinch I might not even bother with that and instead just pop mediaservicesd into IDA or Hopper and attach to the process as it hangs in littlesnitch. However I did not write a tinfoil essay on a strange observed behavior without actually investigating it, so I will not be doing any of those for you.

Re: macOS phones home when previewing local image files [video]

#23
post #18

Earlier quoted context omitted.

Analytics are off, as is iCloud, the App Store, Siri Suggestions, and every other Apple service there is a knob exposed for. Live Text is on, because the machine was recently updated to Ventura and it defaults to on and it never asked if I wanted it. (It's a brand new preference setting.) If you're going to call someone lazy, look first into what it takes to MITM a TLS connection from an Apple system service to Apple…

Maybe media codec checks then, or a bug that ignores the metrics setting. We can go all day at this until someone finishes the research. > It seems you are unaware. It's not trivial these days. I know very well what it takes, thats why I said Apple does not likely make this easy. The last time I tried was a few releases ago: disable SIP, write a frida hook to disable pinning, maybe a couple hours the first time you d…

If as you say Apple is deliberately making it so difficult to inspect what their OS is doing, maybe we should assume the worst, until proven otherwise.

Re: macOS phones home when previewing local image files [video]

#24
post #20
post #17

Earlier quoted context omitted.

There is no legitimate reason why quicklook should be hitting an API when I preview a bitmap in the Finder. Analytics and Siri Suggestions are off. I don't use iCloud. Text recognition models would likely be served from an Apple CDN, not api.smoot.apple.com. I don't know what it's sending (an API hostname suggests some dynamic server code, not just a file download), but it should not be sending anything at all. I don…

I'm responding to you in good faith in the hope that you will take this with an open mind, but now that I see the previous thread, I'm worried that you might not. I'm not sure if you saw this comment but I thought it was particularly constructive and deserves consideration: https://news.ycombinator.com/item?id=34403107 > I didn't make the claim that file information is being sent because I didn't want to publish anyt…

I was wondering how long it would take someone to notice.

It's deliberate.

Re: macOS phones home when previewing local image files [video]

#25
post #23

Earlier quoted context omitted.

Maybe media codec checks then, or a bug that ignores the metrics setting. We can go all day at this until someone finishes the research. > It seems you are unaware. It's not trivial these days. I know very well what it takes, thats why I said Apple does not likely make this easy. The last time I tried was a few releases ago: disable SIP, write a frida hook to disable pinning, maybe a couple hours the first time you d…

If as you say Apple is deliberately making it so difficult to inspect what their OS is doing, maybe we should assume the worst, until proven otherwise.

[deleted]

Re: macOS phones home when previewing local image files [video]

#26
Anyone know how to actually examine the contents of the request? Everyone's tossing around their own theories as to what this request is for but it looks like nobody's doing any real investigation. I'm on macOS Ventura and I tried this method that was suggested in another HN post: https://lapcatsoftware.com/articles/logging-https.html

But it doesn't seem to work. According to the aforementioned post, Apple system binaries are using cert pinning so it's difficult to intercept the network requests that they make. The suggestion was setting an environment variable to politely ask them to log their requests. I don't think mediaanalysisd respects this variable, however.

Post reply on HN