Hacker News Reader

Comment by ravenstine | Hacker News Reader

> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective.

Yes, and no. If you're using software that the state deems to be subversive or "dangerous", a developer certificate would make the nature of the software you are running pretty clear. They don't have to know exactly which program you're running, but just enough information to put you on a list.

> You shouldn’t probably block ocsp.apple.com with Little Snitch or in your hosts file.

I never asked them to do that in the first place, so I'll be blocking it from now on.

View on HN

> I never asked them to do that in the first place, so I'll be blocking it from now on.

Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

The hosts file works for now. Use 127.0.0.1 and ::1 on two separate lines. Used tcpdump to verify.

Isn't that just with Big Sur? Also, I'm using the hosts file method.

The OP is about Big Sur.

I don’t think it’s actually just in Big Sur. At the bottom of this post describing how to stop them from hiding traffic, they mention someone did a test on Catalina and ran into an issue with the Messages app:

https://tinyapps.org/blog/202010210700_whose_computer_is_it....

Apple deprecated kernel extensions like Little Snitch in Catalina, so if I had to guess it probably applies there as well.

if they keep doing like this I will block their entire ASN .

Until they front it via cloudflare or aws. I got hit by AWS blocking when setting up a network in Russia for the 2018 World Cup - my unifi controller was on an ec2 instance that was blocked due to telegram shenanigans. Worked around the problem but shows that blocking an AS can lead towards an unusable computer.

They already are fronting much of their stuff via Akamai, so good luck doing that...

Apple is old enough that you need only block 17./8: they have a class A(!).

Or stop buying stuff that is broken-by-design in the first place.

Do you think you are going to win the war against "your own" hardware?

It's worth noting that on ios you can never block anything - just have to put up with it.

... and that apple wants to merge its operating systems

No they don’t. They keep adding new ones.

They want to provide a consistent user experience across their ecosystem. Not the same thing.

Unfortunately the consistency is moving in the direction of iOS rather than macOS.

You can still block access by host by using an HTTP proxy like Fiddler or Charles.

Settings > WIFI > Proxy

I use adblockios and haven't upgraded because they unblocked the blocking. I keep hearing about charles, I wonder if it is special or if it doesn't really block everything.

You could block still block it externally by running a dns sinkhole (a la PiHole) on the same network, provided that you can still configure the DNS resolver.

That assumes the hostname will stay the same and not get overloaded by other essential services.

Yep. That seems to be within the realm of possibility though, no?

Maybe downgrade the macos would work. As I'm in old version of os, Little Snitch works quite well.

Privacy concerns aren’t the only reason to block it. It also makes software way more responsive. I was experiencing daily freezes that would disconnect my keyboard and mouse (particularly when waking the computer or connecting to an external display) on my 2020 MacBook Air before adding the entry to my hosts file which fixed the issue entirely. It was so pronounced and irreparable by Apple support technicians that I nearly ended up getting rid of the computer.

Besides blocking from the hosts file, you can try:

    sudo defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None
    
    sudo defaults write com.apple.security.revocation.plist OCSPStyle None

Reply on news.ycombinator.com