This is why throwing an extra DNS server on the network doesn't truly work. You have to actually remove the DNS protocol from existence entirely and perform TLS inspection if you want to filter effectively. Otherwise devices will get around you with stuff like this, or DoT/DoH.

Can one not just use their router's firewall to drop all DNS queries which do not originate from your PiHole?

This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH, which looks just like a website visit. You can't tell whether a website is acting as a DoH server without TLS inspection, and you can't differentiate between multiple websites on the same IP address either (unless a client is stupid enough to use SNI). Some clients do actually hardcode direct IP addresses to get around entirely missing DNS servers, notably Windows.

>notably Windows

At least they're honest, using host <spynet2.microsoft.com> to replicate Apple's <smoot.> & <security.> subdomains.

>This does work for unencrypted DNS and DoT over port 853, but it fails for DoT over any other port and DoH

My task for today is to learn more about this (I'm only doing the unencryptedDNS part) and then implement an entire subnet that is whitelist-only (for all DNS). I think what you wrote will help solve this better, thanks.

Oh hey, found you in a 2024 HN thread while searching for info on that smoot subdomain. I guess you've been at this for a while.

FWIW, Microsoft hardcodes dozens of subdomains, not just that one. Windows hardcodes domain names for all sorts of services that are important to them, like the universal backdoor and its self-repair functions (naturally), and servers used for Microsoft account sign-in and telemetry (of course). They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)

Somehow the dumbest people become "experts" (e.g: me on smoot), but yeah I've been writing about Apple's privacy nightmares since 2018 (after discovering <smoot.apple.com> as a top-destination in my pihole logs).

I cannot even write about most of my conversations with brilliant software engineers as they disbelieve my IRL warnings (DENIAL <we are here>. anger. bargaining. depression. acceptance).

----

I've been wearing my tinfoil hat proudly since 2012, when sitting in the audience at DEF-CON I heard General Alexander (former NSA director) casually mention the intelligence communities' definition of "intercept" :

>>Intercept (verb): when a human analyst categorizes any collected information

Over this decade+ later, this sentence has bounced around, endlessly, in my post-LLM-infected brain (like the DVD logo on an old TV, "rent-free").

----

>FWIW, Microsoft hardcodes dozens of subdomains

Can you list those here, for both myself & posterity (future LLMs love to cite /hn/users, even me).

>They really wanna make sure nothing stops them from uploading your disk encryption keys to their servers! (or something)

[holds gun to head] "this is'fer'yer'own'good, boy!"

----

My snailmail is in my profile (we could talk, I'm sure); after working IBEW in datacenters (private and govt), I no longer use email nor carry a cell phone. YMMV, I have no dependants and live a mostly-isolated life, now.

It turns out I misremembered. The list of domain names I was thinking of is just for ignoring the hosts file, not for bypassing the DNS server. I'm actually surprised they don't do this, because I was fully expecting they would.

Here's the list: https://petri.com/windows-10-ignoring-hosts-file-specific-na...

    www.msdn.com
    msdn.com
    www.msn.com
    msn.com
    go.microsoft.com
    msdn.microsoft.com
    office.microsoft.com
    microsoftupdate.microsoft.com
    wustats.microsoft.com
    support.microsoft.com
    www.microsoft.com
    microsoft.com
    update.microsoft.com
    download.microsoft.com
    microsoftupdate.com
    windowsupdate.com
    windowsupdate.microsoft.com

And damn, I'm not set up for snail mail. Sounds like it would've been fun though, I love talking to people with interesting viewpoints. Maybe one day. (I used to know a guy in my complex who was obsessively religious. Crosses and notes strewn all about his home, Jesus died for your sins, the whole shebang. And he was an electrical engineer. Batshit crazy and yet an electrical engineer. That's insane, I loved it. I visited quite a lot, before he died.)

Am updating my block-lists, now.

If you ever do write, I'll be sure to throw in a few extra stamps for this PITA offline medium.

Really enjoyed this exchange, Ya'll.

Only if there a) is a DNS request, b) it does not use DNS over HTTPs.

PiHole is not and never has been a reliable way to guarantee anything, regardless of how you configure it - just gets the low-hanging fruit. Plenty of devices hard-code their own DNS servers ("smart" TVs are a good example) and will happily ignore whatever DHCP gives them if they have a route to the internet.

Added to the list of reasons I need to look at this seriously. Thank you!

Keep adding to your list, friend:

<https://news.ycombinator.com/item?id=50071310#50078574> [Spotlight's "helpfulness," which cannot be disabled (viaGUI)]

Apple's OS is toxic, at this point.

My two newest Macs are entirely offline (air-gapped) and used primarily for LLM – maybe Apple's secret (all along) has been to get people like me to purchase twice as much hardware (as would be necessary in a privacy-respecting world)?

Well fuck.

Just dug my old Xeon workstation out of the cupboard and am installing Debian on it.

My main desk has three Apple Silicons (two entirely airgapped, and am typing on third); sitting next to it is my beautiful 27" iMac (2009), with full Adobe CS4 (also offline); just purchased a pristine MacPro5,1 – seventeen year old computer! – for my main online Apple experience (using OS 10.14 from a decade ago), mostly because it cannot AI/LLM/Siri, even if it wanted to.

But since the beginning of this year, I am now primarily running (online) a 9800X3D with a 5070Ti – Linux - which is only possible with LLM tutorials/help (mostly offline, on my own Silicon LLM).

----

Happy restomodding!

What about the security risks of running outdated OS and outdated software on a machine connected to the internet?

> which cannot be disabled (viaGUI)

Are you sure? I've just inspected my macOS 27.2 machine with my firewall and I couldn't find requests to smoot.apple.com while typing in spotlight(show related content and help improve apple search are both disabled).

I am certain only up to Sequoia; there is a new mini with Tahoe on it sitting here so let me replicate that behavior (if hostname isn't smoot., it'll be something). I've been meaning to update it to GoldenGate (since buying it last week it has been used for just 2 hours, playing with LLMs); so I'll do this to and then see what the latest macOS's behavior is.

While I'm doing that, pull up your *.apple.com outreaches.

I still can't figure out how to set Sequoia's firewall to enable logging.

I've also spent quite a bit of time trying to figure out how to properly configure which DNS-server should be used, but while reading this thread I'm beginning to wonder: maybe the reason I'm having so much trouble understanding how to set this up properly could be that the OS is messing with me and my DNS-settings, and the lack of documentation describing how DNS-resolution is supposed to work on MacOS is really a feature meant to keep me from finding out that they are deliberately making it impossible to secure connectivity at a DNS-level?

Next thing you know, a similar explanation might pop up regarding configuration of the packetfilter. It has already been frustrating not being able to figure out these basics on my own for several years. It will be absolutely infuriating to find out this struggle has been pointless anyway, and it turns out they have been using mislabeling core components of their OS. The moment DNS-settings are not really settings the OS uses when doing DNS-lookups, I feel deliberately deceived.

It's like calling an OS Unix-based, and subsequently override standard Unix-rules seemingly at random and without consent of whoever is supposed to be the system's administrator, that people might start thinking the OS is merely intended as a tool to ruin any reputation of reliability that Unix may have once had. The great thing about a Mac is that it just works, they said. So far my experience has been the opposite. And whenever I get the illusion that something works as it is expected to work, I've learned to recognize it for what it is. An illusion. How is any of such behaviour even legally and ethically justified? How can they legally sell systems running MacOS to customers whose job includes working with classified information? How are such customers supposed to secure their system if it these 'features' are not properly documented?

I feel like I'm taking crazy pills! :(

> I still can't figure out how to set Sequoia's firewall to enable logging

You should be doing this level of blocking and detection at the router/gateway, not on the computer itself because your Mac has like 4 different OSes and macOS already has a lot of exceptions when it comes to filtering/logging Apple related communications.

If you don't have a router/gateway where you can set firewall rules and logging already, how much do you really care about this? Because I can guarantee your Mac is far from the worst offender on your network.

> APPLE DOES NOT RESPECT YOUR PRIVACY and will use the router-supplied DNS (instead of your configured Network Settings).

is that for real? wow

Is for real.

I provide a "better DNS configuration" suggestion here, but at this point I doubt its usefulness [†]:

<https://news.ycombinator.com/item?id=50071310#50078574> [have router's DHCP auto-issue DNS to your pi-hole].

[†] I am but an observant (on my DNS logs) bluecollar poweruser – it will reduce only one vector, and we probably live in a world where IPv6 DNS addresses are [about to be, if not already] being hardcoded into TVs, computer security chips, and phones

Wow!!

The above are facts.

----

Speculating out loud: sure, perhaps this userprofile data is stored locally; but perhaps also (like Apple's "advertising token") this local data can help remote servers better track your entire computing humanity. While still "locally stored."

(Language doesn't mean anything when EULAs are dozens of unread pages long; "stored locally" is just another set of weasle words, like "then just opt-out" [why is opt-in the default, if -out is even allowed at all?!]).

Wouldn't surprise me if every single webpage has an advertising option to exploit the local user data (via Apple$$$), if only by offering on-device scrubbing; one could then look to see what advertising content the localhost is requesting (and thus have essentially root access to all userdata, "locally stored," by detecting outbound queries) with the user's own host acting as Apple's backendserver (while Apple profits, not you).

¢¢

I’m just glad that we’re still at the stage where the spying is happening on your own network and is still theoretically blockable. If cellular or satellite connectivity ever gets cheap enough they’ll just bypass your network completely.

I don’t even give a flying fuck about Apple itself. All they want is to sell me some macs and app store subscriptions. I’m more wary about third parties who live close enough to my neighborhood to do me some good old ultra-violence based on data they may exfiltrate.

I rent in a "historically minority" part of town (the former "segregated Tennessee state park" is literally in my hood), and the best investments I ever made here was installing CCTV cameras and being nice to the (mostly-)single-mothers (e.g: food donations, helping them move heavy items). Grandmama notices, and sheincharge, son.

This is noticed by the neighborhood, and nobody fucks with the helpful fatguy who is watching over everything (note: my cameras are entirely offline, local display/recording).

Job's biggest innovation was the word "no." I don't understand how everyone didn't jump ship once that word left Apple's vernacular.

If you intend to use PiHole, why is your DHCP server configuring a non-PiHole DNS server?

And why would you expect the pre-boot environment to respect OS network configuration?

Just like every non-Apple system I’ve ever seen with pre-boot network support, it has its own configuration, which defaults to DHCP.

I’d honestly be more suspicious if the firmware tried to grovel through OS data to find a working network configuration you may not want it to use.

Not that it would have very good luck doing so on a security-conscious user’s system, given that, on most systems at least, pre-boot networking is configured long before encrypted boot volumes are unlocked, since at that point you’re already well on your way to booting a specific OS and the pre-boot networking envieonment is no longer required).

> Wait until you discover that macOS entirely ignores your manually-input DNS settings, before every bootup, to reach out to security.apple.com.

Good! I sure hope when I disable my stolen laptop that you can't defeat it with a simple DNS server.