undefined | Better HN

0 pointsinfotogivenm3y ago0 comments

Agree with gp that this is a astonishingly huge logical leap by the author. I would guess the author left the default “report metrics to apple” on, and apple is noting that “a user leveraged the photo preview feature for the first time in X days.” I do wish these metrics were optin but I somewhat get the decision from a PM standpoint, and to their credit Apple presents this choice to the user during the setup process in a really hard-to-miss way.

Incredibly lazy blog post IMO, if you’re going to write an article and video on an infosec site, take the time to MITM the connection so you can avoid purely tinfoil speculative reporting. Apple likely does not make this easy but it is possible to do anything when SIP is disabled.

0 comments

sneak3y ago

Analytics are off, as is iCloud, the App Store, Siri Suggestions, and every other Apple service there is a knob exposed for.

Live Text is on, because the machine was recently updated to Ventura and it defaults to on and it never asked if I wanted it. (It's a brand new preference setting.)

If you're going to call someone lazy, look first into what it takes to MITM a TLS connection from an Apple system service to Apple. It seems you are unaware. It's not trivial these days.

infotogivenmOP3y ago

Maybe media codec checks then, or a bug that ignores the metrics setting. We can go all day at this until someone finishes the research.

> It seems you are unaware. It's not trivial these days.

I know very well what it takes, thats why I said Apple does not likely make this easy. The last time I tried was a few releases ago: disable SIP, write a frida hook to disable pinning, maybe a couple hours the first time you do it. If I were in a pinch I might not even bother with that and instead just pop mediaservicesd into IDA or Hopper and attach to the process as it hangs in littlesnitch. However I did not write a tinfoil essay on a strange observed behavior without actually investigating it, so I will not be doing any of those for you.

nhchris3y ago

If as you say Apple is deliberately making it so difficult to inspect what their OS is doing, maybe we should assume the worst, until proven otherwise.

1 more reply

j / k navigate · click thread line to collapse