"Advanced Tracking and Fingerprinting Protection" Leaks DNS Queries to Apple (opens in new tab)

Being a network and security guy, I've watched firewalls start blocking Apple devices "privacy" proxy as "Proxy Avoidance" category on common firewalls such as Palo Alto and Fortinet, and have often debated whether to allow or filter this. It's mostly noise to me, but I just facepalm with silly apple users falling for these consumer traps.

To me, this is just another way Big Tech is trying to siphon everything you do via them for inspection, ie. their marketing or selling of trending what you do regularly, including Apple. People don't know any better, it sounds real good to the normal layperson user as "protection", but really, it's not. When Apple switches this on globally under the guise of user benefit, I just laugh knowing better. Now that Apple sees _everything_ you do, they can go ahead and build that search engine they always wanted too.

Think differently said the wolf to the sheep.

Funny just a week or so ago Google of all people announced a "Privacy VPN" product. Hah, yeah right Google, you're just mad Apple thought of the racket first and want in on the action since Microsoft already has their Telemetry spyware well established for everything a user does sent to them, and Apple now too with their privacy proxy spyware.

As opposed too cloudflare, or google, or my shady provider. Cloudflare does exactly the same but call it filtering.

Use a VPN and unbounded orso if you want to keep you queries private..

I noticed I couldn't reach my home servers which use split dns resolution, and it turns out that's because iOS 17 routes DNS queries via Apple DNS servers when using 'Advanced Tracking and Fingerprinting Protection'.

Good to know

* when setting up home networks or

* you want to use DNS for content filtering or

* you prefer your DNS queries to stay private

Dont leak DNS queries to Apple, leak them to Cloudflare 1.1.1.1 instead plox! K thx bye.

I would be interest for Kagi (with their browser Orion) to comment and get their take on this

Imagine being technically competent enough to know how to configure alternative DNS servers and also stupid enough to bother trying to filter your teenage kids internet.