from Hacker News

My Mac contacted 63 different Apple owned domains in an hour, while not is use

by rpgbr on 6/12/25, 11:21 AM with 202 comments

  • by al_borland on 6/12/25, 11:50 AM

    While this seems like a lot, in some ways this is what user's expect. Push notifications should be coming all the time, assuming the system is on. Most users expect various maintenance services to run when the system idle so it doesn't interfere with their active use of the system. When users open apps like Weather (or view a widget), they expect it to already be up to date without having to manually refresh or wait for data to load when the app launches.

    I'm sure some fat can be trimmed, and it may not all be user-centric, but a lot of this had to do with the expectations users have these days with the data being always up to date, instantly available, and proactive about alerting them to things they may want to know about, like rain coming to your area in 30 minutes.

    One of my big pet peeves is when I pick up my phone in the morning, go to open an app, and it starts updating, so I need to wait for the download/install. It just had 8 hours on a charger to do that, and instead it seems to wait until it's taken off the charger and unlocked. With auto-updates on, I'd much rather this happen when placed on the charger and inactive, than actively in use and off the charger. The same can be said for a lot of things on the desktop.

    This ends up mostly being a question of transparency and user control. Which then becomes a question of how much time/money to they invest in features for 1% of users? Now how much time do they invest in those same features when the 99% will stumble in there, turn a bunch of stuff off, then call support and ask why their weather widget isn't updating?

  • by SimianSci on 6/12/25, 11:56 AM

    Polling domains when attached to the network like this doesnt suprise me in the least. Apple's ecosystem has often been praised for its tight integration, and this consistent network connectivity is the result. Anybody who has worked with large scale services that rely on messaging services to ensure people get timely notifications and data, knows that you need services which are continuously polling endpoints to check and see if they have new information.

    Organizations like Apple who service billions of devices cannot rely on a "push data to system only when something has updated" type of system, as such a system doesnt operate at their scale. They have to operate a system where individual clients are assumed to have an unreliable connection to the service, and where the client does the legwork of checking for new data stored in a centralized system.

    This is what you are seeing in the article. Domains like [gdmf.apple.com] which govern device management, are where the declarative device management system is checking Apple's various databases to see if they need to update their configuration.

  • by Ardren on 6/12/25, 12:26 PM

    For fun, compare and contrast the comments here to this post on Windows 10 from 5 days ago: https://news.ycombinator.com/item?id=44208050
  • by jitl on 6/12/25, 11:49 AM

    Would it really be better if there was one domain used for everything? If you want to turn off your Mac doing things like syncing data with the screen off, you can: https://support.apple.com/en-in/guide/mac-help/mh40774/15.0/...
  • by this_user on 6/12/25, 12:42 PM

    Apple is the new Microsoft. They have pretty much saturated their target market. And since there is nothing much new to do, teams justify their existence in the org by changing existing things and adding unneeded functionalities that ultimately make the user experience progressively worse.
  • by mark_l_watson on 6/12/25, 12:41 PM

    As so many other people have also said, many Apple services like iCloud sync require a lot of network I/O. I use two iPads, one with 64G of storage and the other with 1 terabyte of storage. Applications and data frequently get offloaded and reloaded on my old iPad.

    I appreciate hand-off, and accept the overhead for supporting that.

    Most data is encrypted at rest on Apple's servers and during transport. Check their documentation.

  • by lapcat on 6/12/25, 12:17 PM

    Little Snitch can detect and block connections at the process level.

    https://www.obdev.at/products/littlesnitch/index.html

  • by nkotov on 6/12/25, 2:58 PM

    Apple has a nice list here where you can see what it connects to and why: https://support.apple.com/en-us/101555
  • by 1vuio0pswjnm7 on 6/12/25, 7:02 PM

    One of the things that really put me off about Apple's computers, namely their pre-installed OS, was how "chatty" they have become when attached to a local network, let alone the internet.

    As such, I stopped buying Apple. I have not owned a Mac since the G4 days. I never attached it to the internet. I would use TCP/IP and a crossover cable to move files.

    I always see a high vollume of traffic from other peoples' Apple computers on the wire that is not intitiated by the computer owner. To my sensibilities, this is cringeworthy. Because there is no way to turn if off. The computer owner has no control over it.

    Apple fans can argue this is useful and convenient. That may be true. But that does not explain why it is mandatory, on by default and impossible to disable. I am not against useful options and convenience. I am in favor of control.

    When I compile and install a NetBSD image the amount of mandatory network traffic is zero. It is up to me to decide what to enable. That's how I like it.

  • by thomassmith65 on 6/12/25, 11:24 AM

    With Apple, you want to block *.apple.com and white-list subdomains as you need them. If instead you black-list apple subdomains, the battle will never end.
  • by DavideNL on 6/12/25, 6:13 PM

    Somewhat related;

    This week i configured Keyboard Maestro to turn off Wi-Fi and Bluetooth when my MacBook (M1 Pro) goes to sleep, and re-enable them on wake.

    This has had a huge impact on the battery drain while not being used. Even when the lid is closed.

    Would recommend.

  • by Avamander on 6/12/25, 12:21 PM

    It's even better that quite a few of those connections are unencrypted (and are actively used by some vendors to profile devices).
  • by jbrooks84 on 6/12/25, 12:40 PM

    Is this the first time you are monitoring traffic of any modern consumer devices connected to the Internet?
  • by hoppp on 6/12/25, 3:11 PM

    If you want to block Apple domains, why buy a Mac?

    Vendor lock in and tracking is all part of the Apple experience.

  • by zevon on 6/12/25, 12:02 PM

    Does anybody know if all the Apple remote connection things happen on the MacOS level? I'm mostly using Asahi on my personal Macbook these days instead of MacOS and I'm curious if that cuts off everything or just many things.
  • by simondotau on 6/12/25, 11:45 AM

    The way I see it is either you trust Apple or you don’t. To be clear, I think it’s perfectly reasonable to arrive at either conclusion, as it relates to your own needs and security posture.

    Personally I choose to trust them. My trust is not blind, and they could lose my trust very quickly. But as it stands right now, they have my trust.

    If you say that you don’t trust Apple, I don’t see how you could tolerate running any of their software. Relying on an operating system made by a company I don’t trust seems wildly irresponsible to me.

  • by crawsome on 6/12/25, 11:42 AM

    I'm curious what Microsoft and Ubuntu's experience is as well, so there's a frame of reference.

    I skimmed that list, and Devil's Advocate; It seems like most of that is functional, stuff that they want to update in the background to make sure you have a better experience when you're back?

    On the flip, I guess we think Apple is up to something shady? My last understanding was that they were firm they didn't sell user data. Did this change?

  • by st3fan on 6/12/25, 12:02 PM

    What is the problem with this?
  • by dusted on 6/12/25, 1:12 PM

    they must have missed one, I'm sure they can index 64 domains.. unless 0 means "don't do anything". Just be glad they didn't opt for a 16 bit register for the call home functionality :D
  • by realreality on 6/12/25, 12:19 PM

    I use a slow cellular connection and noticed some apple service (I could never figure out which one, even after installing an outgoing firewall) was aggressively uploading some large blob every time the mac woke from sleep, which made the whole connection useless for up to half an hour.

    At some point, apple must've fixed this "bug", but the experience -- and apple's increasingly obtrusive software -- convinced me to switch to linux.

  • by oneplane on 6/12/25, 12:13 PM

    TL;DR: not really all that exciting. Apple also publishes a list of domains, ports and protocols and what they are needed for. The side-effects of filtering them usually means something doesn't work right or doesn't work at all (push messages, software updates, buying stuff, anti-theft - which will fail closed!).

    > I have been trying to minimize to the extent possible the reach of big tech into my life

    That's how integrated services on connected devices work; why the surprise? You can't both have a connected experience that works while also not connecting to hosted services that provide that functionality.

    This isn't just Apple, anything that has any connected (cloud or anti-theft or otherwise) will need to function like this.

    If your version of big tech is anything that provides managed services, you might as well get off the internet as it doesn't really provide that much value without it. That applies to basic services as well:

    - Want email? Either go big or go home since you'll be attacked and spammed so much that unless you essentially learn to become an MSP for email for yourself it's not really feasible (and that includes all the GitHub projects we've seen on self-hosting; it's great as a one-off or hello-world demo, yet maintenance and knowledge is still required - time people aren't willing to invest)

    - Want search engines? Extremely expensive to run, so you're going to consume one or not use one at all.

    - Want to communicate with other people? They might use scary big tech and there is nothing you can do about it short of not communicating with other people (but that's antithetical to your wish to communicate with others).

    - Want to communicate with business services? They might require you use known quantities such as specific operating system versions and configurations, certain apps, or they might not service you at all (banks, insurance, medical, transit etc.)

    Can you apply a lot of time and energy to work around all of this? Possibly! But you end up not having much time left to do the things you actually wanted to do in your life. It essentially ends up similarly to what al_borland wrote: most large workflows and processes (regardless of governmental, for-profit businesses etc) don't want to make intensive exceptions just so 0.001% of their customers can be 'different', on one hand because it's not sustainable (you end up having one process for 99.99% of the users and many, just-as-expensive variations to that process for a bunch of individuals), on the other hand because it's not profitable (spending for one flavour and getting all the return on it vs. spending and getting practically no return on it).

  • by npteljes on 6/12/25, 11:45 AM

    Honestly, the list looks legit. Computers nowadays are semi-remotely-managed appliances. Internet is presumed, offline is not first, and offline is absolutely not exclusive.

    >I have been trying to minimize to the extent possible the reach of big tech into my life.

    I don't think this goal is possible, or worthwhile, on a big tech offering like a Mac + macOS. It can certainly be tried, but the user needs to be prepared for unforeseen consequences, and the override of the settings. It is like plugging in the ears to have a quieter life, in the middle of a metropolis. In the end, the context won't change. The direction of the platforms are clear, and the zeitgeist is bigger than all of us. The first option with a real impact is leaving the ecosystem.

    Although, blocking some domains could be a good first step towards that. Rome wasn't built in a day.