Apple Phones Home, Two

Daniel Jalkut notes Mac OS X 10.4.7 phones home ostensibly for Dashboard security reasons. Apple, you know better than this. Daniel writes:

The problem is this feature popped up without my permission, and there’s no obvious way for me to turn it off.

Bingo. This is a replay of the iTunes “MiniStore” fiasco, which Apple eventually did the Right Thing about after getting a PR black eye.

Other writers will do a better job lambasting Apple over this (ooh boy, can’t wait for the Doctorow spittlefest), so I’ll skip the sermon. Instead, I’ll riff on a different point: vendors, trust and Little Snitch.

Little Snitch is developed by the fine folks at Objective Development — an independent party. It alerts you to new outgoing connections, allowing you to permit or deny them on-the-fly. It’s great at catching apps phoning home.

Given the OS-level nature and security benefit of this type of feature, I think it’s quite conceivable a future version of Mac OS X could roll in this functionality. And therein lies the rub: a security conflict of interest.

If 10.4.7 had Little Snitch-like functionality today, I bet Apple would have added dashboardadvisoryd to the default whitelist. After all, Apple knows it’s not malicious, right? Last thing Apple tech support needs is millions of users getting warnings about a new outgoing connection.

That’s the crux of my point: I wouldn’t trust Apple not to hobble such a security feature in their “favor”. This is exactly where you want an independent third party to provide the functionality. Even if 10.5 included such functionality, I’d still use Little Snitch since they lack an incentive to surreptitiously hide certain traffic (except for Little Snitch itself phoning home — just kidding).

Apple overall does pretty well, but between them hiding the “opt-out” option when asking for your personal information while installing Mac OS X (command-Q, by the way, will let you skip it), closing the source of the kernel, the iTunes MiniStore and now this, Apple sends out a creepy signal that it’s best to fend for yourself.

Tuesday, July 04, 2006
01:19 AM