[tubbyjr]

I have not bought an Apple product... evar

But I said I would get the first production-ready ARM Laptop chip... It had to be an Apple, here I am writing this on an M1 Laptop now (to my credit I am trying to minimize as much of the home phoning via various means, albeit I understand I'm using complete spyware).

ARM/RISC is the future.

[908B64B197]

You bought the second production-ready ARM laptop chip it seems. [0]

Also, unlike the M1, if your SSD goes bad because of excessive usage [2] you can just swap it with a screwdriver [1]

[0] https://en.wikipedia.org/wiki/Surface_Pro_X

[1] https://www.ifixit.com/Teardown/Microsoft+Surface+Pro+X+Tear...

[2] https://www.macrumors.com/2021/02/23/m1-mac-users-report-exc...

[cesarb]

> You bought the second production-ready ARM laptop chip it seems. [0]

Do netbooks count as laptops? Because I've used the Efika MX (https://genesi.company/products/smartbook), which is an ARM netbook older than the Surface.

[Nition]

Can anyone beat 1992? The Acorn A4:

http://www.computinghistory.org.uk/det/22807/Acorn-A4-Laptop

[m_mueller]

I think you win :)

[Angostura]

> I understand I'm using complete spyware

What makes you say that? There is relatively little phoning home in MacOS

[jolmg]

I don't really follow Apple news, but I do remember this:

https://sneak.berlin/20201112/your-computer-isnt-yours/

> On modern versions of macOS, you simply can’t power on your computer, launch a text editor or eBook reader, and write or read, without a log of your activity being transmitted and stored.

> It turns out that in the current version of the macOS, the OS sends to Apple a hash (unique identifier) of each and every program you run, when you run it. Lots of people didn’t realize this, because it’s silent and invisible and it fails instantly and gracefully when you’re offline, but today the server got really slow and it didn’t hit the fail-fast code path, and everyone’s apps failed to open if they were connected to the internet.

> Because it does this using the internet, the server sees your IP, of course, and knows what time the request came in. An IP address allows for coarse, city-level and ISP-level geolocation...

> Apple (or anyone else) can, of course, calculate these hashes for common programs: everything in the App Store, the Creative Cloud, Tor Browser, cracking or reverse engineering tools, whatever.

> This means that Apple knows when you’re at home. When you’re at work. What apps you open there, and how often. They know when you open Premiere over at a friend’s house on their Wi-Fi, and they know when you open Tor Browser in a hotel on a trip to another city.

[cgh]

For what it's worth, Apple has refuted this here: https://support.apple.com/en-us/HT202491

"We do not use data from these checks to learn what individual users are launching or running on their devices.

Notarization checks if the app contains known malware using an encrypted connection that is resilient to server failures.

These security checks have never included the user’s Apple ID or the identity of their device. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.

In addition, over the the next year we will introduce several changes to our security checks:

A new encrypted protocol for Developer ID certificate revocation checks

Strong protections against server failure

A new preference for users to opt out of these security protections"

[dylan604]

>Notarization checks if the app contains known malware using an encrypted connection that is resilient to server failures.

Hmm, was that statement released before or after their servers failed?

[Dylan16807]

"we promise not to store your personal data (from now on)" and "we never used the data" are extremely weak refutations.

[titzer]

I'm with Stallman on this one. Without access to the source code of their entire server stack, there really is no way to be sure of what they are or are not doing.

[orf]

Even with it there is no way to be sure of what they are or are not doing. Trust in an external endpoint is not improved by some theoretical source code dump on GitHub.

[astrange]

This post is factually incorrect, it does not send a hash of the application (instead an identifier that can be shared across apps) and the server doesn't save any logs.

[neolog]

It's a developer ID. Most developers have only one app, so it's very close to an app ID.

[derefr]

But a content-hash would have given them a release ID (i.e. which specific version of the app bundle you're running.)

A series of {release hash, launch timestamp} events could be used to build a much more precise profile of your computing habits than just {app ID, launch timestamp} events would.

Also, you're ignoring the power-law: while yes, the majority of software exists in a long-tail of ISVs, most of the apps that people use are made by big corps that make a lot of apps each. 80% of the apps on any computer (Windows or macOS) are Microsoft or Apple or Adobe apps. When you're using any of those, all Apple gets is {Apple, timestamp} or {Google, timestamp} or {Adobe, timestamp}. That's... not very useful for profiling. Especially the first two. Safari and iTunes are both just "Apple" through this system. Are you working? Relaxing? Who knows?

[neolog]

Those are fair points. The original report was much more serious before Apple changed policies to make the reports encrypted in transit and stopped logging IPs.

[zelon88]

Apple telling you they don't log IPs means nothing. Facebook did this and nobody batted an eye. [1]

It's also incredibly unlikely. I'm just trying to picture what this server that does no kind of user identification at all looks like. What value would it possibly offer? Just to count how many times an application is opened? How can any kind of analytic application function without some kind of user profiling mechanism and a place to store that data for analysis?

It sounds too good to be true, so it probably is.

[1] https://www.eff.org/deeplinks/2019/03/facebook-doubles-down-...

[stouset]

It’s not an analytic application, its purpose is to benefit users not Apple, and Apple doesn’t actually have any profit incentive to collect user data from this service.

Facebook operates a free service that they use to collect data about you to sell for advertising purposes. Apple sells expensive personal electronics directly to consumers, and has made it a part of their core brand to be privacy-conscious. They’re certainly not perfect, and they’ve clearly made missteps along the way, but they’ve done more than virtually any other public company to further their customers’ privacy and demonstrably collect as little data as possible. When they have made mistakes, they’ve carefully explained what circumstances led to it and have generally gone above and beyond in ensuring that kind of mistake can’t happen again.

Your perspective is little different than the indefensible “both sides” mentality many people have toward politics. Apple is not Facebook, and there is a massive difference to anyone actually paying attention.

[kbenson]

I too, used to think incentives were good enough to generally guard against bad behavior like this. The problem is that incentives can change quickly and unless data is explicitly (and with some guarantee) removed, there's always the chance for it to be accidentally exposed, nefariously exported, or repurposed as incentives change. The only safe amount of data to send out by default is what's essential to accomplish what you are trying to do.

Relying on Apple to do the right thing when they're sent a bunch of data which has some use to them, and to their users, if they keep it and run statistical analysis against it, is like relying on that handshake agreement to store some of your belonging in your kindly old neighbors shed. Sure, you trust him, but he's not going to be around forever, and who's to say what will happen to it if someone takes over his property after he's gone. And if that kind neighbor had a habit of cleaning up the stuff your kids left in your yard for you by putting the items in that shed of his... well it's nice that he allows your kids to get their stuff from there whenever they want, but still, that's just asking for problems down the line.

[astrange]

https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...

[kergonath]

There is some phoning home from applications, though. On top of the occasional Gatekeeper SNAFU. I like to rely on Little Snitch, and feel nervous when using a computer without it.

[jdshaffer]

I'm curious -- do you find a lot of unsavory activity using "Little Snitch", or is it almost all fair-and-square?

I ask out of honest curiosity. I tinkered with LS a year ago or so, but it made me wonder just how many bad-actors are really out there.

Cheers!

[kergonath]

Google, Adobe, and Microsoft tend to be quite bad. The other ones tend to be reasonable and just check for updates every now and then. It has flagged a couple of daemons, mostly related to iCloud, but nothing very suspicious after a quick investigation.

So no, nothing too worrisome.

[m_eiman]

A lot of applications, perhaps a majority, use analytics and send data data to eg Google or Microsoft whenever you run them.

[tubbyjr]

So what measure of relatively little in your mind would yield it not to be spyware?

In my mind, no phoning home, and open-source at the very least. So to me, it's spyware indeed, because as you just said yourself, it phones home.

[outworlder]

Hash checks for malware is not the same as spyware. If anything, it's the opposite.

One could argue that these hashes should be downloaded and then checked against a local database and I can't really argue against that, sounds like a standard anti-virus MO and I would prefer that.

You can block those connections if they bother you.

[dylan604]

>checked against a local database

Is this ripe for being manipulated by an infected system though? By keeping it central to the home office, they have control over the single location rather than trying to ensure every single system stays current.

[upbeat_general]

They can be blocked but not in a simple way for most users. If it was a preference synced with iCloud or at the very least in system preferences I’d be okay with it but I shouldn’t have to fight with my OS. Plus I had to unblock ocsp.apple.com at one point because it was causing an issue with something else.

In any case, defaults matter.

[Dylan16807]

It's not the "opposite". It's very much a "lesser evil" situation.

> One could argue

Could and should.

[mike00632]

The 2019 Microsoft Surface Pro X is an ARM laptop.

https://www.theverge.com/2019/11/5/20948092/microsoft-surfac...

It uses a Qualcomm laptop processor.

[lallysingh]

Can you put Linux on it?

[edgyquant]

Last I saw Linux will boot but it’s so new they were still in the alpha stages of having a proper terminal, let alone true GPU support.

[kergonath]

In a VM, yes. As the only OS, not quite yet.

[ben-schaaf]

Not if you want the GPU to work - or a whole host of other things that usually don't work on recent macs.

[bloqs]

I hope you read up on the SSD wear and tear controversy that has been PR'd out of existence