Member Avatar for happygeek
happygeek 2,411 Most Valuable Poster

If Mac enthusiasts groaned when Apple announced it was switching to Intel chips, watch out for full-scale hissy fits as they discover that OS X 10.4.7 contacts Cupertino servers on a regular basis. Just how similar to Microsoft does Apple want to be?

You would have thought that the furor regarding the Windows Genuine Advantage mother ship communication might have been a warning shot about secret computer communications being a bad thing. You would have certainly have thought the ongoing legal wrangling at Microsoft would have the alarm bells ringing at Apple.

Nevertheless, no, in an insane display of Seattle Fever, Apple developers were quite happy to have a new process in 10.4.7 called dashboardadvisoryd call out to Cupertino in order to verify Dashboard widget versioning matches the ones on Apple's servers. In typical Microsoft fashion, end users are being assured that no personal information is transmitted. In equally typical Microsoft fashion, you can be sure that Apple would not have been saying anything had the packet sniffers using Little Snitch not made their discovery. Certainly not the fact that, also new to this latest Tiger update, a the .Mac dotMacTranslator service will attempt to contact configuration.apple.com if you create a new email account, for example, regardless if that email account is a .Mac address or not.

I seriously doubt that anyone with any real understanding of how the OS works will lose much sleep over the actions themselves, but plenty of end users will be asking why Apple felt it didn’t need to disclose the phone home policy. Moreover, in this malware aware era, asking quite legitimately in my never humble opinion. What's more, everyone should be asking where there is no obvious method to disable this WGA-alike behavior. Unless, as a rather unhelpful Apple spokesperson advised, you turn it off through a terminal entry.

Of course, it is somewhat ironic that Apple has exposed itself to all this bad press over nothing. Does anyone really care if some darn Dashboard Widget is up to date or not? Do they care enough for the OS to phone home and check on their behalf? No, I thought not. Apple insists it is a security measure that prevents server spoofing and that the end user has downloaded a kosher widget from a third party host.

The .Mac email account business is a little harder to explain, and shrug off for that matter. If anyone fancies having a go at enlightening me, hit the comment button now.

  • 1 Contributor
  • 0 Replies
  • 112 Views

Dani AI

Generated

raised a good, still-relevant point: system components occasionally reach out to vendor servers for integrity, configuration or update checks, and that behavior can surprise users who expect a closed, local-only OS. The useful first step is not to assume intent but to verify exactly what is being sent and by which binary, then decide whether to block or disable it.

To audit outbound activity on a Tiger-era Mac, identify the process and capture the traffic. Useful commands:

sudo lsof -i -n -P
netstat -an
ps aux | grep <pid>
sudo tcpdump -i en0 -w /tmp/trace.pcap

Open the saved capture in Wireshark to inspect HTTP headers and payloads. If the connection is encrypted you will not see payload contents; in that case look for TLS hostnames, used ports and certificate details to decide whether the connection is expected.

To contain or disable an offending component, locate its launch item and unload it (always back up the plist first):

ls /System/Library/LaunchAgents /System/Library/LaunchDaemons ~/Library/LaunchAgents
sudo cp /path/to/com.example.plist /path/to/com.example.plist.backup
sudo launchctl unload /path/to/com.example.plist

Proceed cautiously: unloading system services can remove useful functionality. A safer, reversible approach is an outbound firewall that blocks specific processes — the OP mentioned packet-sniffing tools; a user-level outbound rule lets you block without changing system files.

Practical rule: monitor first, confirm what identifiers (hostnames, headers) are exchanged, then block only the precise process/host if the traffic contains identifiable private data or you can tolerate the lost feature. Keep system updates and vendor statements in mind, and back up any plist you modify so changes are reversible.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.