Unblock xp.apple.com

Which AdBlocker/DNS cloud service do you use?

AdGuard Home

Other

No response

NextDNS users only

• IMPORTANT - I have disabled the block page in NextDNS and confirm that the problem still occurs!

With which block list(s) does the problem occur?

Multi ULTIMATE

Which domain(s) should be unblocked?

xp.apple.com

Why should the domain(s) be unblocked?

You can see this domain under 'software update' in their documentation here so blocking it might break update for those device : https://support.apple.com/en-us/101555

https://apple.stackexchange.com/questions/372241/what-is-the-host-xp-apple-com-for-and-what-is-sent-there

https://www.scss.tcd.ie/doug.leith/apple_google.pdf

I do NOT recommend unblocking it. @hagezi

For me official doc must prevail on other thing, because if apple come to put something new behind this and it's blocked you will break user update (and create a massive security issue).
If Apple say it's for update it's for update so it must be unblocked as false positive.

Also in your doc it say : Despite selecting the ‘Don’t Share” option on the “iPhone Analytics” screen during the startup process, telemetry data is sent to xp.apple.com/report/2/psr ota

Telemetry data is not tracking nor publicity and I don't even see why it's an argument to prevent the unblock

Potentially preventing update for some telemetry is too risky and a complete nonsense if you take the goal of blocklist (blocking tracking / ads)

It's why I recommend the unblocking as for me hagezi's list have the same line as oisd meaning have a list that try to break the least thing as possible even in it's ultimate list.

Edit : also there is other list on the net for those who want to block everything at the cost os breaking many thing without never unblocking the known false positive like this one.

I would agree, but the domain is blocked for a very long time across the Pihole/AGH community and there were never issues with it. This blocklist is also NOT focused for business compliance! The goal of the blocklist is to serve the best possible amount of protection against tracking, ads and other unwanted connections (which xp. is one of) for the community. Businesses have their own eco system to protect their network, which is compliant to the CoC and the ruling law.

I get your point though, but the focus is protection without breaking services and usability.

https://help.nextdns.io/t/p8hsc0x/macos-users-check-xp-apple-com

Blocking of XP.apple.com prevents Xprotect (Apple Security System) to update.

Thanks @BirdInFire i will create a pull request.

[hagezi]

The domain is only blocked in Ultimate and it remains blocked there. It is tracking, the blocking has not caused any problems since some iOS versions.

[hagezi]

https://gizmodo.com/apple-iphone-analytics-tracking-even-when-off-app-store-1849757558

https://youtu.be/8JxvH80Rrcw?si=PH-_QISdkvbZICDP

[hagezi]

There were a few OS versions in which there were problems with updates when the domain was blocked. I only had problems with watchOS back then, but these problems have not occurred for a few versions now. Apple has "reacted". Almost all Apple devices are represented here in the household and there are no problems with the blocked domain.

There may be one or two functions where there are restrictions that we haven't noticed yet. That is also the reason why it is only blocked in Ultimate.

The Ultimate is an aggressive list that blocks a few trackers that lead to restrictions, such as the Facebook graph tracker.

If you use Ultimate, you should be aware of what you are using. There is a list version for each desired blocking level, from relaxed to aggressive.