[HN Gopher] macOS 26 breaks custom DNS settings including .internal
___________________________________________________________________
macOS 26 breaks custom DNS settings including .internal
One of those 'woke up to MacOS updates' and finding none of my
dockers are reachable via dnsmasq (which I use), and low and
behold, an update silently breaks custom dns resolution. Hopefully
Apple will listen to the bug report I've made. Hold off on updating
if you use this...
Author : adamamyl
Score : 296 points
Date : 2026-03-19 15:06 UTC (7 hours ago)
(HTM) web link (gist.github.com)
(TXT) w3m dump (gist.github.com)
| adamamyl wrote:
| Before others jump in: I already use Linux (and used to run
| FreeBSD as my desktop operating system).
| bgentry wrote:
| Thanks for sharing your report, it's frustrating to see things
| like this break in minor patch updates. Small tip for GitHub
| Gist: set the file format to markdown (give it a .md extension)
| so that the markdown will be rendered and won't require
| horizontal scrolling :)
| mrpippy wrote:
| The report says it broke when updating from macOS 15 to 26,
| so not a minor patch update. I'm a bit surprised no one
| noticed this earlier though, since 26 has been out since
| September and in beta since June.
| Congeec wrote:
| If you have ScreenTime turned on. Port :8080 is occupied and your
| ubuntu apt-get in a docker build gets hash mismatch because they
| obviously modified packets. Let alone I am having another issue
| of unable to delete a private key in Keychain Access.
|
| The whole macOS thing is amateur
| delduca wrote:
| Port 5000 is also ocupied on macOS.
| 1718627440 wrote:
| Why does macOS use ports above 1024 by default? There is a
| reason it is reserved to be used by OS services.
| binaryturtle wrote:
| I run a setup like that on my (outdated) Yosemite machine to
| provide multiple private TLDs for local deployment/development
| needs.
|
| I set that up in like 2014? Even back then it was known already
| that the quick /etc/resolver way was the deprecated way to do
| things. So I guess they finally killed that feature off?
|
| The proper (more awkward) way is to use scutil directly (which
| then stores the settings in some binary plist somewhere, I
| assume).
|
| Maybe try this and see if it still works afterwards?
| hrmtst93837 wrote:
| scutil is only half the story, because some macOS lookups still
| go through mDNSResponder in ways that ignore or override that
| config, which leaves you debugging random misses and binary
| plist junk. At this point, unbound or dnsmasq is simpler.
| himata4113 wrote:
| Still wishing for the day apple is split into the hardware and
| the software company. I want their silicon, but I will never use
| their (arguably terrible) operating system. If I can't run my own
| kernel and kernel modules then it's a device that I don't own.
| Firmware is alright in some cases, but my laptop next to me is
| running core boot just to prove a point.
| t-sauer wrote:
| But you can run your own kernel on Macs, no? Isn't driver
| support the issue?
| vbezhenar wrote:
| Maybe Apple Hardware would write Linux drivers to sell their
| hardware for servers. Intel contributes to Linux kernel. AMD
| contributes to Linux kernel. Nvidia contributes to Linux
| kernel. A lot of hardware manufacturers support Linux to some
| extent. It's no longer reverse-engineered wild west.
| himata4113 wrote:
| Not on new silicon and asahi linux is still pretty damn far
| from being able to use it seriously. I do appreciate the
| effort, but I am just saying that it would be a lot better if
| you know, apple sold the hardware so vendors could build
| laptops with apple silicon.
| whalesalad wrote:
| macOS is not perfect but I don't think anyone could seriously
| argue that it is terrible.
| hedora wrote:
| It's pretty bad. IPC doesn't work reliably any more. The
| window manager is unusable. Spotlight misses results and also
| pegs the cpu, killing battery.
|
| Finder is bad enough on its own, but the 1:N mapping from
| logical directories to filesystem directories (like photos,
| home, applications, etc) makes it essentially unusable
| without spotlight.
|
| Notifications are flaky as hell (missing phone calls and
| messages from contacts, but displaying explicitly blocked
| spam sms).
|
| Copy paste between devices has never worked right.
|
| Which part of the OS is not terrible in your experience?
|
| Edit: also, compatibility with video games (even ones
| released for macos) is abysmal. It's much worse than Linux's
| ability to run the Windows version of MacOS native releases!
| theshrike79 wrote:
| > Edit: also, compatibility with video games (even ones
| released for macos) is abysmal. It's much worse than
| Linux's ability to run the Windows version of MacOS native
| releases!
|
| Linux can run Windows native games because Valve has shoved
| millions and millions into perfecting Proton.
|
| And I still wonder why Apple hasn't just dumped a billion
| on Valve's door to build a similar tool for macOS.
| mikestew wrote:
| _(arguably terrible) operating system_
|
| macOS has made some arguably poor design choices, but it makes
| it hard to take someone seriously when they state the whole OS
| is terrible.
| seemaze wrote:
| It's the worst OS we have.. except for all the others.
| himata4113 wrote:
| It could be just me, but every time I tried to do something I
| sat thinking that I am not the target audience for this
| thing. I don't like the UI, I hate not being able to talk to
| the hardware the way I can on linux (uart took me way too
| long to get working), I am angry that I am not able to run
| kvm, I hate not being able to replace the desktop and fix
| bugs myself. That's what makes it terrible for me.
| TheSkyHasEyes wrote:
| MacOS IMHO is no longer a viable OS for people like us(who
| know what this website even is). MacOS26 along with
| Windows11 are enshittifying and in some ways it's glorious
| to see. I do feel bad for non-IT people though, Linux is
| daunting to them...I get it.
| mikestew wrote:
| Fair enough, thanks for clarifying your distaste for macOS.
| Sounds like any closed source OS just isn't for you. :-)
| commandersaki wrote:
| So you're upset an operating system that is called macOS is
| not in fact Linux. Gotcha.
| himata4113 wrote:
| pretty much, it's unix and I want it to be unix, but I
| get the worst parts of linux and windows combined.
| sonofhans wrote:
| I see you. These folks trying to talk you into liking
| MacOS are missing the point. You're being perfectly clear
| about not liking it, and why -- it's not built for you.
| And that sucks, 'cause their hardware is top-notch. It's
| true pain.
|
| Apple really is leaving everyone else years behind in
| making hardware. Yet they've never done what I would
| consider obvious geek-friendly things to MacOS. I'm sad
| about it too, and I wish the OS were better.
| bigyabai wrote:
| There's a reason macOS is the least-used OS behind Linux and
| Windows. If it was any less terrible, we would know.
| x3ro wrote:
| Source? [1] states 12% for macOS and 3% for Linux.
|
| [1]: https://gs.statcounter.com/os-market-
| share/desktop/worldwide...
| hedora wrote:
| Steam reports 3.4% for linux and 2% for macos (last
| montg. This month numbers are probably hit by systematic
| measurement errors).
|
| https://store.steampowered.com/hwsurvey/
|
| Also, the 16% "unknown" in the graph you linked to
| implies huge error bars on macos vs linux!
| bakugo wrote:
| Steam stats aren't particularly meaningful in this
| context, because MacOS is largely unusable for gaming due
| to not being able to run most games.
|
| Valve themselves have given up on supporting their games
| on Mac, likely due to the total lack of backwards
| compatibility.
| seabrookmx wrote:
| That's desktop market share. I'm sure the comment you're
| replying to means overall usage including mobile and
| server, where Linux is far and away the leader.
| mrbuttons454 wrote:
| Papercuts like this are why I moved away from macOS.
|
| I will say, I don't love the use of LLMs to write these bug
| reports. It's probably fine if reviewed, but at least review for
| things like "worked on macOS 25", which obviously didn't exist.
| If that wasn't caught, how sure are you that the rest of the
| report is accurate? We all want the bugs fixed, but people are
| going to start throwing out the obviously LLM written reports
| rather than have to validate each claim, since the author
| probably didn't.
| duped wrote:
| Using LLMs for any kind of writing is unethical, with the
| narrow exception of translation. If you didn't take the time to
| compose your words thoughtfully then you aren't owed the time
| to read them.
| dec0dedab0de wrote:
| There is a huge difference between using an llm and just
| blindly dumping it's output on someone verbatim.
|
| I think it's fine to have an llm write a first or second
| draft of something, then go through and reword most of it to
| be in your own voice.
| r_lee wrote:
| at this point I really think its better to read broken
| english than have to read some clanker slop. it immediately
| makes me want to just ignore whatever text i'm reading, its
| just a waste of time
| runarberg wrote:
| I do wonder, we had pretty good (by some measure of good)
| machine translations before LLMs. Even better, the
| artifacts in the old models were easily recognized as
| machine translation errors, and what was better, the
| mistranslation artifacts broke spectacularly, sometimes
| you could even see the source in the translation and your
| brain could guess the intended meaning through the error.
|
| With LLMs this is less clear, you don't get the old
| school artifacts, instead you get hallucinations, and
| very subtle errors that completely alter the meaning
| while leaving the sentence intact enough that your reader
| might not know this is a machine translation error.
| r_lee wrote:
| and not just artifacts/hallucinations, the worst thing
| about is the fact that its basically "perfect" English,
| perfect formatting, which makes it just look like grey
| slop, since it all sounds the same and its hard to
| distinguish between the slop
| articles/comments/PRs/whatever.
|
| and it will also "clean up" the text to the point where
| important nuances and tangents get removed/transformed
| into some perfect literature where it loses its meaning
| and/or significance
| GauntletWizard wrote:
| The LLM presents a perverse incentive here - It is used for
| perceived efficiency gains, most of which would be consumed
| by the act of rewriting and redrafting. The alienness of
| the thoughts in the document is also non-condusive to this;
| Reading a long document about something you think you know
| but did not write is exhausting and mentally painful - This
| is why code review has such relatively poor results.
|
| Quite frankly, while having an LLM draft and rewriting it
| _would_ be okay, I do not believe it is reasonable to
| expect that to ever happen. It will be either like high
| school paper plagarism (Just change around some of the
| sentences and rephrase it bro), or it will simply not even
| get that much. It is unreasonable with what we know about
| human psychology to expect that "Human-Rewrites of LLM
| drafts", at the level that the human contributes something,
| are maintainable and scalable; Most people psychologically
| _can 't_ put in that effort.
| leptons wrote:
| >The LLM presents a perverse incentive here - It is used
| for perceived efficiency gains, most of which would be
| consumed by the act of rewriting and redrafting.
|
| It might give efficiency gains for the writer, but the
| reader has to read the slop and try to guess at what it
| was intending to communicate and weed out
| "hallucinations". That's a big loss of efficiency for the
| reader.
| duped wrote:
| I don't think that's fine, I think that's an example of why
| using LLMs to write is unethical and creates no value.
|
| The purpose of written language is to express your thoughts
| or ideas to others. If you're synthesizing text and then
| refining it you're not engaging in that practice.
| oasisbob wrote:
| If one is trying to avoid plagiarism, starting with an AI
| draft and polishing it to avoid signs of its true origins
| is not a good method.
| zer00eyz wrote:
| > If you didn't take the time to compose your words
| thoughtfully then you aren't owed the time to read them.
|
| Apply this argument to code, to art, to law, to medicine.
|
| It fails spectacularly.
|
| Blaming the tool for the failure of the person is how you get
| outrageous arguments that photography cant be art, that use
| of photoshop makes it not art...
|
| Do you blame the hammer or the nail gun when the house falls
| down, or is it the fault of the person who built it?
|
| If you dont know what you're doing, it isnt the tools fault.
| abenga wrote:
| I of course expect my lawyer and doctor to thoughtfully
| apply their knowledge to help me. Why should they be any
| different?
| duped wrote:
| I do apply it to those, and I don't see how it "fails" at
| anything.
|
| Presenting synthesized words as original thought isn't
| using a tool, it's laziness at best.
| lurking_swe wrote:
| "compose thoughtfully" != layman terminology
|
| Lawyers thoughtfully write laws that other lawyers
| understand. I'm not sure why that's confusing.
| wyufro wrote:
| That's very elitist and unfair to people who previously
| struggled to form their words but now have a better chance at
| doing so.
| duped wrote:
| I disagree, because those aren't their words.
| brookst wrote:
| Do we care about words or thoughts? Many folks are more
| interested in semantic meaning than character sequences.
| To each their own of course.
| duped wrote:
| One problem I see with the broader use of LLMs these days
| is the death of literacy.
|
| For example, you chose to read my response and attack the
| vocabulary as if that was the point I was trying to make.
| This is a misunderstanding. I am purposefully reusing the
| word choice of the comment I'm replying to.
|
| I was trying to very concisely point out that if an LLM
| is generating your writing it is not your words or your
| thoughts that you're trying to communicate.
| CamperBob2 wrote:
| How'd _you_ learn to write?
| bigyabai wrote:
| An elitist attitude towards plagiarists is common.
| brookst wrote:
| Also elitist attitudes towards people for whom English
| isn't a native language, elitist attitudes towards people
| with dyslexia and other conditions that make writing
| difficult, and elitist attitudes towards people with
| lower education levels.
| eesmith wrote:
| The BBC used to encourage its announcers to use Received
| Pronunciation, which was associated with high social
| class.
|
| The solution to this form of elitism was not to make
| everyone speak RP, but to encourage non-RP accents, which
| is more common in the modern BBC.
|
| Your comment seems elitist by encouraging the use of
| artifice to fit better into an elitist world, rather than
| breaking down elitism.
| rebolek wrote:
| Using LLM is perfect for writing documentation which is
| something I always had problems with it.
| mort96 wrote:
| As someone who has dealt with projects with AI-generated
| documentation... I can't really say I agree. Good
| documentation is terse, efficiently communicating the
| essential details. AI output is soooooooo damn verbose.
| What should've been a paragraph becomes a giant markdown
| file. I like reading human-written documentation, but AI-
| slop documentation is so tedious I just bounce right off.
|
| Plus, when someone wrote the documentation, I can ask the
| author about details and they'll probably know since they
| had enough domain expertise and knowledge of the code to
| explain anything that might be missing. I can't trust you
| to know anything about the code you had an AI generate and
| then had an AI write documentation for.
|
| Then there's the accuracy issue. Any documentation can
| always be inaccurate and it can obviously get outdated with
| time, but at least with human-authored documentation, I can
| be confident that the content at some point matched a
| person's best understanding of the topic. With AI, no
| understanding is involved; it's just probabilistically
| generated text, we've all hopefully seen LLMs generate
| plausible-sounding but completely wrong text enough to
| somewhat doubt their output.
| brookst wrote:
| Classic perfect/good.
|
| The choice is not usually "have humans write amazing top
| notch documentation, or use an LLM".
|
| The choice is usually "have sparse, incomplete, out-of-
| date documentation... or use an LLM".
| mort96 wrote:
| And my claim is that the latter is better.
| brookst wrote:
| Cool, so just ignore documentation then. Problem solved
| for everyone.
| mort96 wrote:
| I dont see how that solves anything.
| duped wrote:
| This immediately invalidates a software or technical
| project for me. The value of documentation isn't the output
| alone, but the act of documenting it by a person or people
| that understand it.
|
| I have done a lot of technical writing in my career, and
| documenting things is exactly where you run into the worst
| design problems before they go live.
| yearolinuxdsktp wrote:
| I disagree with the downvotes, but let me put it differently:
| if you don't understand, have reviewed and be ready to own
| _all_ of LLM output (the thoughtful part), then you aren't
| owned the time to read them. If you didn't try to reign in
| the verbose slop that's the default for LLMs, I don't want to
| read it.
|
| Maybe the poster is running a local LLM.. you'd think that a
| SOTA model would have surmised that an overnight MacOS
| upgrade can only be a minor version.
| Barbing wrote:
| Yes, for the time being the final report should probably come
| from us (but endless opportunity along the way to clarify
| thinking and understand industry standard terms).
| chuckadams wrote:
| I'm used to papercuts on every OS, but at least with a Linux
| box I can roll it back. Usually it's as easy as picking the
| previous boot menu entry (with NixOS, the whole system rolls
| back that way). I find macOS acceptable enough for my laptop,
| but I'm doing most of my real work in Linux containers anyway.
| 827a wrote:
| Its my strong belief that using AI in any capacity which does
| not upfront state "the following content was generated by
| artificial intelligence" is never acceptable. In most
| situations, allowing an AI to wield your name gives off the
| scent of "My time is more valuable than yours, so I've
| automated writing to you." It is quite disgraceful. If your
| use-case would be materially harmed by an upfront disclosure of
| AI generated content, then you need to take a good, hard think
| on what that means for what you're doing (then again, maybe
| you're not interested in thinking anymore and that's how you
| got to this point in your life).
| misnome wrote:
| It's good-faith arbitrage. Until everyone automatically
| suspects everything to be LLM generated and there is zero
| trust, anyone doing this is eroding the good faith that lets
| them get away with it in the first place.
| alsetmusic wrote:
| > state "the following content was generated by artificial
| intelligence"
|
| "... but reviewed by a human / me for accuracy."
| Larrikin wrote:
| I agree with you when you are talking with a human in good
| faith. I disagree when it comes to large corporations and
| government officials. Often times theres a lot of red tape
| you have to get through and create documents that nobody on
| their side is actually reading. Usually this is just to
| discourage people from completing the action they are trying
| to accomplish. LLM generated content has gotten me back
| improperly held taxes and generated multiple extension
| requests where the receiver just had to check a box that they
| got it.
| Wowfunhappy wrote:
| How far do you take this policy?
|
| 1. Am I allowed to ask an AI to proofread a draft for
| grammatical errors?
|
| 2. Am I allowed to ask an AI to proofread a draft for
| technical errors?
|
| 3. In both #1 and #2, am I allowed to ask the AI to suggest
| revisions, or is it only allowed to point out what's wrong
| and why?
|
| 4. If I write a sentence like "Lucy's laughter ___ her
| underlying anxiety" and I'm having trouble coming up with the
| right word to fill in the blank, can I give the sentence to
| an AI and ask it for a list of possible options?
|
| 5. While brainstorming, can I use an AI as a souped up rubber
| duck before I begin writing?
| rectang wrote:
| > Papercuts like this are why I moved away from macOS.
|
| It's been this way for decades. Microsoft was known for
| preserving backwards compatibility, while Apple was known for
| being willing to break stuff.
|
| The differences aren't that extreme in reality: Microsoft
| breaks stuff more than it used to, while Apple has become
| comparatively more conservative than once upon a time.
| st3fan wrote:
| Every OS has papercuts like this. Want me to write a story
| about Linux or Windows that is equally painful? Pick your
| poison .. i've dealt with it all.
| neilsharma425 wrote:
| Has anyone found a working workaround yet? I use dnsmasq for
| .local dev routing and held off updating after seeing this but
| curious if there is a viable path forward short of waiting for
| Apple to patch it.
| mkagenius wrote:
| holding off update seems like reasonable step till the patch
| comes. I also run a .local for apple containers though not
| docker.
| cortesoft wrote:
| Wouldn't the workaround just be to have your local dns server
| enable recursive lookups, and point all your DNS queries to it?
| kenny_r wrote:
| What I'd suggest is using lvh.me, which always resolves to
| localhost, as do all it's subdomains. If you need a specific IP
| you can use nip.io.
|
| If you want valid certs you can generate them with mkcert and
| add them to your system trust store.
| justsomehnguy wrote:
| Solved this type of shenanigans some years ago with this.
|
| New-UnboundInterface.sh - linux/rhel-like specific
| # create a bridge interface for Unbound # because
| Docker... IFTYPE=bridge IFNAME=unbound0
| IPADDR=10.53.0.1 IPADDR6=fd53:fd53:fd53::1 nmcli
| connection add type $IFTYPE ifname $IFNAME nmcli
| connection modify $IFTYPE-$IFNAME ip4 $IPADDR/32 nmcli
| connection modify $IFTYPE-$IFNAME ipv4.dns $IPADDR nmcli
| connection modify $IFTYPE-$IFNAME ip6 $IPADDR6/64 nmcli
| connection modify $IFTYPE-$IFNAME ipv6.dns $IPADDR6 nmcli
| connection up $IFTYPE-$IFNAME firewall-cmd --new-
| zone=unbound --permanent firewall-cmd --zone=unbound
| --permanent --change-interface=$IFNAME firewall-cmd
| --zone=unbound --permanent --add-service=dns firewall-cmd
| --reload
|
| 00-localinterface.conf # should be placed in
| /etc/unbound/conf.d # bind to a specified IP address,
| allow access server: interface: 10.53.0.1
| interface: fd53:fd53:fd53::1 access-control:
| 10.53.0.1/32 allow access-control:
| fd53:fd53:fd53::1/128 allow
|
| 91-allow-docker-containers.conf # allow queries
| from the Docker "bridge" server: access-
| control: 172.18.0.1/16 allow
| hk1337 wrote:
| I've been using macOS since OS X Tiger and I wasn't aware of this
| feature.
| Razengan wrote:
| It also seemingly broke removing Safari cookies on a per website
| basis, something I often used to stop Google's scummy tracking
| across all their services if you just want to sign into YouTube.
| nottorp wrote:
| Firefox + Google Container extension.
|
| Why use Apple's browser when they don't actually care about
| your privacy?
| Drupon wrote:
| FYI the phrase is "lo and behold"
|
| Thank you for the heads up.
| lapcat wrote:
| > https://feedbackassistant.apple.com/feedback/22280434 (that
| seems to need a login?).
|
| All Feedbacks that you file are private to your own Apple
| Account.
| ramon156 wrote:
| Bit off-topic. I mostly use Linux and I'm of the opinion that
| it's miles better than Windows, but I don't fully understand why
| people say MacOS looks bad?
|
| Ignoring the current Tahoe mess, MacOS felt relatively polished.
| I'm purely talking about UX here, as the OS is evidently buggy.
| The most popular Gnome themes are a re-impl of MacOS, so I can't
| be the only one.
| klodolph wrote:
| It's selection bias; the people who complain are the most
| visible online. Especially HN.
| nslsm wrote:
| There's no "Tahoe mess". I've used it since 26.0 and it's good.
| Different indeed, but good. People love complaining.
| celsoazevedo wrote:
| I'm glad that it's working well for you, but from the moment
| some users with M-series SoCs report laggy animations,
| something somewhere has to be wrong.
| hbn wrote:
| There's very valid reasons to have issues with Tahoe's
| changes. The dock being liquid glass is fine. But curving the
| windows to look like iPad apps, and not even adjusting the
| grab target appropriately for resizing the window is bad.
| Getting rid of the title bar so it's not clear where you can
| grab a window is bad. Apple Music hiding the volume slider
| behind another click is bad.
|
| It straight up broke some interfaces too
|
| https://lapcatsoftware.com/articles/2026/1/4.html
| kace91 wrote:
| I'm with you, pre Tahoe I've never had an issue with iOS
| aesthetically, other than lack of customisation.
|
| Then again I never understood the trend to remember fondly
| windows 98 and those kind of interfaces, maybe it's
| generational.
| bdcravens wrote:
| > Then again I never understood the trend to remember fondly
| windows 98 and those kind of interfaces, maybe it's
| generational.
|
| I may have a generational bias (I am almost 49), but I think
| the fondness is due to lack of UI surprise. A button was a
| button, a menu was a menu with clear shortcuts, etc. There
| were no mystery scrollbars that required specific
| interactions to appear or expand. Don't get me wrong, I'm a
| happy-ish MacOS user and love screen size, clear fonts, etc
| that we get in the modern world, but I think we've all had
| moments of frustration when we had to go on a scavenger hunt
| in an app and cursed those who didn't leave well enough
| alone.
| vbezhenar wrote:
| It's incredibly bloated. I don't want AI engine in my OS. I
| don't want Spotlight in my OS. I don't want my OS to load CPU
| for 10 minutes after boot for who knows what. I don't want my
| OS to ship with Chess app and lots of other irrelevant
| software. I don't want my OS to ship with Music app and bother
| me with subscription offers. I don't want my OS to ship with
| iCloud app.
|
| They also do strange choices regarding shipped software. For
| example they ship ancient bash 3, apparently because they hate
| GPLv3 or something like that. I like GPLv3 and this choice
| makes macos user-hostile.
| nijave wrote:
| I don't know. I generally like the UX. The way full screen
| windows work is a bit unique but I ended up liking it once
| getting used to it and the related shortcuts. I don't like the
| lack of window tiling, though.
|
| That said, I still prefer Linux. I think my biggest papercut
| there has been suspend/power management being broken in some
| way or another on both laptop and desktop for the last 8 years.
| commandersaki wrote:
| Yeah Tahoe has been mostly fine. I have all the liquid glass
| stuff turned off (via reduced transparency). The grab handles
| for window corner is annoying, but it doesn't mean the rest of
| the OS is not good.
|
| There's bugs in the OS, like pretty much every OS, but I rarely
| interact with them should they manifest.
| ProllyInfamous wrote:
| I am not familiar with dnsmasq at all (is this machine-local?),
| but absolutely love my PiHole hardware -- you can even create
| rules which intercept hard-coded-IP DNS request and/or httpsDNS.
| You can also hard-code/intercept .TLD to local service IPs.
|
| Programs like LittleSnitch never really seem like "enough" for
| me, because the computer has to boot before DNS filtering comes
| online. It also has the design error (IMHO) of pre-resolving IP
| addresses before clicking Accept/Deny(all).
|
| A great blockrule for your personal firewalls would be to ban (at
| top level) icloud.com, apple.com, &c; system updates can then be
| performed manually using guides like
| <http://www.mrmacintosh.com>. Of course: this _breaks everything_
| (in exactly the way I prefer to compute).
| bombcar wrote:
| This works great (and I use it) _internally_ but when you want
| things like your docker domains to work when you 're on the go,
| it's annoying.
|
| I have setup a VM running DNS on my laptop before ...
| ProllyInfamous wrote:
| It is not too difficult to allow your PiHole to serve you
| globally (but does requiring opening some ports in your
| firewall == additional security risk).
|
| There is a simple checkbox within the DNS's web interface to
| `Allow WAN Requests`. You'd then only run into issues of
| accessing your local IP addresses _if those hosts aren 't
| configured correctly within your network rulesets_.
|
| ----
|
| I am a _user_ , not an _expert_ ; by trade, I am a blue
| collar electrician. I know very little about internet
| topology except how to use simple open-source hardware.
| Perhaps what you said makes sense (e.g. that you cannot use
| outside your network, some service(s)).
| bombcar wrote:
| Yeah that can work, though at that point I start to
| consider just exposing my "internal" DNS to the world at
| large - who cares if secret_service.mydomain.net can be
| seen by everyone to resolve to 192.168.88.4?
|
| You can also do VPN tricks, too.
| JimDabell wrote:
| *.localhost works out of the box doesn't it? You don't need
| dnsmasq at all to have multiple hostnames pointing to 127.0.0.1.
| bombcar wrote:
| You often have internal private IPs you want to resolve to
| things that aren't localhost
| winstonwinston wrote:
| *.example-private point is to have multiple machines using
| private addresses such as web.example-private in A
| 192.168.0.100 and db1.example-private in A 192.168.0.101.
|
| If you just want to resolve 127.0.0.1 then you just resolve
| hostname "localhost" or use 127.0.0.1 directly.
|
| Personally i don't bother configuring custom private dns zones,
| instead i use reserved MDNS *.local that autoconfigure
| everything using machine name (hostname) and DHCP address:
| somehostname.local in A <dhcp assigned ip>.
| MoonWalk wrote:
| A couple iOS versions ago, Apple broke self-signed
| certificates... crippling mobile development by preventing the
| use of HTTPS to communicate with a local server.
|
| It makes you wonder why they were messing around in these areas
| at all at this point.
| yearolinuxdsktp wrote:
| Apple container CLI configures internal domains (`container
| system dns`) by adding an internal resolver and it worked for me
| when I specified an actual domain previously handled by external
| DNS and it showed up as a custom resolver.
|
| Here's a GitHub comment showing someone on MacOS 26 with a
| `.test` domain, which you claim is broken:
| https://github.com/apple/container/issues/856#issuecomment-3...
| --- maybe you are configuring it incorrectly.
| philo23 wrote:
| It's not quite the same, but I've moved to using *.localhost for
| all my local web dev work. All modern browsers will resolve
| *.localhost to 127.0.0.1 internally. No need to setup any DNS
| resolvers or edit your hosts file.
|
| But that only really helps you when you're dealing with websites
| in a browser, and when you want the address to resolve back to
| your local machine. So it wont help you with other programs like
| python/wget/etc or any calls you make to getaddrinfo()
| whalesalad wrote:
| we have dev.our-root-domain.com in public DNS pointing to
| 127.0.0.1
| stock_toaster wrote:
| I've run into resolvers that filter things like that to
| prevent dns rebinding attacks. And localhost (the hostname)
| does not work for CORS.
|
| Best option is probably to set dev.our-root-domain.com in
| /etc/hosts
|
| [1]: https://en.wikipedia.org/wiki/DNS_rebinding
| whalesalad wrote:
| Haven't had an issue yet, with a team scattered across US,
| Canada and UK. I'm sure it's possible - but so far we've
| been using this for about 3 years with no hiccups.
| zamadatix wrote:
| Good tip, I didn't realize the browser would automatically
| resolve any subdomain of localhost to 127.0.0.1/::1 as well
| these days.
|
| I tested on Chrome but I assume this is true for Safari as
| well?
| philo23 wrote:
| Just tried it on my Mac and sadly it doesn't seem like it.
| I'm still on Sequoia, so possibly it does it on Tahoe, but
| probably unlikely. That's a shame.
|
| It'd be nice if someone on the Safari team added this though
| to match Chrome and Firefox!
| nikisweeting wrote:
| The best part is that *.*.localhost is also supported, so you
| can finally just replace *.com for your prod domains with
| *.localhost.
|
| ArchiveBox now uses this feature by default in the latest
| version to finally offer unique per-snapshot domain isolation,
| so we can safely replay archived JS without risking compromise
| of your whole archive.
|
| Such an awesome feature, the barrier to do this used to be
| prohibitively high but now it "just works".
| doctoboggan wrote:
| Yeah I've been doing this as well. I know it's a minor nit, but
| I wish that TLD was shorter. I've used *.local in the past but
| that has bitten me too many times.
| intrasight wrote:
| Honest question: How would this affect me and the vast majority
| of macOS users who use the device for media consumption and
| productivity applications?
|
| Next question: what reason would Apple have to make a change that
| would interfere with developers using their operating system?
| mikestew wrote:
| Your "next question" seems very leading. Can you make your
| point more clear? What's your answer to that question?
| intrasight wrote:
| I don't understand your question since my question was
| honestly posed.
|
| What might lead Apple to make a change that would reduce the
| audience of their devices. I don't develop on macOS but I
| know developers who do. Did they just make a mistake and
| they're gonna fix it?
| mikestew wrote:
| I doubt it was an intentional change. A lot of bugs result
| from, "hmm, didn't think about that use case. Ooops."
| There's just the question of how long it'll be before they
| ship a fix. It _seems_ like there ought to be an automated
| test for something like this, but Apple seems to be
| shedding QA as fast as Microsoft is.
|
| (And apologies if it seemed that I was insinuating ill
| intent on your part.)
| lysace wrote:
| > Ah, the joys of waking up to find the Mac's done an overnight
| upgrade
|
| Wait, it does that (from 15 to 26) without user interaction?
| timw4mail wrote:
| No.
| mikestew wrote:
| No, it does not. It'll bug the shit out of you to upgrade, but
| it won't automatically do a major version upgrade. By default
| it will automatically do minor version upgrades (that can be
| turned off).
|
| That's what makes the LLM bug report make no sense in light of
| OP's report here. Bug says it's a regression from 25.x (which
| doesn't exist), so maybe they mean 15.x? But OP says they "woke
| up" and it was upgraded and broken, but macOS doesn't major
| version upgrades w/o user action. So which is it?
| lysace wrote:
| Phew.
| alin23 wrote:
| macOS 26 has to be the most breaking version so far, its problems
| and intended breaking changes making my app dev life so hard this
| year. Just to name a few:
|
| - Reference Presets no longer allow setting arbitrary SDR nits,
| making it impossible to natively unlock 1600nits of brightness on
| MacBook Pros or 2000nits on Studio Display XDR which breaks my
| Lunar app [0] (this seems to be intended, no idea what hurt Apple
| that they had to block this under SIP)
|
| - The orange microphone dot indicator and its very colored
| friends can no longer have their brightness changed for dimming
| them, which made my YellowDot app useless [1] (I guess this is
| for privacy, I still think this could have a setting guarded
| under TouchID like Accessibility Permissions works)
|
| - Floating non-titled windows don't accept mouse events
| (thankfully this got fixed) [2]
|
| - Gamma table changes don't work on MacBook Neo and M5 Pro/Max
| which breaks Sub-zero Dimming and dimming external monitors that
| don't support DDC (thankfully, Apple is looking into it) [3]
|
| - The resizing area thing on very rounded windows which drives
| everyone nuts, I had to add custom resize handlers to some of my
| windows
|
| - The `com.apple.SwiftUI.Drag-` temporary file paths that get
| generated for any file that gets dragged from a drag&drop handler
| which makes it impossible to get to the original file when
| dragging images from Clop [4] or file shelf apps like Yoink,
| Dropover etc.
|
| - NSImage returning different pixel count for .size than what the
| image actually has, breaking workflows that depended on that to
| determine the image DPI
|
| [0] https://lunar.fyi/#xdr
|
| [1] https://github.com/FuzzyIdeas/YellowDot/issues/18
|
| [2] https://developer.apple.com/forums//thread/814798
|
| [3] https://developer.apple.com/forums/thread/819331
|
| [4] https://lowtechguys.com/clop
| nowahe wrote:
| Ah I was wondering why I couldn't get past 600 nits on my M5
| why it worked great on my M1. Guess I'll just have to live
| without it for now
| alin23 wrote:
| It's still possible with the older forced HDR + Gamma tone-
| mapping logic, but it has its limitations. The native
| unlocking was miles better.
| jesse_dot_id wrote:
| As a hobbyist music producer with an interface always
| connected, that microphone indicator is so annoying and
| unnecessary. I can't believe it can't just be disabled
| outright. I like macOS but it's too opinionated and some of
| those opinions SUCK.
| pier25 wrote:
| There are rumors iOS 27 will be a sort of Snow Leopard update
| with no new features [1]. Just bug fixes and performance
| improvements.
|
| Hopefully Apple will do the same for macOS 27.
|
| [1] https://www.macrumors.com/2026/03/15/ios-27-will-
| reportedly-...
| KennyBlanken wrote:
| > The orange microphone dot indicator and its very colored
| friends can no longer have their brightness changed for dimming
| them, which made my YellowDot app useless [1] (I guess this is
| for privacy
|
| It absolutely is for privacy, to stop malware or trojan
| programs from obscuring their accessing the camera or
| microphone.
|
| > Reference Presets no longer allow setting arbitrary SDR nits,
| making it impossible to natively unlock 1600nits of brightness
| on MacBook Pros or 2000nits on Studio Display XDR which breaks
| my Lunar app [0] (this seems to be intended, no idea what hurt
| Apple that they had to block this under SIP)
|
| OLED displays are widely expected this year. Not wanting to
| have to deal with "my battery life is an hour and a half
| instead of 10, what's going on!? Replace my battery!" nonsense
| is probably the remainder.
| nickdothutton wrote:
| Ah great another reason to add to the many reasons not to use
| this OS. Semi serious question, is Apple looking to dump its
| existing customer base for a new, perhaps consumer not pro-sumer
| one?
| butILoveLife wrote:
| Wait... someone is under the impression that Apple was ever
| good to its customers?
|
| I thought we all just dealt with the overpriced hardware, the
| prisons, the control, that they are a US company that gives
| away data to the government(PRISM), has weak security(Pegasus),
| lies about hardware issues(butterfly keyboard and holding your
| phone wrong), deceptive marketing...
|
| All so we can compile iOS apps.
|
| If you arent compiling iOS apps... Do you not know about
| Fedora? Ofc Windows sucks, but we have Fedora.
| Hizonner wrote:
| Seems bad that people feel forced to use GitHub to talk about
| Apple's bugs.
| bpicolo wrote:
| Another funny thing about Mac networking.
|
| There's a game I play (Old School Runescape) that does network
| ticks every .6s. Mac does some sort of aggressive optimization on
| the network hardware/software, so network this infrequent doesn't
| keep the layers "hot", and you end up getting delayed ticks
| regularly, meaning you learn what should be happening in the game
| .2-.5s late. This optimization for (I assume) battery life makes
| the software not work as intended.
|
| Playing anything that streams, like video, or triggering TCP
| connections (e.g. curl) at a more frequent clip while the game is
| running fixes the problem.
|
| No way other than hacks that I've found to fix it, and I have no
| idea how you could report this to the right team at Apple to get
| it actually fixed.
| speff wrote:
| Very interesting. I play RS3 and made a helper tool[0] for
| tracking ticks. I noticed increased jitter on my MBair
| (~50-150ms) compared to Windows, but I chalked it up to the air
| being on a wifi connection. I wonder if your explanation's the
| real reason.
|
| [0]: https://files.catbox.moe/5n09lg.webm
| bpicolo wrote:
| Watch some twitch while you monitor it - will magically go
| away I suspect
| speff wrote:
| Haaa. Confirmed. Went from 200-400ms (worse than I
| remembered) down to sub 30ms of jitter after putting on a
| stream. Thanks for the pointer
| kccqzy wrote:
| [delayed]
| thedougd wrote:
| I had to abandon Apple MacOS container because it has so many
| issues with networking and DNS. I'm looking forward to try it
| again if they can get it fixed.
|
| https://github.com/apple/container/issues?q=is%3Aissue%20sta...
| bdcravens wrote:
| > The only reliable workaround is to add entries manually to
| /etc/hosts, which bypasses mDNSResponder entirely. This is
| impractical for dynamic use cases (e.g. Docker container DNS,
| where host entries change frequently) and requires sudo for every
| change.
|
| I suppose I'm lazy - I've always used /etc/hosts, but then again,
| I've never had use cases like those mentioned in the linked gist.
| JimmaDaRustla wrote:
| Again? This happened like 6 or 7 years ago. I had so many issues
| with macOS in the few years I was forced to use a MacBook that I
| refused to use it. Not surprised to see this stuff still
| happening.
| hnarn wrote:
| If Asahi had the same battery life and performance as MacOS there
| is zero chance I would be running MacOS.
| chillpenguin wrote:
| I'm glad to find out it's not just me! My homelab has a lot of
| domains on .home.arpa, and I was getting issues related to this.
| kandros wrote:
| I still want to believe macOS 26 was vibe coded with Apple
| Intelligence and siri. Makes it easier to digest daily use
| rusakov-field wrote:
| I don't know , I like macOS, mainly that zsh is readily available
| and I can (almost) do anything I can do on a linux box in a
| personal computer.
| irusensei wrote:
| I never knew about this feature but it's so cool and I wish I
| knew it earlier. Sadly it seems features like these are being
| left to rot in MacOS because it's not what the average normie
| uses.
| pfortuny wrote:
| Lo and behold, just FYI. Trying to help.
| temp0826 wrote:
| Afaik ".internal" isn't reserved/defined anywhere, it's just a
| convention some people/devices use, and doesn't have anything to
| do with the root cause here (a custom resolve.conf or whatever it
| is called in macos changing after an update), no?
| justinsaccount wrote:
| > none of my dockers
|
| Containers ran using docker are called containers, not dockers.
| patabyte wrote:
| Interesting - I run a nearly identical set, with many TLDs
| configured in `/etc/resolver/X` and dnsmasq handling the resolve
| and I have not had a single issue.
|
| the resolver confs all contain this content: #
| /etc/resolver/example-private nameserver: 127.0.0.1
| domain example-private
|
| I noticed in the author's bug report they do not include
| `domain`, which is documented in `man 5 resolver` as:
| # The domain directive is only necessary, if your local #
| router advertises something like localdomain and you have
| # set up your hostnames via an external domain.
|
| In the real world though, I've found the `domain` setting to be
| required nearly every time. I wonder if adding it will resolve
| the issue?
| samgranieri wrote:
| I used to use dnsmasq and etc/resolvers for stuff like dot dev or
| dit whatever back in the day.
|
| These days I'm just using Caddy to do _._.localhost for my web
| dev and it works like a charm.
|
| This is exceptionally sloppy on Apple's part.
___________________________________________________________________
(page generated 2026-03-19 23:00 UTC)