Not long ago I started running (which is a firewall program for Mac which alerts you of incoming and outgoing connections).
What has been most interesting is what apps want to connect to the internet, apps that you would never really expect to do so.
So far of course 99% of it has been completely innocuous: most applications are setup to automatically check for a newer version with bug fixes and new features. That’s good. Also, you can disable this feature if you want. That’s also good.
There are some other occasional interesting attempts. , for example, has made connections to port 10224 of 128.0.0.1, port 42024 of tracker.ambrosia.net, port 80 of register.ambrosiasw.com, and port 123 of tick.usno.navy.mil and time.apple.com.
Now when I had to reinstall SnapZ Pro recently, it needed to get a new authorization code from Ambrosia, which may explain the tracker.ambrosia.net and register.ambrosiasw.com entries (I presume one checked to make sure that I was using the latest version and one checked my old code to give me a new code).
Curious, isn’t it, that it attempted to check the time by polling two NTP services (port 123)? I don’t know why it would do that on a registered version of the app. I could imagine that if I was using a demo version of the app it might want to check the official time/date to prevent me from changing my system clock and pretending that it was, for example, January 1st, 2080, which might give me 73 years of demo instead of 30 days.
More interesting is the fact that a lot of Apple’s own applications want to connect to the internet, mostly to a machine called configuration.apple.com. This machine does not appear to be connected to .Mac since all of those hostnames usually end with .mac.com rather than .apple.com.
I have seen applications such as the Address Book which want to connect. Why? A suggests that this is harmless software checking for an update… But why? Why would Address Book be checking for a new version of itself, rather than being done through OS X’s Software Update. It also isn’t syncing to .Mac, that is done through dot-Mac specific daemons.
Surely the strangest of them all, however, has to be this one:
What the heck?! This is probably completely harmless, but why in God’s green earth is the calculator phoning home? Looking for a new version? Really? Of the calculator?!? What are they going to do, discover some and update the calculator to fix it? Seems unlikely.
Just plain weird, if you ask me.
UPDATE (2008-01-01): Someone wrote in to suggest that this is the currency converter trying to update its data. Makes sense, except that why wouldn’t it wait until I was actually trying to use it?