Hi etresoft,
The detailed response is appreciated, thank you for your time in helping me understand the subject at hand. Will respond to some points, but I think this satisfies my curiosity itch:
> There is no way to tell if the IP address that Little Snitch found was associated with that domain name or the above IP address.
Reverse DNS inaccuracy aside, selecting/listing the wrong outgoing IP is an objective failure for part of the primary use case Little Snitch aims to satisfy. If it failed that, that would infer either (1) the operating system interfered with its ability to select the correct outgoing IP, or (2) it's poorly written and buggy enough to mis-function accordingly - both of which are disappointing conclusion to reach.
> No way to tell. Depending on your computer, it might not even boot again.
This was my concern, which is why further guidance on the subject was sought out before making knee-jerk reactions like removing the binary entirely.
> It is part of the operating system. Is it malicious? Do you regularly see any pop-up ads?
At the time of alert, the answers were inconclusive and no, respectively. I have little snitch on all my machines and this is the first time this process was flagged on any of them. Hence the reaching-out for help.
> Did you detect some kind of heavy energy use from this process?
If it's running, it's gonna use some volume of CPU cycles, no matter how minuscule that may be, that don't provide a benefit to my end experience if it's blocked. Why bother with it running if it's not gonna function right? (moot point, just wanted to explain the logic behind this)
> Here's the problem. Little Snitch is not doing you any favours.
> There is one company (Apple) trying to do advertising honestly and you are blocking them. I'm sure you're not blocking the other companies that are doing advertising dishonestly.
It's a process-by-process, connection-by-connection approach, the same vigilance/diligence applied here is uniform to all running processes. This one is just a gray area given the Apple affiliation. Not sure what to infer from "not doing you any favours" - to this point, Little Snitch has functioned as expected.
> If Apple, or any company for that matter, wanted to be sneaky and upload your personal information, why would they use a name like "strongbad.voiceopia.com" anyway? Why not "certificate-validation.apple.com"? Nobody's going to block that, are they?
> The executable links to 16 different Apple frameworks. Any one of those could be responsible for making this network connection.
More motivation behind the ask - if the daemon is functioning on behalf of another process (as some daemons typically do), I wanted to know which it was. Part of the "if-i-remove-it-what-stops-working" fallout.
> It is absolutely impossible to look at a reverse DNS name and make some kind of judgement.
In this era where a significant amount of the internet runs on AWS/Azure/GCP infrastructure, and IPs / domains are as ephemeral as you've noted, this might be sadly more true than I'd like to believe but notwithstanding - point made.
> It is simply not possible for you to selectively identify and/or block internet traffic on your computer ... [a]ll of this information is encrypted anyway. If any companies did want to track you, they can do it quite easily. You can't block it.
Point made. Blocking connection attempts only goes as far as effort, if a process really wants to "phone home" it can leverage its way around the block/out of the machine eventually.
Thank you, again, for your help/knowledge here, will unflag the process from the deny list accordingly.
