You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Little Snitch intercepted "Noticeboard wants to connect to swscan.apple.com" Legit?

I have Little Snitch monitor for new connection requests. For the first time, something called "noticeboard" is trying to connect to swscan.apple.com. I assume (hope) this is legit since swscan.apple.com is used for upgrades. But I've never seen it before. I've searched high and low and cannot find what "noticeboard" is. I assume it's some inner workings of the OS, but would love to know for sure. Thank you.

MacBook Pro (13-inch Mid 2010), Mac OS X (10.6.8)

Posted on Mar 14, 2014 6:12 PM

Reply
48 replies

Mar 22, 2014 3:58 PM in response to shape

shape wrote:


i would definitely like to know as well. i still have it blocked... until i know what it is.

What happens now if you run Software Update with Noticeboard blocked? What happens if you try to open the App Store? I haven't installed the update yet, so can't test here.


All I'm seeing for this is "This update includes improvements to Mac App Store alerts." I never get MAS alerts in Snow because I always keep the Store denied in LS, until I want to go there, which is very rarely, and not particularly interested in having improved alerts.

Mar 23, 2014 8:41 AM in response to WZZZ

i tried Software Update and didn't notice any differences. the same 2 updates still showed up even though Noticeboard had been terminated by Snitch. App Store loads normally too.


ok - thanks for the info. i don't need app store alerts either but i won't choose to block it if it isn't going to bother me.

Mar 28, 2014 4:31 PM in response to Leon Klingele

This is the URL "Noticeboard.app" requests every 6 hours: https://swscan.apple.com/content/catalogs/others/index-noticeboard-1.sucatalog


These are the file's contents: http://pastebin.com/6aWQSnyW


Here's an excerpt of system.log:



Mar 28 23:04:58 Leon-Klingeles-iMac Noticeboard[12156]: Noticeboard: NoticeboardUpdateOperation finished with notification to show:

{\n Distributions = {\n English = "https://swdist.apple.com/content/downloads/22/32/com.apple.notification.mavericks.snowleopard/r7hihl1cgz71olyv0h9h8yx2zhn4ubhh2g/031-00817.English.dist";\n };\n

ExtendedMetaInfo = {\n notificationUserInfo = {\n actionButtonURL = "macappstore://ax.itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=675248567&mt=12";\n };\n

postedDate = "2014-03-24 09:48:32 -0700";\n reminderIntervals = (\n 604800,\n 2592000\n );\n };\n

Packages = (\n {\n MetadataURL = "https://swdist.apple.com/content/downloads/22/32/com.apple.notification.mavericks.snowleopard/r7hihl1cgz71olyv0h9h8yx2zhn4ubhh2g/com.apple.notification.mavericks.snowleopard.pkm";\n Size = 4135;\n URL = "http://swcdn.apple.com/content/downloads/22/32/com.apple.notification.mavericks.snowleopard/r7hihl1cgz71olyv0h9h8yx2zhn4ubhh2g/com.apple.notification.mavericks.snowleopard.pfpkg";\n },\n

{\n Digest = 5bf74a66b333e2ba37eb0d1f8de2de5ade9200f3;\n MetadataURL = "https://swdist.apple.com/content/downloads/22/32/com.apple.notification.mavericks.snowleopard/r7hihl1cgz71olyv0h9h8yx2zhn4ubhh2g/com.apple.notification.mavericks.snowleopard.pkm";\n Size = 15231;\n URL = "http://swcdn.apple.com/content/downloads/22/32/com.apple.notification.mavericks.snowleopard/r7hihl1cgz71olyv0h9h8yx2zhn4ubhh2g/com.apple.notification.mavericks.snowleopard.pkg";\n }\n );\n

PostDate = "2014-03-28 01:02:01 +0100";\n ServerMetadataURL = "http://swcdn.apple.com/content/downloads/22/32/com.apple.notification.mavericks.snowleopard/r7hihl1cgz71olyv0h9h8yx2zhn4ubhh2g/com.apple.notification.mavericks.snowleopard.smd";\n bundle = "NSBundle (not yet loaded)";\n identifier = "com.apple.notification.mavericks.snowleopard";\n}



Well, click that "Deny, forever" button for outgoing requests from "Noticeboard.app".



Here's how to block outgoing requests from "Noticeboard.app" if you don't see a Little Snitch popup asking you what to do.


1.) In Terminal enter:

open /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/No ticeboard.app


2.) Press return key


3.) You should now see a popup like this:

User uploaded file


4.) Click "Forever", check "Any Connection" and finally click "Deny"

Mar 28, 2014 9:47 PM in response to WZZZ

WZZZ wrote:


Looks like I won't ever be installing that update.

It does have a few other things in it which don't appear to relate to noticeboard:User uploaded file

Unless Apple gets around to telling us what it plans to use it for, I can only guess. It seems to check every six hours to see if there is anything new to display. It's easy enough to disable if users find it annoying.


I would encourage everybody that thinks helping you to upgrade to Mavericks is the wrong approach to let Apple know directly since they are unlikely to read this. Give them you feedback here.

Mar 29, 2014 12:56 AM in response to professortiki

professortiki wrote:

Why connect every 6 hours?

Just checks to see if any new notices have been posted.

I still don't understand what Noricboard really does. Does it send data from my computer? And which?

Nobody outside of Apple seems to know what it really does and without analyzing the traffic we can't be certain, but it would appear that no information is being sent from the computer, it just downloads the catalog from swscan.apple.com and if there is anything new it converts it into the notice dialog you see.


I can see where it might be useful to track the UUID and OS X version from each inquiry to give Apple an idea of what the installed base of older operating systems is, but there are other ways of obtaining such data so they probably don't bother.

Mar 30, 2014 1:01 PM in response to James Weil

This area of the Forum is for Snow Leopard discussions and I don't recall anybody saying it exists in Mavericks and can agree with you that it does not exist anywhere in Mavericks. It may already be built into the Notification Center or some other Mavericks process related to the AppStore, but I wouldn't expect to see a pop-up on a OS X 10.9.x Mac offering an update to Mavericks for free.


There was a second Mac App Store Update that contains noticeboard posted at the same time as the one for Snow Leopard. It was not offered as a Mavericks update, so I can guess that Lion and perhaps Mountain Lion got it. I have not heard of other than Snow Leopard users receiving this popup, but I haven't been watching that closely.

Mar 30, 2014 1:24 PM in response to MadMacs0

With the Snow user base still hovering around 20%, my guess is they want to move everyone off Snow. Hence the annoying reminders. Two ways to look at this, if what I say is true: another Snow security update might still be forthcoming until they get that user base down to what they consider to be an acceptable minimum. Or it just means, "now start upgrading." I tend to think it's the latter.

Little Snitch intercepted "Noticeboard wants to connect to swscan.apple.com" Legit?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.