5 ms·

https://developer.apple.com/documentation/networkextension/nepackettunnelprovider https://developer.apple.com/documentation/networkextension/n...

by zx2c4 8y ago

Wowfunhappy 8y ago
Wow. Is there any way around this for a user? What if SIP is off? If there's no workaround, that makes me quite uncomfortable.
- oneplane 8y ago
  There are plenty of workarounds, but the issue is that when you want to pass quality control you have to play by they platform owner's rules. While not always nice on one hand, on the other hand this does mean that most users will be safe to install most software checked and distributed that way, without needing the intimate knowledge we have. I totally understand that if Apple builds and maintains a PKI-based security model, they are going to want to check your stuff before allowing you in. If, on the other hand, the user doesn't care, they can simply turn off the security model or adjust it.
  - Wowfunhappy 8y ago
    > they can simply turn off the security model or adjust it. I'd very much like to know what this involves. I'll feel better knowing how it can be done. If you have a link that would be great!
    - maxmunzel 8y ago
      Google for macOS gatekeeper
      - mosselman 8y ago
        DuckDuckGo is a better option with regards to privacy ;). Since this is a topic on VPN software.
      - Wowfunhappy 8y ago
        Oh, if disabling Gatekeeper is all it takes, then cool. I was worried there was some new system...
    - oneplane 8y ago
      There are multiple ways and levels. The easiest is gatekeeper, which lives in the security settings. Next is SIP, which is a deeper layer (also PKI based) which cannot be changed while booted (which is a very good security model). You can only change this preboot or in the recovery environment. At that point, you may choose to disable SIP completely, or just parts of it (done using the csrutil). For an easier preboot option, you can use something like rEFInd/rEFIt to do this whenever you feel like it from a small preboot application. Security-wise, that can be problematic, and I suggest you turn on EFI password authentication so it's not something everyone can do to your machine. This means you can still change the SIP settings on-demand per boot using a USB stick with rEFInd on it, but doing that requires you to chain boot off of that USB drive and doing that triggers EFI protection and requires a password before you can do that. Normal boot would not require a password and lets you use the system as-is.
  - fauigerzigerk 8y ago
    The problem is that on iOS Apple's "quality control" includes banning normal and fun human activities such as sex. If that is now coming to the Mac as well then I will stop being Mac user and I will move away from Apple's platforms altogether. Requiring Apple's permission to run WireGuard automatically means requring the permission of the government as well. You don't even have to resort to China to see why that is bad. Many western governments are aggressively working towards banning various forms of encrypted communications.
    - Fnoord 8y ago
      > The problem is that on iOS Apple's "quality control" includes banning normal and fun human activities such as sex. While being totally OK with (gun) violence. Hello, double (American) standard. Keep that double standard in the US. I don't want it in the EU. Thank you.
    - oneplane 8y ago
      That's not their quality control you are referring to but the content guidelines (censor). It's a choice they are free to make, and are probably mostly copied off some American idea on what should be public or not. The problem you are running in to is that your ideas don't match their ideas and you want them to match your ideas (which they won't because they don't live in your world, they live in their world, which at this time is mostly the USA world). If in your country the government would enforce some law stating that companies should not block sex in their content pipelines, then Apple, just like they do in every other country, will comply. This is also the reason they censor stuff in China, it's the law over there. So while their ideas and values might not match with you, they do still have to follow the law. If you believe companies with a large impact should not block certain information from flowing, that is something you can enforce by law. A company has to deal with the law, and cannot go and be an anarchist whenever it feels like it (but people can) because then they cease to exist.
      - Wowfunhappy 8y ago
        If Apple did not block sideloading on iOS, they wouldn't practically be able to implement this kind of censorship in China and elsewhere. They would be able to remove it from the App Store, but people would be able to acquire the software via other means. (This topic doesn't really apply to macOS though, just iOS.)
- morpheuskafka 8y ago
  I don't know a lot about Apple development, but there is presumably some way for developers to run these on their own machines for testing. An Apple Developer account is $99/year, including 100 iOS devices for sideloading, so I'd guess something similar applies to Macs?
HHad3 8y ago
The documentation mentions that an entitlement is required. However, this only implies that an Apple account is needed and the yearly dev fee is to be paid. Entitlements work outside of the App Store too. Personally I'm happy to see WireGuard in the App Store, but would be concerned if Apple indeed limits the API to it. Could you elaborate on if distribution outside of the App Store is impossible?
- zx2c4 8y ago
  Check it out: https://data.zx2c4.com/network-extension-is-mac-app-store-only.png https://data.zx2c4.com/network-extension-is-mac-app-store-on...
  - HHad3 8y ago
    Indeed! Color me surprised. I have tried to reproduce the issue and found that even though you can create provisioning profiles for direct distribution with the Network Extension entitlement, and the UI shows that all is fine, the provisioning profile does NOT contain the required entitlement. After some digging I found a FAQ on network extensions by Apple [1]. Point #8 clearly says: > #8 — On the Mac, can Developer ID apps host Network Extension providers? > Currently this is not possible; only Mac App Store apps can host Network Extension providers. Thus the missing entitlement is most likely not a bug (and the cert UI is just bad). This is not a technical limitation, just Apple with questionable politics. [1] https://forums.developer.apple.com/thread/67613 https://forums.developer.apple.com/thread/67613
    - mrpippy 8y ago
      I suspect the reasoning is to prevent malware/spyware from setting up an always-on VPN without the user’s permission (i.e. the recent Facebook/Onavo scandal). Without using NetworkExtension, a kext is needed (which now require fairly obnoxious user consent). And using NetworkExtensiom essentially requires Apple’s approval.

https://developer.apple.com/documentation/networkextension/nepackettunnelprovider https://developer.apple.com/documentation/networkextension/n...

by zx2c4 8y ago

https://developer.apple.com/documentation/networkextension/nepackettunnelprovider https://developer.apple.com/documentation/networkextension/n...

Wowfunhappy 8y ago

Wow. Is there any way around this for a user? What if SIP is off? If there's no workaround, that makes me quite uncomfortable.

oneplane 8y ago
There are plenty of workarounds, but the issue is that when you want to pass quality control you have to play by they platform owner's rules. While not always nice on one hand, on the other hand this does mean that most users will be safe to install most software checked and distributed that way, without needing the intimate knowledge we have. I totally understand that if Apple builds and maintains a PKI-based security model, they are going to want to check your stuff before allowing you in. If, on the other hand, the user doesn't care, they can simply turn off the security model or adjust it.
- Wowfunhappy 8y ago
  > they can simply turn off the security model or adjust it. I'd very much like to know what this involves. I'll feel better knowing how it can be done. If you have a link that would be great!
  - maxmunzel 8y ago
    Google for macOS gatekeeper
    - mosselman 8y ago
      DuckDuckGo is a better option with regards to privacy ;). Since this is a topic on VPN software.
    - Wowfunhappy 8y ago
      Oh, if disabling Gatekeeper is all it takes, then cool. I was worried there was some new system...
  - oneplane 8y ago
    There are multiple ways and levels. The easiest is gatekeeper, which lives in the security settings. Next is SIP, which is a deeper layer (also PKI based) which cannot be changed while booted (which is a very good security model). You can only change this preboot or in the recovery environment. At that point, you may choose to disable SIP completely, or just parts of it (done using the csrutil). For an easier preboot option, you can use something like rEFInd/rEFIt to do this whenever you feel like it from a small preboot application. Security-wise, that can be problematic, and I suggest you turn on EFI password authentication so it's not something everyone can do to your machine. This means you can still change the SIP settings on-demand per boot using a USB stick with rEFInd on it, but doing that requires you to chain boot off of that USB drive and doing that triggers EFI protection and requires a password before you can do that. Normal boot would not require a password and lets you use the system as-is.
- fauigerzigerk 8y ago
  The problem is that on iOS Apple's "quality control" includes banning normal and fun human activities such as sex. If that is now coming to the Mac as well then I will stop being Mac user and I will move away from Apple's platforms altogether. Requiring Apple's permission to run WireGuard automatically means requring the permission of the government as well. You don't even have to resort to China to see why that is bad. Many western governments are aggressively working towards banning various forms of encrypted communications.
  - Fnoord 8y ago
    > The problem is that on iOS Apple's "quality control" includes banning normal and fun human activities such as sex. While being totally OK with (gun) violence. Hello, double (American) standard. Keep that double standard in the US. I don't want it in the EU. Thank you.
  - oneplane 8y ago
    That's not their quality control you are referring to but the content guidelines (censor). It's a choice they are free to make, and are probably mostly copied off some American idea on what should be public or not. The problem you are running in to is that your ideas don't match their ideas and you want them to match your ideas (which they won't because they don't live in your world, they live in their world, which at this time is mostly the USA world). If in your country the government would enforce some law stating that companies should not block sex in their content pipelines, then Apple, just like they do in every other country, will comply. This is also the reason they censor stuff in China, it's the law over there. So while their ideas and values might not match with you, they do still have to follow the law. If you believe companies with a large impact should not block certain information from flowing, that is something you can enforce by law. A company has to deal with the law, and cannot go and be an anarchist whenever it feels like it (but people can) because then they cease to exist.
    - Wowfunhappy 8y ago
      If Apple did not block sideloading on iOS, they wouldn't practically be able to implement this kind of censorship in China and elsewhere. They would be able to remove it from the App Store, but people would be able to acquire the software via other means. (This topic doesn't really apply to macOS though, just iOS.)
morpheuskafka 8y ago
I don't know a lot about Apple development, but there is presumably some way for developers to run these on their own machines for testing. An Apple Developer account is $99/year, including 100 iOS devices for sideloading, so I'd guess something similar applies to Macs?

HHad3 8y ago

The documentation mentions that an entitlement is required. However, this only implies that an Apple account is needed and the yearly dev fee is to be paid. Entitlements work outside of the App Store too. Personally I'm happy to see WireGuard in the App Store, but would be concerned if Apple indeed limits the API to it. Could you elaborate on if distribution outside of the App Store is impossible?

zx2c4 8y ago
Check it out: https://data.zx2c4.com/network-extension-is-mac-app-store-only.png https://data.zx2c4.com/network-extension-is-mac-app-store-on...
- HHad3 8y ago
  Indeed! Color me surprised. I have tried to reproduce the issue and found that even though you can create provisioning profiles for direct distribution with the Network Extension entitlement, and the UI shows that all is fine, the provisioning profile does NOT contain the required entitlement. After some digging I found a FAQ on network extensions by Apple [1]. Point #8 clearly says: > #8 — On the Mac, can Developer ID apps host Network Extension providers? > Currently this is not possible; only Mac App Store apps can host Network Extension providers. Thus the missing entitlement is most likely not a bug (and the cert UI is just bad). This is not a technical limitation, just Apple with questionable politics. [1] https://forums.developer.apple.com/thread/67613 https://forums.developer.apple.com/thread/67613
  - mrpippy 8y ago
    I suspect the reasoning is to prevent malware/spyware from setting up an always-on VPN without the user’s permission (i.e. the recent Facebook/Onavo scandal). Without using NetworkExtension, a kext is needed (which now require fairly obnoxious user consent). And using NetworkExtensiom essentially requires Apple’s approval.