3 ms·

The sandboxing of apps is a nice benefit, though. I can be reasonably confident apps won't conflict with each other and that they're interfacing cleanly and min

The sandboxing of apps is a nice benefit, though. I can be reasonably confident apps won't conflict with each other and that they're interfacing cleanly and minimally with the host OS. Perhaps not the best example, but I set up Wireguard recently. On Linux, this involves building and installing a kernel module, and directly modifying the host's networking configuration. On Mac, I can install it from the App Store, and I know any networking configuration is handled through Apple's high level APIs (I've built a VPN-based Mac App Store app before). Alternatively, you might install Tunnelblick, a Mac app that wraps OpenVPN and is distributed outside the App Store. It'll end up running scripts like these, as necessary to configure networking on the host: * https://github.com/Tunnelblick/Tunnelblick/blob/master/tunnelblick/client.4.up.tunnelblick.sh https://github.com/Tunnelblick/Tunnelblick/blob/master/tunne... Nothing in that script is crazy--it's all necessary stuff if you're not limiting yourself to the higher level APIs. But it doesn't take many apps doing things of that complexity for totally justifiable reasons before you start having issues.

catalogia 7y ago
Isn't the wireguard implementation on MacOS a userland implementation? Seems like a poor example to compare with the Linux version, which is technically superior specifically because it requires a kernel module.
- moduspol 7y ago
  The MacOS one must be a userland implementation because if it required kernel modules, it wouldn't be able to be in the App Store. The only way to implement a VPN on the App Store is to use the higher level APIs, as far as I know. The Linux one may be "superior" in that it's able to process packets faster, but the resulting user experience is quite different. If you have multiple VPN apps, even including userspace ones like OpenVPN, the likelihood of all of them reliably handling host OS interactions cleanly with regular usage over time drops. They have to do the same kinds of things in that Tunnelblick script I linked.
  - catalogia 7y ago
    > "The Linux one may be "superior" in that it's able to process packets faster, but the resulting user experience is quite different." "Process packets faster" is one way of looking at it. Better battery life is another way of framing it less dismissively. (OpenVPN sucks and I don't really see how it's relevant to the discussion.)

catalogia 7y ago

Isn't the wireguard implementation on MacOS a userland implementation? Seems like a poor example to compare with the Linux version, which is technically superior specifically because it requires a kernel module.

moduspol 7y ago
The MacOS one must be a userland implementation because if it required kernel modules, it wouldn't be able to be in the App Store. The only way to implement a VPN on the App Store is to use the higher level APIs, as far as I know. The Linux one may be "superior" in that it's able to process packets faster, but the resulting user experience is quite different. If you have multiple VPN apps, even including userspace ones like OpenVPN, the likelihood of all of them reliably handling host OS interactions cleanly with regular usage over time drops. They have to do the same kinds of things in that Tunnelblick script I linked.
- catalogia 7y ago
  > "The Linux one may be "superior" in that it's able to process packets faster, but the resulting user experience is quite different." "Process packets faster" is one way of looking at it. Better battery life is another way of framing it less dismissively. (OpenVPN sucks and I don't really see how it's relevant to the discussion.)