7 ms·

> The bridging requires the binary to have the com.apple.vm.networking entitlement, and Apple docs helpfully give this note: >> Note This entitlement is restri

> The bridging requires the binary to have the com.apple.vm.networking entitlement, and Apple docs helpfully give this note: >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I have not done development in Xcode for some time, but the first thing I wanted to do for an internal project was hamstrung by restricted entitlements. Luckily, it was just an experiment, but it makes it feel like this is coming up a lot. Is there still a way around this (i.e. to run your own code on macOS) ? This isn’t the first time I’ve seen a project based around Virtualization.framework; that’s both exciting and disconcerting. Issues like entitlement deals (that I will never be able to obtain) make the wide open path forward look a lot like a narrow track, the direction of which only Apple controls.

djxfade 6y ago
I feel like unless you are one of the bigger players, you never get a reply. I work for a company that develop apps, and we got into a situation where we had a need to be able to disable NFC temporarily, because Apple Pay was triggering when it shouldn't (on a ticket scanning gate). Hidden deep in an obscure doc, I found a notice about a special entitlement you could request by emailing the Apple Pay support team. Emailed them two times over the last two years, never even got a reply
- afandian 6y ago
  Apple customers surrender their phones, and experiences, to Apple's custody. That walled garden is discussed every day here. But I wonder how much 'normal' Apple consumers realize how shoddy some of that custody really is. I bet your customers blamed you for that bug, not Apple?
  - pyr0hu 6y ago
    Of course they gonna blame the creator of the app, not Apple. The customer has no idea about the development and what entitlements are available or not. Why should they blame Apple, I don't understand your point. As the creator, notify your users about it and there you can blame Apple as long as you want. But if the users are not notified, they don't really know that the creators are waiting for Apple.
- alfanick 6y ago
  As an user I literally run into this usecase: Germany, local bus company, I've run out of cash, so I just bought online ticket via Deutsche Bahn app (it's a QR code). When you enter the bus, you need to scan this QR code, but for some stupid/smart reason Apple Pay triggers and hides this screen, and of course when you try to debug Apple Pay screen is gone, QR code is back. Trying to explain to the bus driver that this was some stupid Apple Pay interaction was quite an experience. Lesson learned: make sure to always have some spare coins with you.
  - tuxone 6y ago
    Maybe the QR code scanner and the NFC POS have been installed in a poor way that make the two options collide. Since QR code could be provided from general purpose apps (browser, photo gallery) there is no software solution to this.
  - aeontech 6y ago
    Hey, I may know some people who’d be very interested in these failure modes on the team. Which bus company? Any chance you know what terminal they use? Would you mind getting in touch off HN to discuss further?
    - lucasverra 6y ago
      Same problem in France, public train company SNCF. All year long I had to ask the (human) controllers to open the glass barrier supposed to be opened with a QR scanner in the gates. Same flawed workflow. Show QR to scanner => not work => check phone on apple pay mode with credit cards => repeat => ask the (human) controllers. You can ping me @ lucas@concpt.io
    - xmodem 6y ago
      I have encountered the same problem with the tunnelbana in Stockholm. Normally I use a card, but on a few occasions I have left it at home or forgotten to top it up, and bought a ticket with the app. When it wasn't scanning and I took my phone off the scanner, I briefly glimpsed the Apple Pay screen before it animated away, so I realised I was "holding it wrong", and was able to get it to scan by holding it at a different angle to keep the NFC sensor at the top of the phone away from reader, but I can imagine a less technically minded user than myself might have serious problems. I don't know anything about the scanner or NFC standards used by this system, sorry.
- aeontech 6y ago
  @djxfade: I might know some people on the team who’d be very interested to hear about it. what’s the best way to get in touch?
  - saagarjha 6y ago
    Unrelated question as an outside observer: how is it possible to get interactions like these as opposed to "file a feedback"?
  - djxfade 6y ago
    Hi, you can contact me on thomas(at)apility(dot).no
- tomduncalf 6y ago
  I recently learned about the "technical support incident" help you can get from Apple, you get two such incidents included with your annual developer program - maybe worth a go, I believe they respond to you quite quickly from what I've heard: https://developer.apple.com/support/technical/ https://developer.apple.com/support/technical/
derefr 6y ago
> Is there still a way around this (i.e. to run your own code on macOS) ? In Big Sur I’ve noticed there’s now a “Developer Tools” entitlement in Privacy. I’m not sure exactly what it allows executables to do, but as it starts off with Terminal.app as a suggested entry, I’d assume it at least allows the given app to spawn unsigned binaries.
- saagarjha 6y ago
  I think this lets apps ignore things like quarantine and data vaults.
eecc 6y ago
Besides a cunning and evil plan to gradually restrict user freedom (/s) I can also imagine this is meant to control an OS feature that can be used to nestle some pretty audacious privacy-violating software, away from the rest of the OS restrictions. Perhaps Apple will figure out some software control to sidestep this administration overhead, or just make it an xtra license to milk more money. After all Microsoft has been doing this since the beginning...
- api 6y ago
  Yes. Freedom in computing is a very sharp double-edged sword. On one hand, it gives you control of your device and your computing world and lets you create anything you want. On the other hand, it lets malware and spyware take total control of your machine and steal all your personal data or extort you with ransomware. Security is always somewhat like that. It really wouldn't be that hard for a determined burglar to break into my house. I could make it a lot harder, but doing so would come at the expense of a great deal of my own convenience and even freedom. I don't want bars on my windows and I don't want to have to authenticate against a panel or app/keyfob every single time I enter or leave my home. My neighborhood has police and I live in a very civilized place. The Internet is an open war zone overrun with criminals and malicious privacy-invading corporations (and governments, and not just your own government) bent on subjecting you to a total panopticon. Computers must be secure in a much more hostile environment than my house or my car. A computer today must be more like a hardened compound in a failed state than a house in a typical developed world city or suburb. I've been saying "the Internet is a failed state" for a while. Apple with its locked down walled garden is like one of those private mercenary security armies that provide security to the rich in failed states.
  - progman32 6y ago
    In this example, I see Apple as one of those armies that only allows you to take groceries from their blessed vendors into the walls (some rumor about razor blades in fruit from the other shops?). They charge those grocery shops for this privilege. I don't disagree with the comment's observations, though I don't see a path to get to a "friendly" internet without sacrificing other important freedoms.
marmaduke 6y ago
I understand the concern, but this seems to derail the whole discussion of this lightweight tool supporting virtualization on m1/Big Sur.
- ultrarunner 6y ago
  That was not my intention, but I can see how that would be the case. As I have seen several mentions of wrappers for Virtualization.framework, the common thread that jumped out to me was the continued march toward dependence on Apple’s provisions. I do hope that the rest of the thread continues to tend toward the merits of this particular tool.
  - marmaduke 6y ago
    yeah, I can see the topic being worth a blog post and a dedicated HN discussion, since there are pros and cons of locking things up like this.
my123 6y ago
For that specific entitlement, it's overridden by vmnet.framework if you call it from root. However, Virtualization.framework runs out of process, and Apple forgot to check for root if the entitlement isn't present. That should get solved soon.
walrus01 6y ago
> >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I can understand the desire, for convenience's sake of testing stuff quickly, to directly virtualize a guest linux OS on a developer's workstation laptop or desktop running MacOS. But that's an absolute non-starter for me. Contact your sales representative for an entitlement? Forget that, I'll keep on using Linux kernel based virtualization with either xen or kvm, and the equivalent of xen domU PV or HVM on a normal x86-64 server platform, controlled remotely from my laptop, thanks. The whole language in that sounds like they hired some MBAs away from Oracle.
- marcan_42 6y ago
  Or you could wait until I port Linux to these Macs and then use KVM on that :-) (shameless plug) Seriously though, the machines are open, you can disable all the security to various degrees. The entitlement stuff is for deploying to vanilla Macs with all the codesigning requirements enabled (e.g. via the App Store), for security. It doesn't stop you from bypassing it on your own machines.
  - Wowfunhappy 6y ago
    If you disable SIP, iOS apps stop working. https://forums.macrumors.com/threads/if-you-disable-sip-all-you-ios-apps-will-stop-working-on-your-m1.2269661/ https://forums.macrumors.com/threads/if-you-disable-sip-all-... Your line was my line for a long time. But I feel like this is a significant step. For the first time, by taking control of your own device you’re loosing functionality.
    - new_realist 6y ago
      That’s because iOS devices are locked down for security. iOS apps are given a promise of a trusted computing base which must be kept. Otherwise your company, government or criminal gives you a MacOS laptop with SIP disabled and can now trivially circumvent the privacy protections built into all iOS devices, including for data sync’d over the cloud with your other secure devices.
solarexplorer 6y ago
I think this entitlement controls only the ability if you are not running as root. That makes perfect sense, because you don't want random user processes to be able to sniff your network traffic... > A Boolean that indicates whether the app manages virtual network interfaces without escalating privileges to the root user. https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_vm_networking?language=objc https://developer.apple.com/documentation/bundleresources/en...
- dingaling 6y ago
  > I think this entitlement controls only the ability if you are not running as root. Indeed, but why can't it be granted by root?
  - solarexplorer 6y ago
    Well, if you don't care about security, you can always put the setuid bit on the binary (I suppose that would work?). I agree that the situation is not ideal, but at least you can run it on your own computer if you actually want to... In the past there were some bad actors doing shady stuff on iOS with this type of entitlement. I wonder if that influenced this type of restriction: https://guce.techcrunch.com/copyConsent?sessionId=3_cc-session_0a3a7fb3-fd15-41aa-8dba-83a7383b2990&lang=es-ES https://guce.techcrunch.com/copyConsent?sessionId=3_cc-sessi...
johncolanduoni 6y ago
Is it restricted for developer ID/notarized software, or just the App Store? The latter doesn’t surprise (or bother) me particularly, but if it’s the former it would be pretty surprising and annoying. In the past I’ve even used weird internal entitlements like the custom lisp sandbox directives just fine with signed binaries, though I haven’t tried to notarize them.
rubatuga 6y ago
Imagine if you wanted to run a Linux program with KVM support, and you had to ask Linus to enable a flag on your Linus ID Account.
- pjmlp 6y ago
  Eventually even Linux will diverge from its idealistic roots as our generation has left the world of living.
jamesfmilne 6y ago
You can self-sign binaries to run on your own machine with the entitlement. You only need the entitlement from Apple if you want to distribute applications with the entitlement to other people.

djxfade 6y ago

I feel like unless you are one of the bigger players, you never get a reply. I work for a company that develop apps, and we got into a situation where we had a need to be able to disable NFC temporarily, because Apple Pay was triggering when it shouldn't (on a ticket scanning gate). Hidden deep in an obscure doc, I found a notice about a special entitlement you could request by emailing the Apple Pay support team. Emailed them two times over the last two years, never even got a reply

afandian 6y ago
Apple customers surrender their phones, and experiences, to Apple's custody. That walled garden is discussed every day here. But I wonder how much 'normal' Apple consumers realize how shoddy some of that custody really is. I bet your customers blamed you for that bug, not Apple?
- pyr0hu 6y ago
  Of course they gonna blame the creator of the app, not Apple. The customer has no idea about the development and what entitlements are available or not. Why should they blame Apple, I don't understand your point. As the creator, notify your users about it and there you can blame Apple as long as you want. But if the users are not notified, they don't really know that the creators are waiting for Apple.
alfanick 6y ago
As an user I literally run into this usecase: Germany, local bus company, I've run out of cash, so I just bought online ticket via Deutsche Bahn app (it's a QR code). When you enter the bus, you need to scan this QR code, but for some stupid/smart reason Apple Pay triggers and hides this screen, and of course when you try to debug Apple Pay screen is gone, QR code is back. Trying to explain to the bus driver that this was some stupid Apple Pay interaction was quite an experience. Lesson learned: make sure to always have some spare coins with you.
- tuxone 6y ago
  Maybe the QR code scanner and the NFC POS have been installed in a poor way that make the two options collide. Since QR code could be provided from general purpose apps (browser, photo gallery) there is no software solution to this.
- aeontech 6y ago
  Hey, I may know some people who’d be very interested in these failure modes on the team. Which bus company? Any chance you know what terminal they use? Would you mind getting in touch off HN to discuss further?
  - lucasverra 6y ago
    Same problem in France, public train company SNCF. All year long I had to ask the (human) controllers to open the glass barrier supposed to be opened with a QR scanner in the gates. Same flawed workflow. Show QR to scanner => not work => check phone on apple pay mode with credit cards => repeat => ask the (human) controllers. You can ping me @ lucas@concpt.io
  - xmodem 6y ago
    I have encountered the same problem with the tunnelbana in Stockholm. Normally I use a card, but on a few occasions I have left it at home or forgotten to top it up, and bought a ticket with the app. When it wasn't scanning and I took my phone off the scanner, I briefly glimpsed the Apple Pay screen before it animated away, so I realised I was "holding it wrong", and was able to get it to scan by holding it at a different angle to keep the NFC sensor at the top of the phone away from reader, but I can imagine a less technically minded user than myself might have serious problems. I don't know anything about the scanner or NFC standards used by this system, sorry.
aeontech 6y ago
@djxfade: I might know some people on the team who’d be very interested to hear about it. what’s the best way to get in touch?
- saagarjha 6y ago
  Unrelated question as an outside observer: how is it possible to get interactions like these as opposed to "file a feedback"?
- djxfade 6y ago
  Hi, you can contact me on thomas(at)apility(dot).no
tomduncalf 6y ago
I recently learned about the "technical support incident" help you can get from Apple, you get two such incidents included with your annual developer program - maybe worth a go, I believe they respond to you quite quickly from what I've heard: https://developer.apple.com/support/technical/ https://developer.apple.com/support/technical/

derefr 6y ago

> Is there still a way around this (i.e. to run your own code on macOS) ? In Big Sur I’ve noticed there’s now a “Developer Tools” entitlement in Privacy. I’m not sure exactly what it allows executables to do, but as it starts off with Terminal.app as a suggested entry, I’d assume it at least allows the given app to spawn unsigned binaries.

saagarjha 6y ago
I think this lets apps ignore things like quarantine and data vaults.

eecc 6y ago

Besides a cunning and evil plan to gradually restrict user freedom (/s) I can also imagine this is meant to control an OS feature that can be used to nestle some pretty audacious privacy-violating software, away from the rest of the OS restrictions. Perhaps Apple will figure out some software control to sidestep this administration overhead, or just make it an xtra license to milk more money. After all Microsoft has been doing this since the beginning...

api 6y ago
Yes. Freedom in computing is a very sharp double-edged sword. On one hand, it gives you control of your device and your computing world and lets you create anything you want. On the other hand, it lets malware and spyware take total control of your machine and steal all your personal data or extort you with ransomware. Security is always somewhat like that. It really wouldn't be that hard for a determined burglar to break into my house. I could make it a lot harder, but doing so would come at the expense of a great deal of my own convenience and even freedom. I don't want bars on my windows and I don't want to have to authenticate against a panel or app/keyfob every single time I enter or leave my home. My neighborhood has police and I live in a very civilized place. The Internet is an open war zone overrun with criminals and malicious privacy-invading corporations (and governments, and not just your own government) bent on subjecting you to a total panopticon. Computers must be secure in a much more hostile environment than my house or my car. A computer today must be more like a hardened compound in a failed state than a house in a typical developed world city or suburb. I've been saying "the Internet is a failed state" for a while. Apple with its locked down walled garden is like one of those private mercenary security armies that provide security to the rich in failed states.
- progman32 6y ago
  In this example, I see Apple as one of those armies that only allows you to take groceries from their blessed vendors into the walls (some rumor about razor blades in fruit from the other shops?). They charge those grocery shops for this privilege. I don't disagree with the comment's observations, though I don't see a path to get to a "friendly" internet without sacrificing other important freedoms.

marmaduke 6y ago

I understand the concern, but this seems to derail the whole discussion of this lightweight tool supporting virtualization on m1/Big Sur.

ultrarunner 6y ago
That was not my intention, but I can see how that would be the case. As I have seen several mentions of wrappers for Virtualization.framework, the common thread that jumped out to me was the continued march toward dependence on Apple’s provisions. I do hope that the rest of the thread continues to tend toward the merits of this particular tool.
- marmaduke 6y ago
  yeah, I can see the topic being worth a blog post and a dedicated HN discussion, since there are pros and cons of locking things up like this.

my123 6y ago

For that specific entitlement, it's overridden by vmnet.framework if you call it from root. However, Virtualization.framework runs out of process, and Apple forgot to check for root if the entitlement isn't present. That should get solved soon.

walrus01 6y ago

> >> Note This entitlement is restricted to developers of virtualization software. To request this entitlement, contact your Apple representative. I can understand the desire, for convenience's sake of testing stuff quickly, to directly virtualize a guest linux OS on a developer's workstation laptop or desktop running MacOS. But that's an absolute non-starter for me. Contact your sales representative for an entitlement? Forget that, I'll keep on using Linux kernel based virtualization with either xen or kvm, and the equivalent of xen domU PV or HVM on a normal x86-64 server platform, controlled remotely from my laptop, thanks. The whole language in that sounds like they hired some MBAs away from Oracle.

marcan_42 6y ago
Or you could wait until I port Linux to these Macs and then use KVM on that :-) (shameless plug) Seriously though, the machines are open, you can disable all the security to various degrees. The entitlement stuff is for deploying to vanilla Macs with all the codesigning requirements enabled (e.g. via the App Store), for security. It doesn't stop you from bypassing it on your own machines.
- Wowfunhappy 6y ago
  If you disable SIP, iOS apps stop working. https://forums.macrumors.com/threads/if-you-disable-sip-all-you-ios-apps-will-stop-working-on-your-m1.2269661/ https://forums.macrumors.com/threads/if-you-disable-sip-all-... Your line was my line for a long time. But I feel like this is a significant step. For the first time, by taking control of your own device you’re loosing functionality.
  - new_realist 6y ago
    That’s because iOS devices are locked down for security. iOS apps are given a promise of a trusted computing base which must be kept. Otherwise your company, government or criminal gives you a MacOS laptop with SIP disabled and can now trivially circumvent the privacy protections built into all iOS devices, including for data sync’d over the cloud with your other secure devices.

solarexplorer 6y ago

I think this entitlement controls only the ability if you are not running as root. That makes perfect sense, because you don't want random user processes to be able to sniff your network traffic... > A Boolean that indicates whether the app manages virtual network interfaces without escalating privileges to the root user. https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_vm_networking?language=objc https://developer.apple.com/documentation/bundleresources/en...

dingaling 6y ago
> I think this entitlement controls only the ability if you are not running as root. Indeed, but why can't it be granted by root?
- solarexplorer 6y ago
  Well, if you don't care about security, you can always put the setuid bit on the binary (I suppose that would work?). I agree that the situation is not ideal, but at least you can run it on your own computer if you actually want to... In the past there were some bad actors doing shady stuff on iOS with this type of entitlement. I wonder if that influenced this type of restriction: https://guce.techcrunch.com/copyConsent?sessionId=3_cc-session_0a3a7fb3-fd15-41aa-8dba-83a7383b2990&lang=es-ES https://guce.techcrunch.com/copyConsent?sessionId=3_cc-sessi...

johncolanduoni 6y ago

Is it restricted for developer ID/notarized software, or just the App Store? The latter doesn’t surprise (or bother) me particularly, but if it’s the former it would be pretty surprising and annoying. In the past I’ve even used weird internal entitlements like the custom lisp sandbox directives just fine with signed binaries, though I haven’t tried to notarize them.

rubatuga 6y ago

Imagine if you wanted to run a Linux program with KVM support, and you had to ask Linus to enable a flag on your Linus ID Account.

pjmlp 6y ago
Eventually even Linux will diverge from its idealistic roots as our generation has left the world of living.

jamesfmilne 6y ago

You can self-sign binaries to run on your own machine with the entitlement. You only need the entitlement from Apple if you want to distribute applications with the entitlement to other people.