9 ms·

WireGuard: Great protocol, but skip the Mac app

115 points by parsecs 6y ago

GekkePrutser 6y ago
Making a bug report would be better :) But yeah Apple doesn't make it any easier with vpns on big Sur, they have to use a new type e of extension now and they exclude their own services automatically. Not something that seems related to these issues but it make macOS one again less interesting for me as daily driver
- boardwaalk 6y ago
  > and they exclude their own services automatically. Unless you have information otherwise, I don't think that the whitelist applied to the filtering features used by Little Snitch et al also applies to VPNs.
  - st3fan 6y ago
    Correct. There is no exception for apples own apps to skip the active VPN connection. How could there be? Things would break and it would be a privacy nightmare.
tssva 6y ago
While it may be good from an encryption and basic security configuration perspective I find wireguard lacking from a networking and administration perspective. Networking wise it implements a point to multipoint model which is just awful to deal with. I had hoped that moving on from frame relay and ATM had killed this model but wireguard brings it right back. Then you also have to deal with complications of wireguard interfaces always being up. The two combined means doing anything but the most basic setups means more complicationd with more chance for incorrect configuration than an ipsec or openvpn alternative. Then there is the whole troubleshooting problem. When it doesn't work wireguard provides much less information to troubleshoot the issue than ipsec and openvpn. Also there is the irritating lines of code comparison vs ipsec and openvpn when for the most part it is comparing apples to oranges since wireguard doesn't include many of the features of either which are required for an enterprise site to site or road warrior VPN solution. Once the solutions are in place to provide comparable functionality the attack surface is likely to be pretty comparable.
- tptacek 6y ago
  I've done a lot of professional work over the past few months† with WireGuard and can't think of a piece of information I've ever needed to troubleshoot it that it doesn't provide. You know about `dynamic_debug`, right? There's also just not that much to debug! You've got keys, allowed IP lists, and endpoint addresses. There aren't a lot of other knobs to turn! I think a thing that gets people into trouble with WireGuard is not understanding how modest its design is. The goal of WireGuard is to drop into the networking stack as just another interface. It doesn't intend to implement an entire new networking model on top of itself. My experience has generally been, if it's straightforward to express in the Linux networking model, it's straightforward with WireGuard. I think this is a very good thing. I really don't want to have to think about what the OpenVPN developers believe about networking in general. I want to bring up secure transports and route packets over them the way I'd route over any other tunnel I want orthogonal, predictable interfaces that I (or Tailscale, or whatever) can build more complicated things on top of. † https://fly.io/blog/ipv6-wireguard-peering/ https://fly.io/blog/ipv6-wireguard-peering/
- 3np 6y ago
  Could you elaborate on how these issues and limitations you mention can manifest in practice? I’ve set up a couple of different topologies and haven’t felt limited yet. Though troubleshooting packet loss is not fun and I haven’t been able to figure out how to avoid that and fragmentation, but I believe that’s more due to me than WG itself.
  - tptacek 6y ago
    What's the fragmentation issue you're having?
    - scaladev 6y ago
      Not OP, but I've seen one small issue with using WireGuard on GCP VMs — you must limit MTU to 1380 or it starts silently dropping some packets and leaves you wondering why some HTTPS sites refuse to load (I thought I set up a VPN to avoid censorship? why the hell am I still having the same issues?) Probably an obvious thing for a networking expert, but it took me a few minutes to figure out what's going on.
pthreads 6y ago
I have had the opposite experience to OP. I have the macOS app installed on several Macs (laptops and desktops). They have all worked so well to the point that I even forget Wireguard is running. On top of that I upgrade macOS almost as soon as Apple releases a new version. It is true that for updating WG you need to first disable the on-demand setting (probably only on Big Sur). But to me that is such a trivial hiccup considering it is free and generally bug free! On the rare occasions that I have had a non-trivial issue looking at the log file has provided clues. My VPN cost is only about $5/month as I run my own instance of WG server in the cloud. Worth every penny! It is possible it could be lower if I use one of those #3.50/month AWS lightsail instances but I never tried. Go WG!
- syntaxing 6y ago
  Any tips on how to run your own server safely? I get all paranoid because I’m terrible with security.
  - mfcl 6y ago
    By practicing. Run it anyway and get good at it.
    - justusthane 6y ago
      “By practicing” is not a good way to get good at security, unless you want to make potentially devastating mistakes along the way.
      - 3np 6y ago
        It depends on what you put at stake, obviously.
      - mfcl 6y ago
        How else can you get good at security? I guess you could read, but at some point you'll have to practice. And I never said you need to practice with sensitive information.
zacharyozer 6y ago
Had exactly the same experience. Definitely annoying, but more that anything else, I’m impressed that Rachel was able to turn it into cogent blog post.
Jamie9912 6y ago
Skip the Windows app too, I wish it was exactly like this client https://tunsafe.com/ https://tunsafe.com/ (made by the Spotify dev Strigeus)
- tptacek 6y ago
  Does Donenfeld vouch for Tunsafe? I'd be reluctant to use a WireGuard client he didn't endorse, if only because I've been on the sidelines in conversations about VPN client software vulnerabilities and I know he's careful about this stuff (Donenfeld's background is in vuln research). There is more to get right than just the protocol.
  - Jamie9912 6y ago
    I don't think he does, Tunsafe implements Wireguard, but it hasn't been updated for maybe 2 years now. Still, the UI is so much nicer than the Wireguard one
- drummer 6y ago
  I used this, was easy to setup. Recommend checking it out as well.
- StavrosK 6y ago
  Why not just use that? Looks like it uses WireGuard under the hood.
  - Jamie9912 6y ago
    It sadly doesn't get updates anymore, but still works for now at least
- pvg 6y ago
  If the UI is more important to you than the security of your VPN, by all means but I think for most uses this is questionable advice. TunSafe development has been dormant for years, the official WireGuard client fixed one of its bigger Windows UI quirks just recently.
Shank 6y ago
I’m still sad about the state of WireGuard for average consumers. The protocol and the underlying tools are a simple and nice in a UNIX-like way, but for average people, it’s a wash. WireGuard would benefit greatly from a set of robust, easy to understand clients. The current state of the world, where many VPN providers ship questionable apps of varying quality, is just sad for a solution that claims to prioritize security and privacy. The WireGuard app is somewhat useable, but it is by no means “easy to setup” unless you’re already familiar with how WireGuard works.
- pxeboot 6y ago
  I found the Android client very easy to use. You can import a config file or scan a QR code to setup a profile. If you know what you are doing, you can setup it up manually. Compared to the Cisco client we use for work, wireguard seemed better in every way.
SomaticPirate 6y ago
Isn’t this what Tailscale claims to fix? Zero config VPN on top of Wireguard? Would love for one of the creators to weigh in.
- BostonEnginerd 6y ago
  I totally understand why the Tailscale folks do it this way, but I don't really want to link my Google or MS accounts to my private VPN. The product looks fantastic though!!
  - tptacek 6y ago
    It is a disgustingly well designed product. Go kick the tires and you'll see what I mean. It's just alarming.
UI_at_80x24 6y ago
To make the WireGuard windows app better (for non-admin users) you need to make your user(s) a member of the "Network Configuration Operators" group. This allows you enable/disable (or choose if you have multiple) the VPN without needing to be a member of the Administrators group. You also need to add a line to the registry. Here's the powershell code to do that: New-ItemProperty "hklm:\software\wireguard" -Name "LimitedOperatorUI" -Value 1 -PropertyType "DWord" -Force Add-LocalGroupMember -Group "Network Configuration Operators" -Member "$username"
- grandinj 6y ago
  That sounds like a good idea that should be added to the WireGuard installer? Perhaps log a feature request?
- est 6y ago
  it used to just 2 clicks on a control panel. control userpasswords2 A simple user account managing interface hidden in a myriad of crap dashboards.
nominated1 6y ago
> Wireguard won't upgrade itself if it's still running… This is not unique to Wireguard. I’ve had this happen with the Lockdown app too. This is an Apple problem. Apple should notify you that the VPN app needs to close in order to upgrade then offer you a simple way of doing that. > I don't know exactly, and I don't really care. This about sums it up. This is a rant and it’s difficult not to just close tab half way through.
- pram 6y ago
  Strange omission, considering automatically updating Safari extensions asks you to exit Safari when it happens.
  - plussed_reader 6y ago
    Purposeful 1st party omission. Or maybe an oversight by Wireguard, but with the way Apple limits API access in iOS for 3rd party I'm non-plussed.
- lrossi 6y ago
  A rant can be useful. The article is just misleading clickbait. Not sure how it got upvoted here.
- sevagh 6y ago
  >This about sums it up. This is a rant and it’s difficult not to just close tab half way through. Every single rachelbythebay article: Here's a vague condition. I encountered it at vague companies that I may have worked at. Anyway, whatever, it vaguely caused problems. Here's my vague workaround or suggestion. Whatever. Bye.
arthurcolle 6y ago
ZeroTier is so much better than WireGuard. I literally spend 2 weeks futzing about with a WireGuard config and was able to set up a VPN between my homelab and my new apartment in less than 15 minutes with ZT. Day and night difference in quality and ease of use. AMA?
- laingc 6y ago
  I’ve never really figured out whether ZeroTier can be trusted. WireGuard has an excellent reputation among people I respect. What is it about ZT that made you trust it with your traffic?
- chipsa 6y ago
  I've got Tailscale setup. It uses Wireguard under the hood, so I don't have to worry about the security of the protocol, just whether I trust the company providing the management. Took just as much time to setup as you did with ZeroTier.
sneak 6y ago
Wireguard can only be installed via the Mac App Store, which, upon opening, transmits your permanent/unchangeable hardware serial number and Apple ID (required to download even free apps), which is linked to your phone number, to Apple, thus deanonymizing your VPN's public IP. I don't use the Mac App Store. I run my VPN on a second device, because I no longer find the macOS to sufficiently preserve my privacy. It's insane to me that Apple thinks it's okay to demand hardware serial number, name, street address, email, and phone number to download free privacy apps. An organization that had privacy as a value simply would not do that. Apple has banned apps that want to use the NetworkExtension API from being self-signed, OR by being Apple-approved-developer signed and distributed outside of the App Store. You can download the windows Wireguard client from the Wireguard website, but not the mac one. They even recently censored the donations link in the Wireguard mac client, because App Store.
- perryizgr8 6y ago
  > Wireguard can only be installed via the Mac App Store I think you can also use brew.
  - sneak 6y ago
    That uses a different API that is widely assumed will be removed soon in a future macOS, and as such nobody wants to rely on it or build around it. It also requires root. It is not used by the Wireguard GUI app in the Mac App Store (MAS). The wireguard-app-from-wireguard is only distributed via MAS, and you cannot build that GUI version that they distribute via MAS yourself, because that version uses the NetworkExtension API and that only works with the appropriate signed entitlement from Apple, which as of very recently didn't get issued outside of MAS apps.
- opensmtpd 6y ago
  If self and Apple-approved developer signing is not allowed, how do developers test their apps that use those APIs? I don't know a lot about how Mac apps work, but I've heard somewhere that you have to sign all apps to build and install on any device.
nuker 6y ago
IPSec IKEv2. Look Ma, no apps! Native MacOS client.
- tptacek 6y ago
  I would rather use a VPN client written in Perl than rely on macOS IPSEC support for anything, let alone have to configure the serverside for it.
  - nuker 6y ago
    Any specific bugs?
  - fmajid 6y ago
    IPsec on Apple devices works very well once it's running, even if debugging tools are abysmal for getting to that point. If it helps, I have a shell-script to auto-setup an IPsec/IKEv2/MOBIKE and WireGuard VPN on top of an OpenBSD machine, including in the cloud: https://github.com/fazalmajid/edgewalker/ https://github.com/fazalmajid/edgewalker/
    - tptacek 6y ago
      Part of the point of running WireGuard is never having to expose IPSEC code to your adversaries, so I don't really see the appeal of something that sets up both WireGuard and a bunch of IKE stuff.
    - nuker 6y ago
      Yea, OpenBSD iked is not Strongswan, its a new code. Much smaller and secure, not all features supported yet though, like redirect.
lrossi 6y ago
What’s the point of ranting on your blog about a free and open source app that is quite new as well? At least raise a bug if you’re not willing to put in any effort to help. It’s people like this that make it so hard to stay motivated to do any kind of open source work. Choosing beggars.
upofadown 6y ago
A friend recently attempted to chat with me over XMPP on macOS. The result was a nightmare of trying different out of date and poorly supported mac clients. They seemed quite used to the process. The logical choice for desktop (Gajim) did not have an app available. The MacPort is wildly out of date. Which is too bad because Gajim supports macOS. It seems that no one can be bothered to package it. It's like everyone has abandoned MacOS but are too polite to admit it...
- MattJ100 6y ago
  For the record, Beagle IM and Monal are both in the macOS app store, open-source and actively maintained XMPP clients. I generally agree with your observation though. I'm not really a macOS developer, but from the sidelines it appears it has become increasingly difficult to develop and ship open software for both Apple operating systems. See for example this discussion from a few months ago ("Can't you just right-click?"): https://news.ycombinator.com/item?id=24217116 https://news.ycombinator.com/item?id=24217116
- neilalexander 6y ago
  It’s not clear from your comment if everyone has abandoned macOS or if everyone has abandoned XMPP.
  - upofadown 6y ago
    Gajim specifically has support for macOS and is well maintained. It is available on pretty much every desktop OS. No one has even bothered to package it for macOS even though it would be quite easy to do so. So it would have to be the case that macOS users in particular have abandoned XMPP.
throwaway894345 6y ago
I’ve had really good luck with Tailscale (Wireguard-based mesh VPN) on Apple devices (and Linux).
freebuju 6y ago
Hic Hic Mac late to the party yet again! Steve Jobs really did create a cult Burp
SergeAx 6y ago
WireGuard works perfectly on my Windows box for like half a year now. Standalone installation, no WinStore, or how is this thing by Microsoft called. It asked for auto-update 2 or 3 times since install and did it with no effort. I became interested in how exactly it works and found an original code repo. It turned out that a delay between repo tag push and auto-update notification was about 15 minutes. This includes CI/CD pipeline time! I've instantly converted into Wireguard beleiver.
Titanous 6y ago
Jason (the creator of Wireguard) wrote a great response to this: https://lists.zx2c4.com/pipermail/wireguard/2020-December/006226.html https://lists.zx2c4.com/pipermail/wireguard/2020-December/00...
- nominated1 6y ago
  Being quoted by Jason Donenfeld as “correctly identified the technical nature of the problem” was quite a nice Christmas gift. Thank you Jason for your hard work and wonderful wares!!

115 points by parsecs 6y ago

Making a bug report would be better :) But yeah Apple doesn't make it any easier with vpns on big Sur, they have to use a new type e of extension now and they exclude their own services automatically. Not something that seems related to these issues but it make macOS one again less interesting for me as daily driver

boardwaalk 6y ago
> and they exclude their own services automatically. Unless you have information otherwise, I don't think that the whitelist applied to the filtering features used by Little Snitch et al also applies to VPNs.
- st3fan 6y ago
  Correct. There is no exception for apples own apps to skip the active VPN connection. How could there be? Things would break and it would be a privacy nightmare.

tssva 6y ago

While it may be good from an encryption and basic security configuration perspective I find wireguard lacking from a networking and administration perspective. Networking wise it implements a point to multipoint model which is just awful to deal with. I had hoped that moving on from frame relay and ATM had killed this model but wireguard brings it right back. Then you also have to deal with complications of wireguard interfaces always being up. The two combined means doing anything but the most basic setups means more complicationd with more chance for incorrect configuration than an ipsec or openvpn alternative. Then there is the whole troubleshooting problem. When it doesn't work wireguard provides much less information to troubleshoot the issue than ipsec and openvpn. Also there is the irritating lines of code comparison vs ipsec and openvpn when for the most part it is comparing apples to oranges since wireguard doesn't include many of the features of either which are required for an enterprise site to site or road warrior VPN solution. Once the solutions are in place to provide comparable functionality the attack surface is likely to be pretty comparable.

tptacek 6y ago
I've done a lot of professional work over the past few months† with WireGuard and can't think of a piece of information I've ever needed to troubleshoot it that it doesn't provide. You know about `dynamic_debug`, right? There's also just not that much to debug! You've got keys, allowed IP lists, and endpoint addresses. There aren't a lot of other knobs to turn! I think a thing that gets people into trouble with WireGuard is not understanding how modest its design is. The goal of WireGuard is to drop into the networking stack as just another interface. It doesn't intend to implement an entire new networking model on top of itself. My experience has generally been, if it's straightforward to express in the Linux networking model, it's straightforward with WireGuard. I think this is a very good thing. I really don't want to have to think about what the OpenVPN developers believe about networking in general. I want to bring up secure transports and route packets over them the way I'd route over any other tunnel I want orthogonal, predictable interfaces that I (or Tailscale, or whatever) can build more complicated things on top of. † https://fly.io/blog/ipv6-wireguard-peering/ https://fly.io/blog/ipv6-wireguard-peering/
3np 6y ago
Could you elaborate on how these issues and limitations you mention can manifest in practice? I’ve set up a couple of different topologies and haven’t felt limited yet. Though troubleshooting packet loss is not fun and I haven’t been able to figure out how to avoid that and fragmentation, but I believe that’s more due to me than WG itself.
- tptacek 6y ago
  What's the fragmentation issue you're having?
  - scaladev 6y ago
    Not OP, but I've seen one small issue with using WireGuard on GCP VMs — you must limit MTU to 1380 or it starts silently dropping some packets and leaves you wondering why some HTTPS sites refuse to load (I thought I set up a VPN to avoid censorship? why the hell am I still having the same issues?) Probably an obvious thing for a networking expert, but it took me a few minutes to figure out what's going on.

pthreads 6y ago

I have had the opposite experience to OP. I have the macOS app installed on several Macs (laptops and desktops). They have all worked so well to the point that I even forget Wireguard is running. On top of that I upgrade macOS almost as soon as Apple releases a new version. It is true that for updating WG you need to first disable the on-demand setting (probably only on Big Sur). But to me that is such a trivial hiccup considering it is free and generally bug free! On the rare occasions that I have had a non-trivial issue looking at the log file has provided clues. My VPN cost is only about $5/month as I run my own instance of WG server in the cloud. Worth every penny! It is possible it could be lower if I use one of those #3.50/month AWS lightsail instances but I never tried. Go WG!

syntaxing 6y ago
Any tips on how to run your own server safely? I get all paranoid because I’m terrible with security.
- mfcl 6y ago
  By practicing. Run it anyway and get good at it.
  - justusthane 6y ago
    “By practicing” is not a good way to get good at security, unless you want to make potentially devastating mistakes along the way.
    - 3np 6y ago
      It depends on what you put at stake, obviously.
    - mfcl 6y ago
      How else can you get good at security? I guess you could read, but at some point you'll have to practice. And I never said you need to practice with sensitive information.

zacharyozer 6y ago

Had exactly the same experience. Definitely annoying, but more that anything else, I’m impressed that Rachel was able to turn it into cogent blog post.

Jamie9912 6y ago

Skip the Windows app too, I wish it was exactly like this client https://tunsafe.com/ https://tunsafe.com/ (made by the Spotify dev Strigeus)

tptacek 6y ago
Does Donenfeld vouch for Tunsafe? I'd be reluctant to use a WireGuard client he didn't endorse, if only because I've been on the sidelines in conversations about VPN client software vulnerabilities and I know he's careful about this stuff (Donenfeld's background is in vuln research). There is more to get right than just the protocol.
- Jamie9912 6y ago
  I don't think he does, Tunsafe implements Wireguard, but it hasn't been updated for maybe 2 years now. Still, the UI is so much nicer than the Wireguard one
drummer 6y ago
I used this, was easy to setup. Recommend checking it out as well.
StavrosK 6y ago
Why not just use that? Looks like it uses WireGuard under the hood.
- Jamie9912 6y ago
  It sadly doesn't get updates anymore, but still works for now at least
pvg 6y ago
If the UI is more important to you than the security of your VPN, by all means but I think for most uses this is questionable advice. TunSafe development has been dormant for years, the official WireGuard client fixed one of its bigger Windows UI quirks just recently.

Shank 6y ago

I’m still sad about the state of WireGuard for average consumers. The protocol and the underlying tools are a simple and nice in a UNIX-like way, but for average people, it’s a wash. WireGuard would benefit greatly from a set of robust, easy to understand clients. The current state of the world, where many VPN providers ship questionable apps of varying quality, is just sad for a solution that claims to prioritize security and privacy. The WireGuard app is somewhat useable, but it is by no means “easy to setup” unless you’re already familiar with how WireGuard works.

pxeboot 6y ago
I found the Android client very easy to use. You can import a config file or scan a QR code to setup a profile. If you know what you are doing, you can setup it up manually. Compared to the Cisco client we use for work, wireguard seemed better in every way.

SomaticPirate 6y ago

Isn’t this what Tailscale claims to fix? Zero config VPN on top of Wireguard? Would love for one of the creators to weigh in.

BostonEnginerd 6y ago
I totally understand why the Tailscale folks do it this way, but I don't really want to link my Google or MS accounts to my private VPN. The product looks fantastic though!!
- tptacek 6y ago
  It is a disgustingly well designed product. Go kick the tires and you'll see what I mean. It's just alarming.

UI_at_80x24 6y ago

To make the WireGuard windows app better (for non-admin users) you need to make your user(s) a member of the "Network Configuration Operators" group. This allows you enable/disable (or choose if you have multiple) the VPN without needing to be a member of the Administrators group. You also need to add a line to the registry. Here's the powershell code to do that: New-ItemProperty "hklm:\software\wireguard" -Name "LimitedOperatorUI" -Value 1 -PropertyType "DWord" -Force Add-LocalGroupMember -Group "Network Configuration Operators" -Member "$username"

grandinj 6y ago
That sounds like a good idea that should be added to the WireGuard installer? Perhaps log a feature request?
est 6y ago
it used to just 2 clicks on a control panel. control userpasswords2 A simple user account managing interface hidden in a myriad of crap dashboards.

nominated1 6y ago

> Wireguard won't upgrade itself if it's still running… This is not unique to Wireguard. I’ve had this happen with the Lockdown app too. This is an Apple problem. Apple should notify you that the VPN app needs to close in order to upgrade then offer you a simple way of doing that. > I don't know exactly, and I don't really care. This about sums it up. This is a rant and it’s difficult not to just close tab half way through.

pram 6y ago
Strange omission, considering automatically updating Safari extensions asks you to exit Safari when it happens.
- plussed_reader 6y ago
  Purposeful 1st party omission. Or maybe an oversight by Wireguard, but with the way Apple limits API access in iOS for 3rd party I'm non-plussed.
lrossi 6y ago
A rant can be useful. The article is just misleading clickbait. Not sure how it got upvoted here.
sevagh 6y ago
>This about sums it up. This is a rant and it’s difficult not to just close tab half way through. Every single rachelbythebay article: Here's a vague condition. I encountered it at vague companies that I may have worked at. Anyway, whatever, it vaguely caused problems. Here's my vague workaround or suggestion. Whatever. Bye.

arthurcolle 6y ago

ZeroTier is so much better than WireGuard. I literally spend 2 weeks futzing about with a WireGuard config and was able to set up a VPN between my homelab and my new apartment in less than 15 minutes with ZT. Day and night difference in quality and ease of use. AMA?

laingc 6y ago
I’ve never really figured out whether ZeroTier can be trusted. WireGuard has an excellent reputation among people I respect. What is it about ZT that made you trust it with your traffic?
chipsa 6y ago
I've got Tailscale setup. It uses Wireguard under the hood, so I don't have to worry about the security of the protocol, just whether I trust the company providing the management. Took just as much time to setup as you did with ZeroTier.

sneak 6y ago

Wireguard can only be installed via the Mac App Store, which, upon opening, transmits your permanent/unchangeable hardware serial number and Apple ID (required to download even free apps), which is linked to your phone number, to Apple, thus deanonymizing your VPN's public IP. I don't use the Mac App Store. I run my VPN on a second device, because I no longer find the macOS to sufficiently preserve my privacy. It's insane to me that Apple thinks it's okay to demand hardware serial number, name, street address, email, and phone number to download free privacy apps. An organization that had privacy as a value simply would not do that. Apple has banned apps that want to use the NetworkExtension API from being self-signed, OR by being Apple-approved-developer signed and distributed outside of the App Store. You can download the windows Wireguard client from the Wireguard website, but not the mac one. They even recently censored the donations link in the Wireguard mac client, because App Store.

perryizgr8 6y ago
> Wireguard can only be installed via the Mac App Store I think you can also use brew.
- sneak 6y ago
  That uses a different API that is widely assumed will be removed soon in a future macOS, and as such nobody wants to rely on it or build around it. It also requires root. It is not used by the Wireguard GUI app in the Mac App Store (MAS). The wireguard-app-from-wireguard is only distributed via MAS, and you cannot build that GUI version that they distribute via MAS yourself, because that version uses the NetworkExtension API and that only works with the appropriate signed entitlement from Apple, which as of very recently didn't get issued outside of MAS apps.
opensmtpd 6y ago
If self and Apple-approved developer signing is not allowed, how do developers test their apps that use those APIs? I don't know a lot about how Mac apps work, but I've heard somewhere that you have to sign all apps to build and install on any device.

nuker 6y ago

IPSec IKEv2. Look Ma, no apps! Native MacOS client.

tptacek 6y ago
I would rather use a VPN client written in Perl than rely on macOS IPSEC support for anything, let alone have to configure the serverside for it.
- nuker 6y ago
  Any specific bugs?
- fmajid 6y ago
  IPsec on Apple devices works very well once it's running, even if debugging tools are abysmal for getting to that point. If it helps, I have a shell-script to auto-setup an IPsec/IKEv2/MOBIKE and WireGuard VPN on top of an OpenBSD machine, including in the cloud: https://github.com/fazalmajid/edgewalker/ https://github.com/fazalmajid/edgewalker/
  - tptacek 6y ago
    Part of the point of running WireGuard is never having to expose IPSEC code to your adversaries, so I don't really see the appeal of something that sets up both WireGuard and a bunch of IKE stuff.
  - nuker 6y ago
    Yea, OpenBSD iked is not Strongswan, its a new code. Much smaller and secure, not all features supported yet though, like redirect.

lrossi 6y ago

What’s the point of ranting on your blog about a free and open source app that is quite new as well? At least raise a bug if you’re not willing to put in any effort to help. It’s people like this that make it so hard to stay motivated to do any kind of open source work. Choosing beggars.

upofadown 6y ago

A friend recently attempted to chat with me over XMPP on macOS. The result was a nightmare of trying different out of date and poorly supported mac clients. They seemed quite used to the process. The logical choice for desktop (Gajim) did not have an app available. The MacPort is wildly out of date. Which is too bad because Gajim supports macOS. It seems that no one can be bothered to package it. It's like everyone has abandoned MacOS but are too polite to admit it...

MattJ100 6y ago
For the record, Beagle IM and Monal are both in the macOS app store, open-source and actively maintained XMPP clients. I generally agree with your observation though. I'm not really a macOS developer, but from the sidelines it appears it has become increasingly difficult to develop and ship open software for both Apple operating systems. See for example this discussion from a few months ago ("Can't you just right-click?"): https://news.ycombinator.com/item?id=24217116 https://news.ycombinator.com/item?id=24217116
neilalexander 6y ago
It’s not clear from your comment if everyone has abandoned macOS or if everyone has abandoned XMPP.
- upofadown 6y ago
  Gajim specifically has support for macOS and is well maintained. It is available on pretty much every desktop OS. No one has even bothered to package it for macOS even though it would be quite easy to do so. So it would have to be the case that macOS users in particular have abandoned XMPP.

throwaway894345 6y ago

I’ve had really good luck with Tailscale (Wireguard-based mesh VPN) on Apple devices (and Linux).

freebuju 6y ago

Hic Hic Mac late to the party yet again! Steve Jobs really did create a cult Burp

SergeAx 6y ago

WireGuard works perfectly on my Windows box for like half a year now. Standalone installation, no WinStore, or how is this thing by Microsoft called. It asked for auto-update 2 or 3 times since install and did it with no effort. I became interested in how exactly it works and found an original code repo. It turned out that a delay between repo tag push and auto-update notification was about 15 minutes. This includes CI/CD pipeline time! I've instantly converted into Wireguard beleiver.

Titanous 6y ago

Jason (the creator of Wireguard) wrote a great response to this: https://lists.zx2c4.com/pipermail/wireguard/2020-December/006226.html https://lists.zx2c4.com/pipermail/wireguard/2020-December/00...

nominated1 6y ago
Being quoted by Jason Donenfeld as “correctly identified the technical nature of the problem” was quite a nice Christmas gift. Thank you Jason for your hard work and wonderful wares!!