27 ms·

Response to “WireGuard: great protocol, but skip the Mac app”

926 points by motiejus 6y ago

l1k 6y ago
That is a fantastic showcase how to respond to negative criticism in a friendly, constructive and polite manner. Good work, Jason.
- sleepyhead 6y ago
  Yup. I rarely use WireGuard but it’s a great app and the response here made me go and donate on their website.
est 6y ago
Is tunsafe.com/osx any better?
- eis 6y ago
  It's a dead project. Last commit was over 2 years ago and the creator seems to have abandoned it (no replies).
Signez 6y ago
May I suggest to @dang to update the title with something just a little bit more informative without much editorialization, like: WireGuard Developer Response to "Great protocol, skip the Mac app" blogpost
- sbierwagen 6y ago
  Mods don't/can't read every comment posted 24/7, and don't actually get pinged if you put an @ before their name. Best way to actually contact the moderation staff is to send an email to hn@ycombinator.com Note that it is currently 1:33 AM on the west coast, so they may not see it for a number of hours.
- Macha 6y ago
  It appears they've gone the opposite direction and removed any reference to the the fact that the author is the wireguard developer.
schoolornot 6y ago
As a Mac admin VPP/App Store distribution is still quite finicky. I don’t understand why Apple has to flex and restrict NetworkExtension/VPN apps to Mac App Store. More iOS-ification of the OS.
- stock_toaster 6y ago
  I understand it to be an attempt[1] to prevent malware/adware from silently hijacking all traffic in the background. [1]: reader decide whether it is a good solution or not
- w0utert 6y ago
  Reading through the explanation IMO the problem is not that Apple wants to force VPN apps to use frameworks and a distribution model they feel best fits their security/safety model. There are good arguments to be made for that. The problem is that the framework itself is just shitty and Apple should improve it. This is one of the things I dislike most about Apple: even despite the high price I pay for their products and (subsequently) the astronomical profits they make, somehow they seem to be completely unable to simply address these kinds of problems as soon as they pop up and make everyone happy again. It's also in Apple's own interest to make sure VPN extensions can automatically update in case of potential security problems, no? So why they don't just throw enough resources at it to make it work really is beyond me. There's a lot to like about Apple products but their culture towards addressing problems that affect their paying customers is becoming increasingly off-putting, especially since they have basically been printing money for over ~10 years now and have no excuses to not improve these kinds of things.
  - DaiPlusPlus 6y ago
    > especially since they have basically been printing money for over ~10 years now and have no excuses to not improve these kinds of things. Apple can't hire enough devs. I told an SWE friend of mine at Apple that I wouldn't mind working there - then he explained to me how restrictive it is to work at Apple (e.g. you have to close your GitHub account, you can't do any moonlighting or FOSS contributions: even on your own time, on your own hardware, while on vacation) - I can't work at a place that wants to exert that much control over my personal life. I get that secrecy is part of being an Apple, but it feels the same as how I thought it'd be cool to work for the FBI's infosec team before I learned that they have mandatory regular drug-testing even for employees in states where cannabis is legal.
alias_neo 6y ago
This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. In my day job, our Apple developers have spent years finding solutions to iOS restrictions around CallKit, Push Notifications and NSTodaysProblem, and those are just the things Apple has intentionally restricted, once you get into the bugs and poor documentation for some APIs it's another story. If our users knew the half of what our Apple Developers have to do, the meetings, discussions, concessions and re-design that has to be done to make things just work, even on par with the Android equivalent, they might be a little bit more understanding. WireGuard has been excellent, and as a Linux user, I haven't needed an app, I have a couple of aliases in my shell to start and stop my tunnels. I've used WireGuard daily for work since lockdown and I used it daily for personal use, while commuting to work before lockdown. In all of that time, I've never had a single issue due to WireGuard (and there isn't even a Linux app to be seen). The expectation is often different between Linux and Apple users though. When I was setting up for the first time, Jason even found time to help me himself on the IRC channel, something I've never expected, and for which I am eternally grateful. I made a donation to WireGuard last year, I'll be doing the same this year and I encourage others to "put their money where their mouth is" and show a little support for the people making and sharing this software for free. I expect an Apple user can afford a small cut of their or their employer's money to do so.
- bawolff 6y ago
  I'm not sympathetic. If you don't think you can do a good job at something due to factors outside your control, you can choose to not do it (refuse to support mac) or do a subpar job. If you choose the latter don't be surprised if users give you negative reviews. There's no participation trophies in business.
- OJFord 6y ago
  > This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. Eh? Isn't that a description of the original complaint, and the 'a response' submitted here is from WireGuard creator/lead Jason/zx2c4 explaining much as you do the restrictions, bugs, and limitations he's tried to work around?
lawrenceduk 6y ago
Our team really likes the mac app!
apple-sauce 6y ago
Honestly, I don't get it. Apple makes big money from their ecosystem. Wireguard developer provides high-quality solution for free, helping to grow proprietary ecosystem, essentially helping Apple to make more money indirectly and directly (by giving 30% from donations). In return developer gets tons of hate from users and from Apple itself in the form of delayed reviews, rejects and constant threat of violating some rule and getting dev account banned. In my opinion, the only solution for this is to stop providing services for free and put a price tag on the app. I understand, that developer is a kind, not-yet-burnt-out person who wants to be the world a better place by providing the free way to exchange information securely, but doing so for free for corporate ecosystem is clearly not sustainable, neither financially nor emotionally.
- tasn 6y ago
  Users demand it. You can't have a popular VPN app without Apple support (because at least one person in the org will have an iDevice), so you have to do it. I made another comment in this thread about my experience building EteSync. That's one of the more annoying parts about Apple being the gatekeeper to 40% of the US population (and in effect, to 100% of businesses). As a developer, you are just stuck with no way out.
  - fxtentacle 6y ago
    Oh you absolutely can. You'll lose 40% of your users, but for a free project, that shouldn't matter much.
    - tasn 6y ago
      Many apps (e.g. EteSync and WireGuard) are almost useless if they don't work for everyone within a certain group. A more extreme example is a messaging app. Will not having iOS support for a messaging app lose you 40% of your users? No, it will lose you 100%. In WireGuard's case it's maybe less obvious than messaging, but if WireGuard doesn't work on macOS, it's enough to have one Apple user in your whole organisation in order to make it a non-viable solution.
iso1631 6y ago
This is a response to the Rachel by the bay blog post https://rachelbythebay.com/w/2020/12/24/wg/ https://rachelbythebay.com/w/2020/12/24/wg/ Personally I rarely use a mac, and don't do wg on demand, but one thing that did annoy me was being unable to set dns search domain, which wasn't mentioned in the blog post, but I believe is also caused by OSX deficiencies.
- rswail 6y ago
  DNS search in MacOS is managed by their DNS infrastructure which is documented under resolver(5). That lets you route the resolution of particular domains to specified nameservers. The files live in /etc/resolver but can also be manipulated with scutil. So it's not an OSX deficiency, it's an OSX difference, similar to launchd vs systemd.
  - iso1631 6y ago
    when I type "ping foo" or visit "http://foo http://foo", I want my search domain to add ".my.domain.com" to the end as configured in DNS. I can do this on the OSX networking tab where I set DNS server, but from what I read that feature isn't available for the wireguard client.
perryizgr8 6y ago
I don't get it. You cannot write a VPN app for MacOs and let people just download the executable from your website? Pretty sure I've never opened the app store on my laptop and still have a VPN installed.
- pilif 6y ago
  that's using older and deprecated frameworks including possibly kernel extensions, all of which are going to go away in the future. Wireguard is using the newer and non-deprecated NetworkExtension framework which requires an entitlement that's only given to app-store apps.
  - DaiPlusPlus 6y ago
    Apple can't possibly get rid of kernel extensions - that's the only way to really extend a system in new and innovative ways (user-mode drivers are more like glorified serial-port applications). So much of Apple's platform today is made up of features that were only possible by extending the OS (e.g. Multi-Finder). Apple's going to have trouble if they keep on hindering the people that made their platform and support their ecosystem. Apple is not living up to their "Think Different" ethos: http://www.thecrazyones.it/spot-en.html http://www.thecrazyones.it/spot-en.html Apple in 1997: Here's to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. They're not fond of rules. And they have no respect for the status quo. Apple 2021: > Follow our poorly-explained, underdocumented, and arbitrarily applied rules or we'll ban you from the App Store.
    - pilif 6y ago
      > Apple can't possibly get rid of kernel extensions they are though. It's getting harder and harder to get them loaded (on an M1 Mac, getting an extension loaded will require 4 reboots and a journey through the recovery environment). I'd say that within the next 2-3 macOS releases, kernel extension won't be loaded at all any more and only user-space APIs will be available for third-parties (including drivers). From a security perspective, this is a huge benefit to users of course, but I agree that at least for advanced users, the ability to patch the kernel at random would still be beneficial for some use-cases.
matlo 6y ago
Can you not release it as a .dmg, without going through the Apple Store? Love WireGuard btw
- hiq 6y ago
  > That sort of suggests another question, though: why are we in the App Store at all? Because as far as I know, Apple only allows NetworkExtension-based apps to be distributed via the App Store, according to their developer relations guy [6], so we're locked in. And even if they were to change that someday somehow, and we went to standalone distribution, we would then have to support two parallel distribution channels so as not to abandon former Mac App Store users, presumably, which means we'd still be limited by App Store restrictions.
  - webmobdev 6y ago
    They should abandon the app store.
    - danShumway 6y ago
      > Because as far as I know, Apple only allows NetworkExtension-based apps to be distributed via the App Store, according to their developer relations guy [6], so we're locked in. They can't.
JD557 6y ago
In case the author is reading this, I recently started using Wireguard in Mac OS with the Mac app and the experience has been great. Not only is it much faster other VPNs that I used in the past, but compared to other clients (Forticlient and Tunnelblick), the overall experience feels much nicer, IMO. Thank you so much for your work!
- domoritz 6y ago
  Absolutely agree. The app just worked. The connection is fast and stable.
- nuker 6y ago
  > Not only is it much faster other VPNs IPSec is as fast as Wireguard. And there is native client in MacOS. As for bloated codebase, there is an OpenBSD iked rewrite.
  - cmeacham98 6y ago
    iirc, ipsec is considered somewhat of a security nightmare by modern standards, given that it difficult to fully understand and very easy to misconfigure in an insecure way. I would only recommend using ipsec over wireguard when legacy compat matters.
    - igetspam 6y ago
      It is. Even the companies I integrate with that require it know it's full of pitfalls. When you've been doing ipsec for two decades and it's a checkbox in your compliance sheet though, you check the box and hopefully you're good at it by now.
    - beermonster 6y ago
      IKEv2 can be configured securely, but by someone that that is familiar with that particular minefield. Both on Windows and MacOS the GUIs configure weaker security by default (the cynic may wonder why!). On MacOS you can use Apple Configurator /Apple Profile Manager and on Windows Powershell, to configure stronger security. The nice thing with WireGuard is it’s either secure or it’s off. As you say, it’s easy to misconfigure IPSec and the number of experts gets smaller day by day.
smcl 6y ago
Incredible that people are so wired and ready to be outraged that they'd send off angry emails on christmas eve after reading someone else's problems with a piece of software.
- segfaultbuserr 6y ago
  +1, really can't understand that. If I want to rant about something, perhaps I'll post it on blogs or forums, I couldn't imagine that harassing the author with angry mails is also an option...
  - bombcar 6y ago
    I think a good part of it is that you can be annoyed by a piece of software and not be able to articulate it beyond “it sucks” - and then you find someone who wrote a detailed article that explains all your pain perfectly. And even though it was Christmas Eve you send it off partially in disgust and partially in a “maybe this explanation makes it clear”.
robertlagrant 6y ago
I don't think I'd have had the same patience with a response on Christmas morning to a project I'd sunk endless time into. Well done OP. Can't wait to see more Wireguard.
metafunctor 6y ago
I for one think the Mac app is awesome. I much, much, much, SO much prefer telling people to install from the App Store as opposed to, well, anything else. Especially I would never, ever tell anyone to use Macports. It's just not the way forward. Do not skip the Mac app. It's pretty good.
segfaultbuserr 6y ago
> We faced rejections in submitting the app, because they decided to change their policy on the app having a link in the "About WireGuard" tool window to www.wireguard.com/donations/ (which they previously had allowed explicitly; now they want 30% or something) Last year Google started to ban donation links in FOSS apps, WireGuard was one of the first victims [0], completely removed from the store. I didn't know that Apple also started doing the same and hit WireGuard again. Extending the definition of an "in-app payment" to a link to the project homepage in the "About" window that doesn't buy any good or service related to the app is an overzealous restriction. Especially so when that button is clicked by, perhaps, only 10% of the users. This is just evil. [0] Open-source apps removed from Google Play Store due to donation links https://news.ycombinator.com/item?id=21268389 https://news.ycombinator.com/item?id=21268389
- furyg3 6y ago
  I couldn't agree more. You're not paying for the app, or the service, those are free and you are simply making a donation. I can imagine that Apple may want to define 'FOSS' to some extent (donations need to go to a non-profit with a board, software needs to be licensed under one of the following licenses, etc), but there should be some room for supporting FOSS that is included in an App Store.
  - segfaultbuserr 6y ago
    Yeah, I can imagine that payment links can potentially be used as a loophole for selling unauthorized in-app payment items outside the store. But this is not the case here, nothing is sold, it's literally only a link to the project home page, https://wireguard.com/donations/ https://wireguard.com/donations/.
    - zaarn 6y ago
      Simple solution, there are human reviewers for this kinda reason and if the rule is "Open Source Apps get a donation button" then not any random can loophole around. Heck, if both Apple and Google offered a solution by which you provide the source code to build, any necessary secret variables for the build and then it gives you those extra privileges, it would be nice. But that costs money the open source apps don't have.
unclekev 6y ago
I didn't know about WireGuard before the initial post on HN, since then it's replaced my OpenVPN solution to access things on my home network stuck behind a 5G mobile CGNAT (no wired service available) I haven't had any issues with the Mac app, but for where the app may be lacking because of the circus that is developing with Apples frameworks and app store it makes up in being absolutely amazing behind the scenes. All the other solutions I've tried have taken weeks of learning and tweaking configs. Had the entire WireGuard solution going end to end in a few hours. It's super simple, lightweight, reliable and easy to understand. It's a shame Apples app store policies and being forced to work with buggy frameworks is holding back developers abilities to write first class native software for MacOS.
tasn 6y ago
The iOS and macOS apps have been the biggest point of stress and frustration when building EteSync[1]. The API is buggy as hell and very limited (if at all available) and the review process is arbitrary and can cause updates to be rejected. You can never know if your workarounds will be accepted or rejected. Sometimes they can even get rejected in future app updates. The EteSync experience is subpar on Apple devices, and there's almost nothing we can do about it. We already spent countless of hours trying to fix things, but Apple just make it impossible. We have more ideas on how to fix things, and we will keep on trying, but it's beyond me why would anyone willingly use an Apple product. Edit (adding one more point): that's one of the more annoying parts about Apple being the gatekeeper to 40% of the US population and in effect, to 100% of businesses (because one bad Apple in the org is enough to spoil the whole bunch). As a developer, you are just stuck with no way out. [1] https://www.etesync.com https://www.etesync.com
- deleted 6y ago
  [deleted]
- plg- 6y ago
  > it's beyond me why would anyone willingly use an Apple product Final users don't see this mess.
  - tasn 6y ago
    That's a fair point, I was picturing developers (who are Apple users) in my head when I wrote this.
  - ubercow13 6y ago
    But it seems they do, eg. rachelbythebay stopped using Wireguard because of the mess.
    - pilif 6y ago
      she stopped using Wireguard (and ranted about it) rather than stopped using Apple's products (which are ultimately responsible for the failures she complained about in Wireguard)
wscott 6y ago
First off, what a level-headed friendly response from a developer who is clearly frustrated by Apple's bugs and policies. As someone who has had to support commercial software this is not easy to do consistently. Second, this has significantly tempered my lusting over the new M1 macs. I think I can be content with my ThinkPad's running Linux.
- rwmj 6y ago
  This worries me for a similar reason - I get requests to port some software I wrote over to the Mac from time to time, and the new M1 Mac Mini is cheap enough that I might have bought one to do this development. But I'm not keen to spend any money or time on an ecosystem which might be closed down in the future.
  - marcus_holmes 6y ago
    Aeah, how much more proprietary and strange are the Apple API's going to get? They'll have control over the entire vertical, and can put all kinds of undocumented crap right in the silicon.
    - wscott 6y ago
      even to the syscall level, like the MAP_JIT flag to mmap() https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-jit https://developer.apple.com/documentation/bundleresources/en... not optional and requires special app entitlements to enable. So you are not going to write portable code that has a JIT without apple-special code.
      - TwoBit 6y ago
        A JIT is a major potential source of malware enablement and thus a security consideration.
        andrekandre 6y ago
isodev 6y ago
There are bugs of course, but let's not loose scope of the fact that "Apple has restricted" usually means Apple is preventing bad actors from doing the wrong thing. As a developer, I usually find it rewarding to work with the Sandbox and not against it. Making this part of the product conception very early on results in much smoother experience at the end. Of course, if submitting to the store is an afterthought there are surely some challenges to tackle.
- viktorcode 6y ago
  I agree. For me the biggest win is much less maintenance in the long run. Sandbox hacks will eventually stop working and will have to be replaced. If someone can't make the app they want without going around sandbox, then they should avoid App Store distribution instead of betting the product on "clever" workarounds.
- toyg 6y ago
  > "Apple has restricted" usually means Apple is preventing bad actors Thanks for the laugh! "Apple has restricted" usually means Apple wants to retain complete control in order to extract maximum profit. That's all it is.
  - Ensorceled 6y ago
    While the parent comment is a bit pollyannish, this comment is overly pessimistic.
Quiark 6y ago
Wow, shame on Apple...
lrossi 6y ago
> I woke up this morning with my inbox lit up by netizens outraged at me for having allowed the WireGuard Project to produce such terribly subpar and dysfunctional software for the Mac. That was a weird way to wake up on Christmas, considering how much I really do care about delivering polished software. The response is much nicer than deserved. I would not have blamed him for a less friendly reaction.
- bombcar 6y ago
  In that situation I’d take the emails in a “welcome to my hell” frame of mind instead of a “why are they pissed at me”. It’s also true of much enterprise software - it’s often as good as the developers could make it given the constraints they were working with.
- young_unixer 6y ago
  I'm laughing right now trying to imagine how Linus would have replied to this.
cm2187 6y ago
How fast is wireguard on windows? OpenVPN is fast on linux but disastrous on windows, you really have to tweak the settings to go beyond 5 MB/s and usually not much more.
viktorcode 6y ago
Cloudflare WARP beta works somehow. And it isn't distributed through the App Store on Mac. So, it is definitely possible for WireGuard.
- shp0ngle 6y ago
  Cloudflare WARP is really buggy on iOS (for me at least)
coldcode 6y ago
As an iOS developer I can relate, Apple makes amazing hardware, but their software development is often meh. I don't think it's malicious, its just they have so many thousands of teams, often working independently of each other, and your experience with them is like dealing with sightless people describing an elephant. Some teams do amazing things, some mediocre, some downright awful, like any company, but exaggerated because of their central importance in so many other peoples/companies lives. Some of this could be fixed but even there Apple is a huge operation and executives are of all kinds. I work for a F50 company (non tech) with an infinite set of teams and execs and its another mix of amazing/stupid. No one company can uniformly manage so much code and hardware to boot and do it perfectly. There are things Apple could do to make it less irritating—the hard problem is picking which subset of horrifically irritating things to fix.
- Joe_Cool 6y ago
  > makes amazing hardware Louis Rossmann would disagree
Macha 6y ago
dang: What was the purpose of removing "Developer's" from the title? Previously it was 'Developer's response to “WireGuard: great protocol, but skip the Mac app”'. Neither of these are the actual title, so that can't be the rule it was operating under, and the fact that it's a developer (as opposed to some other user or Apple/Wireguard fanboy/hater) does change the context, at least for me.
tmpxgdqrcKFuG 6y ago
Couldn’t you just change the url to /about instead of /donations? Seems sort of the thing sketchy sites do to say one thing and link to another. If I want to donate to a project I want to browse the site and learn more about rather than straight to the donation page. Seems like a money grab to take me to the donation page.
- bombcar 6y ago
  To defend Apple here - if they allowed “donations” with only a 5% fee you’d have thousands of developers offing “free premium” to “donators”. What Apple needs is a curated system to support open source development for apps - for example, after proving that you really are a non-profit (think Mozilla foundation) Apple could still charge the 30% but then rebate 20% back as a donation from Apple itself. Win/win.
  - vaduz 6y ago
    Apple already has such a process - you may not agree with the criteria, but they do outline it quite clearly: 3.2 Other Business Model Issues [..] (vi) Approved nonprofits may fundraise directly within their own apps or third-party apps, provided those fundraising campaigns adhere to all App Review Guidelines and offer Apple Pay support. These apps must disclose how the funds will be used, abide by all required local and federal laws, and ensure appropriate tax receipts are available to donors. Additional information shall be provided to App Review upon request. Nonprofit platforms that connect donors to other nonprofits must ensure that every nonprofit listed in the app has also gone through the nonprofit approval process. Learn more about becoming an approved nonprofit. [https://developer.apple.com/apple-pay/nonprofits/ https://developer.apple.com/apple-pay/nonprofits/] Mozilla Foundation would be fine, but WireGuard is in hot mess as the "Donation" is not actually going to a non-profit organisation - it has in fact taken steps to avoid identifying _who_ the money is going to.
    - bombcar 6y ago
      That hot mess is interesting (and obviously never brought up by the Apple is Evil crowd) - if you don't want to identify the destination of funds just don't call it a "Donate" button and let Apple take their cut. 70% of something is still more than 100% of zero.
auggierose 6y ago
In the developer documentation for Network extensions they describe how to enable them for Apps outside the App store: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... It's under "Discussion". Haven't tried out if it works though, but the link in [6] that the developer refers to is 3 years old, so maybe check again?
indymike 6y ago
It sure feels like we're swinging back to the pre-PC days where code portability and interoperability was sacrificed at the altar of vendor lock-in.
mensetmanusman 6y ago
In an alternative universe, one could imagine macOS developers being so frustrated that they only bother with updating their windows/linux versions. In which case, only apps like parallels would have to be working, then the bugs of macOS could be bypassed for many and focused for a set of well-funded developers. All apps would have a translation layer, but that seems to not be an issue with the m1.
- deleted 6y ago
  [deleted]
danShumway 6y ago
I know that people say this all the time, and usually nothing comes from it, but it really feels like Apple is playing with fire here. Over just the past year I've gone from "I don't see why I wouldn't support Mac" to "I'm not even going to try and build my software for Mac, life is too short to deal with Apple's crap." It's been kind of a weird transition. I was talking to someone recently about accessibility between multiple GUI frameworks (QT/Electron/GTK/Swift/etc...) and they brought up Mac accessibility differences. And immediately my brain jumped to, "well, who cares if those frameworks are accessible on Mac, because it's not like my software is going to be on there. Only the Linux/Windows/mobile experiences matter." It was a very strange feeling to have that be the first thing that instinctively popped into my head. And I'm only one developer, and probably no one's really going to notice or care about my decisions, and historically as long as users demand Mac software/releases, developers have had to just put up with it, so I don't have strong evidence that this is going to be different. But I wonder how long that can hold out before eventually something snaps. Realistically, there's no way that Wireguard can refuse to release for MacOS. But everyone else? If you're making a game, why would you ever target a Mac build if you're worried about running into issues like this? Is the gaming marketshare on Mac really big enough to justify this kind of annoyance and time commitment? I'm probably naive, but it just seems like at some point developers are going to decide that the only reason to support Mac is if it's their primary market. Maybe Apple doesn't care, maybe they'd like us all to move to iOS anyway.
ismyrnow 6y ago
App Store gatekeeping needs to burn. It may be helpful for the tech-illiterate who want simple and safe apps, but it's not a viable for a healthy ecosystem of broad ranging applications. It's crazy to think I can't install an app from a developer I trust from their website.
- johnofthesea 6y ago
  You can disable Gatekeeper.
igetspam 6y ago
I'm going to bookmark this reply as an example of how to take feedback and respond appropriately. Jason's explanations both take responsibility for the issues at hand and provide adequate information to understand the difficulty in resolving them. He takes responsibility for a failure in review, which is a common problem I see in engineering orgs. I'm not an Apple user but I have a lot of love for the wireguard project (our company has donated) and the commitment shown here makes me confident that my feelings are not misplaced.
- todd8 6y ago
  I was going to simply upvote this comment, but I'm chiming in to agree with you because I want to complement Jason for being the kind of developer that I really respect. He provides a tool that so valuable to so many and does so while dealing with a difficult set of requirements imposed by Apple. His response to a frustrated user isn't defensive but helpful and informative. Jason sets an example that the rest of us developers should strive for.
  - pkd 6y ago
    Precisely. Too often I see bad behaviour in open source communities justified with the lazy reply of "being nice does not produce good software" (multiple examples of this in yesterday's thread about suckless) and Jason's handling of this situation is a great refutation of that theory.
    - Skunkleton 6y ago
      Going to chime in here as well. Jason's attitude here is commendable. I am going to add this to my collection of "things to read when I am unreasonably mad at something". Here is one from Greg K-H in case anyone is interested [1]. [1] https://news.ycombinator.com/item?id=25515566 https://news.ycombinator.com/item?id=25515566
sonotmyname 6y ago
> Because as far as I know, Apple only allows NetworkExtension-based apps to be distributed via the App Store, No, not so. Plenty of VPN apps based on network extensions are delivered outside the Mac App Store. In fact, most commercial VPNs are done this way. My company uses GlobalProtect for example, and I can install it any number of ways, and it’s been NE based for over a year now...
TwoBit 6y ago
> a developer new to the codebase didn't realize that he was removing a workaround to yet-another-Apple-bug. Isn't this what code comments should be good for preventing?
- m45t3r 6y ago
  The author did address this later on, saying he was sorry for not adding a comment. Anyway, no software development process is perfect, but sure the Apple ecosystem make everything worse.
- lerxst00 6y ago
  This is literally what the OP has acknowledged was an issue: > I should have caught it, and I take responsibility for it, and probably workarounds need more comments so this doesn't happen
j1elo 6y ago
Apple doesn't deserve to have such careful and detail-oriented FOSS developers like Jason, developing for their platform. He is genuinely wasting time in order to work around Apple's developer-unfriendly platform. Not that I should be telling devs where they should spend their time... but I feel like so much effort is being devoted to fix Apple's issues. > When I'm debugging these issues, I'll often times spend a few hours in IDA Pro (Apple doesn't provide debug symbols, unlike Microsoft, which makes this process even more miserable than it already is), and after identifying the issue I'll often have several ideas for "clever" workarounds. Which of them are acceptable for the App Store? Usually none! Really, why we need to have very talented people spending their time in dealing with this, instead of contributing actual value on other parts of the project? Apple should be losing devs in favor of other better platforms, not the other way around. With less and worse products at their disposal, Apple users would then be well aware that they are choosing a platform that alienates developers.
- VonGuard 6y ago
  Completely agree. Apple has nothing but contempt for its developers, and treats them like indentured servants. "Oh it took 10 years to get your app working right? Well, it doesn't work right anymore after yesterday's patch."
  - uncledave 6y ago
    That could be said for any platform these days. It's certainly not specific to Apple!
    - foepys 6y ago
      Microsoft broke a lot in the past few years when they got rid of their dedicated QA department(s) but they are very keen of fixing backwards compatibility issues. I can still run my desktop application that I compiled in 1998. Try that on a Mac.
      - uncledave 6y ago
crawshaw 6y ago
One problematic thing about App Store reviews as a developer is on each submission, Apple does a cursory review of the whole app. This means a one-line bug fix that is an improvement in anyone’s eyes can get caught on a detail that has been present for years. It would be fine if these complaints about old details were reported to developers as “blocking any future app releases”, but blocking immediate bug fixes really hurts.
CharlesW 6y ago
Dumb question 1: Why not do what Apollo for Reddit (and many other apps) does and add in-app "tips" and/or other purchases? With minimal UI support it'd be orders-of-magnitude more effective at raising money for WireGuard than a web link, regardless of Apple's markup. Dumb question 2: Why isn't it a good idea to create a non-profit, or distribute via a partner non-profit, to reduce the App Store take to 0%? (Even without that, Apple's take would be 15% until the app hits $1 million in annual net sales there.) I see people in the thread asking for special treatment for this (important and worthy, of course) project, which Apple obviously can't do that without creating a thousand other problems.
blacklight 6y ago
FOSS developers should simply stop developing good software for Apple devices. The absolute opacity of Apple's technical policies and their arrogant i-dont-care/its-your-problem approach against developers are quite renewed in the community. This ends up costing a lot of development time to developers who mostly work for free, who struggle to reverse engineer or debug what happens on MacOS/iOS, and (like Wireguard's case shows) it harms the reputation of their software because people tend to blame the application rather than the OS when things don't work as intended. If people want to use FOSS software, then they should be able to do so on systems that support the FOSS ecosystem, that provide developers with appropriate tools to debug what's going on (ON ANY PLATFORM) and sufficient documentation for them to understand how a certain component of the OS is supposed to behave. I know that in the past 15 years lots of tech-savvy people have opted for Apple products because "they're still UNIX under the hood, and unlike Linux they just work out of the box". But being Unix-like DOES NOT mean to be developer-friendly! Apple is still an opaque developer-unfriendly company even if it provides you with a native bash!
- tomxor 6y ago
  > I know that in the past 15 years lots of tech-savvy people have opted for Apple products because "they're still UNIX under the hood, and unlike Linux they just work out of the box". But being Unix-like DOES NOT mean to be developer-friendly! Apple is still an opaque developer-unfriendly company even if it provides you with a native bash! That was true over 10 years ago (was certainly a big factor for me), but i'm not so sure it is for most people anymore. I remember back when I bought macs (more than 11 years ago now) they used to proudly advertise their "UNIX" certification and tout the BSD/Mach origins, I think this is when most of the original OS team was still there. But today it seems to be one of the most neglected aspects of the system. Each time one of my colleagues with a mac tries to run one of my considerate bsd/gnu friendly scripts I discover most of their userland has not actually been updated in 10 years. I end up getting them to install brew and replacing every binary used in the script... and yet bizarrely things like ZSH suddenly pop up as the new default shell.
  - biztos 6y ago
    I’ve been developing for Linux using Macs for the last 12 years or so. At first I was really into setting up everything just-so on the Mac, with an environment so closely mirroring the production servers that I was confident I could deploy stuff from there to staging. But in the last few years, I ended up just having a reproducible set of dev and stage-like Docker containers. That way I can do all my coding in my nice shiny Apple UI, and all the build/test/run stuff happens in a place I have full control over. This probably doesn’t solve everyone’s problems but for me it was the best way to have my Linux cake and eat my candy Apple too. And yeah, the ZSH thing was super annoying.
IOT_Apprentice 6y ago
why isn't Apple building the Wireguard protocol into the OS directly as Linux is doing?
adamc 6y ago
This was very interesting to read. It contributes to my sense that MacOS is not really a top priority at Apple any more. Recent OS upgrades there have been quite painful.
rsfinn 6y ago
The following suggests a technical solution and expresses no opinion on the policy issues of supporting the Mac App Store: Jason implies that Mac apps that use the Network Extension can only be distributed through the App Store, but this appears to be a misunderstanding. This page at Apple purports to document a way to build an app for distribution outside the App Store: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... Perhaps this would allow WireGuard to support the Mac more easily without having to rely on the App Store. (It still requires an Apple Developer account, but that's already a requirement for the App Store.)
- sneak 6y ago
  There has previously been inconsistency between the documentation and practice, with Apple staff clarifying things contrary to the documentation. If this has changed for the better, it has changed very recently.
mkarliner 6y ago
Mac client WFM. No complaints. So there...
abalone 6y ago
Maybe dumb question but why are they distributing through the Mac App Store? Seems like a lot of these problems are due to the review process. It is possible to just do direct downloads on the Mac.
jgelsey 6y ago
WireGuard is a spectacular gift to the community and I am grateful to have it.
wpm 6y ago
Couldn't a lot of the Apple pain be avoided simply by ditching the Mac App Store? It's not a requirement for distributing software on the Mac, so why deal with the pain, the limitations, the 30% cut, the slow approvals, if you don't really have to? The Windows Installer is distributed as an MSI, there's no reason the WireGuard installer for Mac couldn't just be distributed as a self-hosted .pkg. Cisco doesn't host their VPN packages on the MAS either.
SergeAx 6y ago
> I woke up this morning with my inbox lit up by netizens outraged Wait, are there people reading random blog post about piece of software and deciding it would be a good idea to nag author of the software by retranslating someone other's opinion? Isn't that, how to say, inadequate?
dang 6y ago
Related previous Christmas-present thread: https://news.ycombinator.com/item?id=25533263 https://news.ycombinator.com/item?id=25533263
CGamesPlay 6y ago
My, what a very polite maintainer! It makes me a bit sad that I couldn't ever figure out how to submit my bug report to the WireGuard project (if I recall I had to sign up for a mailing list? but I just want to submit one bug, not become a maintainer). Although, perhaps that added friction is what saves Jason the energy to be so polite when a nasty blog article hits the front page :) On the off chance this post is read, the bug report is simple: WireGuard for Mac doesn't respect /etc/hosts.
PointyFluff 6y ago
Also, skip the Mac. Apple is predatory white-washed garbage.

926 points by motiejus 6y ago

l1k 6y ago

That is a fantastic showcase how to respond to negative criticism in a friendly, constructive and polite manner. Good work, Jason.

sleepyhead 6y ago
Yup. I rarely use WireGuard but it’s a great app and the response here made me go and donate on their website.

est 6y ago

Is tunsafe.com/osx any better?

eis 6y ago
It's a dead project. Last commit was over 2 years ago and the creator seems to have abandoned it (no replies).

Signez 6y ago

May I suggest to @dang to update the title with something just a little bit more informative without much editorialization, like: WireGuard Developer Response to "Great protocol, skip the Mac app" blogpost

sbierwagen 6y ago
Mods don't/can't read every comment posted 24/7, and don't actually get pinged if you put an @ before their name. Best way to actually contact the moderation staff is to send an email to hn@ycombinator.com Note that it is currently 1:33 AM on the west coast, so they may not see it for a number of hours.
Macha 6y ago
It appears they've gone the opposite direction and removed any reference to the the fact that the author is the wireguard developer.

schoolornot 6y ago

As a Mac admin VPP/App Store distribution is still quite finicky. I don’t understand why Apple has to flex and restrict NetworkExtension/VPN apps to Mac App Store. More iOS-ification of the OS.

stock_toaster 6y ago
I understand it to be an attempt[1] to prevent malware/adware from silently hijacking all traffic in the background. [1]: reader decide whether it is a good solution or not
w0utert 6y ago
Reading through the explanation IMO the problem is not that Apple wants to force VPN apps to use frameworks and a distribution model they feel best fits their security/safety model. There are good arguments to be made for that. The problem is that the framework itself is just shitty and Apple should improve it. This is one of the things I dislike most about Apple: even despite the high price I pay for their products and (subsequently) the astronomical profits they make, somehow they seem to be completely unable to simply address these kinds of problems as soon as they pop up and make everyone happy again. It's also in Apple's own interest to make sure VPN extensions can automatically update in case of potential security problems, no? So why they don't just throw enough resources at it to make it work really is beyond me. There's a lot to like about Apple products but their culture towards addressing problems that affect their paying customers is becoming increasingly off-putting, especially since they have basically been printing money for over ~10 years now and have no excuses to not improve these kinds of things.
- DaiPlusPlus 6y ago
  > especially since they have basically been printing money for over ~10 years now and have no excuses to not improve these kinds of things. Apple can't hire enough devs. I told an SWE friend of mine at Apple that I wouldn't mind working there - then he explained to me how restrictive it is to work at Apple (e.g. you have to close your GitHub account, you can't do any moonlighting or FOSS contributions: even on your own time, on your own hardware, while on vacation) - I can't work at a place that wants to exert that much control over my personal life. I get that secrecy is part of being an Apple, but it feels the same as how I thought it'd be cool to work for the FBI's infosec team before I learned that they have mandatory regular drug-testing even for employees in states where cannabis is legal.

alias_neo 6y ago

This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. In my day job, our Apple developers have spent years finding solutions to iOS restrictions around CallKit, Push Notifications and NSTodaysProblem, and those are just the things Apple has intentionally restricted, once you get into the bugs and poor documentation for some APIs it's another story. If our users knew the half of what our Apple Developers have to do, the meetings, discussions, concessions and re-design that has to be done to make things just work, even on par with the Android equivalent, they might be a little bit more understanding. WireGuard has been excellent, and as a Linux user, I haven't needed an app, I have a couple of aliases in my shell to start and stop my tunnels. I've used WireGuard daily for work since lockdown and I used it daily for personal use, while commuting to work before lockdown. In all of that time, I've never had a single issue due to WireGuard (and there isn't even a Linux app to be seen). The expectation is often different between Linux and Apple users though. When I was setting up for the first time, Jason even found time to help me himself on the IRC channel, something I've never expected, and for which I am eternally grateful. I made a donation to WireGuard last year, I'll be doing the same this year and I encourage others to "put their money where their mouth is" and show a little support for the people making and sharing this software for free. I expect an Apple user can afford a small cut of their or their employer's money to do so.

bawolff 6y ago
I'm not sympathetic. If you don't think you can do a good job at something due to factors outside your control, you can choose to not do it (refuse to support mac) or do a subpar job. If you choose the latter don't be surprised if users give you negative reviews. There's no participation trophies in business.
OJFord 6y ago
> This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. Eh? Isn't that a description of the original complaint, and the 'a response' submitted here is from WireGuard creator/lead Jason/zx2c4 explaining much as you do the restrictions, bugs, and limitations he's tried to work around?

lawrenceduk 6y ago

Our team really likes the mac app!

apple-sauce 6y ago

Honestly, I don't get it. Apple makes big money from their ecosystem. Wireguard developer provides high-quality solution for free, helping to grow proprietary ecosystem, essentially helping Apple to make more money indirectly and directly (by giving 30% from donations). In return developer gets tons of hate from users and from Apple itself in the form of delayed reviews, rejects and constant threat of violating some rule and getting dev account banned. In my opinion, the only solution for this is to stop providing services for free and put a price tag on the app. I understand, that developer is a kind, not-yet-burnt-out person who wants to be the world a better place by providing the free way to exchange information securely, but doing so for free for corporate ecosystem is clearly not sustainable, neither financially nor emotionally.

tasn 6y ago
Users demand it. You can't have a popular VPN app without Apple support (because at least one person in the org will have an iDevice), so you have to do it. I made another comment in this thread about my experience building EteSync. That's one of the more annoying parts about Apple being the gatekeeper to 40% of the US population (and in effect, to 100% of businesses). As a developer, you are just stuck with no way out.
- fxtentacle 6y ago
  Oh you absolutely can. You'll lose 40% of your users, but for a free project, that shouldn't matter much.
  - tasn 6y ago
    Many apps (e.g. EteSync and WireGuard) are almost useless if they don't work for everyone within a certain group. A more extreme example is a messaging app. Will not having iOS support for a messaging app lose you 40% of your users? No, it will lose you 100%. In WireGuard's case it's maybe less obvious than messaging, but if WireGuard doesn't work on macOS, it's enough to have one Apple user in your whole organisation in order to make it a non-viable solution.

iso1631 6y ago

This is a response to the Rachel by the bay blog post https://rachelbythebay.com/w/2020/12/24/wg/ https://rachelbythebay.com/w/2020/12/24/wg/ Personally I rarely use a mac, and don't do wg on demand, but one thing that did annoy me was being unable to set dns search domain, which wasn't mentioned in the blog post, but I believe is also caused by OSX deficiencies.

rswail 6y ago
DNS search in MacOS is managed by their DNS infrastructure which is documented under resolver(5). That lets you route the resolution of particular domains to specified nameservers. The files live in /etc/resolver but can also be manipulated with scutil. So it's not an OSX deficiency, it's an OSX difference, similar to launchd vs systemd.
- iso1631 6y ago
  when I type "ping foo" or visit "http://foo http://foo", I want my search domain to add ".my.domain.com" to the end as configured in DNS. I can do this on the OSX networking tab where I set DNS server, but from what I read that feature isn't available for the wireguard client.

perryizgr8 6y ago

I don't get it. You cannot write a VPN app for MacOs and let people just download the executable from your website? Pretty sure I've never opened the app store on my laptop and still have a VPN installed.

pilif 6y ago
that's using older and deprecated frameworks including possibly kernel extensions, all of which are going to go away in the future. Wireguard is using the newer and non-deprecated NetworkExtension framework which requires an entitlement that's only given to app-store apps.
- DaiPlusPlus 6y ago
  Apple can't possibly get rid of kernel extensions - that's the only way to really extend a system in new and innovative ways (user-mode drivers are more like glorified serial-port applications). So much of Apple's platform today is made up of features that were only possible by extending the OS (e.g. Multi-Finder). Apple's going to have trouble if they keep on hindering the people that made their platform and support their ecosystem. Apple is not living up to their "Think Different" ethos: http://www.thecrazyones.it/spot-en.html http://www.thecrazyones.it/spot-en.html Apple in 1997: Here's to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. They're not fond of rules. And they have no respect for the status quo. Apple 2021: > Follow our poorly-explained, underdocumented, and arbitrarily applied rules or we'll ban you from the App Store.
  - pilif 6y ago
    > Apple can't possibly get rid of kernel extensions they are though. It's getting harder and harder to get them loaded (on an M1 Mac, getting an extension loaded will require 4 reboots and a journey through the recovery environment). I'd say that within the next 2-3 macOS releases, kernel extension won't be loaded at all any more and only user-space APIs will be available for third-parties (including drivers). From a security perspective, this is a huge benefit to users of course, but I agree that at least for advanced users, the ability to patch the kernel at random would still be beneficial for some use-cases.

matlo 6y ago

Can you not release it as a .dmg, without going through the Apple Store? Love WireGuard btw

hiq 6y ago
> That sort of suggests another question, though: why are we in the App Store at all? Because as far as I know, Apple only allows NetworkExtension-based apps to be distributed via the App Store, according to their developer relations guy [6], so we're locked in. And even if they were to change that someday somehow, and we went to standalone distribution, we would then have to support two parallel distribution channels so as not to abandon former Mac App Store users, presumably, which means we'd still be limited by App Store restrictions.
- webmobdev 6y ago
  They should abandon the app store.
  - danShumway 6y ago
    > Because as far as I know, Apple only allows NetworkExtension-based apps to be distributed via the App Store, according to their developer relations guy [6], so we're locked in. They can't.

JD557 6y ago

In case the author is reading this, I recently started using Wireguard in Mac OS with the Mac app and the experience has been great. Not only is it much faster other VPNs that I used in the past, but compared to other clients (Forticlient and Tunnelblick), the overall experience feels much nicer, IMO. Thank you so much for your work!

domoritz 6y ago
Absolutely agree. The app just worked. The connection is fast and stable.
nuker 6y ago
> Not only is it much faster other VPNs IPSec is as fast as Wireguard. And there is native client in MacOS. As for bloated codebase, there is an OpenBSD iked rewrite.
- cmeacham98 6y ago
  iirc, ipsec is considered somewhat of a security nightmare by modern standards, given that it difficult to fully understand and very easy to misconfigure in an insecure way. I would only recommend using ipsec over wireguard when legacy compat matters.
  - igetspam 6y ago
    It is. Even the companies I integrate with that require it know it's full of pitfalls. When you've been doing ipsec for two decades and it's a checkbox in your compliance sheet though, you check the box and hopefully you're good at it by now.
  - beermonster 6y ago
    IKEv2 can be configured securely, but by someone that that is familiar with that particular minefield. Both on Windows and MacOS the GUIs configure weaker security by default (the cynic may wonder why!). On MacOS you can use Apple Configurator /Apple Profile Manager and on Windows Powershell, to configure stronger security. The nice thing with WireGuard is it’s either secure or it’s off. As you say, it’s easy to misconfigure IPSec and the number of experts gets smaller day by day.

smcl 6y ago

Incredible that people are so wired and ready to be outraged that they'd send off angry emails on christmas eve after reading someone else's problems with a piece of software.

segfaultbuserr 6y ago
+1, really can't understand that. If I want to rant about something, perhaps I'll post it on blogs or forums, I couldn't imagine that harassing the author with angry mails is also an option...
- bombcar 6y ago
  I think a good part of it is that you can be annoyed by a piece of software and not be able to articulate it beyond “it sucks” - and then you find someone who wrote a detailed article that explains all your pain perfectly. And even though it was Christmas Eve you send it off partially in disgust and partially in a “maybe this explanation makes it clear”.

robertlagrant 6y ago

I don't think I'd have had the same patience with a response on Christmas morning to a project I'd sunk endless time into. Well done OP. Can't wait to see more Wireguard.

metafunctor 6y ago

I for one think the Mac app is awesome. I much, much, much, SO much prefer telling people to install from the App Store as opposed to, well, anything else. Especially I would never, ever tell anyone to use Macports. It's just not the way forward. Do not skip the Mac app. It's pretty good.

segfaultbuserr 6y ago

> We faced rejections in submitting the app, because they decided to change their policy on the app having a link in the "About WireGuard" tool window to www.wireguard.com/donations/ (which they previously had allowed explicitly; now they want 30% or something) Last year Google started to ban donation links in FOSS apps, WireGuard was one of the first victims [0], completely removed from the store. I didn't know that Apple also started doing the same and hit WireGuard again. Extending the definition of an "in-app payment" to a link to the project homepage in the "About" window that doesn't buy any good or service related to the app is an overzealous restriction. Especially so when that button is clicked by, perhaps, only 10% of the users. This is just evil. [0] Open-source apps removed from Google Play Store due to donation links https://news.ycombinator.com/item?id=21268389 https://news.ycombinator.com/item?id=21268389

furyg3 6y ago
I couldn't agree more. You're not paying for the app, or the service, those are free and you are simply making a donation. I can imagine that Apple may want to define 'FOSS' to some extent (donations need to go to a non-profit with a board, software needs to be licensed under one of the following licenses, etc), but there should be some room for supporting FOSS that is included in an App Store.
- segfaultbuserr 6y ago
  Yeah, I can imagine that payment links can potentially be used as a loophole for selling unauthorized in-app payment items outside the store. But this is not the case here, nothing is sold, it's literally only a link to the project home page, https://wireguard.com/donations/ https://wireguard.com/donations/.
  - zaarn 6y ago
    Simple solution, there are human reviewers for this kinda reason and if the rule is "Open Source Apps get a donation button" then not any random can loophole around. Heck, if both Apple and Google offered a solution by which you provide the source code to build, any necessary secret variables for the build and then it gives you those extra privileges, it would be nice. But that costs money the open source apps don't have.

unclekev 6y ago

I didn't know about WireGuard before the initial post on HN, since then it's replaced my OpenVPN solution to access things on my home network stuck behind a 5G mobile CGNAT (no wired service available) I haven't had any issues with the Mac app, but for where the app may be lacking because of the circus that is developing with Apples frameworks and app store it makes up in being absolutely amazing behind the scenes. All the other solutions I've tried have taken weeks of learning and tweaking configs. Had the entire WireGuard solution going end to end in a few hours. It's super simple, lightweight, reliable and easy to understand. It's a shame Apples app store policies and being forced to work with buggy frameworks is holding back developers abilities to write first class native software for MacOS.

tasn 6y ago

The iOS and macOS apps have been the biggest point of stress and frustration when building EteSync[1]. The API is buggy as hell and very limited (if at all available) and the review process is arbitrary and can cause updates to be rejected. You can never know if your workarounds will be accepted or rejected. Sometimes they can even get rejected in future app updates. The EteSync experience is subpar on Apple devices, and there's almost nothing we can do about it. We already spent countless of hours trying to fix things, but Apple just make it impossible. We have more ideas on how to fix things, and we will keep on trying, but it's beyond me why would anyone willingly use an Apple product. Edit (adding one more point): that's one of the more annoying parts about Apple being the gatekeeper to 40% of the US population and in effect, to 100% of businesses (because one bad Apple in the org is enough to spoil the whole bunch). As a developer, you are just stuck with no way out. [1] https://www.etesync.com https://www.etesync.com

deleted 6y ago
[deleted]
plg- 6y ago
> it's beyond me why would anyone willingly use an Apple product Final users don't see this mess.
- tasn 6y ago
  That's a fair point, I was picturing developers (who are Apple users) in my head when I wrote this.
- ubercow13 6y ago
  But it seems they do, eg. rachelbythebay stopped using Wireguard because of the mess.
  - pilif 6y ago
    she stopped using Wireguard (and ranted about it) rather than stopped using Apple's products (which are ultimately responsible for the failures she complained about in Wireguard)

wscott 6y ago

First off, what a level-headed friendly response from a developer who is clearly frustrated by Apple's bugs and policies. As someone who has had to support commercial software this is not easy to do consistently. Second, this has significantly tempered my lusting over the new M1 macs. I think I can be content with my ThinkPad's running Linux.

rwmj 6y ago
This worries me for a similar reason - I get requests to port some software I wrote over to the Mac from time to time, and the new M1 Mac Mini is cheap enough that I might have bought one to do this development. But I'm not keen to spend any money or time on an ecosystem which might be closed down in the future.
- marcus_holmes 6y ago
  Aeah, how much more proprietary and strange are the Apple API's going to get? They'll have control over the entire vertical, and can put all kinds of undocumented crap right in the silicon.
  - wscott 6y ago
    even to the syscall level, like the MAP_JIT flag to mmap() https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_allow-jit https://developer.apple.com/documentation/bundleresources/en... not optional and requires special app entitlements to enable. So you are not going to write portable code that has a JIT without apple-special code.
    - TwoBit 6y ago
      A JIT is a major potential source of malware enablement and thus a security consideration.
      - andrekandre 6y ago

isodev 6y ago

There are bugs of course, but let's not loose scope of the fact that "Apple has restricted" usually means Apple is preventing bad actors from doing the wrong thing. As a developer, I usually find it rewarding to work with the Sandbox and not against it. Making this part of the product conception very early on results in much smoother experience at the end. Of course, if submitting to the store is an afterthought there are surely some challenges to tackle.

viktorcode 6y ago
I agree. For me the biggest win is much less maintenance in the long run. Sandbox hacks will eventually stop working and will have to be replaced. If someone can't make the app they want without going around sandbox, then they should avoid App Store distribution instead of betting the product on "clever" workarounds.
toyg 6y ago
> "Apple has restricted" usually means Apple is preventing bad actors Thanks for the laugh! "Apple has restricted" usually means Apple wants to retain complete control in order to extract maximum profit. That's all it is.
- Ensorceled 6y ago
  While the parent comment is a bit pollyannish, this comment is overly pessimistic.

Quiark 6y ago

Wow, shame on Apple...

lrossi 6y ago

> I woke up this morning with my inbox lit up by netizens outraged at me for having allowed the WireGuard Project to produce such terribly subpar and dysfunctional software for the Mac. That was a weird way to wake up on Christmas, considering how much I really do care about delivering polished software. The response is much nicer than deserved. I would not have blamed him for a less friendly reaction.

bombcar 6y ago
In that situation I’d take the emails in a “welcome to my hell” frame of mind instead of a “why are they pissed at me”. It’s also true of much enterprise software - it’s often as good as the developers could make it given the constraints they were working with.
young_unixer 6y ago
I'm laughing right now trying to imagine how Linus would have replied to this.

cm2187 6y ago

How fast is wireguard on windows? OpenVPN is fast on linux but disastrous on windows, you really have to tweak the settings to go beyond 5 MB/s and usually not much more.

viktorcode 6y ago

Cloudflare WARP beta works somehow. And it isn't distributed through the App Store on Mac. So, it is definitely possible for WireGuard.

shp0ngle 6y ago
Cloudflare WARP is really buggy on iOS (for me at least)

coldcode 6y ago

As an iOS developer I can relate, Apple makes amazing hardware, but their software development is often meh. I don't think it's malicious, its just they have so many thousands of teams, often working independently of each other, and your experience with them is like dealing with sightless people describing an elephant. Some teams do amazing things, some mediocre, some downright awful, like any company, but exaggerated because of their central importance in so many other peoples/companies lives. Some of this could be fixed but even there Apple is a huge operation and executives are of all kinds. I work for a F50 company (non tech) with an infinite set of teams and execs and its another mix of amazing/stupid. No one company can uniformly manage so much code and hardware to boot and do it perfectly. There are things Apple could do to make it less irritating—the hard problem is picking which subset of horrifically irritating things to fix.

Joe_Cool 6y ago
> makes amazing hardware Louis Rossmann would disagree

Macha 6y ago

dang: What was the purpose of removing "Developer's" from the title? Previously it was 'Developer's response to “WireGuard: great protocol, but skip the Mac app”'. Neither of these are the actual title, so that can't be the rule it was operating under, and the fact that it's a developer (as opposed to some other user or Apple/Wireguard fanboy/hater) does change the context, at least for me.

tmpxgdqrcKFuG 6y ago

Couldn’t you just change the url to /about instead of /donations? Seems sort of the thing sketchy sites do to say one thing and link to another. If I want to donate to a project I want to browse the site and learn more about rather than straight to the donation page. Seems like a money grab to take me to the donation page.

bombcar 6y ago
To defend Apple here - if they allowed “donations” with only a 5% fee you’d have thousands of developers offing “free premium” to “donators”. What Apple needs is a curated system to support open source development for apps - for example, after proving that you really are a non-profit (think Mozilla foundation) Apple could still charge the 30% but then rebate 20% back as a donation from Apple itself. Win/win.
- vaduz 6y ago
  Apple already has such a process - you may not agree with the criteria, but they do outline it quite clearly: 3.2 Other Business Model Issues [..] (vi) Approved nonprofits may fundraise directly within their own apps or third-party apps, provided those fundraising campaigns adhere to all App Review Guidelines and offer Apple Pay support. These apps must disclose how the funds will be used, abide by all required local and federal laws, and ensure appropriate tax receipts are available to donors. Additional information shall be provided to App Review upon request. Nonprofit platforms that connect donors to other nonprofits must ensure that every nonprofit listed in the app has also gone through the nonprofit approval process. Learn more about becoming an approved nonprofit. [https://developer.apple.com/apple-pay/nonprofits/ https://developer.apple.com/apple-pay/nonprofits/] Mozilla Foundation would be fine, but WireGuard is in hot mess as the "Donation" is not actually going to a non-profit organisation - it has in fact taken steps to avoid identifying _who_ the money is going to.
  - bombcar 6y ago
    That hot mess is interesting (and obviously never brought up by the Apple is Evil crowd) - if you don't want to identify the destination of funds just don't call it a "Donate" button and let Apple take their cut. 70% of something is still more than 100% of zero.

auggierose 6y ago

In the developer documentation for Network extensions they describe how to enable them for Apps outside the App store: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... It's under "Discussion". Haven't tried out if it works though, but the link in [6] that the developer refers to is 3 years old, so maybe check again?

indymike 6y ago

It sure feels like we're swinging back to the pre-PC days where code portability and interoperability was sacrificed at the altar of vendor lock-in.

mensetmanusman 6y ago

In an alternative universe, one could imagine macOS developers being so frustrated that they only bother with updating their windows/linux versions. In which case, only apps like parallels would have to be working, then the bugs of macOS could be bypassed for many and focused for a set of well-funded developers. All apps would have a translation layer, but that seems to not be an issue with the m1.

deleted 6y ago
[deleted]

danShumway 6y ago

I know that people say this all the time, and usually nothing comes from it, but it really feels like Apple is playing with fire here. Over just the past year I've gone from "I don't see why I wouldn't support Mac" to "I'm not even going to try and build my software for Mac, life is too short to deal with Apple's crap." It's been kind of a weird transition. I was talking to someone recently about accessibility between multiple GUI frameworks (QT/Electron/GTK/Swift/etc...) and they brought up Mac accessibility differences. And immediately my brain jumped to, "well, who cares if those frameworks are accessible on Mac, because it's not like my software is going to be on there. Only the Linux/Windows/mobile experiences matter." It was a very strange feeling to have that be the first thing that instinctively popped into my head. And I'm only one developer, and probably no one's really going to notice or care about my decisions, and historically as long as users demand Mac software/releases, developers have had to just put up with it, so I don't have strong evidence that this is going to be different. But I wonder how long that can hold out before eventually something snaps. Realistically, there's no way that Wireguard can refuse to release for MacOS. But everyone else? If you're making a game, why would you ever target a Mac build if you're worried about running into issues like this? Is the gaming marketshare on Mac really big enough to justify this kind of annoyance and time commitment? I'm probably naive, but it just seems like at some point developers are going to decide that the only reason to support Mac is if it's their primary market. Maybe Apple doesn't care, maybe they'd like us all to move to iOS anyway.

ismyrnow 6y ago

App Store gatekeeping needs to burn. It may be helpful for the tech-illiterate who want simple and safe apps, but it's not a viable for a healthy ecosystem of broad ranging applications. It's crazy to think I can't install an app from a developer I trust from their website.

johnofthesea 6y ago
You can disable Gatekeeper.

igetspam 6y ago

I'm going to bookmark this reply as an example of how to take feedback and respond appropriately. Jason's explanations both take responsibility for the issues at hand and provide adequate information to understand the difficulty in resolving them. He takes responsibility for a failure in review, which is a common problem I see in engineering orgs. I'm not an Apple user but I have a lot of love for the wireguard project (our company has donated) and the commitment shown here makes me confident that my feelings are not misplaced.

todd8 6y ago
I was going to simply upvote this comment, but I'm chiming in to agree with you because I want to complement Jason for being the kind of developer that I really respect. He provides a tool that so valuable to so many and does so while dealing with a difficult set of requirements imposed by Apple. His response to a frustrated user isn't defensive but helpful and informative. Jason sets an example that the rest of us developers should strive for.
- pkd 6y ago
  Precisely. Too often I see bad behaviour in open source communities justified with the lazy reply of "being nice does not produce good software" (multiple examples of this in yesterday's thread about suckless) and Jason's handling of this situation is a great refutation of that theory.
  - Skunkleton 6y ago
    Going to chime in here as well. Jason's attitude here is commendable. I am going to add this to my collection of "things to read when I am unreasonably mad at something". Here is one from Greg K-H in case anyone is interested [1]. [1] https://news.ycombinator.com/item?id=25515566 https://news.ycombinator.com/item?id=25515566

sonotmyname 6y ago

> Because as far as I know, Apple only allows NetworkExtension-based apps to be distributed via the App Store, No, not so. Plenty of VPN apps based on network extensions are delivered outside the Mac App Store. In fact, most commercial VPNs are done this way. My company uses GlobalProtect for example, and I can install it any number of ways, and it’s been NE based for over a year now...

TwoBit 6y ago

> a developer new to the codebase didn't realize that he was removing a workaround to yet-another-Apple-bug. Isn't this what code comments should be good for preventing?

m45t3r 6y ago
The author did address this later on, saying he was sorry for not adding a comment. Anyway, no software development process is perfect, but sure the Apple ecosystem make everything worse.
lerxst00 6y ago
This is literally what the OP has acknowledged was an issue: > I should have caught it, and I take responsibility for it, and probably workarounds need more comments so this doesn't happen

j1elo 6y ago

Apple doesn't deserve to have such careful and detail-oriented FOSS developers like Jason, developing for their platform. He is genuinely wasting time in order to work around Apple's developer-unfriendly platform. Not that I should be telling devs where they should spend their time... but I feel like so much effort is being devoted to fix Apple's issues. > When I'm debugging these issues, I'll often times spend a few hours in IDA Pro (Apple doesn't provide debug symbols, unlike Microsoft, which makes this process even more miserable than it already is), and after identifying the issue I'll often have several ideas for "clever" workarounds. Which of them are acceptable for the App Store? Usually none! Really, why we need to have very talented people spending their time in dealing with this, instead of contributing actual value on other parts of the project? Apple should be losing devs in favor of other better platforms, not the other way around. With less and worse products at their disposal, Apple users would then be well aware that they are choosing a platform that alienates developers.

VonGuard 6y ago
Completely agree. Apple has nothing but contempt for its developers, and treats them like indentured servants. "Oh it took 10 years to get your app working right? Well, it doesn't work right anymore after yesterday's patch."
- uncledave 6y ago
  That could be said for any platform these days. It's certainly not specific to Apple!
  - foepys 6y ago
    Microsoft broke a lot in the past few years when they got rid of their dedicated QA department(s) but they are very keen of fixing backwards compatibility issues. I can still run my desktop application that I compiled in 1998. Try that on a Mac.
    - uncledave 6y ago

crawshaw 6y ago

One problematic thing about App Store reviews as a developer is on each submission, Apple does a cursory review of the whole app. This means a one-line bug fix that is an improvement in anyone’s eyes can get caught on a detail that has been present for years. It would be fine if these complaints about old details were reported to developers as “blocking any future app releases”, but blocking immediate bug fixes really hurts.

CharlesW 6y ago

Dumb question 1: Why not do what Apollo for Reddit (and many other apps) does and add in-app "tips" and/or other purchases? With minimal UI support it'd be orders-of-magnitude more effective at raising money for WireGuard than a web link, regardless of Apple's markup. Dumb question 2: Why isn't it a good idea to create a non-profit, or distribute via a partner non-profit, to reduce the App Store take to 0%? (Even without that, Apple's take would be 15% until the app hits $1 million in annual net sales there.) I see people in the thread asking for special treatment for this (important and worthy, of course) project, which Apple obviously can't do that without creating a thousand other problems.

blacklight 6y ago

FOSS developers should simply stop developing good software for Apple devices. The absolute opacity of Apple's technical policies and their arrogant i-dont-care/its-your-problem approach against developers are quite renewed in the community. This ends up costing a lot of development time to developers who mostly work for free, who struggle to reverse engineer or debug what happens on MacOS/iOS, and (like Wireguard's case shows) it harms the reputation of their software because people tend to blame the application rather than the OS when things don't work as intended. If people want to use FOSS software, then they should be able to do so on systems that support the FOSS ecosystem, that provide developers with appropriate tools to debug what's going on (ON ANY PLATFORM) and sufficient documentation for them to understand how a certain component of the OS is supposed to behave. I know that in the past 15 years lots of tech-savvy people have opted for Apple products because "they're still UNIX under the hood, and unlike Linux they just work out of the box". But being Unix-like DOES NOT mean to be developer-friendly! Apple is still an opaque developer-unfriendly company even if it provides you with a native bash!

tomxor 6y ago
> I know that in the past 15 years lots of tech-savvy people have opted for Apple products because "they're still UNIX under the hood, and unlike Linux they just work out of the box". But being Unix-like DOES NOT mean to be developer-friendly! Apple is still an opaque developer-unfriendly company even if it provides you with a native bash! That was true over 10 years ago (was certainly a big factor for me), but i'm not so sure it is for most people anymore. I remember back when I bought macs (more than 11 years ago now) they used to proudly advertise their "UNIX" certification and tout the BSD/Mach origins, I think this is when most of the original OS team was still there. But today it seems to be one of the most neglected aspects of the system. Each time one of my colleagues with a mac tries to run one of my considerate bsd/gnu friendly scripts I discover most of their userland has not actually been updated in 10 years. I end up getting them to install brew and replacing every binary used in the script... and yet bizarrely things like ZSH suddenly pop up as the new default shell.
- biztos 6y ago
  I’ve been developing for Linux using Macs for the last 12 years or so. At first I was really into setting up everything just-so on the Mac, with an environment so closely mirroring the production servers that I was confident I could deploy stuff from there to staging. But in the last few years, I ended up just having a reproducible set of dev and stage-like Docker containers. That way I can do all my coding in my nice shiny Apple UI, and all the build/test/run stuff happens in a place I have full control over. This probably doesn’t solve everyone’s problems but for me it was the best way to have my Linux cake and eat my candy Apple too. And yeah, the ZSH thing was super annoying.

IOT_Apprentice 6y ago

why isn't Apple building the Wireguard protocol into the OS directly as Linux is doing?

adamc 6y ago

This was very interesting to read. It contributes to my sense that MacOS is not really a top priority at Apple any more. Recent OS upgrades there have been quite painful.

rsfinn 6y ago

The following suggests a technical solution and expresses no opinion on the policy issues of supporting the Mac App Store: Jason implies that Mac apps that use the Network Extension can only be distributed through the App Store, but this appears to be a misunderstanding. This page at Apple purports to document a way to build an app for distribution outside the App Store: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... Perhaps this would allow WireGuard to support the Mac more easily without having to rely on the App Store. (It still requires an Apple Developer account, but that's already a requirement for the App Store.)

sneak 6y ago
There has previously been inconsistency between the documentation and practice, with Apple staff clarifying things contrary to the documentation. If this has changed for the better, it has changed very recently.

mkarliner 6y ago

Mac client WFM. No complaints. So there...

abalone 6y ago

Maybe dumb question but why are they distributing through the Mac App Store? Seems like a lot of these problems are due to the review process. It is possible to just do direct downloads on the Mac.

jgelsey 6y ago

WireGuard is a spectacular gift to the community and I am grateful to have it.

wpm 6y ago

Couldn't a lot of the Apple pain be avoided simply by ditching the Mac App Store? It's not a requirement for distributing software on the Mac, so why deal with the pain, the limitations, the 30% cut, the slow approvals, if you don't really have to? The Windows Installer is distributed as an MSI, there's no reason the WireGuard installer for Mac couldn't just be distributed as a self-hosted .pkg. Cisco doesn't host their VPN packages on the MAS either.

SergeAx 6y ago

> I woke up this morning with my inbox lit up by netizens outraged Wait, are there people reading random blog post about piece of software and deciding it would be a good idea to nag author of the software by retranslating someone other's opinion? Isn't that, how to say, inadequate?

dang 6y ago

Related previous Christmas-present thread: https://news.ycombinator.com/item?id=25533263 https://news.ycombinator.com/item?id=25533263

CGamesPlay 6y ago

My, what a very polite maintainer! It makes me a bit sad that I couldn't ever figure out how to submit my bug report to the WireGuard project (if I recall I had to sign up for a mailing list? but I just want to submit one bug, not become a maintainer). Although, perhaps that added friction is what saves Jason the energy to be so polite when a nasty blog article hits the front page :) On the off chance this post is read, the bug report is simple: WireGuard for Mac doesn't respect /etc/hosts.

PointyFluff 6y ago

Also, skip the Mac. Apple is predatory white-washed garbage.