6 ms·

My experience with this so far was... mixed. - This breaks DNS resolution for company-internal domains. - This routes all my traffic through CloudFlare or an

by pilif 5y ago

My experience with this so far was... mixed. - This breaks DNS resolution for company-internal domains. - This routes all my traffic through CloudFlare or another CDN I might or might not trust (yes, the IP is hidden, but not the data) - it significantly slows down my internet access on my location. - it tends to turn itself on again without my intervention especially the last point is very problematic for me

defaultname 5y ago
To use it you're clearly using early beta software. Clearly it isn't going to "turn itself on again". I turned it on and actually forgot I did. Performance is decent here. I mean of course it's going to be worse than native, but that's the compromise. As to trusting Cloudflare -- what do you mean? You understand your connection is still TLS end-to-end encrypted (presuming that's what we're talking about), right? I mean...presuming the site your talking to isn't using Cloudflare SSL. In no way does this reduce that security. If you're talking about HTTP, well everyone in between can already see that.
- marmaduke 5y ago
  > Clearly it isn't going to "turn itself on again" Why is it so clear? An iPhone hotspot turns itself off as soon as a device disconnects, with no option to leave it on, presumably for security or battery reasons.
- kerng 5y ago
  [Clearly not turn itself on.] Funny story, I was shocked and quite annoyed that an iPhone automatically turns on Wifi and stuff every day by itself - even if you turn it off... Still dont know how to actually turn it off
  - permo-w 5y ago
    if you disable from quick menu, it turns back on. if you disable from settings, it doesn’t
    - nucleardog 5y ago
      And when you do so it does flash a message along the lines of “Disconnecting nearby wifi until tomorrow”. Which makes it pretty clear it’s not a wifi kill switch but just a “my current connection is shit, let me use cellular” button.
      - permo-w 5y ago
        yeah, but even so, it’s one of these occasions where an os symbol has been altered to change behaviour without the user’s consent or control it’s not quite as egregious, but it reminds me of how a lot of desktop apps now just minimise to tray rather than actually ending the process when you click the close button. discord is probably the worst offender for that, since it’s not (that I’m aware) a customisable behaviour
        ryankrage77 5y ago
        Discords behaviour is customisable (at least on Windows). Settings > app settings - Window settings > close button - minimize to tray. Turning this off causes Discord to quit completely when clicking the red X in the top right.
        defaultname 5y ago
        The control center wifi control always worked this way. It wasn't "altered", that is a primary feature of its functionality. Apple gains nothing from your WiFi re-engaging. But many users do because, as another comment mentioned, people turn it off in control center because their connection is temporarily shit, or more likely just accidentally. Then they get to end of month and they have a monster cell overage. Someone was using control center wrong (despite it very clearly indicating the use of the button). It's a learning experience.
        permo-w 5y ago
        no, you’re wrong. it started working this way in iOS 11. You can look it up if you like
  - mvanbaak 5y ago
    If you disable it from the control center thingie overlay it even states that is only for this day ... If you disable it from settings, it stays off.
  - klaushardt 5y ago
    If you tap the wifi button in your controll center it just turns it off for 24 hours or when you switch locations. If you turn it off in the Settings App then it stays off.
- pilif 5y ago
  > To use it you're clearly using early beta software. Clearly it isn't going to "turn itself on again". Of course I’m talking about the beta version. But I can assure you that once I found out that it interferes with internal DNS, I turned it off (it’s on by default on the current betas) and a day later it was back on. That’s what I meant with „it turns itself on again“
gjsman-1000 5y ago
It directs to an Apple server, then CloudFlare, so considering it’s basically a double VPN speed decreases have been reasonable. The fact they can see unencrypted HTTP data is a downside with all VPNs. At least you have the double hop going in your favor. As for turning on by itself, it’s annoying, but it is the very first developer-only preview so I’m not complaining yet.
yunohn 5y ago
> This breaks DNS resolution for company-internal domains. Is this not the case for any VPN or proxying service? In fact, it could even be a security flaw if your internal domains were accessible on external VPN style endpoints?
- gjsman-1000 5y ago
  Also it’s developer preview 1. People like the OP who gripe about bugs on such an unfinished product are the reason why Apple doesn’t make those first builds available to anyone but their registered developers for the first month.
  - pilif 5y ago
    I have of course reported the issues using the feedback app, but judging by previous experiences with other apple betas, I wouldn’t hold my hopes up of any of this getting fixed. There’s value in talking about issues early as it allows admins of corporate networks to make adjustments to their infrastructure (like introducing split dns rather than just have *.internal.example.com resolve to internal addresses) to be prepared for the eventual launch of this feature in September
- krageon 5y ago
  > Is this not the case for any VPN or proxying service? No, it's not. > In fact, it could even be a security flaw if your internal domains were accessible on external VPN style endpoints? It would be, but then this is not something that happens on a network configured in the way you describe.
  - yunohn 5y ago
    I use NordVPN. It specifically has an opt-in setting to use locally discovered DNS in favor of their in-network DNS. This is crucial since out-of-network DNS can leak activity. I’m not sure what kind of network you believe I described, but would be useful to have a clearer explanation from you.
  - defaultname 5y ago
williamtwild 5y ago
"yes, the IP is hidden, but not the data" Using TLS it certainly should be.
- stock_toaster 5y ago
  Does it work like an https proxy (with CONNECT) or a socks proxy? Because if it is instead actually unwrapping the connection somehow (eg. mitm) then they would be able to see the content, and that seems like a huge no-go -- both for the users, AND for apple as I would think it would open them up to liability. note: they certainly would be able to see unencrypted http traffic regardless though.
EveYoung 5y ago
Does Apple preserve the client source IP in the request (similar to Cloudflare's VPN) or will the server only see the IP of the exit node?
- dividuum 5y ago
  The whole point of the service is to hide the client source IP.
  - EveYoung 5y ago
    Not necessarily. I thought it was mainly about encrypting traffic in untrusted networks. Cloudflare already does it like this in their VPN service.
    - dividuum 5y ago
      Correct. I guess it wasn't really obvious from the linked mail. The introduction video at https://developer.apple.com/videos/play/wwdc2021/10096/ https://developer.apple.com/videos/play/wwdc2021/10096/ is a lot clearer.
      - defaultname 5y ago
        Not sure why you said correct, as it's both. A big part of private relay -- I would say the most significant part -- is to allow people to talk to websites without giving up their personal IP (and from that pretty tight geolocation, and with fingerprinting a correlation with loads of other data they collect). Apple makes a big deal about it being about maintaining privacy, not just against snooping of traffic -- which is unlikely -- but against fingerprinting and targeting from the services and sites you connect to. And to answer the original guy, no Apple does not add any headers or details to tell the destination what your IP address is. They just see that they're talking to an exit node somewhere approximal of your general region.
        alam2000 5y ago
xiphias2 5y ago
> This breaks DNS resolution for company-internal domains. Why would it? The WWDC developer video clearly states that it’s only for public domains.
- ec109685 5y ago
  I believe the DNS requests are routed through their ingress proxy, so there's no chance to hit an internal split horizon DNS server.
wolverine876 5y ago
> the IP is hidden, but not the data Isn't the great majority of your traffic HTTPS?
ezfe 5y ago
> it tends to turn itself on again without my intervention This is listed as a known issue in the release notes

by pilif 5y ago

defaultname 5y ago

To use it you're clearly using early beta software. Clearly it isn't going to "turn itself on again". I turned it on and actually forgot I did. Performance is decent here. I mean of course it's going to be worse than native, but that's the compromise. As to trusting Cloudflare -- what do you mean? You understand your connection is still TLS end-to-end encrypted (presuming that's what we're talking about), right? I mean...presuming the site your talking to isn't using Cloudflare SSL. In no way does this reduce that security. If you're talking about HTTP, well everyone in between can already see that.

marmaduke 5y ago
> Clearly it isn't going to "turn itself on again" Why is it so clear? An iPhone hotspot turns itself off as soon as a device disconnects, with no option to leave it on, presumably for security or battery reasons.
kerng 5y ago
[Clearly not turn itself on.] Funny story, I was shocked and quite annoyed that an iPhone automatically turns on Wifi and stuff every day by itself - even if you turn it off... Still dont know how to actually turn it off
- permo-w 5y ago
  if you disable from quick menu, it turns back on. if you disable from settings, it doesn’t
  - nucleardog 5y ago
    And when you do so it does flash a message along the lines of “Disconnecting nearby wifi until tomorrow”. Which makes it pretty clear it’s not a wifi kill switch but just a “my current connection is shit, let me use cellular” button.
    - permo-w 5y ago
      yeah, but even so, it’s one of these occasions where an os symbol has been altered to change behaviour without the user’s consent or control it’s not quite as egregious, but it reminds me of how a lot of desktop apps now just minimise to tray rather than actually ending the process when you click the close button. discord is probably the worst offender for that, since it’s not (that I’m aware) a customisable behaviour
      - ryankrage77 5y ago
        Discords behaviour is customisable (at least on Windows). Settings > app settings - Window settings > close button - minimize to tray. Turning this off causes Discord to quit completely when clicking the red X in the top right.
      - defaultname 5y ago
        The control center wifi control always worked this way. It wasn't "altered", that is a primary feature of its functionality. Apple gains nothing from your WiFi re-engaging. But many users do because, as another comment mentioned, people turn it off in control center because their connection is temporarily shit, or more likely just accidentally. Then they get to end of month and they have a monster cell overage. Someone was using control center wrong (despite it very clearly indicating the use of the button). It's a learning experience.
        permo-w 5y ago
        no, you’re wrong. it started working this way in iOS 11. You can look it up if you like
- mvanbaak 5y ago
  If you disable it from the control center thingie overlay it even states that is only for this day ... If you disable it from settings, it stays off.
- klaushardt 5y ago
  If you tap the wifi button in your controll center it just turns it off for 24 hours or when you switch locations. If you turn it off in the Settings App then it stays off.
pilif 5y ago
> To use it you're clearly using early beta software. Clearly it isn't going to "turn itself on again". Of course I’m talking about the beta version. But I can assure you that once I found out that it interferes with internal DNS, I turned it off (it’s on by default on the current betas) and a day later it was back on. That’s what I meant with „it turns itself on again“

gjsman-1000 5y ago

It directs to an Apple server, then CloudFlare, so considering it’s basically a double VPN speed decreases have been reasonable. The fact they can see unencrypted HTTP data is a downside with all VPNs. At least you have the double hop going in your favor. As for turning on by itself, it’s annoying, but it is the very first developer-only preview so I’m not complaining yet.

yunohn 5y ago

> This breaks DNS resolution for company-internal domains. Is this not the case for any VPN or proxying service? In fact, it could even be a security flaw if your internal domains were accessible on external VPN style endpoints?

gjsman-1000 5y ago
Also it’s developer preview 1. People like the OP who gripe about bugs on such an unfinished product are the reason why Apple doesn’t make those first builds available to anyone but their registered developers for the first month.
- pilif 5y ago
  I have of course reported the issues using the feedback app, but judging by previous experiences with other apple betas, I wouldn’t hold my hopes up of any of this getting fixed. There’s value in talking about issues early as it allows admins of corporate networks to make adjustments to their infrastructure (like introducing split dns rather than just have *.internal.example.com resolve to internal addresses) to be prepared for the eventual launch of this feature in September
krageon 5y ago
> Is this not the case for any VPN or proxying service? No, it's not. > In fact, it could even be a security flaw if your internal domains were accessible on external VPN style endpoints? It would be, but then this is not something that happens on a network configured in the way you describe.
- yunohn 5y ago
  I use NordVPN. It specifically has an opt-in setting to use locally discovered DNS in favor of their in-network DNS. This is crucial since out-of-network DNS can leak activity. I’m not sure what kind of network you believe I described, but would be useful to have a clearer explanation from you.
- defaultname 5y ago

williamtwild 5y ago

"yes, the IP is hidden, but not the data" Using TLS it certainly should be.

stock_toaster 5y ago
Does it work like an https proxy (with CONNECT) or a socks proxy? Because if it is instead actually unwrapping the connection somehow (eg. mitm) then they would be able to see the content, and that seems like a huge no-go -- both for the users, AND for apple as I would think it would open them up to liability. note: they certainly would be able to see unencrypted http traffic regardless though.

EveYoung 5y ago

Does Apple preserve the client source IP in the request (similar to Cloudflare's VPN) or will the server only see the IP of the exit node?

dividuum 5y ago
The whole point of the service is to hide the client source IP.
- EveYoung 5y ago
  Not necessarily. I thought it was mainly about encrypting traffic in untrusted networks. Cloudflare already does it like this in their VPN service.
  - dividuum 5y ago
    Correct. I guess it wasn't really obvious from the linked mail. The introduction video at https://developer.apple.com/videos/play/wwdc2021/10096/ https://developer.apple.com/videos/play/wwdc2021/10096/ is a lot clearer.
    - defaultname 5y ago
      Not sure why you said correct, as it's both. A big part of private relay -- I would say the most significant part -- is to allow people to talk to websites without giving up their personal IP (and from that pretty tight geolocation, and with fingerprinting a correlation with loads of other data they collect). Apple makes a big deal about it being about maintaining privacy, not just against snooping of traffic -- which is unlikely -- but against fingerprinting and targeting from the services and sites you connect to. And to answer the original guy, no Apple does not add any headers or details to tell the destination what your IP address is. They just see that they're talking to an exit node somewhere approximal of your general region.
      - alam2000 5y ago

xiphias2 5y ago

> This breaks DNS resolution for company-internal domains. Why would it? The WWDC developer video clearly states that it’s only for public domains.

ec109685 5y ago
I believe the DNS requests are routed through their ingress proxy, so there's no chance to hit an internal split horizon DNS server.

wolverine876 5y ago

> the IP is hidden, but not the data Isn't the great majority of your traffic HTTPS?

ezfe 5y ago

> it tends to turn itself on again without my intervention This is listed as a known issue in the release notes