3 ms·

The only problem I have with it is that the entitlement system controls both what you can submit to the App Store as well as what you can locally compile and in

The only problem I have with it is that the entitlement system controls both what you can submit to the App Store as well as what you can locally compile and install. For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Fonts also require an entitlement, but I'm not sure if it's just something you need a paid dev account for or if you need to specifically grovel to Apple as to why you need it. I doubt "I want to submit a pull request to iSH" would be considered a valid reason (but correct me if I'm wrong). Even things like camera access in multitasking views are entitlements that your dev account needs to be preapproved for. In fact, it wasn't even something that Apple even publicly mentioned for a while - only Zoom had it until someone reverse-engineered their app bundle and found out about it.

shuckles 5y ago
Didn’t that get hardened in response to the Onavo revelations? In particular, Facebook was using their developer certificate to sign spyware installed via MDM. I don’t remember it being a requirement from the beginning, even though China has tightly regulated VPNs for a long time.
- upbeat_general 5y ago
  Honestly I see no issue with facebook being allowed to do this. If someone pays me to install spyware on my desktop, nobody complains that we should remove the ability to run as root.
jackson1442 5y ago
> For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Can't you manually add a vpn without an app? I haven't needed to configure this myself but presumably if you're bundling your own vpn app you can do the manual configuration in settings which is significantly easier.
- 0x0 5y ago
  That only works if your VPN uses one of the 2-3 standard protocols supported by iOS itself. If your VPN uses a different protocol, you must (with an entitlement) develop an app that gets to execute its code for every packet sent and received. For example, if you want to create a "VPN" that sends and receives packages by audio like an oldschool modem, or if you want to implement the WireGuard protocol, or if you want to implement a dns tunnel, etc. The good thing is that any random shady app can't just start hijacking and intercepting every network packet for the entire device. The bad thing is that it makes difficult as an outsider to contribute to open-source VPN apps, since you don't have access to the entitlement (which ultimately requires access the the private code signing keys and provisioning profiles for the developer that DID receive the grant (and the debug device must also be registered there)).
  - jackson1442 5y ago
    Fascinating. Thanks for the information!!

shuckles 5y ago

Didn’t that get hardened in response to the Onavo revelations? In particular, Facebook was using their developer certificate to sign spyware installed via MDM. I don’t remember it being a requirement from the beginning, even though China has tightly regulated VPNs for a long time.

upbeat_general 5y ago
Honestly I see no issue with facebook being allowed to do this. If someone pays me to install spyware on my desktop, nobody complains that we should remove the ability to run as root.

jackson1442 5y ago

> For example, you can't locally develop a VPN app until you ask Apple permission to develop a VPN app. Almost certainly this is to appease China, which I find particularly egregious. Can't you manually add a vpn without an app? I haven't needed to configure this myself but presumably if you're bundling your own vpn app you can do the manual configuration in settings which is significantly easier.

0x0 5y ago
That only works if your VPN uses one of the 2-3 standard protocols supported by iOS itself. If your VPN uses a different protocol, you must (with an entitlement) develop an app that gets to execute its code for every packet sent and received. For example, if you want to create a "VPN" that sends and receives packages by audio like an oldschool modem, or if you want to implement the WireGuard protocol, or if you want to implement a dns tunnel, etc. The good thing is that any random shady app can't just start hijacking and intercepting every network packet for the entire device. The bad thing is that it makes difficult as an outsider to contribute to open-source VPN apps, since you don't have access to the entitlement (which ultimately requires access the the private code signing keys and provisioning profiles for the developer that DID receive the grant (and the debug device must also be registered there)).
- jackson1442 5y ago
  Fascinating. Thanks for the information!!