4 ms·

Apple could simply reimplement APN and iCloud Files and etc over their own Private Relay connections, so that any carrier who blocks Private Relay ends up block

Apple could simply reimplement APN and iCloud Files and etc over their own Private Relay connections, so that any carrier who blocks Private Relay ends up blocking all push notifications to all Apple devices. They have not yet done so, but if they do, either all US carriers will have to collude to block it — which could reasonably be considered anti-competitive behavior and would attract immediate governmental review — or they'd all have to allow Private Relay, as otherwise they'd bleed millions of customers due to being hostile to iPhone. It seems safe to assume that Apple doesn't like user APN traffic being tracked any more than the rest of their traffic, and so I would imagine this is essentially the roadmap for all Apple Services provided to their users over the next few years. It's also possible the Beta is just to see what happens when they make the traffic visible and possible to block, and having seen the carriers tending towards "block anything that inhibits tracking", they might simply target Private Relay 2.0 as "HTTP3 over 443/udp to http3.apple.com" and have that be an N-way reflector point for all customer-provided Apple services, including Private Relay and the rest as different channels over that multipath HTTP3 layer. They chose to implement Private Relay in a way that could be detected, and are measuring how neutrality-hating carriers respond. Assuming it's their final answer is not a bet I'd take.

Gigachad 5y ago
It seems like any kind of forceful action would trigger government review. The safest option to me seems to be just having a modal pop up saying "T-Mobile blocks private relay from being used". It isn't a forceful use of power by Apple and it clearly informs just the simple truth that the users carrier is hostile and maybe they want to switch.
- op00to 5y ago
  I expect my iPhone to work the same on any carrier.
  - Gigachad 5y ago
    That has never been the case. Carriers have been tampering with web traffic for a while now. If T-Mobile is specifically tampering with the network, the problem is external and out of the control of Apple.
  - floatingatoll 5y ago
    In the US, big Carrier A implements the full array of iPhone capabilities for carriers under Settings > Cellular; big Carrier B does not. Most people aren’t aware of what they’re missing, but for example, when implemented by the carrier properly, the cellular data usage heading is “this billing cycle” instead of “however long it’s been since you last clicked Reset Statistics manually”; and Settings > Phone > Call Forwarding has an iOS native UI rather than forcing you to dial 1980s-style *#12##0112636382* modem strings into the dialer. Does your carrier implement this? If not, will you switch carriers? It’s unclear what degree of importance you assign to your expectation, as it could be anything from “for the tasks I care about” to “in every possibly way without exception”. (For me: It’s not important eniugh to switch carriers on its own, though it’s certainly a factor if I have greater reasons.)
    - mariojv 5y ago
      I was always wondering why statistics never correctly showed information for my billing cycle. Admittedly, I wasn't the account holder until recently, but I never understood that it was a carrier settings. Are there other carrier-specific features that you know about? By the way, your parent comment hypothesizing about http/3 and Apple services likely being routed via Private Relay was also very insightful. The http/3 part seems quite speculative, but I could easily see the Apple services being routed over Private Relay as part of any standard "dogfooding" roadmap.
      - floatingatoll 5y ago
        There is not a lot of difference between http3 and a VPN protocol that can bundle and transport multiple bidirectional channels asynchronously, especially when considering the restriction “only uses http protocols and none other” — a quality that many Apple services share with Private Relay. It’s absolutely speculative to consider http3 a viable replacement for ”a VPN”, as many consider Private Relay to be^, but that’s not due to any technical limitation. We could benchmark Squid-over-http3 versus Wireguard VPN in various latency and packet loss scenarios today (if implemented), and get productive and interesting results. We could do the same with varnish / nginx versus openvpn / pptpd. Whether or not it supports CONNECT is worth noting, but is no obstacle for “let’s assume that everything is HTTP”, as appears widely applicable to both Apple’s services to their customers, and a significant majority of consumer VPN traffic, today. Have those benchmarks been performed yet? Are we all doing it wrong by using wireguard et al. to Mullvad et al. for 99% HTTP traffic and we just don’t realize it yet? I look forward someday to finding out the answer :) ps. iOS carrier APIs and functionality are NDA’d so I don’t have any other information or useful examples to offer, as my experience with carriers as their customer is very limited. Perhaps others will know; apologies. ^ I haven’t seen an FP yet titled “If it can’t carry SSH traffic, it’s not a VPN”, but certainly there’ll be one someday. I can’t predict when, though, anymore than I can guess when someone else will realize to seriously ask, supported by benchmarks and encapsulation overhead charts, “Should tcp be deprecated in favor of http?”. (I have no opinion on what the correct answers are at this time.)
- evilDagmar 5y ago
  Better verbiage would be "T-Mobile requires the ability to report your browsing activity to third-parties."
  - Gigachad 5y ago
    Legally much more risk since you are now assuming motives rather than stating plain facts. Even if those motives seem certainly correct.
    - krageon 5y ago
      It is a plain fact that they will have that ability.
floatingatoll 5y ago
ps. Everyone who’s reading this story and discussion, go read the report that T-Mobile only forces Private Relay off for customers who are enrolled in their content-filtering product: https://tmo.report/2022/01/t-mobile-blocking-icloud-private-relay-for-some-but-its-not-what-you-think/ https://tmo.report/2022/01/t-mobile-blocking-icloud-private-...
- JimDabell 5y ago
  There’s been an update to the article addressing this: > However, many of the users we’ve heard from, and tested ourselves, do not have any such content filtering enabled. We’ve followed up with T-Mobile for additional clarification, but have not yet heard back.
- KingMachiavelli 5y ago
  I don't know why these products are still around. They are already basically useless; from T-Mobile's site: > Visiting secured web sites (https) because encryption prevents Web Guard from seeing the content of those websites I guess T-Mobile should start downgrading HTTPS to HTTP /s
  - mh- 5y ago
    Some carriers would if they could. That's why HSTS was implemented.
- floatingatoll 5y ago
  And their confirmation of that is out today, with an iOS 15.2 bug reported to Apple as well. https://www.theverge.com/22878885/verizon-att-t-mobile-apple-icloud-private-relay-feature-supported https://www.theverge.com/22878885/verizon-att-t-mobile-apple...

Gigachad 5y ago

It seems like any kind of forceful action would trigger government review. The safest option to me seems to be just having a modal pop up saying "T-Mobile blocks private relay from being used". It isn't a forceful use of power by Apple and it clearly informs just the simple truth that the users carrier is hostile and maybe they want to switch.

op00to 5y ago
I expect my iPhone to work the same on any carrier.
- Gigachad 5y ago
  That has never been the case. Carriers have been tampering with web traffic for a while now. If T-Mobile is specifically tampering with the network, the problem is external and out of the control of Apple.
- floatingatoll 5y ago
  In the US, big Carrier A implements the full array of iPhone capabilities for carriers under Settings > Cellular; big Carrier B does not. Most people aren’t aware of what they’re missing, but for example, when implemented by the carrier properly, the cellular data usage heading is “this billing cycle” instead of “however long it’s been since you last clicked Reset Statistics manually”; and Settings > Phone > Call Forwarding has an iOS native UI rather than forcing you to dial 1980s-style *#12##0112636382* modem strings into the dialer. Does your carrier implement this? If not, will you switch carriers? It’s unclear what degree of importance you assign to your expectation, as it could be anything from “for the tasks I care about” to “in every possibly way without exception”. (For me: It’s not important eniugh to switch carriers on its own, though it’s certainly a factor if I have greater reasons.)
  - mariojv 5y ago
    I was always wondering why statistics never correctly showed information for my billing cycle. Admittedly, I wasn't the account holder until recently, but I never understood that it was a carrier settings. Are there other carrier-specific features that you know about? By the way, your parent comment hypothesizing about http/3 and Apple services likely being routed via Private Relay was also very insightful. The http/3 part seems quite speculative, but I could easily see the Apple services being routed over Private Relay as part of any standard "dogfooding" roadmap.
    - floatingatoll 5y ago
      There is not a lot of difference between http3 and a VPN protocol that can bundle and transport multiple bidirectional channels asynchronously, especially when considering the restriction “only uses http protocols and none other” — a quality that many Apple services share with Private Relay. It’s absolutely speculative to consider http3 a viable replacement for ”a VPN”, as many consider Private Relay to be^, but that’s not due to any technical limitation. We could benchmark Squid-over-http3 versus Wireguard VPN in various latency and packet loss scenarios today (if implemented), and get productive and interesting results. We could do the same with varnish / nginx versus openvpn / pptpd. Whether or not it supports CONNECT is worth noting, but is no obstacle for “let’s assume that everything is HTTP”, as appears widely applicable to both Apple’s services to their customers, and a significant majority of consumer VPN traffic, today. Have those benchmarks been performed yet? Are we all doing it wrong by using wireguard et al. to Mullvad et al. for 99% HTTP traffic and we just don’t realize it yet? I look forward someday to finding out the answer :) ps. iOS carrier APIs and functionality are NDA’d so I don’t have any other information or useful examples to offer, as my experience with carriers as their customer is very limited. Perhaps others will know; apologies. ^ I haven’t seen an FP yet titled “If it can’t carry SSH traffic, it’s not a VPN”, but certainly there’ll be one someday. I can’t predict when, though, anymore than I can guess when someone else will realize to seriously ask, supported by benchmarks and encapsulation overhead charts, “Should tcp be deprecated in favor of http?”. (I have no opinion on what the correct answers are at this time.)
evilDagmar 5y ago
Better verbiage would be "T-Mobile requires the ability to report your browsing activity to third-parties."
- Gigachad 5y ago
  Legally much more risk since you are now assuming motives rather than stating plain facts. Even if those motives seem certainly correct.
  - krageon 5y ago
    It is a plain fact that they will have that ability.

floatingatoll 5y ago

ps. Everyone who’s reading this story and discussion, go read the report that T-Mobile only forces Private Relay off for customers who are enrolled in their content-filtering product: https://tmo.report/2022/01/t-mobile-blocking-icloud-private-relay-for-some-but-its-not-what-you-think/ https://tmo.report/2022/01/t-mobile-blocking-icloud-private-...

JimDabell 5y ago
There’s been an update to the article addressing this: > However, many of the users we’ve heard from, and tested ourselves, do not have any such content filtering enabled. We’ve followed up with T-Mobile for additional clarification, but have not yet heard back.
KingMachiavelli 5y ago
I don't know why these products are still around. They are already basically useless; from T-Mobile's site: > Visiting secured web sites (https) because encryption prevents Web Guard from seeing the content of those websites I guess T-Mobile should start downgrading HTTPS to HTTP /s
- mh- 5y ago
  Some carriers would if they could. That's why HSTS was implemented.
floatingatoll 5y ago
And their confirmation of that is out today, with an iOS 15.2 bug reported to Apple as well. https://www.theverge.com/22878885/verizon-att-t-mobile-apple-icloud-private-relay-feature-supported https://www.theverge.com/22878885/verizon-att-t-mobile-apple...