3 ms·

Fun fact: the WireGuard macOS client application cannot work on macOS unless it's distributed via the App Store - Apple simply will not provide the required VPN

by sneak 3y ago

Fun fact: the WireGuard macOS client application cannot work on macOS unless it's distributed via the App Store - Apple simply will not provide the required VPN entitlements for web/self distributed apps. You can use the commandline wg tools (which use a different OS API) but not the GUI ones. This means that WireGuard-the-org can't distribute the mac GUI app directly, and if you want to use the official WireGuard app (eg for accessing a VPN for privacy), somewhat ironically you have to ID yourself (which requires a phone number) and your computer's hardware serial to Apple first to download it via the App Store. It smacks of the totalitarian rms "right to read" essay - provide strong ID and hardware unique identifiers to be allowed to download and use privacy software on your own computer. https://www.wireguard.com/install/ https://www.wireguard.com/install/ While not directly relevant to fly.io, I figured this might be relevant in the context of Apple's other anticompetitive actions this week related to web-based native app distribution on iOS in the EU for the DMA. This issue with VPN apps has been true on macOS for years. I personally didn't know why WireGuard didn't offer direct downloads, but I emailed Jason Donenfeld a couple years ago and he let me know that Apple has been restricting these APIs in non-AppStore apps, which was news to me, as I didn't know that Apple had started any of their AppStore-only bullshit on macOS.

Corrado 3y ago
This is not entirely accurate. macOS now has System Extensions[0], which allow you to tie into the network to provide VPN services. This is what Tailscale uses in their non-App Store downloaded app. [0] https://developer.apple.com/system-extensions/ https://developer.apple.com/system-extensions/
- sneak 3y ago
  https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... It appears that they will now give out these entitlements for non-MAS apps, but only to members of their developer program. This means that you can't build one that will work on macOS without IDing yourself to Apple, so you still can't build it from scratch from source (as a non-developer-program person) and expect it to work (without disabling SIP).
traceroute66 3y ago
> the WireGuard macOS client application cannot work on macOS unless it's distributed via the App Store That's bullshit and I'm pretty sure you know it. This is a technical forum and you should know better than to spread unsubstantiated Apple-bashing FUD. MullvadVPN and ProtonVPN are two very well known VPN providers who's VPN apps you will not find on the Apple App Store and instead you are invited to download from their respective websites. It has been that way basically forever (or at least a very long time now we're in 2024), so its not like its a reflection of a recent Apple change either. I actually quite like the fact that WireGuard is distributed via the Apple App Store and I thank them for doing that. It makes updating much easier, rather than having a dozen apps each with their own update process.
- sneak 3y ago
  Those use different (less efficient, older, and perhaps deprecated-in-the-future) APIs. I encourage you to try to build a working copy of the official WireGuard macOS app from source without an ADP membership. You can't. https://git.zx2c4.com/wireguard-apple/about/ https://git.zx2c4.com/wireguard-apple/about/ https://git.zx2c4.com/wireguard-apple/tree/Sources/WireGuardApp/Config/Developer.xcconfig.template https://git.zx2c4.com/wireguard-apple/tree/Sources/WireGuard...
  - traceroute66 3y ago
    > Those use different (less efficient, older, and perhaps deprecated-in-the-future) APIs. Your original statement is still bullshit. You said "Apple simply will not provide the required VPN entitlements for web/self distributed apps". I've clearly demonstrated that statement is just plain wrong. MullvadVPN and ProtonVPN are not distributed via the AppStore and they work and are not blocked by MacOS.
  - bananapub 3y ago
    > Those use different (less efficient, older, and perhaps deprecated-in-the-future) APIs. then correct your initial post, which says something entirely different: > Fun fact: the WireGuard macOS client application cannot work on macOS unless it's distributed via the App Store - Apple simply will not provide the required VPN entitlements for web/self distributed apps. You can use the commandline wg tools (which use a different OS API) but not the GUI ones. it really is increasingly annoying that people just post nonsense on HN to back up their dumb prejudices.
deleted 3y ago
[deleted]
apitman 3y ago
Are you sure this isn't about Apple trying to prevent users from accidentally installing backdoor VPNs from apps that Apple hasn't vetted? I've run into the same thing on Windows. You basically can't even run a Golang app unless it's signed, and code signing is basically a racket (~$400/year) unless you distribute through the official stores. Note defending the current state of things, but I can understand how we got here and it may not be malicious on Apple's part.

by sneak 3y ago

Corrado 3y ago

This is not entirely accurate. macOS now has System Extensions[0], which allow you to tie into the network to provide VPN services. This is what Tailscale uses in their non-App Store downloaded app. [0] https://developer.apple.com/system-extensions/ https://developer.apple.com/system-extensions/

sneak 3y ago
https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_networking_networkextension https://developer.apple.com/documentation/bundleresources/en... It appears that they will now give out these entitlements for non-MAS apps, but only to members of their developer program. This means that you can't build one that will work on macOS without IDing yourself to Apple, so you still can't build it from scratch from source (as a non-developer-program person) and expect it to work (without disabling SIP).

traceroute66 3y ago

> the WireGuard macOS client application cannot work on macOS unless it's distributed via the App Store That's bullshit and I'm pretty sure you know it. This is a technical forum and you should know better than to spread unsubstantiated Apple-bashing FUD. MullvadVPN and ProtonVPN are two very well known VPN providers who's VPN apps you will not find on the Apple App Store and instead you are invited to download from their respective websites. It has been that way basically forever (or at least a very long time now we're in 2024), so its not like its a reflection of a recent Apple change either. I actually quite like the fact that WireGuard is distributed via the Apple App Store and I thank them for doing that. It makes updating much easier, rather than having a dozen apps each with their own update process.

sneak 3y ago
Those use different (less efficient, older, and perhaps deprecated-in-the-future) APIs. I encourage you to try to build a working copy of the official WireGuard macOS app from source without an ADP membership. You can't. https://git.zx2c4.com/wireguard-apple/about/ https://git.zx2c4.com/wireguard-apple/about/ https://git.zx2c4.com/wireguard-apple/tree/Sources/WireGuardApp/Config/Developer.xcconfig.template https://git.zx2c4.com/wireguard-apple/tree/Sources/WireGuard...
- traceroute66 3y ago
  > Those use different (less efficient, older, and perhaps deprecated-in-the-future) APIs. Your original statement is still bullshit. You said "Apple simply will not provide the required VPN entitlements for web/self distributed apps". I've clearly demonstrated that statement is just plain wrong. MullvadVPN and ProtonVPN are not distributed via the AppStore and they work and are not blocked by MacOS.
- bananapub 3y ago
  > Those use different (less efficient, older, and perhaps deprecated-in-the-future) APIs. then correct your initial post, which says something entirely different: > Fun fact: the WireGuard macOS client application cannot work on macOS unless it's distributed via the App Store - Apple simply will not provide the required VPN entitlements for web/self distributed apps. You can use the commandline wg tools (which use a different OS API) but not the GUI ones. it really is increasingly annoying that people just post nonsense on HN to back up their dumb prejudices.

deleted 3y ago

[deleted]

apitman 3y ago

Are you sure this isn't about Apple trying to prevent users from accidentally installing backdoor VPNs from apps that Apple hasn't vetted? I've run into the same thing on Windows. You basically can't even run a Golang app unless it's signed, and code signing is basically a racket (~$400/year) unless you distribute through the official stores. Note defending the current state of things, but I can understand how we got here and it may not be malicious on Apple's part.