Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Response to “WireGuard: great protocol, but skip the Mac app”

lists.zx2c4.com

Post reply on HN
Print view View original

261–270 of 392 posts

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#261

Post by andrekandre »

TwoBit wrote: post #217
wscott wrote: post #72

Earlier quoted context omitted.

even to the syscall level, like the MAP_JIT flag to mmap() https://developer.apple.com/documentation/bundleresources/en... not optional and requires special app entitlements to enable. So you are not going to write portable code that has a JIT without apple-special code.

A JIT is a major potential source of malware enablement and thus a security consideration.

applogies if its an ignorant question but, if the os had proper access protections, even with a buffer overflow or other exploits to an app itself, how can that enable malware just by having a JIT?

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#262

Post by snuxoll »

Lievelingsduif wrote: post #127
SSLy wrote: post #73

Earlier quoted context omitted.

You can put OS X in a Windows or Linux hosted hypervisor, but the Apple doesn't want you to know about it.

Hackintoshes break the TOS last time I checked. Some stuff can be built for Macs from Linux, stuff like the Godot game engine supports this. It is however a guess if they're going to allow that build or not.

Godot doesn’t build Mac binaries on Linux, the export templates provided include the platform native binaries.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#264

Post by dessant »

jaywalk wrote: post #188
dessant wrote: post #125

Earlier quoted context omitted.

Jason was planning to challenge the App Store rejection after the fix for the WireGuard regression has been published, though I'm not sure what's the current state of the issue. The rejection is wrong, because the App Store review guidelines clearly spell out that apps may request donations through Safari. On the other hand, apps cannot use in-app purchases to request donations, unless they are published by an approv…

The wording is vague enough that having a link in your app for donations could easily be (and apparently is) considered a violation.

Having a link to an external web page to receive donations is not considered a violation on the App Store, this is a mistake by a reviewer.

Collecting funds "within the app" means that the payment flow is completed without leaving the app. They explicitly list two ways for any app to accept donations, by redirecting the user to an external web service opened in Safari, or by collecting payments using a text message.

You obviously have to somehow communicate to the user that donations can be made, and that is allowed to happen by showing an external link.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#265

Post by fluidcruft »

sneak wrote: post #252
hundchenkatze wrote: post #243

Earlier quoted context omitted.

You should give Windows Subsystem for Linux a try. It's what I'd choose in your scenario. https://docs.microsoft.com/en-us/windows/dev-environment/ove...

There is the other issue that Windows is full of spyware. Most of the mac's telemetry is inadvertent and leaks much less data to the OS vendor.

I would assume any IT-issued devices are full of spyware regardless of OS vendor.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#266

Post by weitzj »

Hamuko wrote: post #258
sneak wrote: post #247

Earlier quoted context omitted.

I don't think Apple cares very much about personal VPNs, only corporate ones. The number of people who gate a mac purchase on the capability to speak WireGuard is tiny. I now only connect my macs and ios devices to the internet via external VPN router/firewalls on which I have root; I can no longer invest the time to hack macOS sufficiently to permit me to ensure that no unauthorized traffic is leaving it. This means…

I would imagine Wireguard usage in corporate networks to increase in the future, so if Apple only cares about corporate VPNs, surely there'd be reason to implement that as well. My guess would rather be that Apple at some point cared about corporate VPNs but no longer do, and that option is mainly just legacy.

If Wireguard would be certified and you can have a contract with a company to carry the risk of this VPN solution then it will gain traction. I know that technically it is probably superior and safer, but for regulatory things people might still chose Ipsec

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#267

Post by evgen »

Macha wrote: post #185
evgen wrote: post #161

Earlier quoted context omitted.

Any references for this? I have only heard of this happening when the page is clearly for donations (like this case) or almost exclusively composed of 'give us money' content.

https://news.ycombinator.com/item?id=24192021 1. App links to developer's blog. At one point the top post is about their patreon. Apple removes app until post is amended. 2. Also apparently the bandcamp app has no links to their website, for the same reason. https://news.ycombinator.com/item?id=19378914 Amazon Kindle app could not link to amazon.com as users could purchase books there without giving apple their cut

Amazon.com is nothing but a sales site so I cannot imagine why anyone would think it is anything other than a path to try to route around in-app purchases, same with Bandcamp. The one with the developer blog and a patreon link is a lot weaker, but the other two examples were explicity not allowed according to the rules at the time.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#268

Post by vaduz »

dessant wrote: post #264
jaywalk wrote: post #188

Earlier quoted context omitted.

The wording is vague enough that having a link in your app for donations could easily be (and apparently is) considered a violation.

Having a link to an external web page to receive donations is not considered a violation on the App Store, this is a mistake by a reviewer. Collecting funds "within the app" means that the payment flow is completed without leaving the app. They explicitly list two ways for any app to accept donations, by redirecting the user to an external web service opened in Safari, or by collecting payments using a text message.…

> "Having a link to an external web page to receive donations [by a registered charity or a non-profit] is not considered a violation on the App Store"

Which e.g. "PayPal@zx2c4.com" is not, clearly.

The words you are missing are important.

One of the reasons why I do not gift money to WireGuard developer(s) is that they have taken the steps to obscure where and to whom the money is going, which is in and of itself fishy. Just labelling something as 'donation' does not make it so.

[Edit: line breaks]

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#269

Post by dessant »

vaduz wrote: post #268
dessant wrote: post #264

Earlier quoted context omitted.

Having a link to an external web page to receive donations is not considered a violation on the App Store, this is a mistake by a reviewer. Collecting funds "within the app" means that the payment flow is completed without leaving the app. They explicitly list two ways for any app to accept donations, by redirecting the user to an external web service opened in Safari, or by collecting payments using a text message.…

> "Having a link to an external web page to receive donations [by a registered charity or a non-profit] is not considered a violation on the App Store" Which e.g. "PayPal@zx2c4.com" is not, clearly. The words you are missing are important. One of the reasons why I do not gift money to WireGuard developer(s) is that they have taken the steps to obscure where and to whom the money is going, which is in and of itself fi…

Only nonprofits are allowed to use in-app purchases on the App Store, while other apps must use Safari for fundraisers, read the guidelines in their entirety.

> One of the reasons why I do not gift money to WireGuard developer(s) is that they have taken the steps to obscure where and to whom the money is going, which is in and of itself fishy. Just labelling something as 'donation' does not make it so.

Your remark about WireGuard developers being fishy and obscuring where the money goes is ridiculous, and the way you framed it, just... wow.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#270

Post by ajkjk »

uncledave wrote: post #233
VonGuard wrote: post #222

Earlier quoted context omitted.

Completely agree. Apple has nothing but contempt for its developers, and treats them like indentured servants. "Oh it took 10 years to get your app working right? Well, it doesn't work right anymore after yesterday's patch."

That could be said for any platform these days. It's certainly not specific to Apple!

No, but Apple does it worst, and the fact that other companies do it doesn't excuse them in the the slightest.
Post reply on HN