Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Response to “WireGuard: great protocol, but skip the Mac app”

lists.zx2c4.com

Post reply on HN
Print view View original

31–40 of 392 posts

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#31

Post by segfaultbuserr »

> We faced rejections in submitting the app, because they decided to change their policy on the app having a link in the "About WireGuard" tool window to www.wireguard.com/donations/ (which they previously had allowed explicitly; now they want 30% or something)

Last year Google started to ban donation links in FOSS apps, WireGuard was one of the first victims [0], completely removed from the store. I didn't know that Apple also started doing the same and hit WireGuard again. Extending the definition of an "in-app payment" to a link to the project homepage in the "About" window that doesn't buy any good or service related to the app is an overzealous restriction. Especially so when that button is clicked by, perhaps, only 10% of the users. This is just evil.

[0] Open-source apps removed from Google Play Store due to donation links

https://news.ycombinator.com/item?id=21268389

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#32

Post by liaukovv »

dcow wrote: post #22
alias_neo wrote: post #7

This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. In my day job, our Apple developers have spent years finding solutions to iOS restrictions around CallKit, Push Notifications and NSTodaysProblem, and those are just the things Apple has intentionally restricted…

I love Jason’s response and think it carries the right tone and is delivered near flawlessly. It’s clearly frustrating to deal with Apple’s platform lockdown, and he captures such in a professional and rational manner. Bravo. What bothers me is that I’ve experienced an increasing number of maintainers of supposed cross platform projects simply not care about macOS anymore to the extent that they’re openly hostile tow…

Being cross-platform is not the same as supporting every platform in existence

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#33

Post by unclekev »

I didn't know about WireGuard before the initial post on HN, since then it's replaced my OpenVPN solution to access things on my home network stuck behind a 5G mobile CGNAT (no wired service available)

I haven't had any issues with the Mac app, but for where the app may be lacking because of the circus that is developing with Apples frameworks and app store it makes up in being absolutely amazing behind the scenes.

All the other solutions I've tried have taken weeks of learning and tweaking configs. Had the entire WireGuard solution going end to end in a few hours.

It's super simple, lightweight, reliable and easy to understand.

It's a shame Apples app store policies and being forced to work with buggy frameworks is holding back developers abilities to write first class native software for MacOS.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#34

Post by formerly_proven »

dcow wrote: post #22
alias_neo wrote: post #7

This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. In my day job, our Apple developers have spent years finding solutions to iOS restrictions around CallKit, Push Notifications and NSTodaysProblem, and those are just the things Apple has intentionally restricted…

I love Jason’s response and think it carries the right tone and is delivered near flawlessly. It’s clearly frustrating to deal with Apple’s platform lockdown, and he captures such in a professional and rational manner. Bravo. What bothers me is that I’ve experienced an increasing number of maintainers of supposed cross platform projects simply not care about macOS anymore to the extent that they’re openly hostile tow…

FWIW in the projects I've involved in we do get macOS-specific requests and reports from time to time but I have yet to see a macOS dev step up and contribute.

There is lots of cross-platform software, which works on Linux, Windows and even BSDs; you can't expect (or feel entitled for) open source maintainers to then also go ahead and buy expensive Apple hardware just to support their idiosyncratic almost-BSD-but-not-really-UNIX OS.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#35

Post by DaiPlusPlus »

w0utert wrote: post #19
schoolornot wrote: post #5

As a Mac admin VPP/App Store distribution is still quite finicky. I don’t understand why Apple has to flex and restrict NetworkExtension/VPN apps to Mac App Store. More iOS-ification of the OS.

Reading through the explanation IMO the problem is not that Apple wants to force VPN apps to use frameworks and a distribution model they feel best fits their security/safety model. There are good arguments to be made for that. The problem is that the framework itself is just shitty and Apple should improve it. This is one of the things I dislike most about Apple: even despite the high price I pay for their products…

> especially since they have basically been printing money for over ~10 years now and have no excuses to not improve these kinds of things.

Apple can't hire enough devs.

I told an SWE friend of mine at Apple that I wouldn't mind working there - then he explained to me how restrictive it is to work at Apple (e.g. you have to close your GitHub account, you can't do any moonlighting or FOSS contributions: even on your own time, on your own hardware, while on vacation) - I can't work at a place that wants to exert that much control over my personal life. I get that secrecy is part of being an Apple, but it feels the same as how I thought it'd be cool to work for the FBI's infosec team before I learned that they have mandatory regular drug-testing even for employees in states where cannabis is legal.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#36

Post by DaiPlusPlus »

pilif wrote: post #26
perryizgr8 wrote: post #18

I don't get it. You cannot write a VPN app for MacOs and let people just download the executable from your website? Pretty sure I've never opened the app store on my laptop and still have a VPN installed.

that's using older and deprecated frameworks including possibly kernel extensions, all of which are going to go away in the future. Wireguard is using the newer and non-deprecated NetworkExtension framework which requires an entitlement that's only given to app-store apps.

Apple can't possibly get rid of kernel extensions - that's the only way to really extend a system in new and innovative ways (user-mode drivers are more like glorified serial-port applications). So much of Apple's platform today is made up of features that were only possible by extending the OS (e.g. Multi-Finder).

Apple's going to have trouble if they keep on hindering the people that made their platform and support their ecosystem.

Apple is not living up to their "Think Different" ethos: http://www.thecrazyones.it/spot-en.html

Apple in 1997:

  Here's to the crazy ones.  
  The misfits.  
  The rebels.  
  The troublemakers.  
  The round pegs in the square holes.  
  They're not fond of rules.
  And they have no respect for the status quo.
Apple 2021:

> Follow our poorly-explained, underdocumented, and arbitrarily applied rules or we'll ban you from the App Store.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#37

Post by nbzso »

dcow wrote: post #22
alias_neo wrote: post #7

This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. In my day job, our Apple developers have spent years finding solutions to iOS restrictions around CallKit, Push Notifications and NSTodaysProblem, and those are just the things Apple has intentionally restricted…

I love Jason’s response and think it carries the right tone and is delivered near flawlessly. It’s clearly frustrating to deal with Apple’s platform lockdown, and he captures such in a professional and rational manner. Bravo. What bothers me is that I’ve experienced an increasing number of maintainers of supposed cross platform projects simply not care about macOS anymore to the extent that they’re openly hostile tow…

As a long-time Apple user, I agree with developers on this. Give it time and they will abandon the platform, which is not geared to be anything more than a vertically integrated channel for money. "but if you’re not interested in spending it actually supporting macOS, don't market your project as a cross platform" This is again Apple driven effect. Most of the Open Source projects are cross-platform because of Mac Os X, not what Mac Os is now. I advocate for Linux as a platform with real control over computing and hope developers realizing that this is a chance for Linux to become desktop heaven. My main workflow is design-focused and if software like Affinity Design or Sketch was available today I will remove anything Apple-related from my job.

There is a lot of graphic design and video professionals that will jump the ship. We have Blender, and Resolve is working under Linux, but Inkscape and Gimp are not capable enough to replace Sketch/Affinity/Adobe Illustrator/Photoshop.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#38

Post by OJFord »

alias_neo wrote: post #13
OJFord wrote: post #10

Earlier quoted context omitted.

> This appears to be a very typical response from an Apple user who doesn't understand the lengths and hoops developers have to jump through to work around Apple's many, many restrictions, bugs and limitations. Eh? Isn't that a description of the original complaint, and the 'a response' submitted here is from WireGuard creator/lead Jason/zx2c4 explaining much as you do the restrictions, bugs, and limitations he's tri…

Apologies, I indeed meant the original post to which Jason was responding. By "response" I meant the response of the user to the WireGuard Mac app. Again apologies, I somehow jumped a few mental hoops of my own when commenting.

Ah no worries, just misunderstood since between you and the submitter both sides got called a 'response'. Bloody English language, eh!

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#39

Post by pilif »

DaiPlusPlus wrote: post #36
pilif wrote: post #26

Earlier quoted context omitted.

that's using older and deprecated frameworks including possibly kernel extensions, all of which are going to go away in the future. Wireguard is using the newer and non-deprecated NetworkExtension framework which requires an entitlement that's only given to app-store apps.

Apple can't possibly get rid of kernel extensions - that's the only way to really extend a system in new and innovative ways (user-mode drivers are more like glorified serial-port applications). So much of Apple's platform today is made up of features that were only possible by extending the OS (e.g. Multi-Finder). Apple's going to have trouble if they keep on hindering the people that made their platform and support…

> Apple can't possibly get rid of kernel extensions

they are though. It's getting harder and harder to get them loaded (on an M1 Mac, getting an extension loaded will require 4 reboots and a journey through the recovery environment).

I'd say that within the next 2-3 macOS releases, kernel extension won't be loaded at all any more and only user-space APIs will be available for third-parties (including drivers).

From a security perspective, this is a huge benefit to users of course, but I agree that at least for advanced users, the ability to patch the kernel at random would still be beneficial for some use-cases.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#40

Post by w0utert »

DaiPlusPlus wrote: post #35
w0utert wrote: post #19

Earlier quoted context omitted.

Reading through the explanation IMO the problem is not that Apple wants to force VPN apps to use frameworks and a distribution model they feel best fits their security/safety model. There are good arguments to be made for that. The problem is that the framework itself is just shitty and Apple should improve it. This is one of the things I dislike most about Apple: even despite the high price I pay for their products…

> especially since they have basically been printing money for over ~10 years now and have no excuses to not improve these kinds of things. Apple can't hire enough devs. I told an SWE friend of mine at Apple that I wouldn't mind working there - then he explained to me how restrictive it is to work at Apple (e.g. you have to close your GitHub account, you can't do any moonlighting or FOSS contributions: even on your o…

That's crazy and stupid, no argument about that. But even if they refuse to change that culture (which they should) they could still 'fix' that problem by throwing more money at it, everybody has their price.
Post reply on HN