Live data from Hacker News

Response to “WireGuard: great protocol, but skip the Mac app”

lists.zx2c4.com

321–330 of 392 posts

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#321
post #296

Earlier quoted context omitted.

Yes, he says it right in the post. They had a donation link in the about section that Apple forced them to remove because the payments weren't going through the app store payment system where they get a cut.

It might be worth appealing that rule by claiming that the payment is a donation and optional.

That would be an instance of very talented developers sinking even more of their time into Apple's despicable platform.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#322
post #303

I'm going to bookmark this reply as an example of how to take feedback and respond appropriately. Jason's explanations both take responsibility for the issues at hand and provide adequate information to understand the difficulty in resolving them. He takes responsibility for a failure in review, which is a common problem I see in engineering orgs. I'm not an Apple user but I have a lot of love for the wireguard proje…

I was going to simply upvote this comment, but I'm chiming in to agree with you because I want to complement Jason for being the kind of developer that I really respect. He provides a tool that so valuable to so many and does so while dealing with a difficult set of requirements imposed by Apple. His response to a frustrated user isn't defensive but helpful and informative. Jason sets an example that the rest of us d…

Precisely. Too often I see bad behaviour in open source communities justified with the lazy reply of "being nice does not produce good software" (multiple examples of this in yesterday's thread about suckless) and Jason's handling of this situation is a great refutation of that theory.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#323
post #47

First off, what a level-headed friendly response from a developer who is clearly frustrated by Apple's bugs and policies. As someone who has had to support commercial software this is not easy to do consistently. Second, this has significantly tempered my lusting over the new M1 macs. I think I can be content with my ThinkPad's running Linux.

Yeah, I'm wondering if my next work computer will be something different after almost 20 years of working on NeXT/Mac OS X/MacOS because I'm not sure general development will continue to be viable on the M1s. Spent another weekend moving my wife over to a new Windows machine ... not interested in that environment.

I'm being silly here but what if the Raspberry Pi became beefier over time? That would be a great platform.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#324
post #186

Earlier quoted context omitted.

This sums up my experience developing on macOS as well. Apple forces you to use broken API's and then you have to find workarounds to make your app usable. Someone should start an Apple developer support group on appledevsupport.group or something and get users to upvote broken API's (and broken terms of service: like mentioning donations are accepted in a free app!) that need fixing. Getting enough developers in one…

I don't think I've ever run into a "broken" API on MacOS. But I haven't seen a "well documented" one either. There's a lot of arcane knowledge in targeting MacOS.

I've run into broken API without even trying…core things in like AppKit and Foundation, even. Many of them get fixed, but I find it difficult to believe that you've never run into buggy API on the platform.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#325

Earlier quoted context omitted.

It might be worth appealing that rule by claiming that the payment is a donation and optional.

That would be an instance of very talented developers sinking even more of their time into Apple's despicable platform.

There's a lot of very undespicable people using the platform, unfortunately…

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#326
post #22

Earlier quoted context omitted.

I love Jason’s response and think it carries the right tone and is delivered near flawlessly. It’s clearly frustrating to deal with Apple’s platform lockdown, and he captures such in a professional and rational manner. Bravo. What bothers me is that I’ve experienced an increasing number of maintainers of supposed cross platform projects simply not care about macOS anymore to the extent that they’re openly hostile tow…

FWIW in the projects I've involved in we do get macOS-specific requests and reports from time to time but I have yet to see a macOS dev step up and contribute. There is lots of cross-platform software, which works on Linux, Windows and even BSDs; you can't expect (or feel entitled for) open source maintainers to then also go ahead and buy expensive Apple hardware just to support their idiosyncratic almost-BSD-but-not…

This is especially annoying when getting to the lower levels of programming. I'm maintaining a Rust client for SQL Server, and in recent OS X versions Apple decided with their secure framework to not support the measly TLS certificates of SQL Server (Azure, Docker). Now I have a ticket with no real help.

How I finally solved this is I got a Mac Mini from cloud, I could with a lots of trouble finally start docker in it (needed a desktop to click some icons) and test my code. This meant statically linking OpenSSL instead, which is not the greatest from a security point of view.

All of this took six months, and it was really hard to get Mac users to commit anything. It was ridiculously annoying to write and test without buying an Apple computer.

After this experience I just don't want to support any of their products anymore. Too much time wasted.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#327
post #247

Earlier quoted context omitted.

I don't think Apple cares very much about personal VPNs, only corporate ones. The number of people who gate a mac purchase on the capability to speak WireGuard is tiny. I now only connect my macs and ios devices to the internet via external VPN router/firewalls on which I have root; I can no longer invest the time to hack macOS sufficiently to permit me to ensure that no unauthorized traffic is leaving it. This means…

> I can no longer invest the time to hack macOS sufficiently to permit me to ensure that no unauthorized traffic is leaving it. > This means none of my iPads or iPhones have SIMs in them any longer If you use Apple products for personal use: you sound like a masochist. If you are forced to use them professionally: I'm sorry for you.

Neither is true. Android in the stock configuration is much the same, and the hardware is worse.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#328
post #327

Earlier quoted context omitted.

> I can no longer invest the time to hack macOS sufficiently to permit me to ensure that no unauthorized traffic is leaving it. > This means none of my iPads or iPhones have SIMs in them any longer If you use Apple products for personal use: you sound like a masochist. If you are forced to use them professionally: I'm sorry for you.

Neither is true. Android in the stock configuration is much the same, and the hardware is worse.

To the point you feel forced to use your Android phone without SIM?

I bought my android phone for less than 150€ and it does what I need (phone calls, navigation). For everything else I use a debian based distro on my laptop (in some rare case, I dual boot windows).

I really have no issues and I spent way way less than any Apple fan ever will to do basically the same thing.

Let's be honest, most people are willing to pay hefty prices for Apple's products just because of the social status they provide.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#329
post #217

Earlier quoted context omitted.

A JIT is a major potential source of malware enablement and thus a security consideration.

applogies if its an ignorant question but, if the os had proper access protections, even with a buffer overflow or other exploits to an app itself, how can that enable malware just by having a JIT?

It cannot; Apple's security policy towards third-party JITs is misguided. Such a feature is useful if you are interested in providing defense-in-depth for a JIT that you have taken effort to secure and would like stronger, hardware-backed mitigations for. The API should really be opt-in for the apps that want it–the real consumers of it are going to Chrome and Firefox.

Re: Response to “WireGuard: great protocol, but skip the Mac app”

#330
post #72

Earlier quoted context omitted.

Aeah, how much more proprietary and strange are the Apple API's going to get? They'll have control over the entire vertical, and can put all kinds of undocumented crap right in the silicon.

even to the syscall level, like the MAP_JIT flag to mmap() https://developer.apple.com/documentation/bundleresources/en... not optional and requires special app entitlements to enable. So you are not going to write portable code that has a JIT without apple-special code.

And that JIT has additional considerations on Apple silicon, where there is specific hardware that needs to be taken into account: https://developer.apple.com/documentation/apple_silicon/port...
Post reply on HN