Hacker News new | ask | show | jobs
by dombili 2676 days ago
It works great. As a user, I love that it's being distributed via the Mac App Store. The one and only nitpick I have is the lack of bulk import support of the config files, but that's something I can live without.

I'm looking forward to the Windows version. Thank you for taking the long and careful route with it.
2 comments
zx2c4 2676 days ago
You can bulk import by selecting a .zip archive of files, actually. But perhaps we can make the open file dialog multiselect. Good idea. I added it to the TODO list here: https://docs.google.com/document/d/1BnzImOF8CkungFnuRlWhnEpY...
link
dombili 2676 days ago
Oh, I didn't know that. ZIP import solves the issue for me, but I'm glad you've got the multi-select feature on your to-do list.
link
fauigerzigerk 2676 days ago
I am extremely unhappy about not being able to install any software on my Mac without Apple's approval. This information changes a lot for me.

I certainly hope that there are still viable workarounds at this point. But this is a step in a very dangerous direction.

link
joosters 2676 days ago
Right-click on a (non-signed) program you want to run, and select 'Open'. Now MacOS will ask if you want to run this software or not, and it can remember this decision so you can just run it as normal in the future.
link
fauigerzigerk 2676 days ago
I know. I've done that many times. But what the WireGuard guys are saying sounds like it's something very different:

"Because it uses these deep integration APIs, we're only allowed to distribute the application using the macOS App Store (whose rejections, appeals, and eventual acceptance made for quite the stressful saga over the last week and a half)"

link
akvadrako 2676 days ago
That's quite interesting - it's the first I've seen of a real world app being limited in this way and it is worrisome. I suspect if you disabled System Integrity Protection is would work, but not sure.

On iOS they've always been APIs like this - they only work via Apple approval and not dev or enterprise signatures.

link
moduspwnens14 2676 days ago
I'm an iOS/Mac dev that's released a VPN app on both app stores.

The limiting factor is that the "Network Extension" framework is the way these apps work as VPNs, and currently Mac App Store distribution is the only supported method if you're using that framework (see #8) [1].

[1] https://forums.developer.apple.com/thread/67613

link
xenadu02 2675 days ago
Macs are still macs. You can turn off SIP, disable AMFI & entitlement checks, then grant your app whatever entitlements you want and they won’t be verified.

I really really don’t recommend doing that; you’re giving up a lot of security.

A much easier alternative is to have a dev account, then you can just enable the entitlements in your provisioning profile for your dev devices (or personal devices). Most entitlements don’t require any approval for a dev profile.

link