5 ms·
> The SDK’s config ships a flag “use_netifs”: true. That flag triggers code in the SDK binary that constructs its NWConnection with a specific required interfac
by calcifer 3mo ago
> The SDK’s config ships a flag “use_netifs”: true. That flag triggers code in the SDK binary that constructs its NWConnection with a specific required interface: en0 (WiFi) or pdp_ip0 (cellular), rather than using the system default route.
> On iOS, this bypasses any configured VPN’s tun0 interface entirely. The peer tunnel does not cross a user-configured VPN, even when the rest of the app’s HTTPS traffic does.
What's a legitimate use case for this API? When/why should an app be allowed to bypass a user-configured VPN?
- picofarad 3mo ago> When/why should an app be allowed to bypass a user-configured VPN? temporarily if full tunnelling isn't working, one can split tunnel to route around issues due to VPN But imo an app should never bypass something like a network boundary.
- kotaKat 3mo agoLook at how far TikTok can go if you try blocking DNS. The hardcoded IPs, self-DNS-resolution and cat-and-mouse game of blocking is quite... interesting.
- vsgherzi 3mo agoIs there anywhere I could read more about this ?
- kotaKat 3mo agohttps://github.com/M4jx/TikTokBlocklist https://github.com/M4jx/TikTokBlocklist I think they may have scaled back from this, but they were running a 100% malware-style playbook to hit the Tiktok servers like it was some kinda sketchy C2 package. Lots of attempts of their own DoH (and DoT!) and normal DNS servers to try to get into the Tiktok network.
- chmod775 3mo ago> What's a legitimate use case for this API? When you're the application providing the VPN or when you're any app built to communicate with something on a local-ish network, not something actually reachable globally.