Post

Replies

Boosts

Views

Activity

Reply to The HTTP POST request is split into two TCP packets
To rephrase the above (correct) reply... TCP is a stream service, and not a datagram service. There is no correlation between the numbers of writes and the numbers of reads performed, just in the total volume of data transferred. Or you can get a network error when the transfer fails to complete, of course. Receiving an incoming kilobyte-sized transfer in one read, or obtaining that same arriving kilobyte data in a thousand single-byte reads, or anything between those two, are all equally valid and all possible. Your apps are responsible for finding the beginning and the end of your data in the stream. This includes potentially reading and receiving part of some subsequent kilobyte-sized hunk of data also arriving at the end of one of your previous reads, if you allowed enough room in your read for that data. Again, do not think of records or datagrams or numbers of reads and writes here. Not with TCP. Not with TLS, for that matter. As for servers receiving HTTP or HTTPS (slowly), there are attacks that leverage similar behaviors. Slowloris is an example.
Aug ’22
Reply to macOSX,How can I achieve a safe space on the same computer.Realize a multi-purpose machine
You're seemingly headed for what is known as mandatory access controls with compartmentation; a trusted execution environment. Mandatory controls do get expensive to build and operate, and mandatory controls are gnarly to manage, too. And macOS doesn't particularly support mandatory controls for user apps, and particularly not after Xcode 9 and macOS High Sierra and TrustedBSD. The usual response to these requirements is multiple "system high" Macs, or maybe multiple guests in a VM if your local security policy allows that. Which also gets expensive, but less so. All as you seem to be aware. If you really need this isolation for your apps, then SELinux might interest. Intel tried providing something similar to your requirements with SGX, but has seemingly largely given up on this outside of servers. Apple doesn't offer anything similar to third-party developers. PS: For low-level information on macOS, the set of books comprising the New OSX Book might interest. PPS: You'll likely need to discuss these requirements with the folks managing the content filter and endpoint security on this Mac.
Topic: App & System Services SubTopic: Core OS Tags:
Aug ’22
Reply to Send and receive IP packets from iOS
Data sent over an IP network uses IP packets. Only. If I ignore the (confusing to me) TCP and UDP phrasing you’ve used here, I’d consider an IP tunnel (usually TLS wrapped, maybe using GRE or stunnel, etc) connection, or creating a custom protocol router that extracts the app data and forwards that via TLS (stream) or DTLS (datagram). The former tunnel wraps (encapsulates) the existing IP traffic, the latter router preferably sends only the app data. The choice of stream or datagram depends on the details of the LAN-local (Bluetooth) data. If the data is status data and periodic updates and some can (rarely) be lost (read: datagram), then UDP or (preferably, secure) DTLS. If some of the data can’t be dropped (read: stream), then TCP or QUIC or (preferably, secure) TLS.
Aug ’22
Reply to Can Core Data be accessed from other platforms?
If you’re asking whether Core Data is a good choice for a local object persistence across platforms, no. If you’re looking for remote data or object persistence, S3, Firebase, and other options exist. There are frameworks such as Parse that avoid being tied into one backend hosting vendor, as well. Programming language choices and local or backend data storage choices all factor into these decisions.
Jul ’22
Reply to OPENSSL@3 and Monterey - Fickle Partners?
I'd suggest using your own real and registered domain, or using a subdomain of a real and registered domain of yours. Making up bogus TLDs is getting tougher by the day too, with the thousands of new TLDs ICANN has been adding in recent years. For this case, I'd suggest avoiding re-use of an RFC-reserved domain, as getting creative with .local (e.g. ali.ourseventh.local) tends not to end well. Leave all of .local to mDNS. Using your own domain or subdomain, set up your own authoritative DNS server, set up DHCP for your local client MAC addresses or (workable, but less desirable) set up static addresses on the clients, and allocate consistent IP addresses for hosts with certificates. Then load and trust your private root public certificate onto each client, and load your leaf certificates onto the servers.
Jul ’22
Reply to Network.Framework ICMP/Ping
Network Framework? Don't think that'll work. ICMP is too far down the network stack. You're probably for CFSockets, as described here: https://www.rderik.com/blog/building-a-server-client-aplication-using-apple-s-network-framework/ Some related information and apps: https://pwhois.org/lft/ https://dublin-traceroute.net https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay
Jun ’22
Reply to Does my app use non exempt encryption?
In years past, the answer to this was no. Admins had access to chats. For details, there's a StackOverflow 2018 thread entitled End to end encryption with Firestore with some background. More generally, if you're not prepared to be subpoenaed into some court or committee somewhere to defend your answer and your implementation should things go sideways, then "no" is the safest answer. That, or check with your local legal staff, if you have one. Rather than Telegram or WhatsApp, Signal would likely be the most likely comparison. Telegram didn't (and may still not) default to encrypted 1:1 chats, unless the user selected the "secure chat" setting. See page 177 and following for Apple's answer for iMessage, and the considerations cited by Apple: https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf
Jun ’22
Reply to iOS game App Rejected due to App Unresponsive
FTP is older than IP. Yes, really. It's that old. FTP severely allergic to firewalls and modern networks, and leaks credentials in cleartext. Firewalls have to sniff the FTP traffic to permit FTP to pass the firewall. And many firewalls just block FTP traffic. If you're not using those FTP credentials (and since you're using FTP, the credentials are just going to leak), see if using HTTPS and UnityWebRequest works for your needs... https://docs.unity3d.com/ScriptReference/Networking.UnityWebRequest.html
Jun ’22
Reply to What is the purpose of the Virtualization framework?
Different hypervisor / virtualization vendors have different requirements, different storage formats, different expectations, and use very different paravirtualization schemes. Virtualization Framework means the vendors can potentially avoid tying into the hardware directly, and quite possibly also conflicting with each other and with macOS. VF means better abstractions both for the hypervisor vendors, and better flexibility for Apple. The hypervisors apps don't need quite as many details of lower-level processor hardware implementations. Apple then has opportunities around implementing lower-level and architectural changes, while disrupting fewer apps and vendors. VF may mean the ability to dedicate parts of the hardware run-time environment to a specific app and its timing and resource requirements, dedicating virtual cores, rather than sharing cores and scheduling. This might provide a resource-intensive or latency-sensitive app with better timing, and interfering less with the rest of macOS. VF also provides a path for vendors to reduce or eliminate kernel code, and which has been a long-time security and stability and control goal for Apple. TL;DR: it makes hypervisors into something closer to standard apps, and rather further from hunks of the kernel written by others.
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’22
Reply to Prevent iOS from killing the app while suspended
Re-code the app to contend with what can and variously will happen here; that the app can quite possibly be suspended and resumed. That re-coding might involve storing the data locally and/or queuing an event for later, or contacting a remote server and logging / tracking the activity there. And as for your questions, no, and no. https://developer.apple.com/documentation/uikit/app_and_environment/scenes/preparing_your_ui_to_run_in_the_background/about_the_background_execution_sequence https://developer.apple.com/documentation/uikit/app_and_environment/scenes/preparing_your_ui_to_run_in_the_background/extending_your_app_s_background_execution_time
Topic: App & System Services SubTopic: Core OS Tags:
Jun ’22