News for hackers. Stuff that matters.
Re:Apple's “iCloud Private Relay” broke risk based authentic... by marcinzm on Wednesday July 07, 2021 @01:13PM (#27763445)
>(No-one is going to switch off private relay to convenience a single website)

If you're a seller and a decent chunk of your income comes from Etsy you definitely would. They already do that with avoiding VPNs to not get suspended.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by barkerja on Wednesday July 07, 2021 @01:45PM (#27763820)
How many average Etsy users do you think would know that iCloud Private Relay is the cause of their issues?
Re:Apple's “iCloud Private Relay” broke risk based authentic... by danudey on Wednesday July 07, 2021 @04:01PM (#27765176)
They will google it and find a forum result somewhere that says "If you have iCloud, try turning off Private Relay. This solved the problem for me!" followed by a dozen other people saying 'Thanks so much, this fixed it for me too!"

At least, it would if their Etsy accounts weren't getting locked until they can contact support.

That said, the Etsy app won't be subject to Private Relay, so if the functionality is there then a lot of users won't have to worry about it as much.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by lewisinc on Wednesday July 07, 2021 @07:52PM (#27767098)
> They will google it

I'm sorry to tell you this, but sooo many people in the US alone are not technically literate enough to know how to debug an issue like this.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by katbyte on Wednesday July 07, 2021 @05:29PM (#27765924)
You may be putting too much faith in non technical people googling their way to a solution you or I would easily find..
Re:Apple's “iCloud Private Relay” broke risk based authentic... by user-the-name on Wednesday July 07, 2021 @05:15PM (#27765812)
> That said, the Etsy app won't be subject to Private Relay

Why? As far as I know it will apply to apps as well.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by danudey on Wednesday July 07, 2021 @07:11PM (#27766816)
Per the WWDC talk on it: https://developer.apple.com/videos/play/wwdc2021/10096/

> In iOS 15 and macOS 12, Private Relay will apply to all web browsing in Safari, all DNS name resolution queries, and a small subset of traffic from apps.

> Specifically, this will include all insecure HTTP traffic, such as TCP port 80.

This implies that app traffic won't apply to HTTPS traffic, which supports my assertion, but then later in the video:

> Not all networking done by your app occurs over the public internet, so there are several categories of traffic that are not affected by Private Relay.

> Any connections your app makes over the local network or to private domain names will be unaffected.

> Similarly, if your app provides a network extension to add VPN or app-proxying capabilities, your extension won't use Private Relay and neither will app traffic that uses your extension.

> Traffic that uses a proxy is also exempt.

So this says that HTTPS traffic will be included, which disproves my assertion, and seems more likely to be true.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by user-the-name on Wednesday July 07, 2021 @07:16PM (#27766852)
Yeah, they are not being very clear, which is nothing new for Apple. But usually, you get closest to the truth if you look at what their intent is, and in this case, the intent is to limit the ability to track users, and there is no reason they would make a distinction between web users and app users there.
Re:Apple's “iCloud Private Relay” broke risk based authentic... by breakfastduck on Wednesday July 07, 2021 @06:17PM (#27766380)
You would, sure.

99.9% of etsy userbase would not.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by Waterluvian on Wednesday July 07, 2021 @08:15PM (#27767214)
If there’s one lesson I badly want to see all engineers learn is that odds are they haven’t the faintest clue what it’s like to be a typical user.

99% of computer users do not inhabit the same galaxy as you do when it comes to understanding and managing technical details.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by breakfastduck on Friday July 09, 2021 @11:24AM (#27784632)
I feel you there. I’m a PO so have those kind of arguments regularly!

At the same time, 99% of computer users have no idea why we can’t just ‘slap x button there and make it do x’ and that is just as infuriating.

Re:Apple's “iCloud Private Relay” broke risk based authentic... by Waterluvian on Saturday July 10, 2021 @08:59PM (#27797675)
So true. And even other engineers too.
Re:Apple's “iCloud Private Relay” broke risk based authentic... by novok on Wednesday July 07, 2021 @01:36PM (#27763730)
Etsy does something similar with vpns where they serve a blank page if you try to access it. They don’t even throw up an error message.

That prevents buyers from buying also.

Etsy will adapt, quickly.