iOS 14 USB tethering broken on Linux: looking for docs and contact at Apple | Hacker News Reader

iOS 14 USB tethering broken on Linux: looking for docs and contact at Apple

corsac.net

126 pointspabs350 comments

Wow, this brings back memories. I hacked on this and other iPhone support on Linux back in the day, including on getting music sync support working, back when I myself used an iPhone.

At the time I wrote usbmuxd, which implements the sync (not tethering) part of the protocol. I can now say that I had a bit of behind the scenes help from an Apple engineer; his tips helped work out some corner cases that would've been quite hard to track down otherwise. This friend sadly passed away a few years ago.

Unfortunately, Apple has always been (publicly) hostile to third party support for their devices. For example, they insist on "signing" music databases with algorithms based on their FairPlay DRM implementation, to stop non-iTunes software from syncing music to them. I reverse engineered one variant of this (which was based on a white-box AES implementation and a lot of obfuscated junk) but they kept changing the algorithm. This went into libgpod and libimobiledevice.

Make sure you also file a Radar at: http://bugreporter.apple.com

They do get triaged just not necessarily actioned depending on priorities etc.

URL doesn’t work for me, but you can also just type “applefeedback://“ in Safari to create a ticket.

That's the wrong URL. The correct URL is https://feedbackassistant.apple.com/

I suspect you meant https://bugreport.apple.com/, which is also accessible via rdar:// on consumer iOS devices. Sadly, the redirect service that has been running their ever since it was replaced by Feedback Assistant seems to not be working at the moment :(

That's the wrong URL, too. Just use https://feedbackassistant.apple.com/

It’s not the wrong URL, it’s the old URL. Until recently it was just as effective as the URL you gave.

SSL_ERROR_UNSAFE_NEGOTIATION when connecting in firefox.

https://www.ssllabs.com/ssltest/analyze.html?d=appleseed.app...

> This server is vulnerable to the Zombie POODLE vulnerability. Grade set to F.

> There is no support for secure renegotiation.

> This server does not support Forward Secrecy with the reference browsers. Grade capped to B.

> This server supports TLS 1.0 and TLS 1.1. Grade capped to B.

What the fuck?

> POODLE vulnerability.

Maybe the domain still uses the gotofail [1] prone implementation of Apple's SSL library?

[1] https://nvd.nist.gov/vuln/detail/CVE-2014-1266

Personal note:

After that CVE was disclosed in 2014, I decided to ditch all Apple hardware forever. There is absolutely no security on any Apple device. The bug meant that there was not a single working SSL encryption from Apple's first OS up until (and including) OSX 10.9.2 and iOS 7.0.6 ... which kinda speaks volumes on Q&A or security audits.

Were all of the other OS X versions affected, too? The CVE only lists 10.9.x (so, 10.9 and 10.9.1)

Yes, all previous OSX version up until 2014 were affected, too. The doubled `goto fail;` line was included since the first public revision of libsecurity_ssl, and the (c) of that file is 1999-2001,2005-2012 Apple Inc. [1]

Nowadays, due to Apple never using any git or any other version control software for opensourced codes, I could trace it down to Mac OSX 10.4 which was released in 2005. [2]

With 10.1, there's no libsecurity open sourced, I don't know why, but I'm pretty damn sure that at least 10.2 included the library back then. I don't have my old Powerbook G4 anymore, but I swear I could verify this bug on 10.2 (Jaguar) that was running on it at the time.

Other versions of (maybe patched?) versions of libsecurity-ssl are located on the same server, with a global directory for everything so it's not actually versioned!? [3]

[1] https://opensource.apple.com/source/Security/Security-55471/...

[2] https://opensource.apple.com/release/mac-os-x-104.html

[3] https://opensource.apple.com/source/libsecurity_ssl/

[4] https://opensource.apple.com/source/libsecurity_ssl/libsecur...

I usually rely upon https://aur.archlinux.org/packages/libimobiledevice-git/ via https://wiki.archlinux.org/index.php/IOS

I'm using the wifi hotspot since wired rarely works for me.

    $ sudo idevicepair pair
    No device found.

with an iPhone running 14.0.1 over USB-C

The blog post links to this libimobiledevice bug report: https://github.com/libimobiledevice/libimobiledevice/issues/... (and the debugging has led them to the kernel driver side of things, not the libimobiledevice side of things)

It gets broken every major release, sometimes even more often :(

Why do people use the USB tether? The WiFi hotspot always works perfectly, it's an open protocol etc.

USB tether is one less wireless signal to worry about. If you're tethering for a long time you're probably plugging your phone into your laptop anyway, to charge it.

I always disliked wired tether and USB cellular modems because Linux thinks it knows about the link state and will close all your sockets if you briefly lost the carrier, whereas with WiFi tethering Linux is never aware of whether the phone has a carrier or not. The ergonomics are much nicer, imho.

I admit I never tried the wired mode on iOS. Maybe it doesn't propagate the link state?

This is a silly solution, but can you solve this by creating a bridge device and putting the cellular modem (and nothing else) on the bridge? Then the link state of the bridge should remain up.

Unlike cellular modems, the iPhone acts as a router and the link state it propagates is the link state of a (virtual) interface connected to that router, independent of the state of the upstream cellular interface.

I wonder why my experience is so different. I primarily use it while taking the train to my parents and for the second part of the journey the signal is bouncing between 2g/3g/no signal but I've not encountered this.

When tethering to a desktop without WiFi. And assuming wifi-usb dongles are not an option. (They can be a little finicky on certain Linux versions)

Very good question! :-)

You can use your mobile as a Wifi-to-USB dongle and dont have to care about wireless credentials which is very nice. This is not possible with a wifi hotspot because in Hotspot mode you cannot use your wifi in parallel.

I do use that with a mobile router that supports Android's usb-cdc-ethernet adapter to forward hotel wifis when i only have one code for a single device (mac address). Or when the wifi gadget you want to use doesnt work with the captive portal. Fast and hassle free.

Personally the wifi version of wireless hotspot was always finicky for me on Linux, requiring a few restarts of the hotspot and the computer wifi to get synced up.

Wired tethering always worked instantly. Well, until now sadly :(. I tried to do this the other day and I just figured something was bugged, but I didn’t realise it is an iOS14 issue. Guess I am stuck with the wifi hotspot for now when I am out and about.

I use a desktop. USB tether works well (I have android phone, not apple) for me. Why bother setting up wifi and buy additional device to make it work with my desktop?

Three reasons for me:

* It disconnects more than once per day, requiring me to enable the wifi hotspot again on the phone

* The phone gets very hot

* It is slower than usb tethering: In my measurements, I get about 4MByte/s over USB and around 2MByte/s with wifi, though I'm not too confident in the results. According to the mobile provider, I should get 10.

EDIT: A fourth one is that the wifi hotspot leaks my first name and phone brand to everyone in the vicinity.

For the fourth point, the network uses the phone’s name set in General->About->Name, which can be anything you want. But your phone brand would probably still be leaked to those who might care by looking at the BSSID of the network (does iOS 14’s MAC address randomization affect those as well?).

That worked, thank you!

I use it to get a console for mobile safari. It does the weirdest things - like truncating input fields if they are too long

> Why do people use the USB tether? The WiFi hotspot always works perfectly, it's an open protocol etc.

My mobile is an Android device, but I believe these reasons all still apply:

* lower power consumption for both devices with wifi off

* significantly lower & more stable ping. i drop from ~44ms with a lot of jitter (a significant number of 120ms pings) to mostly stable <35ms, with a very occasional high ping.

* better-re-sharing. if i am hosting a bunch on a phone, with USB i can bring a mobile travel router with me that has much better range & works with many more users. (it's possible that wifi extender mode may emulate some of this advantage, but it would almost certainly double the jitter problem)

Bummer, I just picked up a nice little cheap GL.iNet travel router ("Mango" and "Slate" are popular models) that works (worked?) with USB tethering on iOS (presumably pre-iOS 14).

I'm sure WiFi tethering will still work with it, but it's nice to remove one potentially flaky connection from the equation.

Vice versa Android USB tethering is broken on MacOS

Apple is probably not going to help for this, sadly. I am fairly sure the details of tethering are considered to be private API and when something like that breaks (having likely been created by reverse engineering originally) they just don’t care. That being said, perhaps you’ll get some support from some skills do reverse engineers to help update that code!

There is space for "we will tell you how to works but no guarantees" between "private api" and "open spec".

Generally for Apple that space is fairly narrow.

Does Linux even exist for Apple? They are where Microsoft was 15 years ago in that respect.

Many if not most of their backend services run on Linux, which you can tell from their job postings.

I don't think their backend services tether with iphones. They wouldn't bother porting even such a fundamental tool as iTunes.

Apple has been using Linux for at least a decade.

Online Store and iTunes Store used to both run on it.

These days I imagine everything does since they use Kubernetes for Siri, Maps etc.

I'm surprised they don't use FreeBSD or some sort of in-house headless build of macOS, since their entire product line has been built around FreeBSD/POSIX base for macOS.

They can just build macOS without the GUI for that.

That was my question as well. They were on mesos, I guess even Apple settled on k8s.

It is a lot easier to hire people to work on tools there are used widely across the industry.

I went to summer house to work and got my old Linux with me. For 10 days, I was out of internet bc wifi driver (obscure brand) was also broken. It was very frustrating, now I know why!

Heh, I remember when tried to tether my iphone wifi connection to Linux desktop first time and didn't know it's not supported by design, LTE-only.

How about running Windows in a VM and utilising Wireshark to analyse the protocol?

If you manage to get anyone from Apple to speak with you send them my way also. I am the author of IOS support for DeviceFarmer ( previously OpenSTF ). Part of that support involves getting video of the screen over the USB connection which uses the same undocumented pathways that libimobiledevice uses. I've been attempting to find someone at Apple to support the open source efforts for nearly a year to no avail.

What I would like Apple to support is fetching the raw h264 stream in a documented fashion, rather than forcing one to use AVFoundation and get pre-processed frames/data. Only allowing decoded video makes it impossible to scale. ( having many devices connected to a single mac all streaming video )

It would also be awesome if they would open up and document all the protocols and operations that the lockdown protocol supports. I doubt that will ever happen though.

Doesn't there come a point where you just say "screw Apple" and leave their devices unsupported?

They're deliberately opaque and obtuse. If people choose to buy their devices then they should accept the consequences of that choice.

I'm not an Apple user. The reason I've spent the last year and a half developing an open source solution to support Apple devices is because it is a challenge and is profitable. I view myself as a sort of technological mercenary. I go where my skills are needed.

I don't own a personal mac laptop, nor do I use an iPhone. If Apple gave me a macbook pro and an iPhone I wouldn't use either. ( other than to develop software that requires those )

I do though believe in making required technical things easier for others. It is a good feeling making something possible with IOS devices that hasn't been done as open source previously.

Creating and testing IOS apps isn't something that will cease to be just because hardcore developers dislike the closed Apple ecosystem. The people who fund Apple, in my opinion, aren't hardcore geeks. They are the normal folk in the world.

My only request to Apple is to please listen to what the developers want and provide some of the information I need so that I can in turn improve the development experience for the developers that are already paying into their ecosystem.

Sitting on your high horse saying "I don't like the way big companies function" doesn't pay the bills or convince anyone you are a good engineer who will stay professional regardless of your personal feelings.

Its surprising to hear someone say open source development is profitable, what is the business model of DeviceFarmer?

Open source is profitable in two ways:

1. If the work is ultimately for a company you are working for fulltime and getting paid from the start. This is the case with IOS support for DeviceFarmer. I work fulltime for T-Mobile. I am thankful to them for allowing the majority of the resulting software to be open sourced. The reason they allowed it to be that way, and wanted it from the start, is so that we can benefit from users using the software, finding bugs, and reporting them. There have been contributions from the open source community to it as well that have been very helpful.

2. By providing paid support for an open source project. There is a great need right now for someone ( and/or many someones ) to work with companies to get DeviceFarmer setup and working well for their needs. I do this a little bit on the side myself, but it is tricky because I don't have much time remaining after my day job to do so, and I have to be careful not to let it become a conflict of interest.

DeviceFarmer as a entity is a collection of key personnel who have been maintaining OpenSTF. I believe all of them are fulltime employees of various companies that use it internally and contribute to it to address their own needs. I joined the core team as a result of writing IOS support for it ( I say "writing", despite also porting in a large chunk of IOS support from other open source contributors; mrx in specific )

Right now DeviceFarmer isn't a legal entity. There is no company or non-profit currently. It is just a bunch of developers cooperating. We have considered creating a non-profit company for it, but it has not been done yet. The members of the group are spread out internationally.

The original main author(s) of OpenSTF formed the company HeadSpin out of it, and offered it as a commercial project. Very recently the company collapsed as a result of internal corruption, but the project itself lives on. Really they had abandoned OpenSTF 2-years ago anyway. The rebranding to DeviceFarmer instead of OpenSTF is to move the project to being open and no longer restricted by HeadSpin.

HeadSpin themselves refused to ever accept contribution of IOS support into the OpenSTF project, because IOS support was one of the main differences in their commercial offering. They refused to ever open source that portion of OpenSTF. Forking the project was necessary to allow this. Essentially the entire community has moved to the fork and abandoned OpenSTF. The crumbling of HeadSpin sealed the deal and OpenSTF is essentially no more.

Another option than creating your own legal entity is to join a fiscal sponsor of open source projects, like Software Freedom Conservancy, Software in the Public Interest or one of the other open source foundations:

https://sfconservancy.org/ https://www.spi-inc.org/ https://flossfoundations.org/foundation-directory

Reply on news.ycombinator.com