Apple's iOS 9 Breaks VPNs

← Back to Stories (view on slashdot.org)

Posted by timothy on Monday September 21, 2015 @04:17AM from the but-I-love-my-central-posterior-nucleus dept.

An anonymous reader writes with a report from The Stack that researchers have discovered a crucial security problem in the latest version of iOS 9: it breaks VPN connections to corporate servers. According to the linked piece, "The flaw was first detected in the iOS 9 beta, and has not been fixed in the released version. Neither has the bug been removed in the current iOS 9.1 beta." The workaround might not be what you want to hear, either, if you've happily upgraded to the latest version: it's to downgrade to iOS 8.4.1.

88 comments

Min score:

Reason:

Sort:

Good for the minnions by Anonymous Coward · 2015-09-21 04:23 · Score: 3, Funny

All the C-levels will be disconnected so we can get work done.
And here I thought Apple was a true business player.
1. Re:Good for the minnions by MouseR · 2015-09-21 04:31 · Score: 5, Informative
  
  We're using Cisco's VPNs at the office and I've not observed it to be broken under iOS 9. Ditto for a colleague of mine.
2. Re:Good for the minnions by zlives · 2015-09-21 04:34 · Score: 5, Informative
  
  FTA "Most notable is that when doing split tunneling, the Tunnel All DNS option no longer functions as expected."
  your setup maybe using public dns or published apps like Citrix.
3. Re: Good for the minnions by Anonymous Coward · 2015-09-21 05:18 · Score: 0
  
  OpenVPN still seems to work fine to get to my office
4. Re:Good for the minnions by gweihir · 2015-09-21 10:35 · Score: 1
  
  So I take it this is a set-up where just some traffic goes into the tunnel? I did that with OpenVPN on Linux a while ago. Was a bit tricky and required policy-based routing because of DNS.
  But if so, I gather the tunnel gets established fine, but routing of DNS-packets does no work as it should?
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 04:24 · Score: -1, Flamebait

Ha, can't believe I read this along with the fake developer hacks (xCode fake apps) and Apple is serious about getting into enterprise. These people know nothing about enterprise and never will. Apple sells tech candy to sugar junkies in consumer markets. That's all they do, and all they are capable of doing.
1. Re:Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 04:56 · Score: 1, Informative
  
  Yes, please use Android.
  Whoops: https://code.google.com/p/andr...
2. Re:Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 04:58 · Score: 1, Funny
  
  BlackBerry wins again. Boom
3. Re:Of course Apple wants into enterprise though? by Ayanami_R · 2015-09-21 05:03 · Score: 4, Interesting
  
  They have a LOT to do. We have had to switch our clients over to a chip and pin AD login from a regular local account. There is no easy way to do this, We can't apply the new security to the old accounts directly, or so I am told, so we have had to make another account and then "port" the old account data into the new one. Time machine broken, because it is protected by UID, no matching UID no backup, period. Keychain wonkiness, everything you know can go wrong with a keychain, has. Dropbox broken, easily fixed, but still... The best part, when 10.11 comes out no one can update because it will break al the chip and pin stuff and users won't be able to login. We have had to send 2 FAQ's on dealing with the asininity of all of this, and we are still stumbling across issues. One of my co-workers is tasked with something to do with programmers and root, that does not like these new accounts. No, I am not helping with that crap. BTW, when this happened with windows, they just pushed a package that did all the wizardry, which was simply installing a card reader driver, and a script that made sure that if there was a matching local account UID that it inherited that account.
  That brings me to the next issue, patch management, or rather the lack of it. When 10.11 comes out we have to hope everyone listens, because otherwise we're playing fun account movement games after downgrading them back to 10.10. users cannot install printers now, we have people bringing their printers in to work, so that we can install them. We have to patch everyone manually as there is no way to manage them with what we have.
  IT has been an absolute mess, and the boss, who is normally ok with letting a small thing slide without a ticket, is demanding that every interaction related to this, even 15 seconds, have a ticket so that he can show the massive time costs of this nonsense.
  
  --
  "Science is the power of man"
4. Re:Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 05:25 · Score: 0
  
  Apple should go for the enterprise, just because it is easier to get one C-level person to buy 10,000 iMacs than it is to get 10,000 consumers to buy one iMac.
  Apple does an odd dance with the enterprise. They take steps back like killing the XServe, having no machines rack mountable without a third party mounting bracket system (Sonnet's RackMac is pretty innovative), and let their filesystems languish [1]. They used to have the ability to physically remove the camera and mics from iMacs and other equipment, but as far as I know, that is gone now. Then Apple does stuff like making deals with Cisco and better ActiveSync compatibility.
  Long term, the enterprise is going to be a lot more stable than consumer whims. Microsoft had a bloody quarter a couple years ago, but made it up by hiking the price on Windows Server and other enterprise items, so they showed a net profit.
  It wouldn't take much out of Apple's $400 billion. First, an enterprise model line of Macs, similar to an iMac, except with the ability to easily remove the camera, and some form of vPro/iLO like system so machines can be reimaged via remote. Similar with laptops. Toss the iSight camera, add remote kill functionality like LoJack for Laptops, and a facility for remote management. Of course, a server Mac (XServe) would be useful as well for the data center.
  Maybe Apple could even jump a step ahead of what is in the market. Make a rack enclosure and blade setup that is dense like a HP Moonshot, but have it for VDI. Add remote application viewing/control like Citrix, and that will make a home in many companies.
  For OS X, it would not require that much. OS X would require better AD integration (so one doesn't need OpenDirectory), or maybe even Apple should toss it altogether, license AD from MS, and build that into OS X. Both Apple and MS would profit greatly by a deal like this.
  Backend application wise, getting Exchange, SQL Server, and other applications onto Macs, with Apple being the one stop shop for support, would also be a coup. In the past, businesses paid great amounts to IBM so they just needed one number to call if something went pointy-end up. If Apple could provide that "any problem, one number" experience, businesses would beat a path to their door.
  The end result is that a business could go to Apple, get a complete solution, hardware, OS, and application, just like consumers can do with Mac hardware, Pages, and OS X. Long term, this would be a steady way to earn revenue, no matter how crappy other parts of the economy wind up.
  If Apple seriously wanted in the enterprise sector, businesses would flock to them, just as an alternative to what is out there.
  [1]: HFS+ is showing its age and needs to be replaced. ZFS would be the ideal replacement. Yes, one can use OSXFuse, but having it native would be very handy.
5. Re:Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 05:48 · Score: 0
  
  Apple seems to be doing just fine selling 10,000 iMacs to 10,000 consumers.
  They don't need any fancy hardware to crack into the enterprise market. What they have is slick and shiny, and CxO's would buy it if it worked. But it doesn't. They need either AD or something like it (system-wide support for LDAP, perhaps?) They need something to manage group policies. They need to lighten up the OSX license and allow for virtual machines running on non-Apple hardware. (Nobody is going to buy eleventeen shit-tons of iMacs when they can just fire up a VM and use terminals.)
  Until they do these things (at an absolute minimum!), they're a toy-computer manufacturer only. Enterprises will treat them the way they treat people using their family SUV to haul loads for construction work: quaint, but mostly useless.
  Meanwhile, everyone is learning how to make Apple's "secret sauce" and their advantage is fading quickly. Enterprise sales will continue to go to Dell, HP, and Microsoft, and eventually they'll "catch up" to Apple's latest layer of gloss. Then the enterprise customers can have their shiny and it'll actually work too!
  I gave up on Apple long ago.
6. Re:Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 06:12 · Score: -1
  
  Apple seems to be doing just fine selling 10,000 iMacs to 10,000 consumers.
  Uh, Apple sells alot more than 10,000 iMacs. Try more like 10,000,000.
7. Re:Of course Apple wants into enterprise though? by Junta · 2015-09-21 06:30 · Score: 2
  
  They did want to be in the enterprise and hence the XServe being created. They realized they just weren't aligned with the industry and the prospects were grim for return on investment for trying to change that. So they stopped doing things that required them to spend money when the returns may likely never happen.
  However when Cisco and IBM want to fall all over themselves to 'partner' with Apple, Apple will take the free endorsement. Note that both the Cisco and IBM deals cost Apple approximately nothing, they just had to smile and nod and endorse it, and in exchange IBM and Cisco spend all the money/do all the work to enable iOS devices for their respective applications and even promise some of their salespeople will push the Apple story. There's no point in turning down those overtures, even if they won't work or have low chance of working, all the risk is carried by IBM and Cisco. Potential upside is Apple suddenly is a viable mainstream enterprise vendor, downside is that Cisco and/or IBM wasted their time and money, but Apple lost nothing.
  So it's not so inconsistent. They'll gladly take money from enterprises, but they don't believe it's worth spending money to try at this juncture.
  
  Both Apple and MS would profit greatly by a deal like this.
  Nope, MS would only lose out. MS has business captive today, and doing what you describe would just weaken their stranglehold. Note that a great deal of what enterprises do with 'Active Directory' goes way beyond the stuff that non-MS platforms support when they integrate, and much of that other stuff does not trivially map to anything but MS's particular vision of describing capabilities. The capabilities may be there across the board, but they are just organized so differently, it would be some investment to try to be apples-to-apples in an unambiguous way.
  
  If Apple could provide that "any problem, one number" experience, businesses would beat a path to their door.
  Except that they wouldn't be that one number. It would be MS and Apple. On the OS, sure vendors provide front line support all the time. When you move up MS stack... You are going to be calling MS if you have a problem. Note that IBM is the only IT company to really have unambiguous success at the game you describe (e.g. POWER chips with AIX on top with DB2 and an unholy mess of stuff on top of it, or the mainframe ecosystem), and even then there's been significant signs of trouble there. For examples of other attempts in the industry, HP is a very notable example of trying *really* hard to get to that IBM story, but no sign of them getting anywhere near IBM's level. HP gets plenty of revenue in other ways, but not specifically in the all-in-one.
  
  If Apple seriously wanted in the enterprise sector, businesses would flock to them, just as an alternative to what is out there.
  And the problem is that they wouldn't. Businesses don't change unless they are forced to. Even then they want the change to be as slight as reasonably possible. The motivator for change is either unbelievably high risk with current environment or very well defined cost savings. There isn't any particularly strong sign of risk where Apple improves compared to status quo. For cost, passionate arguments can be had about TCO, but those are very subjective arguments that vary greatly circumstance to circumstance. In practice, businesses make decisions on concrete metrics like acquisition cost and recurring license fees. On that front, Apple doesn't have much room to be compelling and also have the margin to which they are accustomed.
  Enterprise is a big uphill battle that really isn't as appealing as many would imagine. Support costs are sky high, clients have a great deal more leverage than individual consumers to drive negotiation off of 'list' pricing, and generally have decades of accumulated infrastructure and best practices to work inside. For vendors entrenched in the space or pro
  
  --
  XML is like violence. If it doesn't solve the problem, use more.
8. Re:Of course Apple wants into enterprise though? by Junta · 2015-09-21 06:32 · Score: 1
  
  The original argument was saying enterprise was great because a single person represents 10,000 instead of those same 10,000 being represented by 10,000 people. The counter argument is that Apple excels precisely at getting consumers to decide on their platform in an individual fashion, so they have no reason to be attracted to such a prospect.
  
  --
  XML is like violence. If it doesn't solve the problem, use more.
9. Re:Of course Apple wants into enterprise though? by Junta · 2015-09-21 06:36 · Score: 2
  
  Therein lies the crux of the problem for Apple. The way in is basically to do a lot more work enabling concepts like group policies and also 'lighten up licenses' so that effectively people can get use of their work for less money. There isn't an obvious way forward for Apple.
  They can hope that players will upend the industry for them in a way that aligns to their sensibilities, but bending their sensibilities to try to capture the way IT works as-is would be a losing proposition.
  
  --
  XML is like violence. If it doesn't solve the problem, use more.
10. Re:Of course Apple wants into enterprise though? by macs4all · 2015-09-21 07:54 · Score: 0
  
  Yes, please use Android.
  Whoops: https://code.google.com/p/andr...
  Hahahahahahaha!!!!!! That's GREAT!!!!
11. Re:Of course Apple wants into enterprise though? by Anonymous Coward · 2015-09-21 08:04 · Score: 0
  
  Ah yes the apple fanboi has to come in and correct the numbers because we can't have anyone thinking Apple didn't sell millions of computers. This has to be corrected ASAP or we are disparaging apple, amiright?
  What you failed to read was the GP post where the poster said it was better to sell 10000 to one person.
  Thats where the 10,000 number came from. No one was actually trying to say that that was all they sold.
12. Re:Of course Apple wants into enterprise though? by MobileTatsu-NJG · 2015-09-21 08:07 · Score: 0
  
  Why is this modded down? You guys normally love pointing out when Apple copies Android!
  
  --
  
  "I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Source control? by mccalli · 2015-09-21 04:26 · Score: 4, Insightful

What bothers me most about things like this is trying to relate it back to what is supposed to have changed in the latest versions. I can't think of anything in iOS 9 that should have touched code like this, which makes me wonder about the state of source control.

Happy to be wrong, but Apple have had a few regression-type bugs before which again make me think their branching/merging strategies may not quite be up to snuff. Would like to be wrong though - anyone know of a changed area in iOS 9 that would have necessitated playing with something like this?
1. Re: Source control? by Anonymous Coward · 2015-09-21 04:33 · Score: 0, Troll
  
  I'm sure Apple could use a few good geniuses like you. Send your resume Einstein.
2. Re:Source control? by fuzzyfuzzyfungus · 2015-09-21 04:34 · Score: 5, Insightful
  
  Even if they had good reason to poke at this, or rewrite it from the ground up(because discoveryd was totally cooler and better than old-and-busted mdnsresponder, so why stop there?) what possible excuse is there for "This update breaks VPNs" to not be treated as an absolute showstopper? That's the sort of attitude that just doesn't cut it outside the realm of pitiful consumer crap.
3. Re:Source control? by Anonymous Coward · 2015-09-21 04:35 · Score: 0
  
  A performance upgrade perhaps?
4. Re:Source control? by Ravaldy · 2015-09-21 04:36 · Score: 1
  
  Maybe the integration of a security patch or more important features that caused this. After all, they knew about the issue at launch so there's most probably a reasonable reason for the bug. In addition is appears only specific network configurations will cause the issue to occur.
  Because I lack large dev team branching/merging experience, it's hard for me to understand where they could have gone wrong. To me having a branch that makes things work doesn't reverse the fact that another feature may be more important hence a fix is required either way. Again, just speculating.
5. Re: Source control? by Anonymous Coward · 2015-09-21 04:42 · Score: -1
  
  his name isn't einstein
6. Re: Source control? by Ravaldy · 2015-09-21 04:45 · Score: 4, Funny
  
  Please send your resume to me. We need a few d*ck heads that lack the ability to be constructive in their comments.
7. Re: Source control? by Anonymous Coward · 2015-09-21 04:50 · Score: 0
  
  Shirley you're joking.
8. Re: Source control? by Anonymous Coward · 2015-09-21 04:51 · Score: 0
  
  Going to bring in someone to train with the best?
9. Re: Source control? by Minwee · 2015-09-21 04:54 · Score: 2
  
  I am serious. And don't call me Shirley.
10. Re: Source control? by ModernGeek · 2015-09-21 04:55 · Score: 1
  
  They added support for different types of VPNs.
  
  --
  Sig: I stole this sig.
11. Re:Source control? by Moridineas · 2015-09-21 04:57 · Score: 1
  
  Is this a serious comment? Why would you assume they _wouldn't_ make any changes to a given subsystem?
12. Re:Source control? by CastrTroy · 2015-09-21 05:00 · Score: 4, Insightful
  
  what possible excuse is there for "This update breaks VPNs" to not be treated as an absolute showstopper
  This is what happens when you try to make a software update part of a hardware roll-out. They have hardware that they want to ship at a specific date, but haven't had any chance to get the software tested out in a while. They basically had to release iOS 9 even though they knew there was bugs because it was necessary for the new iPad and iPhone models.
  
  --
  
  Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
13. Re: Source control? by Anonymous Coward · 2015-09-21 05:11 · Score: 0
  
  You assume far too much. 15 seconds of Googling turns up the following:
  The per-app VPN feature in iOS provides security and privacy by only routing the traffic of corporate apps through a VPN connection. In iOS 9, Apple has added support for UDP traffic, used by many real time and streaming apps, to its per-app VPN. Apple is also adding support for layer 3 per-app VPN connections.
  Seems to me that this would require mods to VPN and the network stack.
14. Re: Source control? by Anonymous Coward · 2015-09-21 05:13 · Score: 0
  
  Well, looks like we found one of the programmers that fucked it up.
15. Re:Source control? by Anonymous Coward · 2015-09-21 05:13 · Score: 0
  
  They updated VPN to handle more per app tunneling options.
  Mobile Iron had a good breakdown.
  https://www.mobileiron.com/en/smartwork-blog/ios-9-making-great-enterprise-user-experience-even-better
  Scroll down to the "Per-app VPN changes:" section for a synopsis.
16. Re: Source control? by Anonymous Coward · 2015-09-21 06:05 · Score: 0
  
  Going to bring in someone to train with the best?
  Would that we could but the best [dickheads] are all Android users.
17. Re: Source control? by Anonymous Coward · 2015-09-21 06:10 · Score: 0
  
  Sounds like you already have at least one d*ck head in residence.
18. Re: Source control? by Anonymous Coward · 2015-09-21 06:16 · Score: 0
  
  Apparently he's hiring. Just call 800-555-1212 and ask for douchebag.
19. Re:Source control? by Carewolf · 2015-09-21 06:21 · Score: 1
  
  what possible excuse is there for "This update breaks VPNs" to not be treated as an absolute showstopper
  This is what happens when you try to make a software update part of a hardware roll-out. They have hardware that they want to ship at a specific date, but haven't had any chance to get the software tested out in a while. They basically had to release iOS 9 even though they knew there was bugs because it was necessary for the new iPad and iPhone models.
  You mean for publicity? I am sure iOS8 works fine on the new devices. The problem is that they promise a new version every year, and not releasing one would look bad.
20. Re: Source control? by Anonymous Coward · 2015-09-21 06:30 · Score: 0
  
  You should send your resume too because Apple needs more viruses.
21. Re:Source control? by thegarbz · 2015-09-21 06:57 · Score: 1
  
  The problem is that they promise a new version every year, and not releasing one would look bad.
  So just change the 8 to a 9 and make a subtle graphic change and call it a day. I mean Chrome goes through something like 20 versions a month and doesn't seem to have changed in the past few years.
22. Re: Source control? by Anonymous Coward · 2015-09-21 07:26 · Score: 0
  
  Awwwww, someone is upset and posted as AC 4 times trying to sound like more than 1 person.
23. Re:Source control? by swb · 2015-09-21 07:27 · Score: 1
  
  It works fine, but without any of the support for the new hardware features or the new OS features that are supposed to work with the new hardware features.
  AFAICT, the new hardware basically requires a pretty significant OS revision. To be sure, a lot of the changes (like the "task manager" view which now shows a less convenient overlapping page view of existing open apps) seem purely for cosmetics.
24. Re:Source control? by Bogtha · 2015-09-21 07:39 · Score: 1
  
  I can't think of anything in iOS 9 that should have touched code like this, which makes me wonder about the state of source control.
  
  Why? Source control doesn't prevent regressions. Besides, they've clearly been working in this area for iOS 9, see the new network extension points for example.
  
  Apple have had a few regression-type bugs before which again make me think their branching/merging strategies may not quite be up to snuff.
  
  This doesn't even seem remotely related to branching/merging. To be blunt, it sounds like you're just learning source control and are seeing it everywhere.
  
  anyone know of a changed area in iOS 9 that would have necessitated playing with something like this?
  
  Read What's New in iOS. They update it every time they release a new version and it describes what's changed.
  
  --
  Bogtha Bogtha Bogtha
25. Re: Source control? by slick7 · 2015-09-21 08:50 · Score: 1
  
  More like corporate source control. As ubiquitous as mobile devices are, it no longer a given that people will "play nice". To protect the corporate data infrastructure, All mobile devices must have certain limitations, except of course, for those special people, that can make things disappear real quickly.
  
  --
  The mind conceives, the body achieves, the spirit manifests.
26. Re: Source control? by Anonymous Coward · 2015-09-21 09:55 · Score: 0
  
  This. When they added the new Network Extension VPN stuff, the split tunnel support probably changed considerably, and chances are good that they didn't fully test the old VPN extension framework after doing so.
  I doubt it has anything to do with source control. It probably has far more to do with Apple's apparent distaste for proper unit tests.
27. Re:Source control? by Waccoon · 2015-09-21 13:38 · Score: 1
  
  When iOS 8 was released, people noticed straight away that images couldn't be uploaded to web sites. As in, multipart-encoded image data included in a web form was just stripped away.
  My reaction was, "How could such a show-stopping lack of QA be allowed to happen at all, let alone WHY it happened?"
  The reaction from many of my peers on DeviantArt and other art-related web sites, upon realizing the couldn't upload their art, was, "Oh, I'm sure it'll be fixed soon. No big deal."
Virtual Private Networks are for Cows by Anonymous Coward · 2015-09-21 04:30 · Score: -1

You are all Cows. Cows say Mooooo. MOOOOOOOOOOOOO Cows MOOOOOOOOOOOOOOOOOO! MOOOOOOOOOOOOOOO say the Cows. YOU DISCONNECTED COWS!!!
Android Too by Anonymous Coward · 2015-09-21 04:37 · Score: 2, Interesting

Makes you wonder why:
1. Cell manufacturers are moving to devices that cannot be truly turned off by removing the battery.
2. Android after 4.4 broke persistent VPN support.
3. Now iOS 9 breaks VPN support.
Coincidence? Who might prefer to have a citizenry carrying locator beacons that cannot be turned off and where encrypting all data communication has been disabled?
1. Re:Android Too by drinkypoo · 2015-09-21 05:11 · Score: 2
  
  Coincidence? Who might prefer to have a citizenry carrying locator beacons that cannot be turned off and where encrypting all data communication has been disabled?
  You can get cell position via DtoA and your actual calls have been broken open for a long time now, so this is not about that. This is about your data, not about your location.
  
  --
  "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
2. Re:Android Too by mrchaotica · 2015-09-21 06:44 · Score: 1
  
  I'm pretty paranoid, but even I've given up caring about non-removable batteries. If you're that worried, carry an anti-static bag (or other Faraday cage) around with you.
  
  --
  "[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
3. Re:Android Too by thegarbz · 2015-09-21 06:58 · Score: 1
  
  Never attribute to malice what can be attributed to corporate douche-bags pushing untested software out the door with a promise to fix it with the first few patches.
4. Re:Android Too by gweihir · 2015-09-21 10:39 · Score: 0
  
  Makes you wonder why:
  1. Cell manufacturers are moving to devices that cannot be truly turned off by removing the battery.
  Aehm, no battery - no power? How is that different from being "turned off"?
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
5. Re:Android Too by Anonymous Coward · 2015-09-21 11:15 · Score: 0
  
  The battery can't be removed, genius.
6. Re:Android Too by gweihir · 2015-09-21 13:17 · Score: 1
  
  All phones can be truly turned off by removing the battery and all batteries in phones can be removed. The question is how much damage that does.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Impossible by Anonymous Coward · 2015-09-21 04:53 · Score: 2, Insightful

Everyone knows that Macs just work, more Micro$oft FUD.
FUCKEr by Anonymous Coward · 2015-09-21 04:54 · Score: -1

or maK3 loud noises
That's a really good point by Anonymous Coward · 2015-09-21 04:59 · Score: -1

Joking aside, most open source can't handle open source. I mean, you can't randomly insert emacs source code into the Linux kernel, can you? There are definitely rules that govern the exchange of source code between projects, even if we disregard the conflicting licenses. For example you often have to port code that runs beautifully on desktop GNU/Linux to run on a broken Linux like Android, and that's even if you're running the same architecture (x86, ARM, etc).
Adblocker by Anonymous Coward · 2015-09-21 05:03 · Score: -1

I'm sure it's probably the ad blocker that you installed. All Apple products work flawlessly!
I'm not really surprised by Anonymous Coward · 2015-09-21 05:04 · Score: -1

They couldn't get VPN right in OS X either. The only way you can get it to work properly is dropping to a command line and then also editing some config files. "It just works" is the biggest joke in the history of computing.
Split Tunneling? by mveloso · 2015-09-21 05:04 · Score: 4, Insightful

Problem is DNS during split tunneling, which isn't the same as "breaks VPN."
I guess the editors are either click-baiting, are technically illiterate, or both.
1. Re:Split Tunneling? by CimmerianX · 2015-09-21 05:15 · Score: 1
  
  Problem is, while people like us understand what's going on here, the other 95% of the population only see's that their facebook isn't loading. To them, it broke VPN.
  I'm sure of those 95%, 99% have no idea what DNS is
2. Re:Split Tunneling? by Anonymous Coward · 2015-09-21 05:38 · Score: 0
  
  Apple's DNS implementations in general are a bit nonstandard and broken and are a huge headache for administrators. That's the real story that should be here.
  It's not at all surprising the issue has shown up when trying to juggle a wifi, wireless, and vpn network connection all at once.
3. Re:Split Tunneling? by Anonymous Coward · 2015-09-21 05:41 · Score: 0
  
  So due to the inability of the duck face crowd to understand tech, /. is also required to dumb things down?
4. Re: Split Tunneling? by Graymalkin · 2015-09-21 06:25 · Score: 1
  
  Slashdot: Technically illiterate clickbait. Formerly "News for Nerds, Stuff that Matters".
  
  --
  I'm a loner Dottie, a Rebel.
5. Re:Split Tunneling? by Anonymous Coward · 2015-09-21 06:25 · Score: 1
  
  Apple's DNS implementations in general are a bit nonstandard and broken and are a huge headache for administrators. That's the real story that should be here.
  Why and how? (and please try to resist the temptation to work the words: walled, garden and hipster into the reply)
6. Re:Split Tunneling? by drkstr1 · 2015-09-21 08:12 · Score: 2
  
  Well from personal experience at least, we always have to use an IP address when testing our web app on a local build server. The android tablets let us use the internal domain name, out of the box.
  
  --
  Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
7. Re:Split Tunneling? by gweihir · 2015-09-21 10:41 · Score: 1
  
  To be fair, this topic is a bit advanced.
  
  --
  Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
No such problems here by diamondsw · 2015-09-21 05:11 · Score: 0

Didn't see any problems with VPNs during the betas, nor with final release. This is with connections to Junos Pulse, StrongSwan/xl2tpd, and racoon VPNs.
Maybe the reason it wasn't "fixed" is it isn't an issue in the first place.

--
I don't know what kind of crack I was on, but I suspect it was decaf.
Hint by 0123456 · 2015-09-21 05:11 · Score: 1

Don't install .0 versions of operating systems on production systems. At least, not until they've been tested and shown to work.
A little more sense by Anonymous Coward · 2015-09-21 05:12 · Score: 1

Workaround is to reinstall that VPN software on your iOS device.
At least provide _some_ evidence! by Anonymous Coward · 2015-09-21 05:12 · Score: 0

Jesus Christ. If you're going to come up with conspiracy theories, at least try to provide some small degree of evidence. It doesn't even have to be convincing. Just some shred of evidence, rather than nothing at all!

1. Cell manufacturers are moving to devices that cannot be truly turned off by removing the battery.
It's because consumers demand thinner, cheaper devices. That means that the use of physical space must be optimized, even down to tenths of a millimeter, and the cost reduced to a bare minimum. Non-removable batteries take up less space, and are cheaper. Therefore they are used instead of removable batteries.

2. Android after 4.4 broke persistent VPN support.
This was merely a bug in a complex piece of software. You'd know how easy it can be to introduce these kinds of bugs, and how easy it is to accidentally overlook them, if you had ever worked with the Linux networking stack's code, or the code to VPN systems.

3. Now iOS 9 breaks VPN support.
Again, merely a bug in a complex piece of software.
You come off as a complete kook when you make allegations, but then fail to provide any evidence at all to back up these allegations.
And Slashdot editors: please don't mod up baseless allegations! The parent comment is at 4, Insightful currently, and it does not deserve that rating. I don't expect much from you guys, but let's aim for not modding up total shit like parent comment, ok?
Downgrade? by Anonymous Coward · 2015-09-21 05:19 · Score: 2, Interesting

You can't downgrade if you didn't have a backup already.
IOS 9 broke other things as well. IOS 9 won't connect to hidden SSID WIFI networks either. I can verify this issue. There are some other grumblings of WPA / WPA2 connection issues for some as well.
Even some popular apps, like Words with Friends in my case don't work in IOS9.
1. Re:Downgrade? by konohitowa · 2015-09-21 06:50 · Score: 1
  
  My only connection at home is a hidden SSID network and it's working fine. Are you saying you can't connect to unknown hiddens? If so, sounds like the XP version of WiFi. That would bite.
  Killing WwF, opening each game, not touching any tiles, going back to the home screen, then reopening the game seems to help. But yeah, it locks really easily. I'm surprised they didn't have an update ready. Then again, the app has always been a POS - at least on iOS.
2. Re:Downgrade? by Anonymous Coward · 2015-09-21 12:53 · Score: 0
  
  I can't add any hidden networks. If I broadcast the SSID it will connect and work fine. However the moment I switch it back to hidden it disconnects and acts like it doesnt exist. Note this is persistant across the OTA update, a wipe, reset of both the network and phone, and a complete reinstall of IOS 9 from the mess of a program called Itunes.
3. Re:Downgrade? by konohitowa · 2015-09-21 16:59 · Score: 1
  
  Well, that bites. I wish I had some suggestion for you. Mine is working just fine after the update. Like I said, it was an existing connection - not one I tried to add after the update - but it would seem that it shouldn't work at all given your description.
This is the new Apple by Anonymous Coward · 2015-09-21 05:22 · Score: 0

As a long time IT professional (since the late 80s), I never quite understood the anti-Apple sentiment the IT industry, and "techy" sites such as the community here at Slashdot, often displayed. Amazingly, the old Apple "It Just Works" mantra was largely true. There are major exceptions, such as the entire 7.5 era, but overall, they were genuinely easy to use and reliable. That's all the in past. The new Apple is what MS used to be; full of moronic people designing moronic a UI (or 2) wrapped around moronic bugs. The past 5 years or so have seen Apple software go from some of the most friendly, easy-to-use, intuitive and reliable products in the world to one of the worst. If I was starting in IT today I wouldn't touch this Apple shit with a 20-foot pole. The new Apple slogan? "Apple: Computers by Morons, for Morons..."
1. Re:This is the new Apple by Anonymous Coward · 2015-09-21 06:14 · Score: 1
  
  The problem is that Apple is still used to having momentum by taking a market, then making money on an annual basis by incremental upgrades.
  Since Jobs left, things just seem different. Simple things like being able to reliably sync an iPhone via a connector have been broken since iOS 5 [1].
  Each iteration of OS X was supposed to be "faster" than the one before it, and there were a lot of leaps and bounds in background improvements. El Capitan has some decent improvements (especially in the security department with noroot), but it would be nice to see things that other operating systems have, such as real filesystems (HFS+ is showing its age by far), built in hypervisors (ideally, just license VMWare Fusion from EMC and call it done), two factor authentication for remote access (VNC and SSH) [2], some type of "antivirus" utility built in, not for the utility, but just so IT can check the "machine has antivirus on it" box off on the corporate compliance sheet. However, it seems that OS X isn't really getting better.
  Of course, we all know how Apple is going with hardware and repairs on that. My first MacBook Pro from 2009 is fairly easy to repair... if I want a 7200 RPM SSD, pop a panel, battery, a screw or two, toss it in... done. On a new MBP, there is no upgrading the SSD even if they were available just because the entire thing is glued in place, and one wrong move, snap goes a cable, and the entire laptop is rendered worthless.
  [1]: iOS 4 and previous would stop all background tasks and halt all usage of the phone. However, when syncing files, they worked, no sitting there for hours with "waiting for changes to be updated" or other junk. I wish this option (disable all background stuff, and just -sync- the iDevice) were still present.
  [2]: Google has the source code for their authenticator available and it is freely licensed. Having SecurID hooks would be nice as well... heck, Windows NT had SecurID hooks back in the 1990s.
2. Re:This is the new Apple by fluffernutter · 2015-09-21 06:29 · Score: 1
  
  When you have total hardware lockdown and one installable application per every fifty on windows in the market I would hope it would work. Sad that it doesn't.
  
  In most cases when windows doesn't work it isn't windows that is to blame, it is a bad developer or bad/cheap hardware or drivers.
  
  --
  Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
3. Re:This is the new Apple by Anonymous Coward · 2015-09-21 16:44 · Score: 1
  
  Just to be a pedantic dickweed, SSDs are not rated by RPM, that is hard-drives. An SSD revolving at 7200 RPM would likely fail, probably in a violent fashion. However, I will not be testing this, as I am loath to damage my tools, and am rather lacking in spare SSDs.
  That being said, I agree entirely with the spirit of your post.
4. Re:This is the new Apple by guruevi · 2015-09-22 01:07 · Score: 2
  
  HFS has been upgraded to improve. On-the-fly compression, built-in backup/versioning and whole-disk-encryption being some of the more visible things lately. Antivirus has been built-in to OS X since I think 10.5 and two-factor authentication has also been possible since I think 10.3.
  As far as repairs, the 'hard drive' is still replaceable but it's not a SATA thing it's a PCI card and there are several aftermarket options.
  
  --
  Custom electronics and digital signage for your business: www.evcircuits.com
Great by allquixotic · 2015-09-21 06:31 · Score: 1, Interesting

Switched from Android to iOS because Google won't fix their Bluetooth stack. I'll have to try my VPN on Friday and see if iOS 9 broke it. If so, I'll have to have two phones just so I can use two of the most important OS features that have been around for years but nobody can seem to get right (all at once, within one device, that is).
I thought you couldn't downgrade iOS by jonwil · 2015-09-21 10:45 · Score: 1

I thought Apple made it so you couldn't downgrade iOS (as a way to stop people from downgrading to a version that can be jailbroken)
1. Re:I thought you couldn't downgrade iOS by Anonymous Coward · 2015-09-24 03:49 · Score: 0
  
  You can downgrade to a previous version for a limited time after a new version comes out. Apple eventually stops signing old versions of the OS which will prevent downgrades but for major versions (like iOS 9) there is typically a window of 2-3 weeks during which you can downgrade to the previous release.
No issues with iOS 9 and OpenVPN by reemul · 2015-09-21 11:02 · Score: 1

It hasn't caused any problems with my OpenVPN based service. So sad that the corporate guys' software isn't working as well.

--
You're just jealous 'cuz the voices talk to *me*
Been using IPsec VPNs without any problem by ruir · 2015-09-21 11:36 · Score: 1

Both VPNs to work and to commercial VPNs seem to be working fine both in OS/X beta, and the production one. The only long time complaint I have it to be mandatory to install policies to have connect on demand/always on functionalities.
Disconnect not working reliably by Anonymous Coward · 2015-09-21 15:34 · Score: 0

I have noticed spotty issues using disconnect auto VPN configurations. This was bulletproof on iOS 8 but I have had to completely disable it since it 50/50 works
ExpressVPN broken too. by Rick+in+China · 2015-09-21 16:13 · Score: 1

Post-iOS9 install I noticed ExpressVPN doesn't work at all either. At least I only need it for youtube/gmail ish, poor business-users, f'd. This is a pretty serious bug, quite shocked that it was known and let pass into retail release......indicator of slip in quality perhaps? Kinda like macbook 12" forcing users to a single usb-c port, in other words, forcing users into buying an adapter, far before C becomes standard? What's going on here.
iOS9 phones cant use itunes 11.5.5 or WinXP by Winkkin · 2015-09-22 07:47 · Score: 1

For anyone still using WindowsXP with iTunes 11.5.5 and an iPhone with iOS 8.4. If you upgrade your phone to iOS 8.4.1 which came out last week, they do not tell you that you also must up grade to iTunes 12.1. Unfortunately, iTunes 12.1 is not supported on WindowsXP.