How would ATS affect apps which don't just talk to one server of the developer of that app? What if an app should talk directly over wifi to a device in your local home network via HTTP? Or to a system that each company who buys it hosts on their own and in the app the customer has to supply that hostname or IP in order to connect?
Would ATS have enforced that there could only be a few centralized cloud servers?
And can I simply bypass ATS by linking in curl+openssl?
Are iOS apps even allowed to open raw TCP sockets?
> How would ATS affect apps which don't just talk to one server of the developer of that app? What if an app should talk directly over wifi to a device in your local home network via HTTP?
iOS 10 adds the key NSAllowsLocalNetworking which
disables ATS for "connections to unqualified domains and to .local domains". So this can continue to work.
However, treating local networks as secure isn't generally a good design! If the home network has an open Wi-Fi hotspot, or a WPA hotspot with WPS PIN enabled or where the attacker knows or can bruteforce the password (and in many other cases), it is possible to sniff other users' traffic. Instead of using an unencrypted connection, whether HTTP or otherwise, you should design the initial pairing process between the app and the device to set up encryption keys. For HTTPS this can be in the form of having the device generate a self-signed certificate and send it to the app to use as a custom root. You need some sort of pairing or setup process anyway for the device to know how to connect to the user's network, so you might as well do security properly.
> Or to a system that each company who buys it hosts on their own and in the app the customer has to supply that hostname or IP in order to connect?
In that case you should probably just require the companies to have a domain and a certificate for it; build in Let's Encrypt support if you want.
> And can I simply bypass ATS by linking in curl+openssl?
From a technical perspective, yes, though I can't say whether Apple would reject an app because of it.
> Are iOS apps even allowed to open raw TCP sockets?
Would ATS have enforced that there could only be a few centralized cloud servers?
And can I simply bypass ATS by linking in curl+openssl?
Are iOS apps even allowed to open raw TCP sockets?