41–50 of 66 posts
Am I reading this correctly in that this uses TLS - and ends up tunneling TCP and UDP over TCP?
The 'double congestion-control' effect can be alleviated by opening 10 or so TLS connections and pumping the packets down those, to spread the effects of TCP congestion control.
I guess the main question is why should I use/trust this above OpenVPN/Tinc or WireGuard etc?
I am a strong advocate of the saying 'trust but verify'. I believe you should closely audit whatever OSS software you are looking at using in light of your threat model.
To get round to your question: Why should I use subnet over OpenVPN/Tinc etc? That decision is entirely your prerogative. Subnet is small (quick(er) to audit), easy to understand, and has the bare minimum functionality needed to implement a VPN with full mutual authentication. OpenVPN and others have far more features and are almost certainty xx% faster. Where you want to draw the line is up to you.
The project structure is fighting againts norms. The author should not have src checked in. They should have their package as the root so it is "go get-able" and does not require the user to alter their GOPATH. To ensure that the proper dependency versions are present, they should vendor the dependencies. I would have opened an issue on GitHub for them, but I am not signed in currently. Cheers on releasing a neat too…
Nice, I'll try it out once I get home. A couple of question: - What is the throughput once you fixed the issues ? - If you were to implement a client for mobile (iOS, Android), how would you go about it ? (Just theoretically, I understand it's a personal project) I'm using openvpn on a cloud server and one of the big advantages is the availability of mobile client apps.
Mobile: You have to use the APIs that are available on the platform to hook into the network layer. After that its pretty straightforward though - you open some TLS connections, do verification, and encapsulate network traffic in some simple structs.
I guess the main question is why should I use/trust this above OpenVPN/Tinc or WireGuard etc?
Earlier quoted context omitted.
No it's not you [0]. Rust, Go, R, and Python have the highest year-to-year growth. [0] https://stackoverflow.blog/2017/09/06/incredible-growth-pyth...
Python is interesting in that list, given how it's at least 4 times as old as all of the other ones in that list. What's behind that? I don't recall any major developments after Python 3, and most of the news behind that one was about its backwards incompatibility (and currently how 2.x isn't about to go anytime soon)
Earlier quoted context omitted.
No it's not you [0]. Rust, Go, R, and Python have the highest year-to-year growth. [0] https://stackoverflow.blog/2017/09/06/incredible-growth-pyth...
Python is interesting in that list, given how it's at least 4 times as old as all of the other ones in that list. What's behind that? I don't recall any major developments after Python 3, and most of the news behind that one was about its backwards incompatibility (and currently how 2.x isn't about to go anytime soon)
Related: Wireguard is a new VPN for linux in 4k lines of C https://www.wireguard.com/ the model of wireguard has been proven correct by formal methods. Builds on modern crypto, and they kept code short for auditing purposes.
There's also a work-in-progress Go implementation of Wireguard, found over here: https://git.zx2c4.com/wireguard-go/about/
> There is no group of users that should be using the code in this repository here under any circumstances at the moment, not even beta testers or dare devils.
Despite the warning I attempted to use it, but without any real docs I didn't get very far.
Related: Wireguard is a new VPN for linux in 4k lines of C https://www.wireguard.com/ the model of wireguard has been proven correct by formal methods. Builds on modern crypto, and they kept code short for auditing purposes.
My concern is that 'built on modern crypto' and 'reviewed by cryptographers' amounts to 'rolled our own crypto'. IMHO history has shown us time and time again that this is a bad idea - we should use the protocols and ciphers that have stood the test of time. Building subnet using TLS was an architectural choice to avoid playing the role of cryptographer and inevitably getting it wrong.
WireGuard is based on the Noise Protocol Framework [1], designed by the same fella as the Signal Protocol, and already used in production by millions of devices all around the world inside of WhatsApp. Not only that, but we have a formal verification [2] that the crypto is correct in the symbolic model. The WireGuard paper itself [3] was presented to the academic community at NDSS [4]. It's most certainly not the hastily-made nonsense you imply it is with the phrase "rolled our own crypto".
Meanwhile your project, "subnet", tunnels TCP over TCP, which is well known for having pathologically bad performance characteristics [5]. It also has no binding between certificates and the IP addresses that a certificate is allowed to be inside the tunnel, and, unless I've misread, it allows different peers to hijack each others' IP addresses simply by asking [6].
There's a lot of work that goes into doing tunneling well. I encourage your effort to make a fun toy project; it's a great learning opportunity. But please don't spread FUD about other projects without first understanding them.
[2] https://www.wireguard.com/formal-verification/
[3] https://www.wireguard.com/papers/wireguard.pdf
[4] https://www.ndss-symposium.org/ndss2017/
[5] https://www.google.com/search?q=tcp+over+tcp
[6] https://github.com/twitchyliquid64/subnet/blob/50fc8fe2b6ccf...
Earlier quoted context omitted.
There's also a work-in-progress Go implementation of Wireguard, found over here: https://git.zx2c4.com/wireguard-go/about/
From the linked page: > There is no group of users that should be using the code in this repository here under any circumstances at the moment, not even beta testers or dare devils. Despite the warning I attempted to use it, but without any real docs I didn't get very far.
- https://www.wireguard.com/quickstart/
- https://www.wireguard.com/install/
- https://git.zx2c4.com/WireGuard/about/src/tools/wg.8
- https://git.zx2c4.com/WireGuard/about/src/tools/wg-quick.8