141–150 of 157 posts
Wow, I launched this 10 minutes ago and somebody already put it on Hacker News. Spectacular! I'm the author of this and would be happy to answer any questions you have.
How does WireGuard deal with private keys on smartcards or other HSMs ?
Earlier quoted context omitted.
I took it as "the Rust version is in userspace, and therefore will be slower than the in-kernel version."
Right, I heard about the Rust kernel module[1], but perhaps its environment isn't friendly enough yet to attempt to port a project like this to? edit: Just read a little bit of its source, apparently you have to disable std, and he replaces it with his own linux_std that at this point has only printf implemented. So yeah it'd be a pretty intense project if one would attempt it :) 1] https://github.com/tsgates/rust.ko
(disabling std is standard in environments like this; and you still get libcore, which is a lot of stuff!)
Earlier quoted context omitted.
Right, I heard about the Rust kernel module[1], but perhaps its environment isn't friendly enough yet to attempt to port a project like this to? edit: Just read a little bit of its source, apparently you have to disable std, and he replaces it with his own linux_std that at this point has only printf implemented. So yeah it'd be a pretty intense project if one would attempt it :) 1] https://github.com/tsgates/rust.ko
Elsewhere in the thread, they talk about upstreaming some code into the kernel itself; so it has to be in C for that. That's my guess, anyway. (disabling std is standard in environments like this; and you still get libcore, which is a lot of stuff!)
Earlier quoted context omitted.
Would you mind dual-licensing under a more permissive license (BSD or MIT) so the work can be included in the BSD family of operating systems as well as Linux?
I answered this question elsewhere. The answer is that - probably, why not? I need to think about it for more than a few seconds. But the only reason I chose GPLv2 is because that's what Linux uses. I'll quit being lazy and think more carefully about licenses, and hopefully we'll wind up with something good for the BSDs.
If your work is in the public domain, then at least the corporations would have much harder time hijacking and wall-garden it, and the chances of them simply giving up are higher. Or so I hope.
I've read a good chunk of your website. GREAT WORK! Do not give up, you're doing next-level work. =)
Earlier quoted context omitted.
I answered this question elsewhere. The answer is that - probably, why not? I need to think about it for more than a few seconds. But the only reason I chose GPLv2 is because that's what Linux uses. I'll quit being lazy and think more carefully about licenses, and hopefully we'll wind up with something good for the BSDs.
I am not a lawyer but in my eyes having a BSD/MIT license will also save you from a corporation "adopting" your technology and sue you afterwards for infringing a super vague patent of theirs... or something along the lines. If your work is in the public domain, then at least the corporations would have much harder time hijacking and wall-garden it, and the chances of them simply giving up are higher. Or so I hope. I…
Earlier quoted context omitted.
How does WireGuard deal with private keys on smartcards or other HSMs ?
Have you got a smartcard that will do X25519? If so I'd be quite interested to learn which one. Sounds fun to play with.
Earlier quoted context omitted.
This comment was marked 'dead', but I think it was a useful question (though maybe a little aggressive in its wording): > So what's the point ? Linux is a niche market. Mac & Windows will be the vast majority of your users and won't enjoy your killer kernel-based feature... Even when Windows/Mac are the vast majority of clients, each client only needs to process its own traffic. The VPN gateway is more likely the bot…
What's incredible is that the Go implementation is something like 100 lines.
It makes a UDP connection, it sends and receives some packets and then exits again. It's by no means a functional VPN, just the handshake.
No doubt it'll grow into an actual client, but don't be too amazed by it just yet :D
Earlier quoted context omitted.
So, everyone needs to take a deep breath here. In kernel VPN is giving me a bit of a security heart attack. As a security professional I would recommend not running this on anything but a sandbox that isn't connected to your environment. A single misstep in the code, a bad implementation of a crypto library or a bad hook could easily lead to ring 0 compromise. Not trying to discount the author's work, and I haven't r…
As a "security professional", I kind of don't care whether this is in-kernel or not. First, this is Linux, and if someone manages to get code execution in your unprivileged userland program, the odds of you keeping them out of your kernel are already pretty low. Second, and more importantly, this is VPN software . If your VPN gets popped, you probably have bigger problems than whether the attacker got the kernel on t…
Earlier quoted context omitted.
I answered this question elsewhere. The answer is that - probably, why not? I need to think about it for more than a few seconds. But the only reason I chose GPLv2 is because that's what Linux uses. I'll quit being lazy and think more carefully about licenses, and hopefully we'll wind up with something good for the BSDs.
I am not a lawyer but in my eyes having a BSD/MIT license will also save you from a corporation "adopting" your technology and sue you afterwards for infringing a super vague patent of theirs... or something along the lines. If your work is in the public domain, then at least the corporations would have much harder time hijacking and wall-garden it, and the chances of them simply giving up are higher. Or so I hope. I…