Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

121–130 of 293 posts

Re: WireGuard is now in Linus' tree

#121

Post by mekster »

oarsinsync wrote: post #61
Noumenon72 wrote: post #11

Earlier quoted context omitted.

What does it mean to be "in Linus' tree" if it's already on Linux and everywhere else? Like it will be built in somehow?

Right now, it is not part of the Linux kernel. It is just some random external software that you have you download and compile yourself against the source headers of the kernel you're currently running. It got merged into the net-next tree, which meant it has been approved by the maintainer of the Linux kernel net branch to be included into the kernel. Linus has now pulled it from net-next into his own tree, which me…

> As far as that means as an end user, it means that you no longer need to recompile your wireguard module every time there's a kernel update, as now it will be handled by your distro.

That's not the important point.

The point being, when merged as part of the kernel officially, you know it will get more support and eyes for stability and development power as the kernel wouldn't want to ship anything that's at some unstable state.

So you can expect long term usage and maybe RedHat might pick it up as its official VPN solution instead of libreswan some day.

Re: WireGuard is now in Linus' tree

#122

Post by Monory »

ZiiS wrote: post #120
johnebgd wrote: post #83

Earlier quoted context omitted.

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.

You can support on Patreon for less than the minimum tier. It is just the cut-off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!

Re: WireGuard is now in Linus' tree

#124

Post by oarsinsync »

yash1th wrote: post #116
ignoramous wrote: post #98

Earlier quoted context omitted.

Check out https://tailscale.com/ a mesh VPN built on top of wireguard.

I just learned about tailscale today on twitter. Here's the tweet from the founder https://twitter.com/davidcrawshaw/status/1222203472461926401... Looks really promising

It does look very nice. It's a shame that it depends on third parties for authentication, and that they have gems like this in their documentation:

> No app-level integration or reconfiguration is required, because security is built into the network itself. If you configure your network to require Tailscale, every one of your internal services will be subject to multi-factor authentication.

Which is simply not true. I've had 2FA for my Cisco AnyConnect VPN for years. That does not mean my applications I access through the VPN are now magically subject to MFA.

Maybe in time this may end up being viable for me, and maybe it already is for other people. For now, I'd rather my VPN didn't depend on Google, Microsoft, Okta, etc.

Re: WireGuard is now in Linus' tree

#125

Post by makapuf »

3xblah wrote: post #79
CrazyStat wrote: post #71

Earlier quoted context omitted.

Dynamic in theory, but for many people the IP is unchanged for a long time. I remember reading an article that said the average length of time between dynamic IP changes tracked by some company was something like seven months, though I can't find it now. I have cable with a theoretically dynamic DNS but it's changed once in >4 years.

Can you be sure that during 4yrs it never changed >1 even for a short time, maybe hours or days, then reverted back

Well if you don't notice it, for a home vpn, well... you wont notice it.

Re: WireGuard is now in Linus' tree

#126

Post by 0ld »

Since a couple of years I've been running iked [0] on my VPSed OpenBSD. It took me around 5 minutes to setup and it "just works" since then with my iPhone and MacOS clients out of the box, not requiring any additional software.

But since WG is getting so high praise here, I'm now interested what are WG advantages and what does WG have to justify the effort to move away from iked and install/setup the client software everywhere?

I'm certainly going to find out and test it myself, but would really appreciate just a quick answer/explanation

[0] https://man.openbsd.org/iked.8

Re: WireGuard is now in Linus' tree

#127

Post by nif2ee »

ignoramous wrote: post #98
tcas wrote: post #38

Earlier quoted context omitted.

Do you set up nginx or haproxy as a reverse proxy to the wireguard network, or something else? Been wondering if there's an easy way to expose an internal service like that. TCP seems easy, but UDP seems much more problematic.

Check out https://tailscale.com/ a mesh VPN built on top of wireguard.

How does this thing even work? do they host the gateways for you and do the authentication at the start of VPN sessions and generate the wireguard keys for you? so you simply need to connect your networks hosting services and such to their gateways?

Re: WireGuard is now in Linus' tree

#129

Post by mb7733 »

0ld wrote: post #126

Since a couple of years I've been running iked [0] on my VPSed OpenBSD. It took me around 5 minutes to setup and it "just works" since then with my iPhone and MacOS clients out of the box, not requiring any additional software. But since WG is getting so high praise here, I'm now interested what are WG advantages and what does WG have to justify the effort to move away from iked and install/setup the client software…

Same question here but using iked on on linux
Post reply on HN