Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is now in Linus' tree

lists.zx2c4.com

Post reply on HN
Print view View original

231–240 of 293 posts

Re: WireGuard is now in Linus' tree

#231

Post by kragen »

ZiiS wrote: post #120
johnebgd wrote: post #83

Earlier quoted context omitted.

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.

The minimum donation in Bitcoin is probably about US$0.01. Anyway that's what I've paid in transaction fees the last few times I made a donation where I didn't care how long it would take. (They were confirmed within a few hours.) Transaction fees for within-the-hour confirmation are around US$0.20.

Re: WireGuard is now in Linus' tree

#232

Post by lillecarl »

Fredej wrote: post #189
goodpoint wrote: post #181

Earlier quoted context omitted.

Is there a way to implement a mesh using only the public IP addresses?

Someone else linked https://tailscale.com in this thread. Could that be similar to what you're looking for? I haven't dug fully into but definitely will later today.

It seems like it isn't free, I would appreciate not handing my network over to anyone. Since ZeroTier only runs over udp (which can be problematic) and doesn't route over other peers if p2p isn't possible between nodes I've been thinking about building the same admin and ease of deployment around tinc, which can fall back to tcp443 if necessary.

Re: WireGuard is now in Linus' tree

#233

Post by kevin_nisbet »

adevx wrote: post #176
ghthor wrote: post #154

Earlier quoted context omitted.

That's really interesting. So you essentially implemented a Virtual Private Cloud(VPC) on top of the "PHY" network of your hosts? Does that mean that all your nodes have to be accessible to the public internet?

In my case yes and yes, but mostly because I spread out over two cloud providers.

But it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets.

So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example.

Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing IP addresses) for one end of the connection.

Re: WireGuard is now in Linus' tree

#234

Post by derefr »

duskwuff wrote: post #91
wbl wrote: post #70

Earlier quoted context omitted.

The internet does not use OSI.

It never ceases to amaze me how stubbornly educators have clung to the OSI model. It describes a non-Internet protocol stack which was designed in the 1970s, and which was never fully implemented. Attempting to use its layers as an ontology for Internet protocols is doomed to failure, as some of its layers (especially Layer 6) describe components which have no direct equivalent on the Internet.

Layer 6 exists, it’s just that most layer 7 protocols “fix” their layer 6 protocol. E.g., JSON/RPC requires JSON; SOAP requires XML; etc.

But Layer 6 is where the difference lies between ASN.1’s representational encodings—DER, BER, XER, etc. You can switch out this “presentation layer” encoding without either your application layer caring (it just sees an ASN.1 codec library) or your transport layer caring (it’s just transporting an opaque octet-stream payload document.)

One might also describe Avro, Parquet, etc. as “presentation formats”—they all have canonical input ADTs, but multiple possible wire encodings depending on the schema supplied at encode time. But all such schemas decode back to the same input ADT.

Re: WireGuard is now in Linus' tree

#235

Post by Diederich »

nathancahill wrote: post #108
Diederich wrote: post #58

Earlier quoted context omitted.

I've been using WireGuard on my Android phone for a good while now using a free digital ocean droplet via https://github.com/trailofbits/algo It's fast. It's easy. You never have to think about it. It just works.

Do you have any issues with sites blocking the DO IP addresses? I ran this for a while and a number of sites block connections for coming from a data center.

While noting what the other commenters have said, I don't recall running into any blocks, though I don't visit the sites they mentioned.

Re: WireGuard is now in Linus' tree

#236

Post by Whatarethese »

ronnier wrote: post #3

I’ve been nothing but happy with WireGuard. Connecting from my iPhone to my home and it works great, it’s fast and reliable. I’m never waiting to connect. Switching between WiFi, mobile, and sleeping go unnoticed.

The On-Demand feature is amazing. It just works and it so smooth.

Re: WireGuard is now in Linus' tree

#238

Post by stjohnswarts »

ZiiS wrote: post #120
johnebgd wrote: post #83

Earlier quoted context omitted.

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4

I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.

Don't let "it's not enough" stop you. Make a one time payment of what you can afford within reason. They don't expect you to put yourself out.

Re: WireGuard is now in Linus' tree

#239

Post by hwh »

fulafel wrote: post #210
ZoomZoomZoom wrote: post #168

Earlier quoted context omitted.

As far as I understand, the killer feature of Tinc is automatic mesh routing. You can add a node to one instance and the information spreads through the network, wireguard doesn't do that. Also, I heard maintainers were contemplating replacing the protocol with Wireguard. https://www.tinc-vpn.org/pipermail/tinc/2017-February/004755...

IPsec also supports this - give certs signed by a mutually tusted CA to all nodes and they can all communicate host-to-host in a full mesh without needing to reconfigure when adding a host etc.

Can you please elaborate? As far as I see it, IPsec is encrypting traffic. IKE is for setup of security associations. What part of IPsec would do routing, and in this case: potentially multi-hop mesh routing?

Re: WireGuard is now in Linus' tree

#240

Post by stjohnswarts »

jchw wrote: post #49

I’m using WireGuard daily on Linux and iPhone. It’s hard to describe how much better of an experience this is than OpenVPN. Connections are reliable and durable, latency is pretty low, and you can actually understand the software.

Same here. It also seems to use a bit less battery than openvpn as well on my phone.
Post reply on HN