Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

21–30 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#21

Post by sbradford26 »

deepersprout wrote: post #8
sbradford26 wrote: post #6

While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN I think it is a great solution to add a VPN tunnel back to your home network. I am running a WireGuard server on an Unraid server and it was trivial to setup and I can easily hit near gigabit speeds through it.

> While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN Why?

I am mostly talking about in a business setting. WireGuard hasn't even hit its first "official release". A company is not going to switch to something that has not been thoroughly vetted. Also a lot is going to have to wait on vendor support, like incorporating WireGuard into something like Cisco AnyConnect.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#22

Post by sk5t »

gclawes wrote: post #3
jhurliman wrote: post #2

Is there a version of Ubuntu that has GUI NetworkManager support for WireGuard? I’m missing the convenience of toggling the VPN on and off from the system menu.

Or login management that doesn't involve pre-shared keys?

A keypair is not a pre-shared key; but if you're looking for a tool to pull public keys (and peer AllowedIPs) from some other central source of truth, a script might be the right call for now.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#23

Post by Latty »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

It definitely depends on context.

There are some cases where opinionated is just fundamentally better. I'd say that a good example of this is code formatting tools. These have been historically highly configurable, but that creates huge amounts of room for bikeshedding and conflict, where consistency is by far the most important thing and the actual style itself barely matters unless you start getting silly.

I think it essentially becomes a sliding scale on how much consistency and "getting it right" are more important over having something be optimal or perfectly adapted to the situation.

When it comes to security tools like VPNs, reducing the chances for users to shoot themselves in the foot is almost always more important than anything else, so it seems like another area that would be beneficial to have something more opinionated rather than more configurable, so the decisions are in the hands of people who have invested the time in understanding the problems at hand.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#24

Post by flyGuyOnTheSly »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

This is not some strange paradigm shift, it's the UNIX model 101 [0]

[0] https://en.wikipedia.org/wiki/Unix_philosophy#Program_Design...

Re: WireGuard Gives Linux a Faster, More Secure VPN

#25

Post by saber6 »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I’ve configured IPSec vpns for the better part of 15 years.

After using WireGuard for 5 minutes I knew this was going to be a big thing.

IPsec has too many fucking knobs. It is it’s pitfall.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#26

Post by bityard »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

Every time I see a product or project that describes itself as "opinionated", what it really means is the developer implemented the subset of functionality that they require and turn away suggestions and PRs from people who need additional functionality, even if the changes would have no material impact on the author's usage. There's probably some really interesting psychological research that could be done here, but to be polite about it let's just say that authors of "opinionated" software tend to have rather colorful personalities.

Wireguard is not opinionated, it just has a very limited scope. It has one job, to create an encrypted tunnel between two endpoints, and leaves literally everything else up to other tools to build higher-level functionality upon. Contrast with OpenVPN which requires you to be your own TLS certificate authority and all the complication that goes along with that.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#27

Post by Hikikomori »

closeparen wrote: post #18

What are the options right now for open source user/access management around WireGuard? I don’t love the idea of manually writing down keys in a config file. I’m thinking of writing something to template out configs for short term keys (and automatically reload) based on an OIDC authentication, but seems inelegant.

Could create something where you authenticate to vpn.yourdomain.com in your browser using your preferred method that creates a temporary key and starts your wg client for you.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#28

Post by the8472 »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

Taken openssh. You get sane defaults and still have a ton of settings to fiddle with when you encounter odd edge cases or comlex scenarios such jumping through a chain of proxy hosts or talking to some legacy embedded ssh server and such things.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#29

Post by trey-jones »

fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I think Opinionated can be good. I think configurable can be good too. I think the best case is nearly always "Configurable, with smart defaults" meaning defaults that work out of the box for most uses.

Definitely programming languages are on the periphery of this conversation, but I think provide some good examples of why I like opinionated tools in general.

My language of choice right now is Go, and has been for a while. One of the things I like about it is that it's a bit opinionated. For example:

Braces around `if` statements aren't optional. I prefer this to other C-Like languages that allow you to leave out braces for one-liners.

Also the document "Effective Go" exists, which lays out the canonical "best" ways of doing a lot of things. The language doesn't force you to do these things, but there is an authoritative source that makes good suggestions.

The Antithesis of opinionated languages in my opinion is Ruby. I personally hate Ruby, but I know there are a lot of people that love it. I hate it because there are too many ways to of accomplishing the same tax, and to me this makes it harder to read. Go, on the other hand is the easiest language for me to read, largely because of `gofmt`, another thing that doesn't force you to do it a certain way, but strongly encourages a standard end result.

Post reply on HN