Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard Gives Linux a Faster, More Secure VPN

wired.com

Post reply on HN
Print view View original

31–40 of 306 posts

Re: WireGuard Gives Linux a Faster, More Secure VPN

#31

Post by blattimwind »

Vysero wrote: post #17

So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?

It's a kernel module. What you do in practice is to have a configuration file somewhere and then have a command line tool (wg(1)) read that file and have the wireguard kernel module create a wg0...n network device.

The out of kernel alternative is how OpenVPN has always worked, by creating a TUN/TAP device, which basically creates a pipenetwork device bridge, and a user space process reading/writing from that pipe.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#32

Post by sbarre »

bityard wrote: post #26
fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

Every time I see a product or project that describes itself as "opinionated", what it really means is the developer implemented the subset of functionality that they require and turn away suggestions and PRs from people who need additional functionality, even if the changes would have no material impact on the author's usage. There's probably some really interesting psychological research that could be done here, but…

I mean, that's how you choose to interpret opinionated I guess.

I see it more as "convention over configuration". If you want to (or need to) tweak the configuration and settings extensively, then that tool is perhaps not for you, and that's ok. Perhaps you are a subject matter expert, and you want more control.

If you're ok with sane defaults (that were chosen by subject matter experts, and you are not one), then "opinionated" is a great thing.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#34

Post by sigio »

Vysero wrote: post #17

So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?

If you have the right config-files setup, it's a matter of typing 'wg-quick up ' ... and then you will have a VPN up. Bring it down again with 'wg-quick down '.

The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers.

(Running a 70+ node full-mesh vpn)

Re: WireGuard Gives Linux a Faster, More Secure VPN

#35

Post by Latty »

trey-jones wrote: post #29
fivesixzero wrote: post #13

Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…

I think Opinionated can be good. I think configurable can be good too. I think the best case is nearly always "Configurable, with smart defaults" meaning defaults that work out of the box for most uses. Definitely programming languages are on the periphery of this conversation, but I think provide some good examples of why I like opinionated tools in general. My language of choice right now is Go, and has been for a…

I agree that programming languages are an interesting to view over that axis.

I've done a fair amount with Elm, which is undoubtedly hugely opinionated, doing things like locking JavaScript interop behind a message passing system and baking protection from XSS into the language.

Mostly I'd say this all encourages you to do things a better way, but it can be painful, and particularly given the early nature of the language, meeting the edges of the language can be very painful because of it.

In contrast, I adored working with Scala because it was so powerful, but it sits close to Ruby in the "you can do everything a million different ways" rankings. The more I did with it, the more I wanted a refined subset of what was there (which may be what Dotty/Scala 3 ends up being).

Things like "you must always use braces on if statements" are rules I always end up enforcing using tooling anyway because they are just bugs waiting to happen, and are the low-hanging fruit of this debate. Too many language take the approach of "if we can parse it, it's fine", when really the aim should be to make it clear not just to a parser, but to the person reading/writing the code too. Hopefully more languages are more opinionated about that kind of thing in the future.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#36

Post by Diederich »

sigio wrote: post #34
Vysero wrote: post #17

So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?

If you have the right config-files setup, it's a matter of typing 'wg-quick up ' ... and then you will have a VPN up. Bring it down again with 'wg-quick down '. The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers. (Running a 70+ node full-mesh vpn)

> 70+ node full-mesh vpn

~2^70 VPN connections?

Re: WireGuard Gives Linux a Faster, More Secure VPN

#37

Post by blattimwind »

Hikikomori wrote: post #15
niczem wrote: post #9

Not so sure, as lonng as you can not disable logging: https://www.perfect-privacy.com/en/blog/wireguard-vpn-pros-a...

Their use case may require it, not true for others.

What they want to do, cannot be done by Wireguard, because Wireguard does not have the concept of "VPN sessions / connections". What they probably need to do is to assign each customer a fixed private IP for use within their VPN, e.g. from 10.0.0.0/8.

When those are not enough any more, they need to segment their VPN, so they can re-use the private IP space in each segment.

w.r.t. to "NeuroRouting and TrackStop not possible", they could route their stuff through a TUN interface to do whatever they want to do in user space. With a performance cost.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#38

Post by fivesixzero »

293984j29384 wrote: post #33

What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?

The main argument in the article (and other places I’ve seen WG discussed) is the relative ease of auditing the core code as well as auditing implementations. In that context it’s less of an augment that it’s “more secure” and more of an argument that it’s “more cost/time effective to assure that it (the core code or Any implementation) is secure”.

That argument can be strong when considering that effective security in most projects comes down to whether assurance of security can be discerned effectively within a limited time window. Often very limited.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#39

Post by GekkePrutser »

293984j29384 wrote: post #33

What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?

Smaller codebase means less chance of bugs.

But I agree, it should really be audited properly before this statement can be made.

Re: WireGuard Gives Linux a Faster, More Secure VPN

#40

Post by Hello71 »

sbradford26 wrote: post #21
deepersprout wrote: post #8

Earlier quoted context omitted.

> While I don't believe WireGuard is a drop in replacement for IPsec tunnels or OpenVPN Why?

I am mostly talking about in a business setting. WireGuard hasn't even hit its first "official release". A company is not going to switch to something that has not been thoroughly vetted. Also a lot is going to have to wait on vendor support, like incorporating WireGuard into something like Cisco AnyConnect.

this cisco anyconnect system? https://www.cvedetails.com/vulnerability-list/vendor_id-16/p...

doesn't seem very secure to me.

Post reply on HN