41–50 of 306 posts
What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?
Fewer configuration options/smaller codebase mean you have less to screw up while programming, less to read while debugging, and fewer opportunities to get things wrong while deploying.
Don't forget to support Jason, WireGuard's author, on Patreon. https://www.patreon.com/zx2c4
But of course what he's getting now ($1212) is nowhere near that.
Earlier quoted context omitted.
If you have the right config-files setup, it's a matter of typing 'wg-quick up ' ... and then you will have a VPN up. Bring it down again with 'wg-quick down '. The configs itself are basically just the IP's used, and the peers and keys used to communicate with those peers. (Running a 70+ node full-mesh vpn)
> 70+ node full-mesh vpn ~2^70 VPN connections?
Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…
Every time I see a product or project that describes itself as "opinionated", what it really means is the developer implemented the subset of functionality that they require and turn away suggestions and PRs from people who need additional functionality, even if the changes would have no material impact on the author's usage. There's probably some really interesting psychological research that could be done here, but…
Whether it impacts a specific use case is usually here nor there - it’s usually about maintainability. And while finding contributors for open source projects can be difficult, finding people who want to do the thankless work of maintaining code long-term is much harder.
Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…
I’ve configured IPSec vpns for the better part of 15 years. After using WireGuard for 5 minutes I knew this was going to be a big thing. IPsec has too many fucking knobs. It is it’s pitfall.
I wonder if any specification group has ever thrown up their hands and said, “you know what? Fine. Let’s just create one named sub-protocol for the way each of you major players does things; and then have the clients of this protocol do a sub-protocol negotiation; and then have the client use a plugin specific to the sub-protocol that’s been negotiated. Then you don’t need any knobs; all the policy can be baked into the plugin.”
(Come to think of it, this is kind of how the authentication phase of SSH works, when configured to use PAM. “Pretend we’re MIT” (a.k.a. Kerberos); “pretend this is a Microsoft Active Directory domain” (a.k.a. NTLM auth); etc.
So when they say it will be embedded into the Linux Kernel, what does that mean exactly? Does that mean I will be able to open a terminal an type: WireGuard and from then on my connection to the internet will be secure so long as I don't close the terminal or what?
It's more like how iptables/nftables is part of the kernel. You need a recent kernel along with user space tooling. But it will become part of virtually every Linux distribution.
As for "my connection to the internet will be secure" - that's possible, but the main use case right now is "my connection to my vpn/server will be secure".
Additional configuration is required to route all traffic through the wireguard tunnel, and make sure all other traffic is dropped - and to make sure all traffic is dropped, rather than sent in plaintext when the tunnel goes down (a "kill switch").
I'm sure we'll see many tools and scripts that will help automate such setups.
But if you just want a udp routed VPN - you might want to look at zerotier or tinc.
Don't forget to support Jason, WireGuard's author, on Patreon. https://www.patreon.com/zx2c4
Wow, 10k$/month is a lot more than a 'sustainable full-time job' would pay :) At least here in Europe. But of course what he's getting now ($1212) is nowhere near that.
Increasingly it seems like heavily opinionated foundational tools and frameworks are overtaking more highly configurable alternatives, at least in terms of breadth of usage or popularity. Could this be a positive change? Does this represent a healthy response cognitive fatigue in a world with configuration options at every possible layer? Or does this shift to less readily configurable tools represent an overall nega…
Every time I see a product or project that describes itself as "opinionated", what it really means is the developer implemented the subset of functionality that they require and turn away suggestions and PRs from people who need additional functionality, even if the changes would have no material impact on the author's usage. There's probably some really interesting psychological research that could be done here, but…
That's one way of looking at it. Another way of looking at it is to emphasize minimalism, the UNIX philosophy, and keeping maintenance burdens low. Sometimes, neither is the case - Ruby on Rails being the classic example of an opinionated framework, one that did expand to add additional functionality over time.
What makes Wireguard more secure? The article appears to make some weak claims about a smaller codebase and less configuration options but I don't think that translate directly into it being more secure?
E.g., IPsec has a “none” cipher!