221–230 of 306 posts
Earlier quoted context omitted.
It should be possible to run GRE, L2TP, or VXLAN over WireGuard although such tooling probably doesn't exist yet.
What tooling do you need for this? Shell scripts would be the traditional approach.
I really like wireguard, but one thing that bugs me is the fact that it's layer 3 (an ip tunnel) and has no code to support layer 2 (ethernet MAC tunnel). The downside for me is that you have to manage static ips in the configurations (specifically it's not compatible with ipv6 slaac and NDP). There is https://git.zx2c4.com/wg-dynamic but it's very experimental at the moment. The level 3-only tunnel is motivated as "…
It should be possible to run GRE, L2TP, or VXLAN over WireGuard although such tooling probably doesn't exist yet.
Check out Algo [0] if you're interested in setting up a personal WireGuard VPN server. It's simple and hassle-free, especially if you are not familiar with server administration and don't want to be bogged down by details. I have one deployed on Digital Ocean ($5/mo droplet). All you need to do is run the setup script, answer a few yes/no questions (optional features), paste in your API key, and update the firewall s…
At least, not without spending a great deal of my time or a great deal of my personal money to build a suitable rugged production-grade service.
In the case that someone has any trouble configuring WireGuard, I would like to share my automatic deployment of WireGuard and Unbound with full IPv4 and IPv6 support with Packer and Terraform in Hetzner Cloud (although it can be easily adapted to other providers) [1]. In the case that no automatic deployment is necessary, it may also be useful to look directly at the WireGuard configuration [2]. Since WireGuard supp…
Earlier quoted context omitted.
> Could this be a positive change? It's normal and expected evolution of protocols and software. Generation 1: New idea, new implementation. As people become comfortable with the new idea it gains in acceptance and hype. Try to keep it simple and fast, but it's a exercise in exploration and it gains technical debt faster then it gains new features. Generation 2: Widespread acceptance and commercialization. Groups ins…
Generation 4: Bloat the software with so many unnecessary features, the users must want to chat with each other no?
Earlier quoted context omitted.
Substituting MAC for IP address is exactly what ZeroTier does. MACs can't be spoofed, though nodes can be designated as bridges and that allows them to impersonate MACs. There's still the issue of authenticating IPv4 IPs though, which are too small to embed anything useful into. ZeroTier has a certificate system for that but it requires the use of the rules engine to enable it.
> MACs can't be spoofed lol 20 years ago, in college, some folks in the dorm had fun fucking with others at the Ethernet level. Most of us only had experience with the IP level, so couldn't understand what was going on.
Earlier quoted context omitted.
> MACs can't be spoofed lol 20 years ago, in college, some folks in the dorm had fun fucking with others at the Ethernet level. Most of us only had experience with the IP level, so couldn't understand what was going on.
ZeroTier doesn't permit spoofed MACs unless explicitly configured.
Earlier quoted context omitted.
People say complicated PKIs are the most important parts of systems because they are complicated and hard to work with and people get invested in them and all the time they've sunk into them. But in reality, far more people have been secured by SSH keys than by IPSEC keys, and by Signal than by S/MIME.
Yet Web PKI trounces all of them combined. Signal isn't an apposite comparison as Signal implements key signing and key exchange with Signal as the sole certificate authority. Who do you think attests to the authenticity of phone numbers, and how do you think they do so? Indeed, Signal exemplifies exactly what I was saying: key management is crucial, key management is hard. Secure, trusted key management is like 90%…
There are organizations that benefit from a PKI-ier deployment of SSH, but even there, the "I" part of the PKI is extremely attenuated, and most of the real interesting work is done by a single centralized point of trust that mints time- and usage- limited token-equivalents. They're not trees so much as they are vines or fungus colonies. They're great, but they're certainly not a vindication of the 1990s concept of a PKI.
Earlier quoted context omitted.
Something like this: We introduce wireguard2, which is not wire-protocol-compatible with original wireguard. The same configuration files can be used, but you must generate new keys as part of your switch over. We strongly advise you to stop using original wireguard if there is any possibility of a wealthy, organized, determined attacker intercepting your communications. (See CVE2021-x. and forthcoming paper "64 qubi…
So at midnight July 23 2026 everyone upgrades to wireguard2 all at once? Perhaps I am not getting what you are proposing here...
None of this is complicated. It's also worth looking back on the history of TLS vulnerabilities to get a sense of just how little ciphersuite negotiation helped anybody.
Earlier quoted context omitted.
ZeroTier doesn't permit spoofed MACs unless explicitly configured.
and how can they tell?