Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

In-kernel WireGuard is on its way to FreeBSD and the pfSense router

arstechnica.com

Post reply on HN
Print view View original

61–70 of 167 posts

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#61

Post by axaxs »

kbenson wrote: post #28
Jonnax wrote: post #11

Earlier quoted context omitted.

Wow. Netgate come off as incredibly unprofessional. According to the article linked and the info here in that email you linked this is my conclusion: * Netgate tried to ship flawed code that has multiple security issues. * Jason Donenfeld, one of the lead Wireguard developers, went out of his way to work on rewriting it to be better in time for the 13.0 release of FreeBSD * This Netgate employee is angry that they we…

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

Yeah, same.

Even if all of the above is true, it reads like an elaborate insult. And that's fine if that what the author set out to do for some reason. Pretending it wasn't after the fact isn't being honest, in my opinion.

A more professional and neutral announcement could just talk about code that needs to be refactored due to some incompleteness and vulnerabilities.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#62

Post by CameronNemo »

tw04 wrote: post #57
kbenson wrote: post #28

Earlier quoted context omitted.

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

Keep in mind, back in February of 2020 when Kip Macy first announced that Netgate had hired him to port Wireguard, Jason offered to help. First Kip declines the offer, then seems to warm slightly to it, but ultimately appears to have not actually engaged Jason. If I'm Jason and I offer my help (for free), they don't take me up on my offer, then try to release code that would make my baby look quite ugly, I would prob…

Sounds like Jason should trademark Wireguard (the name). Or build an alternative brand. That way Netgate's actions, or the actions of other wireguard implementations, will not reflect on the reputation of his project/product/technology.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#63

Post by Reventlov »

tw04 wrote: post #57
kbenson wrote: post #28

Earlier quoted context omitted.

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

Keep in mind, back in February of 2020 when Kip Macy first announced that Netgate had hired him to port Wireguard, Jason offered to help. First Kip declines the offer, then seems to warm slightly to it, but ultimately appears to have not actually engaged Jason. If I'm Jason and I offer my help (for free), they don't take me up on my offer, then try to release code that would make my baby look quite ugly, I would prob…

"Kip Macy" don't you mean Matt Macy ?

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#64

Post by colordrops »

seany wrote: post #16
andrius4669 wrote: post #4

Link to relevant announcement email: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... There's also Jason's reply to apparently not-nice feedback of someone from NetGate: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

Netgate is weirdly hostile to a lot of opensource stuff, which should be strange given what all their tech is built on top of. This has been going on for years. (see opnsense etc)

They've recently forked their open and closed source products, so a lot of people have been migrating to OPNSense. I've been using it for a couple months now and recommend it.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#66

Post by Crontab »

cperciva wrote: post #54
tptacek wrote: post #52

Earlier quoted context omitted.

Real subtle, Colin.

I mean, Linus has openly acknowledged that he has behaved unprofessionally in the emails he sends to people who are trying to contribute. There isn't anything secret here.

LOL, my first thought was that you were talking about Theo.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#67

Post by tptacek »

axaxs wrote: post #61
kbenson wrote: post #28

Earlier quoted context omitted.

That was my impression too, then I went back a couple prior messages, and looked at the earlier announcement. Wihle Netgate looks to have overreacted (at least from the info we have), I can understand why they would be upset. This was in the original announcement: The first step was assessing the current state of the code the previous developer had dumped into the tree. It was not pretty. I imagined strange Internet…

Yeah, same. Even if all of the above is true, it reads like an elaborate insult. And that's fine if that what the author set out to do for some reason. Pretending it wasn't after the fact isn't being honest, in my opinion. A more professional and neutral announcement could just talk about code that needs to be refactored due to some incompleteness and vulnerabilities.

It's not an elaborate insult.

To a much greater extent than in other security protocols, implementation security is a goal of WireGuard. The protocol itself was designed to support secure kernel implementations; for instance, it's designed in such a way as to not require on-demand dynamic memory allocation.

It's part of the premise of the security model of WireGuard that it has secure kernel implementations. If you're building a kernel WireGuard implementation for a major open source OS without taking advantage of the WireGuard implementation design concepts, you're not really building WireGuard; you're building a compatible fork and calling it "WireGuard".

The "ask" here from Jason was for everyone to slow their roll, take the flawed WireGuard implementation out of the tree, and give everyone a chance to make it more resilient. Considering the amount of work Jason had to go through to get WireGuard into the Linux tree, that seems like a very reasonable request.

Instead, the WireGuard project seems to have been put into a position where they had to scramble to fix up an implementation that was being pushed into FreeBSD, as WireGuard qua WireGuard. I can imagine that being a frustrating experience. It certainly didn't generate the most political response ever, but I think you'd be reaching to call it a deliberate insult.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#68

Post by tptacek »

Crontab wrote: post #66
cperciva wrote: post #54

Earlier quoted context omitted.

I mean, Linus has openly acknowledged that he has behaved unprofessionally in the emails he sends to people who are trying to contribute. There isn't anything secret here.

LOL, my first thought was that you were talking about Theo.

I think he was. :)

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#70

Post by WarOnPrivacy »

anfogoat wrote: post #39
WarOnPrivacy wrote: post #35

Earlier quoted context omitted.

However, you are directing your disdain (about pfSense) toward us. To what end? What is it you want to achieve?

> However, you are directing your disdain (about pfSense) toward us. I don't think I am; who's us in that sentence? > To what end? What is it you want to achieve? I'm scratching an itch. If Netgate can screw the community that helped pfSense gain popularity then surely it is perfectly acceptable for a member of that community to express a little disdain.

> who's us in that sentence?

Everyone in this thread.

> it is perfectly acceptable for a member of that community to express a little disdain.

Okay. I never inferred otherwise. If venting is the total of your goal here are you okay we blow that off or is there something else you're hoping for?

To be clear, I've no animosity toward your posts. My 'hidden' agenda is this: Because hostility takes a toll on the recipients (us), I'm curious if what you're getting in return is worth it.

No judgment. We all do this.

Post reply on HN