Live data from Hacker News

In-kernel WireGuard is on its way to FreeBSD and the pfSense router

arstechnica.com

91–100 of 167 posts

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#91
post #72

Earlier quoted context omitted.

"Kip Macy" don't you mean Matt Macy ?

There's not a good way for me to respond to that without going off-topic. The following is assuming that wasn't a rhetorical question, if it was rhetorical I guess we may just agree to disagree: Until he issues a public apology for his actions, I'll refer to him as Kip. Changing your name to run from the google searches is completely understandable, and I support second chances, but you need to show a bit of remorse…

Damn that link was an adventure from start to end.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#92

Earlier quoted context omitted.

Came here to post that, looks like they are pulling out the recent effort EDIT: removed the "and revert to the original freebsd (broken?) implementation"

WireGuard is gone from the kernel in 13.0-RELEASE. Given the choice between "buggy" and "less than a week old", we're going with the third option of "you can ship a kernel module via the ports tree".

Which is really the absolute best outcome:

https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#93

Earlier quoted context omitted.

> However, you are directing your disdain (about pfSense) toward us. I don't think I am; who's us in that sentence? > To what end? What is it you want to achieve? I'm scratching an itch. If Netgate can screw the community that helped pfSense gain popularity then surely it is perfectly acceptable for a member of that community to express a little disdain.

> who's us in that sentence? Everyone in this thread. > it is perfectly acceptable for a member of that community to express a little disdain. Okay. I never inferred otherwise. If venting is the total of your goal here are you okay we blow that off or is there something else you're hoping for? To be clear, I've no animosity toward your posts. My 'hidden' agenda is this: Because hostility takes a toll on the recipient…

> “Because hostility takes a toll on the recipients (us), I'm curious if what you're getting in return is worth it.

We aren’t the recipients of the hostility; Netgate is. I feel no hostility directed towards me when reading anfogoat’s post. In fact, I thank them for openly expressing their disdain towards Netgate here, as it gives others like me more information to look into and come to our own conclusions on.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#94

Note that there's additional follow-up available here: https://lists.freebsd.org/pipermail/freebsd-hackers/2021-Mar...

Came here to post that, looks like they are pulling out the recent effort EDIT: removed the "and revert to the original freebsd (broken?) implementation"

They are removing both implementations(the new and the broken one) in order to put more work and review on the new one, and release it properly at a later time.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#96

is there any linux equivalent of pfsense+freebsd ?

Untangle NG Firewall, perhaps. [1] 1. https://wiki.untangle.com/index.php/NG_Firewall_Installation

what about vyos ?

https://vyos.io/products/#vyos-router

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#97
post #55
post #29

Earlier quoted context omitted.

OPNsense is criminally underrated. My main routers for my office are virtualized OPNsense VM's in high availability with CARP, DHCP, DNS, VPN endpoints, inter-vlan routing, gateway policies, outbound nat... I could go on. It all works extremely well I can't fathom why people still choose pfSense with all of the community shenanigans and closed source versions. My only gripe with it over 3 years has been the documenta…

I did LOTS of research on what firewall/router distro to install to my new router a few months ago. See my comment history for considering different options. I have to say choosing OPNsense has been a great choice. All the things you said I can agree on, but I have to add one more thing: That quick search bar on the top-right corner where you can quickly type where you want to go. That thing is just super nice when j…

Same here but I've concluded that there is nothing better than a simple install of pure OpenBSD or FreeBSD and setting the rules on /etc/pf.conf. Its safer, faster, lighter and I could argue that is also easier to admin with just SSH and no web code in between.

For example, in the latest version of OpenBSD which has a Wireguard kernel implementation, the management tool has been basically included in the ifconfig command.

  ifconfig wg0 create wgport 5180 wgkey ...
And then you are set. For persistence you create a /etc/hostname.wg0 file containing the commands to bring the interface up.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#98
post #90
post #74

Earlier quoted context omitted.

> It's not an elaborate insult. My read on it wasn't that it was an elaborate insult, but more that it was far more denigrating than it needed to be, if he was trying to be professional. That doesn't mean it was purposeful, sometimes people just don't really associate the statements they make with how it may be perceived. I think it could have been communicated clearly and succinctly with something along the lines of…

I get your point about perceptions, but there's also another aspect of why I found it important and necessary to describe just how poor the code was: When you're talking about replacing and rewriting the implementation on the eve of release, you better have a good reason for doing so. Stuffing a rewrite of security critical code into the kernel at the last minute is a big red flag. The main question that immediately…

> The idea wasn't to be _insulting_

Sure, I didn't really interpret it as you attempting to be insulting, more that you were accidentally insulting through your explanation of what you found.

> but rather to accurately and vividly describe the state of the code, as a motivating factor for the rewrite

Sure, but is any of that really needed beyond "there were numerous security problems we had to address"? When talking about shipping crypto, I think most involved would agree not shipping it is better than shipping something possibly exploitable.

I think the core of what I was trying to express is that words should be crafted with care when expected to be read in a public forum like this, just like any code expected to be used by many should be crafted with care. For the same reason it's useful to remove quadratic algorithms from places where the input is somewhat not entirely vetted, it's useful to take care with words to reduce the chance of misinterpretation.

That doesn't mean scour your statements for the smallest possible misinterpretation, but there's a lot of room to improve things like "I imagined strange Internet voices jeering, “this is what gives C a bad name!”" while still expressing your point constructively. The low hanging fruit is easy to pick, so you might as well pick it.

To be clear, I feel for you with regards to this situation. Nobody really expects weird accusations like you got from simple emails, and that's on Netgate, but a less extreme response that also publicly notes the soured relationship would also be a negative outcome from this in my opinion, if one of lower magnitude.

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#99

Link to relevant announcement email: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649... There's also Jason's reply to apparently not-nice feedback of someone from NetGate: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

Damage control: https://www.netgate.com/blog/painful-lessons-learned-in-secu...

Re: In-kernel WireGuard is on its way to FreeBSD and the pfSense router

#100
Scott Long from Netgate's response: https://www.netgate.com/blog/painful-lessons-learned-in-secu...

"Unfortunately, the public discussion has also veered into vague claims and slanderous attacks. This is where the lack of transparency, the lack of respect, and the inflation of ego is damaging and unproductive. We had hoped for a better collaboration than this, and it makes me doubt the motives of the attackers. And yes, I make deliberate use of the word “attacker” here, because that’s what this is, an attack on Netgate and on the FreeBSD and pfSense communities. Beware of anyone who says that they have all the answers. I also worry about the integrity of those who make vague statements and blanket, over-the-top accusations."

Post reply on HN