Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NetMaker: Connect Everything with a WireGuard VPN

netmaker.io

Post reply on HN
Print view View original

131–140 of 172 posts

Re: NetMaker: Connect Everything with a WireGuard VPN

#131

Post by papercrane »

rcme wrote: post #127
afeiszli wrote: post #123

Earlier quoted context omitted.

SSPL is a bit more restrictive, but politics also have a lot to do with it. "Open Source" is just a term, technically anyone could call their license open source, but most people only consider a license open source if the OSI (a foundation) specifically approves it. Mongo tried and failed to get SSPL approved by OSI: https://blog.tidelift.com/what-i-learned-from-the-server-sid...

Interesting. According to the article, it seems like the biggest complaint was that Mongo was a for-profit company and couldn’t be trusted? I agree that for-profit companies can’t be trusted, but I’m not sure I agree with the statement “that’s not open source because the license was written by a for-profit company”.

That article is obfuscating why the license was going to be rejected by the OSI. The OSI has as part of their definition of open-source that there can be no field of use discriminators. It had nothing to do with the fact that it was drafted by a commercial company. OSI has approved plenty of licenses drafted by for-profit companies (e.g. Intel, IBM, Microsoft.)

https://blog.opensource.org/the-sspl-is-not-an-open-source-l...

https://opensource.org/osd/

Re: NetMaker: Connect Everything with a WireGuard VPN

#132

Post by Dalewyn »

mynameisvlad wrote: post #90
Dalewyn wrote: post #55

Earlier quoted context omitted.

Seeing as this service(?) is, quote, "Backed by Y Combinator" I decided being nice about it on Y Combinator isn't worth my time nor that of any readers passing by. Not to mention websites breaking my scroll bar and disrespecting my time are so common these days they indeed really aren't interesting, which is all the more reason to call them out nicely or otherwise.

> I decided being nice about it on Y Combinator isn't worth my time nor that of any readers passing by. That’s great and all, but the guidelines are there for a reason. Break them enough and you will eventually be banned. And once again, breaking them is a valid reason to get flagged and downvoted, whether you like it or not. > Not to mention websites breaking my scroll bar and disrespecting my time are so common the…

>The logic here really doesn’t follow. Like even remotely. If the topic isn’t interesting then your comment is even less so.

Not pointing out a problem means I implicitly accept them as not problems. I find the aforementioned to be problems, so I will point them out whether nicely or otherwise.

Re: NetMaker: Connect Everything with a WireGuard VPN

#133

Post by afeiszli »

darthrupert wrote: post #63
GhostWhisperer wrote: post #56

Earlier quoted context omitted.

if you can point out the vectors that worry you maybe other will be able to address them sooth your worries

Wireguard requires an open UDP port, by default 51820. NetMaker, at least based on the quick install manual, asks you to open up the following: - 443, 80 (tcp) - 3479, 8089 (TURN, TURN api) - 8085 (exporter EE) - 1883, 8883, 8033, 18083 (if using EMQX) But perhaps none of these are required for actual WAN/Wireguard connections and one needs only limited access to these ports in order to configure the software.

You can lock it down a good amount: - 80 is only required for Caddy to request certificates. If you BYO certs, you can take that off - TURN is optional, so if you disable TURN then dont need 3479 or 8089 - The remaining ports are only for specific features (EMQX and Prometheus exporter) which are not enabled by default.

So really, you could get it down to just 443. However, this should be better documented.

Also worth noting these are all server-side requirements. The actual WireGuard clients do not need these ports open.

Re: NetMaker: Connect Everything with a WireGuard VPN

#134

Post by mynameisvlad »

Dalewyn wrote: post #132
mynameisvlad wrote: post #90

Earlier quoted context omitted.

> I decided being nice about it on Y Combinator isn't worth my time nor that of any readers passing by. That’s great and all, but the guidelines are there for a reason. Break them enough and you will eventually be banned. And once again, breaking them is a valid reason to get flagged and downvoted, whether you like it or not. > Not to mention websites breaking my scroll bar and disrespecting my time are so common the…

>The logic here really doesn’t follow. Like even remotely. If the topic isn’t interesting then your comment is even less so. Not pointing out a problem means I implicitly accept them as not problems. I find the aforementioned to be problems, so I will point them out whether nicely or otherwise.

You just said it happens so often that it’s no longer interesting. If it’s not interesting, then you shouldn’t care enough to comment. Nor is your comment remotely interesting to yourself, the author, or anyone else.

Which is why there’s a whole guideline about it. Shocking, I know.

> so I will point them out whether nicely or otherwise.

And you will continue to be downvoted and flagged when your comments, which we both know are not anywhere near “nicely”, are against the guidelines.

Re: NetMaker: Connect Everything with a WireGuard VPN

#135

Post by Dalewyn »

mynameisvlad wrote: post #134
Dalewyn wrote: post #132

Earlier quoted context omitted.

>The logic here really doesn’t follow. Like even remotely. If the topic isn’t interesting then your comment is even less so. Not pointing out a problem means I implicitly accept them as not problems. I find the aforementioned to be problems, so I will point them out whether nicely or otherwise.

You just said it happens so often that it’s no longer interesting. If it’s not interesting, then you shouldn’t care enough to comment. Nor is your comment remotely interesting to yourself, the author, or anyone else. Which is why there’s a whole guideline about it. Shocking, I know. > so I will point them out whether nicely or otherwise. And you will continue to be downvoted and flagged when your comments, which we b…

Whether something is interesting and whether something is a problem are two different things.

The first step to addressing a problem is calling it out, which I will do because I do not appreciate websites breaking my scroll bar, among other transgressions, no matter how mundane it becomes.

Re: NetMaker: Connect Everything with a WireGuard VPN

#136

Post by mynameisvlad »

Dalewyn wrote: post #135
mynameisvlad wrote: post #134

Earlier quoted context omitted.

You just said it happens so often that it’s no longer interesting. If it’s not interesting, then you shouldn’t care enough to comment. Nor is your comment remotely interesting to yourself, the author, or anyone else. Which is why there’s a whole guideline about it. Shocking, I know. > so I will point them out whether nicely or otherwise. And you will continue to be downvoted and flagged when your comments, which we b…

Whether something is interesting and whether something is a problem are two different things. The first step to addressing a problem is calling it out, which I will do because I do not appreciate websites breaking my scroll bar, among other transgressions, no matter how mundane it becomes.

> And you will continue to be downvoted and flagged when your comments, which we both know are not anywhere near “nicely”, are against the guidelines.

Re: NetMaker: Connect Everything with a WireGuard VPN

#137

Post by latchkey »

nusak wrote: post #109
latchkey wrote: post #3

Digging through their repo on github... I'm really disappointed at the lack of `_test.go` files. This is a security product, I'd be terrified something bad could happen.

the majority of testing is done with integration tests which are in a different repo

Golang is relatively easy to unit test if the code is architected to enable it (with di-like patterns) and from experience, that will catch things that integration tests can easily miss. I would rather see both sets of tests for something dealing with security.

Re: NetMaker: Connect Everything with a WireGuard VPN

#138

Post by yardstick »

gsliepen wrote: post #129
yardstick wrote: post #25

Earlier quoted context omitted.

I somewhat agree with you. I went with Dormant as 1.1 has been in development for years and no official stable release. Changes to 1.1 are the odd PR here and there, nothing really from the main author anymore. Yeah things like improving the encryption I would expect even with a stable but active product like this. Especially given ChaCha20’s widespread adoption and optimisation these days. Likewise I would have like…

It's not so much the other VPN products out there, rather no time and no other core developers. There have been lots of people contributing, some much more than others, but usually it was just to scratch their itch, after which they move on (which is perfectly fine). I'm not sure how to revitalize development if there is not a large interest from developers, and I don't want to turn this into something commercial lik…

Yes completely understand you re time. Just one of those things that happens with life.

Thanks for creating tinc, truly an awesome approach to meshed VPNs!

Re: NetMaker: Connect Everything with a WireGuard VPN

#139

Post by afeiszli »

Lucasoato wrote: post #77

Wouldn’t it be better if companies invested more in improving Wireguard and other open source solutions? How can you trust another company for such an important security service like VPN? What if one of their employees sells you out to the best offer? In the build vs buy equation, often people forget that if you don’t own the keys of your door, you risk someone locks you out.

Worth noting, the WireGuard creator has specifically mentioned these sort of management features (user auth, automated configuration and coordination, ACL's) as out-of-scope of the WireGuard project. He wanted to keep it as simple as possible, and left it to 3rd parties to develop VPN platforms using WireGuard.

Re: NetMaker: Connect Everything with a WireGuard VPN

#140

Post by afeiszli »

latchkey wrote: post #137
nusak wrote: post #109

Earlier quoted context omitted.

the majority of testing is done with integration tests which are in a different repo

Golang is relatively easy to unit test if the code is architected to enable it (with di-like patterns) and from experience, that will catch things that integration tests can easily miss. I would rather see both sets of tests for something dealing with security.

It's definitely lacking on the unit-testing side and we should do more there, but we think integration tests are the more important of the two in this scenario, because the most fragile bits are the interactions between client-client and client-server. It's a lot harder to self-contain those tests without deploying the platform and clients on various infrastructures.
Post reply on HN