Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

Post reply on HN
Print view View original

11–20 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#11

Post by unrealhoang »

turblety wrote: post #6

Nice, I love WireGuard. I ended up building WrapGuard [1] to run applications without root access to the host and choose Go to write it in. I don't really know Rust, but does it make more sense for firmware/networking type software? Is there even a difference? 1. https://github.com/puzed/wrapguard

from TFA, the main advantage would be for embedded (as a library) use case, FFI with Go is harder.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#12

Post by Hakkin »

I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will randomly start draining at 10x normal speed if I have it enabled until I reboot.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#13

Post by razighter777 »

imcritic wrote: post #10

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#14

Post by mwalser »

ur-whale wrote: post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

I wouldn't say that multiple implementations are duplicating the attack surface since most users will not end up running them in parallel.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#15

Post by ur-whale »

mwalser wrote: post #14
ur-whale wrote: post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

I wouldn't say that multiple implementations are duplicating the attack surface since most users will not end up running them in parallel.

I meant at a global level (think as if you're attacking all wireguard users, not a single one)

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#18

Post by intsunny »

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#19

Post by swiftcoder »

ur-whale wrote: post #15
mwalser wrote: post #14

Earlier quoted context omitted.

I wouldn't say that multiple implementations are duplicating the attack surface since most users will not end up running them in parallel.

I meant at a global level (think as if you're attacking all wireguard users, not a single one)

The increased attack surface mostly only affects that one particular implementation though. So, yes, twice as many implementations that may contain exploitable bugs, but each new implementation could only be used to exploit a fraction of the total user base

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#20

Post by maxmcd »

turblety wrote: post #6

Nice, I love WireGuard. I ended up building WrapGuard [1] to run applications without root access to the host and choose Go to write it in. I don't really know Rust, but does it make more sense for firmware/networking type software? Is there even a difference? 1. https://github.com/puzed/wrapguard

I believe you are making use of gVisor’s userspace TCP implementation. I’m not sure if there is something similar in Rust that would be so easy to set up like this.
Post reply on HN