Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard in FreeBSD

cgit.freebsd.org

Post reply on HN
Print view View original

11–20 of 84 posts

Re: WireGuard in FreeBSD

#11

Post by HorizonXP »

atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure.

I plan on using FreeBSD bastions.

Re: WireGuard in FreeBSD

#12

Post by cpach »

atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

IMHO: No. If you like the Ubuntu userland, I see no reason to switch.

Re: WireGuard in FreeBSD

#14

Post by bragr »

HorizonXP wrote: post #11
atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.

The "BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say.

Its fine to like BSD, I just wish people were willing to be honest any say it's based on their personal and philosophical preferences, rather than based on any objective metric.

Re: WireGuard in FreeBSD

#15

Post by zx2c4 »

ksec wrote: post #6

I assume this is with Jason Donenfeld's approval?

Yes! Very excited by this. We developed this together out-of-tree, and it's been available in ports (FreeBSD's package system) for a while now. This here is about moving it into the FreeBSD base system, so that it'll now be developed and improved alongside the rest of the operating system. Terrific step forward.

Re: WireGuard in FreeBSD

#16

Post by rascul »

bragr wrote: post #14
HorizonXP wrote: post #11

Earlier quoted context omitted.

Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.

The " BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say. Its fine to like BSD, I just wish people were willing to be honest…

I think the claim might be related to openbsd's claim on their website:

> Only two remote holes in the default install, in a heck of a long time!

https://www.openbsd.org/

I remember a time when it was zero, not two.

Re: WireGuard in FreeBSD

#17

Post by rascul »

smoochy wrote: post #5
detaro wrote: post #4

Earlier quoted context omitted.

It adds wireguard support to the kernel.

Okay, but... what difference does it make? Apart from not having to install it manually? Am I missing something?

If I recall correctly, we went through this on Linux in the past. I believe the first wireguard implementations were userspace while the work was being done to get it in the kernel.

Re: WireGuard in FreeBSD

#18

Post by jessermeyer »

smoochy wrote: post #5
detaro wrote: post #4

Earlier quoted context omitted.

It adds wireguard support to the kernel.

Okay, but... what difference does it make? Apart from not having to install it manually? Am I missing something?

As others have hinted to -- no userspace copies. No context switches. Vroom Vroom.

Re: WireGuard in FreeBSD

#20

Post by flatiron »

atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

there are no open CVEs against the default install of wireguard on Ubuntu. for all the grief ubuntu gets i find their server has very sane defaults.
Post reply on HN