Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Full-device VPN

private-network.firefox.com

Post reply on HN
Print view View original

111–120 of 122 posts

Re: Firefox Full-device VPN

#111

Post by antihero »

tmikaeld wrote: post #20
jplayer01 wrote: post #19

I don't understand. Their partner is Mullvad. Mullvad has servers across the entire god damn globe. Why is this US-only? Why is it US-only going into early 2020, as in, months to provide service to non-US regions in what's probably going to be a limited roll-out to "select regions"? It's not the 90s anymore. It's time to drop the US-centric crap. They're not a publisher. They're not distributing movies or TV series.

I think it's because Firefox have made their own client and they only want to offer Wireguard connections. Since Wireguard is still a bit new and buggy, they probably want to make sure it's stable and roll out in stages.

But national boundaries are so antiquated.

Re: Firefox Full-device VPN

#112

Post by [deleted] »

azinman2 wrote: post #77

Perhaps Mullvad is great. I don’t know. The whole VPN industry is full of shucksters, and when Mozilla says that Mullvad has “committed” to privacy doesn’t sound like enough heft to me. Why isn’t Mozilla running their own servers if this really is something worth getting into? They’re one of the few privacy and public good companies we have left.

[deleted]

Re: Firefox Full-device VPN

#113

Post by jonplackett »

lmorchard wrote: post #100
jonplackett wrote: post #62

Earlier quoted context omitted.

My guess is everyone on here defending US only... is in the US. Could be wrong.

I mean, also computers are hard and this is a thing that's worth getting right by reducing variables and taking it small steps at a time?

So why not start with a nice small country?

Re: Firefox Full-device VPN

#114

Post by persona_reuse »

fulafel wrote: post #95
Semaphor wrote: post #89

Earlier quoted context omitted.

I recently became a mullvad customer and used wireguard for the first time. Maybe this is a windows thing, but it's so, so much faster than what I was used to from openVPN, ike, etc.

Anyone know if there's something weird about OpenVPN that makes it particularly bad? You'd think crypto + UDP encapsulation at consumer internet speeds would be pretty straightforward to implement performantly in this day and age.

5 years of VPN admining here.

The openvpn community is pretty nonexistent. Core is about 10 guys (half on loan from the for-profit company) and they're multiple years behind on where the development should be.

2.4 release: currently 3 years old, decently robust, but limited. 2.5 release: 38 of 51 blockers still open, no release date in sight. 3.0 release: roadmap was written in 2010, no release date in sight.

OpenVPN 2.5 is where we'll have per-user tls-crypt. tls-auth/tls-crypt in 2.4 means when the PSK (that all clients share) leaks, you have to rotate a PSK for ALL users all at once. Or you could not use that PSK at all and just get DoS'ed over UDP all the time. OpenVPN 3 is where they're looking at being multithreaded. Let that sink in for a minute, because the devs haven't. You share one core with EVERYONE who's connected. openvpn is, performance-wise, a glorified openssl-pipe-to-nc at that point.

These are features that any server admin should be dying to have, because they're what let you scale from "my cute little tunnel from my home to my cloud instance" to "endpoints that can scale."

Tuning to get solid performance means getting the client config right with a lot of low-level tweaks, a lot of iperf and network-ops knowledge, shipping it out to the userbase, and hoping it works in their situation. Tuning later because you screwed anything up is hit and miss: some features you can 'push' out and fix, some you can't. The devs can't imagine tunnels where someone who isn't as immersed in the code as them doesn't control all endpoints and all configs, or where there's no burden to walking around and changing every user's config. I'm years into this and I'm still finding things to adjust or submit patches for, to make my users happier.

OpenVPN has one thing that other VPNs severely lack: a ABSOLUTELY SUPERB hook system. You want to have actions trigger scripts, they got u fam. You can do a lot of serverside and clientside magic because of that, integrating with your SSO and ACL management. Wireguard is much more in the beautiful-in-its-simplicity-but-that-still-means-simple 'static definition' camp (for now).

Re: Firefox Full-device VPN

#115

Post by godelski »

Semaphor wrote: post #90
godelski wrote: post #79

Earlier quoted context omitted.

I'm curious about the parent's question, but consider that Mullvad is about $5 on its own anyways. It also already supports international customers and multiple platforms. So I'm not sure why you would buy it through FF and not directly from Mullvad? It just seems like a middleman with no benefits.

Mullvad is 5€, slightly more

> Mullvad is __about__ $5

5€ is currently $5.54. I'd call that about $5. It's about the same price as if you paid with crypto too.

Re: Firefox Full-device VPN

#116

Post by godelski »

ensignavenger wrote: post #104
godelski wrote: post #79

Earlier quoted context omitted.

I'm curious about the parent's question, but consider that Mullvad is about $5 on its own anyways. It also already supports international customers and multiple platforms. So I'm not sure why you would buy it through FF and not directly from Mullvad? It just seems like a middleman with no benefits.

I would like to buy it through Mozilla in order to support the Mozilla Foundation, because I want to support their work and help them break their dependency on Google for funding.

I can justify this, but I'm wondering why Mullvad doesn't give them a slightly better deal. It is basically the same deal that you get if you pay with crypto, except you -- the user -- lose all the benefits of that. So why not charge something like $4.50? Or $4? They are bringing bulk to Mullvad. One of them, or both, could eat the cost until the price stabilized. I'm sure at Mozilla's scale they could push Mullvad's operating price down.

But the fact is that this does create more links in the VPN, and thus more security risks. Which isn't a big deal for the 99% of us that are just using them to torrent and prevent Comcast from seeing our data, but there's still a principle thing, which is part of why people are jumping from PIA before the merger has even happened.

Re: Firefox Full-device VPN

#117

Post by Semaphor »

godelski wrote: post #115
Semaphor wrote: post #90

Earlier quoted context omitted.

Mullvad is 5€, slightly more

> Mullvad is __about__ $5 5€ is currently $5.54. I'd call that about $5. It's about the same price as if you paid with crypto too.

I just wanted to a) mention the exact price and b) that this might be a reason for some to cut out the middleman.

Re: Firefox Full-device VPN

#118

Post by thiefmeister »

y4mi wrote: post #107
ksec wrote: post #101

Earlier quoted context omitted.

Nope. Rolling out features in your home country is pretty normal. Apple does it all the time. What I have problem is slow roll out features across the globe, when you cant see or understand the reason behind it.

Bad example, Apple's market share is tiny anywhere besides the US. And this isn't a new thing. They partnered with an established vpn provider. Horizontal scaling won't be an issue there. There is really no reason, but I don't really care either And there is really no reason to not go to the actual provider. Same price and you can use it on all platforms. They even provider a wireguard backend. https://mullvad.net/en…

Apple's market share in Japan is big.

Not sure about other places yet.

Re: Firefox Full-device VPN

#119

Post by fulafel »

persona_reuse wrote: post #114
fulafel wrote: post #95

Earlier quoted context omitted.

Anyone know if there's something weird about OpenVPN that makes it particularly bad? You'd think crypto + UDP encapsulation at consumer internet speeds would be pretty straightforward to implement performantly in this day and age.

5 years of VPN admining here. The openvpn community is pretty nonexistent. Core is about 10 guys (half on loan from the for-profit company) and they're multiple years behind on where the development should be. 2.4 release: currently 3 years old, decently robust, but limited. 2.5 release: 38 of 51 blockers still open, no release date in sight. 3.0 release: roadmap was written in 2010, no release date in sight. OpenVPN…

Thanks for the explanation!

If it's not multithreaded, sounds like one thing to try could be just to run an instance per user, but I guess that may not be straightforward to operate.

Oh well, at least we have IPsec.

Re: Firefox Full-device VPN

#120

Post by morpheuskafka »

One the one hand, I'm glad they are using a trusted partner like Mullvad. On the other hand, why would you join a waitlist for a service that requires you to link your account to a US credit card--when you can literally mail cash to Mullvad and be completely anonymous.
Post reply on HN