Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux under WSL2 can be leaking

mullvad.net

Post reply on HN
Print view View original

121–130 of 194 posts

Re: Linux under WSL2 can be leaking

#121

Post by rbanffy »

eptcyka wrote: post #110
donor20 wrote: post #102

Earlier quoted context omitted.

Is Windows firewall supposed to apply to WSL? I never expected that! I'm serious - I run a different firewall on my onlinux. Can you confirm that WSL is supposed to be dealing with (the nightmare) of the windows firewall for internet access? How does fedora / ubuntu etc coordinate / know to do this?

It's somewhat unintuitive that a virtualized guest can circumvent the host's firewall/network stack when the guest doesn't have an explicitly bridged or passthrough'd physical adapter.

It's not circumventing. It exists outside it.

As for the parent, if it's a Microsoft product running on Windows and Windows has a firewall, I'd expect it to be an effective firewall, at least for the things Microsoft gives me.

Re: Linux under WSL2 can be leaking

#122

Post by jsjohnst »

chmod775 wrote: post #61
ss3000 wrote: post #53

Earlier quoted context omitted.

I love everything about Mullvad except their device limit, which is unfortunately a deal breaker for me. 5 is completely inadequate for my use cases.

Mullvad uses the superior way of not having a real account at all - you just get a number you can "deposit" money into. It's the only way they can reliably prevent abuse like a thousand people using one number - because this way you can just track the number of open connections per account number. This is superior to tracking IP-addresses to detect fraud for obvious privacy reasons. I do a similar thing for a service…

> Out of curiosity, how do you even manage to use more than five devices for private use at once? Even just owning that many is unlikely.

I’m not GP and I certainly don’t take GP’s stance about limiting to 5 devices (I think it makes sense), but claiming it’s unlikely that someone owns more than five devices is silly, especially if someone has a family. My non-tech sister’s family of four has two phones, three iPads, two laptops, etc. As another example, I literally own over an order of magnitude more devices than just five devices for private use (yes, I’m an outlier).

Re: Linux under WSL2 can be leaking

#123

Post by mehrdadn »

donor20 wrote: post #103

The idea of the a linux distribution is going to be using the WINDOWS firewall?? seems a bit crazy to me. I expect the distributions on WSL to use their own firewall - that's half of the fun of using WSL. PLEASE don't push fake news like this that results in distribution on WSL having to deal with / modify the window firewall - that would be a total nightmare!

My guess is people are confused because Microsoft has marketed WSL2 as a replacement for WSL1, and it makes sense for WSL1 to go through the Windows firewall, so people assumed WSL2 would behave similarly.

Re: Linux under WSL2 can be leaking

#124

Post by shmerl »

Bedon292 wrote: post #74
shmerl wrote: post #58

Earlier quoted context omitted.

Personally I don't see any benefit that WSL can offer that regular Linux can't. But I don't have any interest in Windows, so your case might differ.

Yeah, I have a few things that keep me in Windows. The primary users of the apps I work on are all on Windows, so having a Windows box around tends to be useful to check everything is good. ArcGIS - Windows only, has enough issues as it is, virtualizing it doesn't tend to go well. Though you can do something like VMWare Fusion mostly successfully. MS Office - Yes there are alternatives, but we sill operate primarily…

If they can't work in Wine, you can always run the outliers in Windows VM on Linux, instead of doing the reverse :)

Re: Linux under WSL2 can be leaking

#125

Post by rbanffy »

logical_person wrote: post #79
ajross wrote: post #33

Earlier quoted context omitted.

Right, this is as much a feature as it is a bug. But it's absolutely something that should be documented and under control of the host-side security layer.

vmswitch is configurable by the host. these VPN authors have no clue what they're doing, windows firewall rules should not in any case be applied to traffic coming from a VM. ridiculous.

> windows firewall rules should not in any case be applied to traffic coming from a VM

I can't agree with this. Everything is running on Windows. The VM runs on Windows and WSL exchanges data with Windows all the time. That the data on the Windows side can leak because I installed a Microsoft-approved product from the Microsoft store on a Windows box with a Microsoft firewall is unacceptable.

Re: Linux under WSL2 can be leaking

#126

Post by MiroF »

donor20 wrote: post #106
AndrewDucker wrote: post #26

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it. But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

Huh - you want linux distributions to have to play with the windows firewall rules? You want windows firewall getting messed up by linux containers? These VPN authors are just idiots - let's stop over complicating things. Half the time people LIKE that they can use linux firewall features on their linux hosts for stuff.

No, I'm pretty sure that is the exact opposite of what they are saying.

Maybe work on your reading comprehension?

Re: Linux under WSL2 can be leaking

#127

Post by jodrellblank »

johnisgood wrote: post #66
Barrin92 wrote: post #59

Earlier quoted context omitted.

>There's no way the banking and finance industry doesn't compete emissions wise with bitcoin not on a per transaction basis, which is the only relevant measure because the banking system supports a lot more people than bitcoin does. A single bitcoin transaction uses 610.20 kWh right now, which is comparable to the energy consumption of an average US household over 20 days.[1] Also for a comparison of scope, Tenpay, T…

I cannot wait for nuclear fusion to finally be here so people will stop worrying about the electricity consumption, and high consumption will not mean pollution or whatever.

All the electricity we generate becomes waste heat in the atmoshpere. Global energy use is currently ~0.1% of Sun power hitting the Earth. USA uses ~10x more electricity per person than India does, assume bringing everyone up to USA levels means we'll be around 1% of Sun power. Grow the population from ~8Bn to predicted ~12Bn and we'll be around 1.5%.

And then everyone gets "too cheap to meter" fusion power? There is not a /lot/ of headroom there, we surely can't go to outputting as much waste heat again as the planet gets from The Sun - and before you say "solar", you already said "fusion".

Re: Linux under WSL2 can be leaking

#129

Post by nybble41 »

rcxdude wrote: post #119
kenforthewin wrote: post #112

Earlier quoted context omitted.

Unclear what goes into calculating the visa transactions. Is it just the literal cost of sending the bits over the wire? Does it include the cost of servers, man-power, real estate, etc?

It's basically the cost of Visa running divided by the number of transactions they do. So yes it includes everything. You don't need to play silly tricks like that to make Bitcoin look bad. Bitcoin uses similar or more energy than the banking system while processing vastly fewer transactions. Somehow people can't comprehend how ridiculously inefficient bitcoin transactions are.

It's the inflation that's expensive, not the transaction processing. The threshold for economical power use in bitcoin mining scales in proportion to the block reward, not block size or number of transactions. Since the rate of inflation decreases exponentially (the block reward in BTC halves every four years) this issue will eventually resolve itself.

Re: Linux under WSL2 can be leaking

#130

Post by nybble41 »

johnisgood wrote: post #72
gambiting wrote: post #28

Earlier quoted context omitted.

The reason why I route all of my traffic through a VPN is simple - in the UK all ISPs have to keep the history of all your browsing for a year. I want to avoid that. That's it. I just don't like this requirement, especially since lots of agencies can access this data without any kind of warrant - so this is like my own little personal protest against this stupid law. Nothing more complex than that.

"UK-based VPN companies may be subject to the same data retention laws as the country's internet service providers. The UK has also made news in the past as some carriers have blocked certain VPNs. However, the use of VPNs remains legal." Not sure how much of it is true. I cannot imagine what would happen to some people there were it to be illegal. I would move out.

You can use a VPN that isn't based in your home country. It's much harder to switch to a non-local ISP.
Post reply on HN