Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux under WSL2 can be leaking

mullvad.net

Post reply on HN
Print view View original

151–160 of 194 posts

Re: Linux under WSL2 can be leaking

#151

Post by filmgirlcw »

shmerl wrote: post #115
filmgirlcw wrote: post #88

Earlier quoted context omitted.

> Linux users don't use Nvidia if they are interested in the modern desktop use case. Which rules out anyone who wants to game or do CUDA stuff. Everyone is welcome to their own opinions and preferences, but if you ask me, if the response to a request to use the most powerful/performant graphics cards is to switch to AMD (and AMD has some good cards but Nvidia’s are better and OpenCL can’t compete with CUDA when it c…

I didn't see an answer that explains how WSL is better than Linux proper, at least not in case when you don't care about Windows itself. AMD is fine for gaming, I'm using 5700XT on Linux for playing games. And AMD will match Nvidia higher end cards next month. So I don't see any reason to use Nvidia for that. WSL offers nothing for gaming or similar use cases that regular Linux can't. If you need to use CUDA with Nvi…

Yes, I’m aware that Nvidia supports Linux for CUDA. Linux is a very popular headless environment for this reason.

I was responding to your response that Nvidia drivers for HiDPi and other display issues are subpar with “well, everyone who is serious about using Linux on the desktop uses AMD.”

First, that’s not true (as evidenced by the many people who do CUDA workloads in Linux). Second, my overarching point is that it’s strikes me as being really dismissive to say “well just don’t use the hardware you like/want/need if you want a good Linux on the desktop experience.”

Re: Linux under WSL2 can be leaking

#152

Post by shmerl »

filmgirlcw wrote: post #150
shmerl wrote: post #136

Earlier quoted context omitted.

Because Linux is my OS of preference in general, so I play games on it as well. But it's good to clarify a few things to avoid confusion: 1. You can use Nvidia on Linux, including for gaming. Nvidia's problems are related to lack of support for modern features (Wayland use cases and so on) caused by the fact that their blob driver in not upstreamed. But it's usable otherwise. 2. AMD drivers are open source and upstre…

To clarify, I’m aware you can use Nvidia on Linux. This was a phrased this way because the driver issues you mention impact performance games under Linux. And again, I understand Linux is your chosen OS — I’m happy you’re so happy. My question was why a person who is using WSL2 would want to run a game in Linux instead of inside Windows. I understand you can game in Linux. That’s not the question. The question is why…

The argument before was "WSL2 will become good for graphical applications" (which also means games). So I answered, that if you want to run games on Linux, you can as well do it straight on Linux running on your hardware without intermediaries. I.e. it wasn't about running games on Windows.

Re: Linux under WSL2 can be leaking

#153

Post by apetresc »

mehrdadn wrote: post #120
eptcyka wrote: post #110

Earlier quoted context omitted.

It's somewhat unintuitive that a virtualized guest can circumvent the host's firewall/network stack when the guest doesn't have an explicitly bridged or passthrough'd physical adapter.

The host is the hypervisor though isn't it? Not the Windows inside it.

Exactly this. If you're running WSL2 then you're in Hyper-V mode, which means Windows itself is also running virtualized. The WSL VM is a sibling of Windows on the hypervisor stack, not hosted inside of.

Re: Linux under WSL2 can be leaking

#154

Post by apetresc »

im3w1l wrote: post #149
xnyan wrote: post #135

Earlier quoted context omitted.

Here’s the issue with your issue: if you are using WSL2 (or other various win10 configurations involving hyper-v), then windows is not running on bare metal anymore. In this scenario, windows is just another guest operating system subject to a hypervisor. Windows is a VM, and your in-VM firewall applies to the VM in which its running. This is how you get real linux “on” windows - the on part is an illusion, trickery…

So WSL1 is reverse wine basically?

Not _exactly_, but it's a pretty close analogy. Certainly moreso than WSL2 is.

Re: Linux under WSL2 can be leaking

#155

Post by shmerl »

filmgirlcw wrote: post #151
shmerl wrote: post #115

Earlier quoted context omitted.

I didn't see an answer that explains how WSL is better than Linux proper, at least not in case when you don't care about Windows itself. AMD is fine for gaming, I'm using 5700XT on Linux for playing games. And AMD will match Nvidia higher end cards next month. So I don't see any reason to use Nvidia for that. WSL offers nothing for gaming or similar use cases that regular Linux can't. If you need to use CUDA with Nvi…

Yes, I’m aware that Nvidia supports Linux for CUDA. Linux is a very popular headless environment for this reason. I was responding to your response that Nvidia drivers for HiDPi and other display issues are subpar with “well, everyone who is serious about using Linux on the desktop uses AMD.” First, that’s not true (as evidenced by the many people who do CUDA workloads in Linux). Second, my overarching point is that…

Nvidia's problems are holding the progress of Linux desktop back, so I totally recommend avoiding it for anyone who is using Linux already for that reason alone (besides various other reasons). But it is usable, just your use cases will be more limited. Performance when it works is OK.

Re: Linux under WSL2 can be leaking

#156

Post by m463 »

closeparen wrote: post #50
smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

A good reminder that you really want proxying done on a separate device (router, Raspberry Pi, etc) physically between the endpoint and the internet.

exactly. It's amazing how many things bypass on-device firewalls. Docker is a good example.

Re: Linux under WSL2 can be leaking

#157

Post by andrewflnr »

AndrewDucker wrote: post #26

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it. But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

> If you want Linux to use a firewall then install one into it

Granted, I don't know much about WSL, but that's a very surprising model to me. I would naively assume that anything in userspace is controlled by the Windows OS-level firewall, not that Linux gets to emit raw packets. To say the least, I'm a little more hesitant than you are to call that reasonable.

Re: Linux under WSL2 can be leaking

#158

Post by smw »

andrewflnr wrote: post #157
AndrewDucker wrote: post #26

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it. But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

> If you want Linux to use a firewall then install one into it Granted, I don't know much about WSL, but that's a very surprising model to me. I would naively assume that anything in userspace is controlled by the Windows OS-level firewall, not that Linux gets to emit raw packets. To say the least, I'm a little more hesitant than you are to call that reasonable.

As mentioned other places int the article, in the WSL2 model, Linux is running under a Hyper-V hypervisor, and isn't in user space.

Re: Linux under WSL2 can be leaking

#159

Post by fomine3 »

closeparen wrote: post #50
smarx007 wrote: post #31

The title is wrong. The VPN traffic does NOT leak. What leaks is the traffic that the VPN software tries to block when the VPN connection is not active. Mullvad uses Windows Firewall to block all internet access if VPN is not active (if the user configured so) and WSL2 bypasses this by not going through Windows Firewall. When the VPN is active, WSL2 traffic IS tunneled through the VPN. UPD: The solution may be to hav…

A good reminder that you really want proxying done on a separate device (router, Raspberry Pi, etc) physically between the endpoint and the internet.

I like this VPN gateway approach. It feels rock solid.

Re: Linux under WSL2 can be leaking

#160

Post by p1necone »

nybble41 wrote: post #129
rcxdude wrote: post #119

Earlier quoted context omitted.

It's basically the cost of Visa running divided by the number of transactions they do. So yes it includes everything. You don't need to play silly tricks like that to make Bitcoin look bad. Bitcoin uses similar or more energy than the banking system while processing vastly fewer transactions. Somehow people can't comprehend how ridiculously inefficient bitcoin transactions are.

It's the inflation that's expensive, not the transaction processing. The threshold for economical power use in bitcoin mining scales in proportion to the block reward, not block size or number of transactions. Since the rate of inflation decreases exponentially (the block reward in BTC halves every four years) this issue will eventually resolve itself.

According to the numbers above a bitcoin transaction is currently 591715 times as expensive (in kwh) as a visa transaction.

If a transaction costs half as much power every 4 years that's only 193 years until it's cheaper than visa[0]! Truly the financial instrument of the (distant) future!

[0] https://www.wolframalpha.com/input/?i=x%5E2+%3D+%281005%2F%2...

Post reply on HN