Earlier quoted context omitted.
Fly-Region: fra
Different poster here but just curious: Are you a Deutsche Telekom user, by chance?
Nope. Still only working very sporadically for me.
Our User-Mode WireGuard Year
161–169 of 169 posts
Re: Our User-Mode WireGuard Year
#162Earlier quoted context omitted.
It sounds like we could have a generic userspace tool that proxies any connection to a WireGuard server. Similar to ssh -L, it would listen on a TCP/UDP port locally (or talk the SOCKS protocol) and convert that to IP packets over the WireGuard connection (using a userspace TCP or UDP implementation for that side). It looks like Fly.io has all the bits, they just need to be packaged as a stand-alone tool rather than…
SSH can do this without any WireGuard: https://rkeene.org/viewer/tmp/ssh-ip-tunnel.txt.htm
One thing to watch out for with that setup is using SSH for TUN devices can suffer from TCP-over-TCP performance issues, aka "TCP meltdown", when there's packet loss. You can avoid this by using normal SSH tunnels, a la ssh -L or -R, which unpack the individual TCP streams and multiplex them over a single connection. Or if you need a more traditional VPN setup use WireGuard.
Re: Our User-Mode WireGuard Year
#163As I read this, the tone and some of the topics started to ring a bell. Fly? Wireguard? I scrolled back up to the top to see who the author was and sure enough it was Thomas from the Security, Cryptography, Whatever podcast that I've been listening to for the last few months. For anyone that enjoyed this kind content you should also definitely check out the podcast he is a part of, the other hosts are great as well.
Re: Our User-Mode WireGuard Year
#164Earlier quoted context omitted.
Right - I understood that it was the walking tree from Lord of the Rings. But, what does it mean for Consul to hold a walking tree? Is it something like: "Consul bears a heavy weight (has a lot of responsibility and so responds slowly)"?
A walking tree is an Ent. A meeting of Ents, with ponderous deliberation — ponderous on _Ent_ timescales, that is — is an Entmoot.
Ohhhh. Their clocks run slowly. A lot of time passes between events. Totally makes sense. Thanks!
Re: Our User-Mode WireGuard Year
#165As I read this, the tone and some of the topics started to ring a bell. Fly? Wireguard? I scrolled back up to the top to see who the author was and sure enough it was Thomas from the Security, Cryptography, Whatever podcast that I've been listening to for the last few months. For anyone that enjoyed this kind content you should also definitely check out the podcast he is a part of, the other hosts are great as well.
Thanks for the pointer to that podcast.
Re: Our User-Mode WireGuard Year
#166Earlier quoted context omitted.
WireGuard isn't really the interesting bit here, it's running TCP/IP over it in userland. You cannot straightforwardly do that with SSL/TLS, but it is in fact the API that WireGuard provides.
This is where the article lost me a little bit. I (think I) technically got the part of running a TCP/IP stack in an unprivileged user process, so you don't have to elevate privilege for adding a network interface and using the host OS TCP/IP stack. And maybe that's already very cool. But: - What other benefits does it give you? - This isn't a new problem and presumably has prior best practices for mitigation. What i…
The answer by tptacek with pros/cons is here: https://news.ycombinator.com/item?id=30277278
Re: Our User-Mode WireGuard Year
#167Because 'sho_hn brought this up, here's a stab at a pro/con list of building TCP/IP directly into our API the way `flyctl` does: Pro: + Can just run "native" SSH directly over it (or, in our case, use x/crypto/ssh, without modification). + Lets `flyctl` offers a `flyctl proxy` command to users, so they can plug their own programs into whatever application they need to use, without asking us to change some proxy we ru…
This is an answer to this question by sho_hn: https://news.ycombinator.com/item?id=30276877
Re: Our User-Mode WireGuard Year
#168Earlier quoted context omitted.
This is where the article lost me a little bit. I (think I) technically got the part of running a TCP/IP stack in an unprivileged user process, so you don't have to elevate privilege for adding a network interface and using the host OS TCP/IP stack. And maybe that's already very cool. But: - What other benefits does it give you? - This isn't a new problem and presumably has prior best practices for mitigation. What i…
The answer by tptacek with pros/cons is here: https://news.ycombinator.com/item?id=30277278
Thanks to both of you!
Re: Our User-Mode WireGuard Year
#169Because 'sho_hn brought this up, here's a stab at a pro/con list of building TCP/IP directly into our API the way `flyctl` does: Pro: + Can just run "native" SSH directly over it (or, in our case, use x/crypto/ssh, without modification). + Lets `flyctl` offers a `flyctl proxy` command to users, so they can plug their own programs into whatever application they need to use, without asking us to change some proxy we ru…
Thanks!