41–48 of 48 posts
Earlier quoted context omitted.
It's extremely fast, the benchmarks I've seen show that it's even faster than the IPSec config you describe.
> the benchmarks I've seen I think GP was asking for links to that, able to share?
I've seen WireGuard recommended here pretty strongly, so I started looking into it, but I couldn't see exactly how it could replace OpenVPN for us. We have an OpenVPN bastion for access into our VPC, and each engineer has their own key. When someone leaves, we can revoke their key. But WireGuard seems to use a single key per network interface. Would we just create an interface for every engineer (I have no idea what…
So yes: there's one interface per engineer laptop, but that's already the case. There's only one remote interface though. (Or several, if you want to have several VPNs -- Wireguard makes that pretty easy too!)
Earlier quoted context omitted.
Did it put you off using openssh/openvpn/libressl/etc? Is there the Torvalds effect? Let maintainers express their discontent in the form they prefer. I see how @zx2c4 might be concerned about possible reputation risks due to the release of this closed-source implementation at the earliest WireGuard stage. Given that the author of TunSafe is not a security expert. Especially if (suddenly) TunSafe turns out to have se…
I'd say the author comes across as immature, which is kind of a bad look if you are making security software.
Earlier quoted context omitted.
I have always found it odd that people seem to feel the need to personally like the creator of something.
There’s a difference between liking someone (which doesn’t really matter) and trusting their judgement (which is what I think folks mean here). I feel it’s somewhat important for the later to be true, especially with security related software.
(I think the answer is "no" in both cases. Disclaimer: my company also donated to WG development, specifically to get cross-platform support :))
Earlier quoted context omitted.
There’s a difference between liking someone (which doesn’t really matter) and trusting their judgement (which is what I think folks mean here). I feel it’s somewhat important for the later to be true, especially with security related software.
Is there evidence that this generally leads to more security vulnerabilities? Is there evidence that specifically in WG, Jason's (technical) judgement has been flawed? (I think the answer is "no" in both cases. Disclaimer: my company also donated to WG development, specifically to get cross-platform support :))
Earlier quoted context omitted.
I feel the opposite way. Subscribed to the Wireguard mailing list for a while and the author seems very friendly, even to help requests that are really .. stretching what a mailing list should be for. Yes, this reply was rather harsh, but if there's someone who jumps on a somewhat popular project and implements (competing, it seems cross platform clients are 'coming soon') commercial/closed source clients than I do u…
If you've created a new open protocol I'd imagine most people would welcome new implementations, especially on platforms that you don't currently support.
He doesn't seem to feel good about a closed source implementation completely disconnected from the project, for a protocol that is as of now unreleased, only releases snapshots with large warnings to not yet depend on it.
The attitude makes sense to me, from a developer's point of view (Will TunSafe follow Wireguard changes closely? How sound is it, compared to the project's own codebase?) and a project's/personal point of view: Someone invests a lot of time into Wireguard and before it's "ready" someone else builds closed source clients with a fancy website for the two biggest operating systems. YMMV.
Earlier quoted context omitted.
Preliminary benchmarks are available on the website. https://www.wireguard.com/performance/ EDIT: Note these are obviously for the reference implementation, not TunSafe.
Interesting, haven’t run IPSec under Linux, is this expected performance? Seems rather low compared to what I’ve experienced under FreeBSD. An i7 Ivy Bride & Broadwell and should be aleast comparable to my almost decade old Nehalem-EP Xeon, shouldn’t it?
First, these are the mobile variants of the CPUs, which are usually slower than their desktop counterparts out of the box, and clock lower more often due to thermal management kicking in a lot, too.
Secondly, a gigabit network card was used, which sets a low ceiling for the benchmark.
Thirdly, these were results averaged over 30 minutes (which again may cause heat issues in some laptops), not burst performance; I doubt OpenVPN would even register on a graph of burst performance of, say, 3 seconds.
Lastly, from what I hear, the Linux IPsec stack is a lot more complicated than is typical. Granted, they're all complicated, but still ...
Is it possible with wireguard to provide public IPv6 address for clients? My server has /64 subnet assigned, and clients have only IPv4, but I'd like to provide white IPv6 address for clients.