Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mullvad: Diskless infrastructure using stboot in beta

mullvad.net

Post reply on HN
Print view View original

41–50 of 135 posts

Re: Mullvad: Diskless infrastructure using stboot in beta

#41

Post by computerfriend »

yamrzou wrote: post #16

A bit tangential to the main post, but I'd to share a recent positive experience with Mullvad: I am a regular user of Mullvad and recently wanted to try a different VPN, that only provides Wireguard configs (i.e. no native app). I used the default setup. For some reason, my internet connection was flaky, and when it disconnected and reconnected, my traffic leaked. That never happened to me with Mullvad as the app com…

Can you share the WireGuard config? I suspect it is either missing firewall rules, or they're badly set.

Re: Mullvad: Diskless infrastructure using stboot in beta

#42

Post by TomSwirly »

kfreds wrote: post #26
oefrha wrote: post #10

For people wondering how the hell a user can audit the server is diskless or whatever, the goal appears to be using TPM to provide remote attestation for all code in the boot path. See https://www.system-transparency.org/ .

Correct! Thank you for highlighting that. Here are some additional details for those interested. We intend to make use of TPM for remote attestation of the current boot chain, reproducible builds to provide a strong link from source code to build artifacts, and a transparency log for a historical record of previously used boot chains, artifacts, WireGuard server keys, and related signatures. As dtx1 mentioned elsewhe…

If you're from Mullvad, let me tell you that I love your service.

I had one technical support question, and I got an immediate response from an actual person who knew this problem, gave me a simple workaround (toggle between wireless connection and not), and told me that a permanent fix was in the works. Likely that fix rolled out because I haven't seen the issue in months.

The idea of an account that doesn't need a password because there's no critical information saved is such a nice one, too.

Keep up the good work - I recommend you to everyone.

Re: Mullvad: Diskless infrastructure using stboot in beta

#43

Post by trelane »

kfreds wrote: post #26
oefrha wrote: post #10

For people wondering how the hell a user can audit the server is diskless or whatever, the goal appears to be using TPM to provide remote attestation for all code in the boot path. See https://www.system-transparency.org/ .

Correct! Thank you for highlighting that. Here are some additional details for those interested. We intend to make use of TPM for remote attestation of the current boot chain, reproducible builds to provide a strong link from source code to build artifacts, and a transparency log for a historical record of previously used boot chains, artifacts, WireGuard server keys, and related signatures. As dtx1 mentioned elsewhe…

Niiice. I really love the concept of reversing the usual DRM use of remote attestation--forcing customers to prove they're running only software allowed by the megacorps. Instead of DRM, it's proving the corporation/server is trustworthy to the customer.

I think I could get behind more of this use!

Re: Mullvad: Diskless infrastructure using stboot in beta

#44

Post by dtx1 »

jack_pp wrote: post #38
dtx1 wrote: post #35

Earlier quoted context omitted.

I stopped pirating music a while ago when spotify became better than what the trackers i was on delivered. That being said, i have recently started looking into it again since spotify is dragging their asses on high quality streaming and their app support on linux started to annoy me. The alternative streaming services barely support linux at all so they aren't really an alternative for me. But you are right it's mos…

Have you tried youtube music (via youtube premium)? I'm not sure about the high quality audio part because I only listen via bluetooth. The recommendations, general app UX and the fact that I can listen via website on desktop have made me cancel spotify.

For low quality audio it's fine, though there's a lot of music I like missing that spotify has. Quality wise it's all over the place and at best as good as spotify.

Generally I don't care much about the UI of any of the services offered and being browser based doesn't really make it any better for me. I can do that with spotify and most other services as well. What I would like to have is a simple paid service with high quality flacs that has an open enough API that i can use many of the great open source tools available and download music for offline use on my phone (data caps and all) without jumping through a lot of hoops. It's not music management is an unsolved problem and for local music i have tons of great options on all my devices from TUI applications to applications with great desktop integration to great open source phone apps. With Spotify there are at least some projects that work somewhat but not really well and certainly nothing that i can easily integrate into my desktop or phone without relying on proprietary clients.

But honestly before I go around trying endless services to get a decent experience I'd rather just take the red music tracker test [1] and build a local collection that "just works" and be done with it.

[1] https://interviewfor.red/en/index.html

Re: Mullvad: Diskless infrastructure using stboot in beta

#45

Post by codethief »

I've been following Mullvad for a long time and my impression (from countless reviews and comments here on HN) has been quite positive. But here's what I don't understand: Why are the servers located in Sweden, a country that's known for online surveillance[0] like no other country in the EU? From the Wikipedia article[1]:

> The law permits the signals intelligence agency, National Defense Radio Establishment, to monitor the content of all cross-border cable-based Internet traffic to combat "external threats" such as terrorism and organized crime.

[0]: https://www.opendemocracy.net/en/can-europe-make-it/didier-b...

[1]: https://en.wikipedia.org/wiki/Internet_in_Sweden#Internet_ce...

Re: Mullvad: Diskless infrastructure using stboot in beta

#47

Post by y4mi »

codethief wrote: post #45

I've been following Mullvad for a long time and my impression (from countless reviews and comments here on HN) has been quite positive. But here's what I don't understand: Why are the servers located in Sweden, a country that's known for online surveillance[0] like no other country in the EU? From the Wikipedia article[1]: > The law permits the signals intelligence agency, National Defense Radio Establishment, to mon…

Because it's a swedish company? The location of the servers is kinda irrelevant in that regard. They'd have to provide government access if there is a lawsuit that demands it. If there isn't one than your critique is entirely pointless

Re: Mullvad: Diskless infrastructure using stboot in beta

#48

Post by zeepzeep »

mateuszf wrote: post #30
zeepzeep wrote: post #7

Earlier quoted context omitted.

> There's just no good answer to perfect trust-no-one private internet access. What about Tor?

I think that if enough exit nodes would be owned by let's say government agencies they would be able to correlate requested domains with actual requester IP.

We all should run a Tor node then to outnumber the bad guys

Re: Mullvad: Diskless infrastructure using stboot in beta

#49

Post by Koffiepoeder »

suyjuris wrote: post #21
yamrzou wrote: post #16

A bit tangential to the main post, but I'd to share a recent positive experience with Mullvad: I am a regular user of Mullvad and recently wanted to try a different VPN, that only provides Wireguard configs (i.e. no native app). I used the default setup. For some reason, my internet connection was flaky, and when it disconnected and reconnected, my traffic leaked. That never happened to me with Mullvad as the app com…

On linux you can create a network namespace exposing only the wireguard network device, so that applications in that namespace cannot leak traffic. Setting this up, however, is quite fiddly in my experience.

In addition it is probably not a bad idea to block all traffic on wlo1 / eth0, except that to the mullvad server ip's, through some ufw rules. If you forget to configure the namespace for some applications then, it is highly unlikely the app has internet access (ie, it would need its own mullvad/vpn implementation included).

Re: Mullvad: Diskless infrastructure using stboot in beta

#50

Post by npteljes »

Terry_Roll wrote: post #33
burnaway wrote: post #13

Earlier quoted context omitted.

>> If you need to hide all of your traffic from other users in your local network, you can accomplish that in a trust-no-one fashion by running your own VPN endpoint on a server you control which provides better privacy guarantees compared to a centralised commercial VPN whose business model will eventually involve selling your data (once user growth stops but shareholders demand continued revenue growth). the privac…

>ie. large number of users sharing the same IP and protects against correlation attacks Depending on where you are based in the world (see https://www.submarinecablemap.com ) realtime throttling of vpn traffic can still identify a user and where they are going in some cases. You can get a degree of privacy from visiting websites located on servers in big data centres, but nothing a search warrant couldnt find out ret…

>There is no privacy!

I think this is a good message. In the same vein, there's no security either. All you can do is make your and your adversaries' life harder, and balance the different tradeoffs.

Post reply on HN