Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

41–50 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#41

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

I love and use mullvad myself but I don't think they are very competitive for the average person. They mostly just care about getting around geo blocks on websites and streaming services, which mullvad puts 0 effort into facilitating.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#42
post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

dont fix if it ain't broken. look at sudo-rs and other rust ports.

ofc, thats a cynical view.

i personally think its a bad idea to duplicate efforts. better combine them. otherwise u risk making mistakes that were already solved. missing lessons already learnt.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#43

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

Mullvad is great for privacy. But it's blocked by pretty much every VPN block list. NordVPN at the very least bypasses all the ones I regularly encounter.

I do use Mullvad for most web browsing though. But Imgur for example is blocked on it, and it's blocked in the UK, so I need NordVPN if I want to see any images there.

Most people's VPN usage is literally just geolocation restrictions and Nord is really good at that.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#44

For the similar reason I do not using any go based proxy code in my MintFlow app, and use rust to implement some proxy protocols. But my app’s wireguard is natively implemented by fdio vpp plugin, so it’s based on C.

I would not have guessed that iOS allows enough access to APIs to implement anything vpp-based. Very cool to see. I also enjoyed working with vpp (for the brief 6 months that I had with it).

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#45
post #31
post #6

Nice, I love WireGuard. I ended up building WrapGuard [1] to run applications without root access to the host and choose Go to write it in. I don't really know Rust, but does it make more sense for firmware/networking type software? Is there even a difference? 1. https://github.com/puzed/wrapguard

Very cool project. Is it always an LD_PRELOAD or can it function as a standalone SOCKS proxy similar to wireproxy?

Thanks chjj. Yeah it's always LD_PRELOAD. There is wireproxy [1] though that might do what you want?

1. https://github.com/whyvl/wireproxy

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#46
post #25

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

Known Limitations WireGuard is a protocol that, like all protocols, makes necessary trade-offs. This page summarizes known limitations due to these trade-offs. Deep Packet Inspection WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfus…

Mullvad does exactly this.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#47

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

Mullvad seems to care and be competent about privacy, but most average VPN users aren’t seeking the most extreme privacy. They just want something cheap that lets them do geolocation things or access the most websites.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#48
post #44

For the similar reason I do not using any go based proxy code in my MintFlow app, and use rust to implement some proxy protocols. But my app’s wireguard is natively implemented by fdio vpp plugin, so it’s based on C.

I would not have guessed that iOS allows enough access to APIs to implement anything vpp-based. Very cool to see. I also enjoyed working with vpp (for the brief 6 months that I had with it).

I was thinking that's hard, but I noticed that vpp get ported to FreeBSD using epoll shim library, and I learnt apple Darwin use some some userland of FreeBSD to do POSIX compatibility, then after some tests and hacking, most related to minor POSIX API adaptation such as mmap and one major coroutine need add some assembly code, and it work! But I think most disappointed to me is that apple do lack some vectorized network IO unless do some kernel extension or other sort non standard ways.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#49
post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

Competitions helps in multiple ways. It improve tooling, test suites, CVE response time, documentation and evolution of the protocol. There are some counter examples where compatibility suck, like DLNA but the problem often come from the spec.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#50
post #16

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

There are forks of wg because of this. Like amnezia-wg

amnezia-wg is quite cool and they have built the kmod too, I did some test so far they can works even in my location which block wireguard server quickly.
Post reply on HN