Live data from Hacker News

Warp – Mobile VPN

blog.cloudflare.com

451–460 of 500 posts

Re: Warp – Mobile VPN

#451

Earlier quoted context omitted.

For me, VPS hosts with data centers near me isn't a thing, but CloudFlare has edge locations near me.

Color me curious. Where is that? And by what definition of near? There isn't even an AWS AZ near you? A t2.micro is literally free and is bigger than the one I'm running mine on (which I'm paying for, so maybe I should swap... though, I don't think AWS has AZs closer than my current $1/mo host).

The t2.micro is only free for a year, no? After that it's expensive vs normal providers, like aws stuff generally.

Re: Warp – Mobile VPN

#452
post #101

Earlier quoted context omitted.

This is precisely my setup, and I couldn't be happier. I have a lot of internal infrastructure including pi-hole, confluence and a number of self-hosted services. WireGuard lets me go anywhere on my laptop and its like I never left home, and I just keep two configurations for when I want to forward only internal IP addresses, or all my traffic.

Any pointers on setup instructions for WireGuard split tunneling on iOS?

You have issues with WireGuard split tunneling in general or only on iOS ?

To make split tunneling work in WireGuard I changed AllowedIPs = 0.0.0.0/0 in the config file into: AllowedIPs = 92.13.14.15/32 10.192.122.0/24

where 10.192.122.0/24 is the subnet of my tunnel, and 92.13.14.15/32 is the ip address of my home computer

this works on iOS and macos for me

Re: Warp – Mobile VPN

#453
post #118

Earlier quoted context omitted.

The ISP might be doing it knowing you're connecting to Netflix. But if you do a VPN, they don't know those specific packets are going to Netflix, so they can't shape the packets.

They certainly can shape any traffic you cause to transit their network. What you mean is they can't selectively shape that traffic. But then why would they want to do that?

Wouldn't it be appear more performant to queue latency insensitive packets separately to others?

Re: Warp – Mobile VPN

#454

> We built Warp around WireGuard So basically Cloudflare created an app with Cloudflare branding and set up a Wireguard server for everyone. No bad, but just check out the original: https://www.wireguard.com While I am not a big fan of VPNs in general, I have to admit, that Wireguard performs exceptionally well. I tested it a week ago and the added latency is pretty much just the network latency and the bandwidth los…

VPN does not usually add appreciable latency from the processing, unless either peer is overloaded.

Re: Warp – Mobile VPN

#457
post #307

Earlier quoted context omitted.

I am still trying to figure it out how to setup a Wireguard server on Kubernetes/GKE to personal use. Outline and OpenVPN clients have some problems that's why I want to try Wireguard.

Is that even possible? I thought Wireguard was essentially a kernel module... Which is basically the only thing you can't dockerize, as the kernel is shared between all containers? Could be mistaken though .. not sure

There is also an official user space implementation. The performance is not bad at all.

[1] https://github.com/WireGuard/wireguard-go.

Re: Warp – Mobile VPN

#458

Earlier quoted context omitted.

Exactly what is this supposed to mean? It's a "standard"? So what? Lots of bad things have been standardized. You have to justify the work on the merits; you can't simply appeal to IETF standardization as intrinsically good. TLS Heartbeat was a standard, and it was not intrinsically good.

This thread was about Cloudflare becoming some proprietary network with its own protocols and doing evil stuff. I was pointing out that when OP said we'd implemented and promoted DNSSEC (and named you) that we were not implementing something we'd invented but a standard.

I don't think Cloud Flare is implementing a lot of scary proprietary stuff outside the IETF process, but the influence that it has on the IETF process is a legitimate question to ask.

Re: Warp – Mobile VPN

#459

It seems to me that in practice, Cloudflare's mission is not actually to build a better Internet, but to offer an alternative, proprietary network (one could call it the CloudflareNet), and convince content providers and consumers to use that network. Because I don't want any single company to have too much power, I'll stick with the standard Internet, which is not owned by any single company. However, I realize that…

I disagree with this statement. We haven't pushed incompatible standards or any other nonsense. We've literally pushed out the latest standards and enabled more encryption (see Universal SSL making SSL free years before Let's Encrypt; see enabling IPv6; enabling HTTP/2; etc. etc.). As for HTTP/3... so will we. See: https://blog.cloudflare.com/http-3-from-root-to-tip/ , https://blog.cloudflare.com/the-road-to-quic/ an…

The problem is, this can still totally remind people of EEE (Embrace, extend, extinguish [1]). And appears to be not incompatible with it. And even if EEE is not your current strategy [2], the trouble is, it may become so in future, even against your best wishes today. COOs/CEOs change, as well as kings do. Today's Benevolent Dictator may get ousted by some sneaky hostile takeover in future, or even just take an unplanned sabbatical in Tibet for reinvigorating their mojo. And may get replaced with a less enlightened one. That's kinda why e.g. people from countries with a history of communist or other authoritarian/totalitarian rule are sometimes wary of creeping surveillance tech even when their country is fully democratic now. A switch to a new authoritarian regime can sometimes happen surprisingly easy even in an apparent democracy. Many countries in the world seem to have given policy mandate to populist-ish chiefs recently, who knows how this will work out further down the line. That's why people fear centralisation of control and of power over infrastructure.

[1]: https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish

[2]: But then, sorry how this sounds, but pessimists tend to think, EEE perpetrators wouldn't publicly admit to it either...

Re: Warp – Mobile VPN

#460
post #286

Earlier quoted context omitted.

My biggest concern with any VPN is: do I trust you? I’ve been reluctant to sign up with any of these VPN services that seem to be advertising everywhere nowadays because I don’t know what they’ll do with my internet traffic. The CloudFlare VPN is interesting to me because they’re a large, established company with a good reputation, so I trust them more than TunnelBear or ExpressVPN or PIA or whoever’s sponsoring YouT…

We thought about the trust aspect of it (we have gone through numerous VPN related threads here on news.yc and r/privacy and this has been one of the top concerns). Here's how we plan to convince folks (in our own naive way) we mean business (do serveral or all among): 1. OpenSource vpn server and client, with ability to Cloud-SSH to the server and view what's running. 2. Hands-off, one-click, spin up VPN servers on…

Another way would be using some trusted computing technology [1] to do that. This would be a good use case for some kind of remote attestation. (Shameless pug: I did my Ph.D. thesis on this, so if you want to discuss this point, cloudflareatvernizzisdotit ;-) )

[1] https://en.wikipedia.org/wiki/Trusted_Computing

Post reply on HN