Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard in FreeBSD

cgit.freebsd.org

Post reply on HN
Print view View original

51–60 of 84 posts

Re: WireGuard in FreeBSD

#51

Post by codethief »

Eisenstein wrote: post #48
codethief wrote: post #43

Earlier quoted context omitted.

Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and…

What about that describes why it should not be implemented? All he says is "I don't like it and it is not acceptable". If you write a paper and have it proof-read by many competent people, then hand that paper in to a teacher and get back an F with "This is no good, it has flaws I do not consider acceptable", would you think that was reasonable explanation for failing your paper?

1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

Re: WireGuard in FreeBSD

#52

Post by Eisenstein »

codethief wrote: post #51
Eisenstein wrote: post #48

Earlier quoted context omitted.

What about that describes why it should not be implemented? All he says is "I don't like it and it is not acceptable". If you write a paper and have it proof-read by many competent people, then hand that paper in to a teacher and get back an F with "This is no good, it has flaws I do not consider acceptable", would you think that was reasonable explanation for failing your paper?

1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

1) What isn't what he said? I paraphrased you and you quoted him

2) Short on time doesn't correlate with writing up three long replies all refusing to mention even one specific technical problem

3) Your link is in regards to FreeBSD and OpenBSD, and does not mention NetBSD, which is what we are talking about specifically.

Re: WireGuard in FreeBSD

#53

Post by tssva »

codethief wrote: post #51
Eisenstein wrote: post #48

Earlier quoted context omitted.

What about that describes why it should not be implemented? All he says is "I don't like it and it is not acceptable". If you write a paper and have it proof-read by many competent people, then hand that paper in to a teacher and get back an F with "This is no good, it has flaws I do not consider acceptable", would you think that was reasonable explanation for failing your paper?

1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

The message you link to is in regard to the FreeBSD implementation and not NetBSD.

Re: WireGuard in FreeBSD

#54

Post by 5e92cb50239222b »

LargoLasskhyfv wrote: post #35
spijdar wrote: post #24

Earlier quoted context omitted.

This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running . I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from…

This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it,…

A minimal Debian installation (which is easiest to do from the netinstall image, although it can be done from any other by selecting the appropriate option in the installation menu: https://unix.stackexchange.com/a/615465) gets you the most slimmed down system possible without going to something like Alpine. There's nothing to remove there if you want your system to boot at all.

No idea why it's not more popular tbh (I setup most systems this way both for security and efficiency reasons). The default installation profiles for most distributions are incredibly bloated in comparison (especially Ubuntu and such).

Re: WireGuard in FreeBSD

#55

Post by noAnswer »

tedunangst wrote: post #38
spijdar wrote: post #24

Earlier quoted context omitted.

This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running . I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from…

One might well ask why a default redhat install doesn't have a dozen services running and when did that become the standard?

It became the standard _because_ of OpenBSD! They mocked others for decades. People forget that!

I remember SuSE 6 from me youth. It run of the box (having selected a Desktop-Setup) SSH, Telnet, Apache, FTP, Finger, Samba, CUPS and probably other daemons I forgot! You dail-in to the internet and bam: everthing/most was accessible via a public IP. I used to "pwn" boxes with exploits from packetstorm myself.

(Ironically OpenBSD was late to the "easy update"-party. You used to need to patch and compile updates yourself.)

Re: WireGuard in FreeBSD

#56

Post by LargoLasskhyfv »

5e92cb50239222b wrote: post #54
LargoLasskhyfv wrote: post #35

Earlier quoted context omitted.

This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it,…

A minimal Debian installation (which is easiest to do from the netinstall image, although it can be done from any other by selecting the appropriate option in the installation menu: https://unix.stackexchange.com/a/615465 ) gets you the most slimmed down system possible without going to something like Alpine. There's nothing to remove there if you want your system to boot at all. No idea why it's not more popular tbh…

Dude, I know that screen, I also did the textmode equivalents ;-)

Nevertheless any Debian or derivative feels bizarre to me. Yes, I know apt-pinning, custom repos and whatnot.

I'm writing this on a derivative booted into 'ramdisk' and running from there for 139 days now. (Oh my Gawd! How dare I?!) Because the good folks from AntiX and MX-Linux made it possible, and did the work for me. Making intelligent use of the facilities Linux can offer.

apt-shred dist chainsaw!

Re: WireGuard in FreeBSD

#57

Post by gonzo »

rwaksmunski wrote: post #50
pram wrote: post #47

Earlier quoted context omitted.

The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.

It’s also a lie that it wasn’t available for review. It was in review for about 10 months before it started to land in a release.

Re: WireGuard in FreeBSD

#58

Post by saurik »

ipsum2 wrote: post #46
freemrkt8 wrote: post #13

Earlier quoted context omitted.

Jason open sourced the project. Why would they need his approval?

WireGuard is a registered trademark.

This puts reasonable restrictions on the usage of the term WireGuard to name your alternative implementation, but neither prevents other people (without any approval) from implementing the protocol nor even from using the term WireGuard to (correctly) describe or label the protocol implemented (and I even could see a solid argument that any command line tooling that might be expected to be compatible with existing third-party tooling that calls out to said tools should be allowed to use the term "wg" or "wireguard", given prior legal precedent that if you use a trademark in a place where it causes a compatibility issue you cannot attempt to claim infringement of that trademark to later stifle interoperability with your project; but, if you go down this path, I'd highly recommend consulting an actual lawyer and getting your response ready to any complaint).

Re: WireGuard in FreeBSD

#59

Post by Arnavion »

dontbenebby wrote: post #42
johnklos wrote: post #36

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never…

>FreeBSD WireGuard drama Can you fill me in? I experimented with Wireguard a while back but it's been a few. (It sounds like concern about design choices not... gossip? Infosec has been insane the past fourish years.)

https://news.ycombinator.com/item?id=30719403

Re: WireGuard in FreeBSD

#60

Post by Arnavion »

rwaksmunski wrote: post #50
pram wrote: post #47

Earlier quoted context omitted.

The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.

It was released to production by Netgate in pfSense. That's why they threw such a hissy fit over it when the code quality was revealed and blew up publicly.
Post reply on HN