Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GotaTun – Mullvad's WireGuard Implementation in Rust

mullvad.net

Post reply on HN
Print view View original

61–70 of 142 posts

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#61

Post by yjftsjthsd-h »

turblety wrote: post #54
throwaway894345 wrote: post #52

Earlier quoted context omitted.

Correct me if I’m wrong, but if you use LD_PRELOAD, presumably it will not work for applications that circumvent libc, such as Go binaries (at least those with CGo disabled)?

Yeah you are right. Can you think of any way we could capture that traffic too?

Can you use user namespaces to create a network namespace with the VPN active and stick applications in that namespace?

From a quick search, https://blog.thea.codes/nordvpn-wireguard-namespaces/ sees to have at least the bones of a decent solution, though I've not had a chance to dig very far. A lot of results use root to set up the namespace, but I was pretty sure that shouldn't be needed with a new kernel and user namespaces enabled

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#62

Post by nrds »

razighter777 wrote: post #13
imcritic wrote: post #10

I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.

That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.

That's the traditional answer parroted in the Wireguard documentation but a few hours' serious thought and design is enough to reveal the fatal flaw: any encapsulating protocol will have to reinvent and duplicatively implement all of the routing logic. Perr-based routing is at least 50% of wireguard's value proposition. Having to reimplement it at the higher level defeats the purpose. No, obfuscation _has_ to be part of the same protocol as routing.

(Btw, same sort of thing occurs with zfs combining raid and filesystem to close the parity raid write hole. Often strictly layered systems with separation of concerns are less than the sum of their parts.)

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#63

Post by oarsinsync »

Gander5739 wrote: post #53
Philip-J-Fry wrote: post #43

Earlier quoted context omitted.

Mullvad is great for privacy. But it's blocked by pretty much every VPN block list. NordVPN at the very least bypasses all the ones I regularly encounter. I do use Mullvad for most web browsing though. But Imgur for example is blocked on it, and it's blocked in the UK, so I need NordVPN if I want to see any images there. Most people's VPN usage is literally just geolocation restrictions and Nord is really good at tha…

Aren't proxies good enough for that purpose?

The user experience differs for proxies.

System wide proxy configuration doesn’t actually always work system wide.

A VPN tends to have more success in encapsulating all application traffic (or all desired application traffic, if you’re so inclined to configure your system)

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#64

Post by Ylpertnodi »

Philip-J-Fry wrote: post #43
intsunny wrote: post #18

Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.

Mullvad is great for privacy. But it's blocked by pretty much every VPN block list. NordVPN at the very least bypasses all the ones I regularly encounter. I do use Mullvad for most web browsing though. But Imgur for example is blocked on it, and it's blocked in the UK, so I need NordVPN if I want to see any images there. Most people's VPN usage is literally just geolocation restrictions and Nord is really good at tha…

I regularly go to imgur via mullvad, exit Netherlands.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#66

Post by stusmall »

ur-whale wrote: post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

Diversity is a fantastic thing for security. It limits the impact when a bug drops and gives the possibility to migrate or run a mix of systems.

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#68

Post by VoxPelli »

saidnooneever wrote: post #42
ur-whale wrote: post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

dont fix if it ain't broken. look at sudo-rs and other rust ports. ofc, thats a cynical view. i personally think its a bad idea to duplicate efforts. better combine them. otherwise u risk making mistakes that were already solved. missing lessons already learnt.

sudo-rs itself is not a bad idea, Canonical’s premature shipping of it in Ubuntu was the bad idea. sudo-rs was transparent with how far it had gotten in compatibility and feature parity

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#69

Post by VoxPelli »

embedding-shape wrote: post #8
ur-whale wrote: post #4

One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security? Probably naively, I'm thinking: - diversity: good - doubling the attack surface: real bad What do the security folks out there think of the topic?

I think the general consensus is that it improves security of the protocol, but obviously that won't matter much if the implementation gets something wrong or has worse security by itself. Issues in the protocol itself would need all implementations to change, but issues in the implementation would obviously be isolated to one implementation. For something like Wireguard, I'd wager a guess that issues in the implemen…

If the implementation gets it wrong that can also be a sign of ambiguity in the protocol / standard and as such result in clarifications and an overall more well specified protocol

Re: GotaTun – Mullvad's WireGuard Implementation in Rust

#70

Post by wing-_-nuts »

gruez wrote: post #38
jorvi wrote: post #29

Earlier quoted context omitted.

Yeah, their reasoning is solid (easy to abuse) but it is still a very useful feature. AFAIK, at the moment your choices are AirVPN and ProtonVPN. AirVPN has static port forwarding and Proton has UPNP port forwarding.

private internet access has port forwarding too

PIA is not to be trusted after their buyout, IMHO
Post reply on HN