Live data from Hacker News

Linux under WSL2 can be leaking

mullvad.net

71–80 of 194 posts

Re: Linux under WSL2 can be leaking

#71
post #46
post #36

Earlier quoted context omitted.

Try dumping UDP packets from the host to the WSL machine...

The WSL machine is a Hyper-V VM. Why would you expect the default configuration to be able to sniff traffic from the host operating system? That would be a massive security hole.

I’m taking about traffic sent to the guest not on the interfaces.

Re: Linux under WSL2 can be leaking

#72
post #3

Earlier quoted context omitted.

I would think that anyone who relies on a VPN for safety or is really particularly security conscious (1) isn't using Windows 10, (2) has networking disabled if they are using it, for example, in a VM, and (3) is probably using a dedicated device like a Slate router or pfSense box as their VPN point.

The reason why I route all of my traffic through a VPN is simple - in the UK all ISPs have to keep the history of all your browsing for a year. I want to avoid that. That's it. I just don't like this requirement, especially since lots of agencies can access this data without any kind of warrant - so this is like my own little personal protest against this stupid law. Nothing more complex than that.

"UK-based VPN companies may be subject to the same data retention laws as the country's internet service providers. The UK has also made news in the past as some carriers have blocked certain VPNs. However, the use of VPNs remains legal."

Not sure how much of it is true. I cannot imagine what would happen to some people there were it to be illegal. I would move out.

Re: Linux under WSL2 can be leaking

#73

Earlier quoted context omitted.

Yea but a whole fraud department of humans emits a ton of carbon. There's no way the banking and finance industry doesn't compete emissions wise with bitcoin.

>There's no way the banking and finance industry doesn't compete emissions wise with bitcoin not on a per transaction basis, which is the only relevant measure because the banking system supports a lot more people than bitcoin does. A single bitcoin transaction uses 610.20 kWh right now, which is comparable to the energy consumption of an average US household over 20 days.[1] Also for a comparison of scope, Tenpay, T…

Yea, after reading more I got a sense of the scale.

Still, I think that's the proper comparison—human processes are the analogue to keeping a blockchain online and mining.

Re: Linux under WSL2 can be leaking

#74
post #58

Earlier quoted context omitted.

WSL is actually really good. To me, it gives you the best of both worlds. Linux for dev stuff, Windows for GUI and games. And its actual Linux, so I am dev'ing a little closer to prod than those on Macs. But that's less of a factor now everything is in Docker and we are all using the same containers. I also feel I have a superior Docker (runs on WSL2) experience to them, better interface and much better battery life.…

Personally I don't see any benefit that WSL can offer that regular Linux can't. But I don't have any interest in Windows, so your case might differ.

Yeah, I have a few things that keep me in Windows. The primary users of the apps I work on are all on Windows, so having a Windows box around tends to be useful to check everything is good.

ArcGIS - Windows only, has enough issues as it is, virtualizing it doesn't tend to go well. Though you can do something like VMWare Fusion mostly successfully.

MS Office - Yes there are alternatives, but we sill operate primarily in Office, and the alternatives are not perfectly compatible. Especially when collaborating with other companies its important. Teams / O365 are certainly getting better, but still not there yet.

Steam - Although that is certainly getting better on Linux as well. And my gaming time is pretty limited these days.

Re: Linux under WSL2 can be leaking

#75
post #7
post #2

We have tested a few other VPN clients from competitors and found that all of them leak in the same way. The way Microsoft has implemented virtual networking for Linux guests makes it very difficult to properly secure them.

It’s a shit show. Can’t trace packets either via wireshark on the host and tcpdump doesn’t work on the guest. I’ve gone back to virtualbox and eviscerated WSL. Another total waste of my life.

Were you using WSL 1 or 2? WSL 1 networking didn't work the way I expected, but WSL 2 seems to support proper Linux networking since it's just a Linux VM under the hood.

Re: Linux under WSL2 can be leaking

#76
post #11

Using WSL should be a very last resort anyway. Just use Linux straight on your hardware if you have a choice and ditch Windows.

WSL is actually really good. To me, it gives you the best of both worlds. Linux for dev stuff, Windows for GUI and games. And its actual Linux, so I am dev'ing a little closer to prod than those on Macs. But that's less of a factor now everything is in Docker and we are all using the same containers. I also feel I have a superior Docker (runs on WSL2) experience to them, better interface and much better battery life.…

That's really over-selling it. WSL is okay. It's better than the previous monstrosities, but that's not saying much. You can't run VS Code in WSL, it literally has code to prevent you from doing that, even if you have a functioning X Server (which is a jolly pain to set up).

Re: Linux under WSL2 can be leaking

#79
post #33

So, if I'm understanding correctly the Linux system gets access to the raw Ethernet system, and so bypasses the Windows firewall. Seems not entirely unreasonable - if you want Linux to use a firewall then install one into it. But it should definitely be well publicised/documented, because otherwise people won't realise they have a gaping hole in their greens m defences.

Right, this is as much a feature as it is a bug. But it's absolutely something that should be documented and under control of the host-side security layer.

vmswitch is configurable by the host. these VPN authors have no clue what they're doing, windows firewall rules should not in any case be applied to traffic coming from a VM. ridiculous.

Re: Linux under WSL2 can be leaking

#80
post #11

Using WSL should be a very last resort anyway. Just use Linux straight on your hardware if you have a choice and ditch Windows.

WSL2 gave my Windows10 laptop new life. Sound drivers etc just work - WSL2 scales RAM/CPU with your workload. Have Kali Kex gui, AmazonLinux 2 terminal, Ubuntu 20 terminal side by side all doing their thing.
Post reply on HN