3 ms·

Is Wireguard stable and ready for general use? The Wireguard devs seem to think it's not: https://www.wireguard.com/#about-the-project https://www.wireguard.co

Is Wireguard stable and ready for general use? The Wireguard devs seem to think it's not: https://www.wireguard.com/#about-the-project https://www.wireguard.com/#about-the-project Work in Progress WireGuard is not yet complete. You should not rely on this code. It has not undergone proper degrees of security auditing and the protocol is still subject to change. We're working toward a stable 1.0 release, but that time has not yet come. There are experimental snapshots tagged with "0.0.YYYYMMDD", but these should not be considered real releases and they may contain security vulnerabilities (which would not be eligible for CVEs, since this is pre-release snapshot software). If you are packaging WireGuard, you must keep up to date with the snapshots.

chme 8y ago
When it has been reviewed merged into the mainline linux kernel, then it can be considered stable. AFAIK Jason does use wireguard for himself now, but is cautious to recommend that to everyone. The last submission to the linux kernel is here: http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html While merging wireguard should not be a problem, its own crypto library called 'zinc' has bigger open points of discussion.
- viraptor 8y ago
  Merging into mainline doesn't mean things are stable. There's a few experimental options available when compiling the kernel.
  - pnutjam 8y ago
    Btrfs has been in the kernel for years.
    - viraptor 8y ago
      I'm not sure if this was meant as a jab or accurate, but btrfs is a good example. The core of it is stable, but there are a few features which are unstable/experimental, yet still included.
- carlmr 8y ago
  >AFAIK Jason does use wireguard for himself now, but is cautious to recommend that to everyone. For me this means he's appropriately cautious for working in security-minded applications like this. A lot of VPN providers would probably release something like an alpha release.
ryanlol 8y ago
I'm not sure why you couldn't say those same things about any of the common VPN solutions.
pvg 8y ago
It's easily stable enough for general use. Here's a comment from the developer about the scary web page blurb: https://news.ycombinator.com/item?id=17092853 https://news.ycombinator.com/item?id=17092853
snaky 8y ago
> Security Analysis of WireGuard. MIT 6.857 Final Project. Andrew He. Baula Xu. Jerry Wu. Spring 2018 https://courses.csail.mit.edu/6.857/2018/project/He-Xu-Xu-WireGuard.pdf https://courses.csail.mit.edu/6.857/2018/project/He-Xu-Xu-Wi... > A Cryptographic Analysis of the WireGuard Protocol. Benjamin Dowling, Kenneth G. Paterson https://eprint.iacr.org/2018/080.pdf https://eprint.iacr.org/2018/080.pdf
tptacek 8y ago
This question comes up in every discussion of WireGuard. Jason's answer is that updating the web page is a low priority for him. You should use WireGuard if you can.
- pm90 8y ago
  > Jason's answer is that updating the web page is a low priority for him I really don't understand this. Why not just update the webpage and eliminate having to give the same response every time, since it seems to be asked a lot?
  - 0xCMP 8y ago
    Well, if it's ready, but it hasn't been a long enough time then maybe we avoid rushing everyone to wireguard until it's been tested in the wild more by those who read the mailing lists and etc.
sbr464 8y ago
I feel like it’s natural for anyone even close to the security industry to be very hesitant to say a product they created is secure or complete. Even Socrates ended with “All I know is that I don’t know”. Which interpreted means: use it.

chme 8y ago

When it has been reviewed merged into the mainline linux kernel, then it can be considered stable. AFAIK Jason does use wireguard for himself now, but is cautious to recommend that to everyone. The last submission to the linux kernel is here: http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html http://lkml.iu.edu/hypermail/linux/kernel/1808.3/00619.html While merging wireguard should not be a problem, its own crypto library called 'zinc' has bigger open points of discussion.

viraptor 8y ago
Merging into mainline doesn't mean things are stable. There's a few experimental options available when compiling the kernel.
- pnutjam 8y ago
  Btrfs has been in the kernel for years.
  - viraptor 8y ago
    I'm not sure if this was meant as a jab or accurate, but btrfs is a good example. The core of it is stable, but there are a few features which are unstable/experimental, yet still included.
carlmr 8y ago
>AFAIK Jason does use wireguard for himself now, but is cautious to recommend that to everyone. For me this means he's appropriately cautious for working in security-minded applications like this. A lot of VPN providers would probably release something like an alpha release.

ryanlol 8y ago

I'm not sure why you couldn't say those same things about any of the common VPN solutions.

pvg 8y ago

It's easily stable enough for general use. Here's a comment from the developer about the scary web page blurb: https://news.ycombinator.com/item?id=17092853 https://news.ycombinator.com/item?id=17092853

snaky 8y ago

> Security Analysis of WireGuard. MIT 6.857 Final Project. Andrew He. Baula Xu. Jerry Wu. Spring 2018 https://courses.csail.mit.edu/6.857/2018/project/He-Xu-Xu-WireGuard.pdf https://courses.csail.mit.edu/6.857/2018/project/He-Xu-Xu-Wi... > A Cryptographic Analysis of the WireGuard Protocol. Benjamin Dowling, Kenneth G. Paterson https://eprint.iacr.org/2018/080.pdf https://eprint.iacr.org/2018/080.pdf

tptacek 8y ago

This question comes up in every discussion of WireGuard. Jason's answer is that updating the web page is a low priority for him. You should use WireGuard if you can.

pm90 8y ago
> Jason's answer is that updating the web page is a low priority for him I really don't understand this. Why not just update the webpage and eliminate having to give the same response every time, since it seems to be asked a lot?
- 0xCMP 8y ago
  Well, if it's ready, but it hasn't been a long enough time then maybe we avoid rushing everyone to wireguard until it's been tested in the wild more by those who read the mailing lists and etc.

sbr464 8y ago

I feel like it’s natural for anyone even close to the security industry to be very hesitant to say a product they created is secure or complete. Even Socrates ended with “All I know is that I don’t know”. Which interpreted means: use it.