6 ms·

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s m

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away? EDIT: Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release.”, so perhaps real soon now? https://lists.zx2c4.com/pipermail/wireguard/2020-January/004905.html https://lists.zx2c4.com/pipermail/wireguard/2020-January/004... This is definitely big news!

johnebgd 7y ago
If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4 https://www.patreon.com/zx2c4
- ZiiS 7y ago
  I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.
  - Monory 7y ago
    You can support on Patreon for less than the minimum tier. It is just the cut-off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!
    - ZiiS 7y ago
      Thank you, they could make this clearer.
      - sundarurfriend 7y ago
        I didn't know this either. I guess that's why many projects have a fake $1 tier with just "the pleasure of knowing you contributed" or something like that as the "reward" for that tier. To let people know that that's still an option.
        lukevp 7y ago
        I agree, I would have signed up for a $1 tier or perhaps $2 but $15 is far too high for the minimum tier. I support the Zig author for $1/mo and hope others would do the same for my open source projects in the future.
  - acqq 7y ago
    Apart from knowing that 15 USD monthly is not a minimum possible donation there, please see other possibilities to donate on the official link for donations (also posted here). Patreon is only one of the options.
  - ldoughty 7y ago
    If you go to wireguards donation page, you can make a one-time donation too.
  - kragen 7y ago
    The minimum donation in Bitcoin is probably about US$0.01. Anyway that's what I've paid in transaction fees the last few times I made a donation where I didn't care how long it would take. (They were confirmed within a few hours.) Transaction fees for within-the-hour confirmation are around US$0.20.
  - stjohnswarts 7y ago
    Don't let "it's not enough" stop you. Make a one time payment of what you can afford within reason. They don't expect you to put yourself out.
- sansnomme 7y ago
  If you work for a company that uses Wireguard, please ask your employer to contribute.
  - deleted 7y ago
    [deleted]
  - Sabinus 7y ago
    What's the rate of companies doing this?
    - mosselman 7y ago
      I have no real idea, but I wouldn't be surprised if it is less than 1%.
      - treesknees 7y ago
        The problem I ran into is that my company will match employee contributions to registered non-profits. Wireguard doesn't seem to be a project under a registered non-profit. My company won't donate to a random Patreon or PayPal link.
        deleted 7y ago
        [deleted]
        snowwrestler 7y ago
        There have been numerous threads here on HN about this: donating to people to support open source development does not match up with what companies usually do, so it runs into all sorts of corporate friction. Whereas a monthly or annual support contract is the sort of thing that companies do all the time, and at low dollar amounts it might not require much approval at all. Unfortunately it is up to open source developers themselves to set their business model, and many don't seem to like (or want to do the work of) setting up overtly commercial relationships like support contracts.
      - 7y ago
- zx2c4 7y ago
  Thanks for posting this; we appreciate it. More generally, donation options for the project are listed here: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/
  - acqq 7y ago
    That ( https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ -- repeating for completeness and exposure) is surely much better link for donations, as some of us would feel limited with a single "Patreon" option. There are other possibilities for individuals: "Monthly: GitHub Sponsors, Paypal, Patreon, Liberapay" "Once: Stripe, Bitcoin, Paypal" And also "for non-profit foundations and companies." Thanks!
  - lostapathy 7y ago
    Any way you can add a "choose your amount" box on patreon, or a lower amount? I try to drop micro-contributions with creators via patreon and $15 is above the current budget for something I don't (yet?) make much use of.
    - jwbwater 7y ago
      Go to https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ and click on GitHub Sponsors, there's a $5/month option there.
- ldoughty 7y ago
  it seems there are confusing / multiple sources of income, patreon is only one. I don't know if it's fair to say he's not making what he asks for.. or basing a 1/10th claim without knowing how much he gets from other sources. (Bronze/gold partnerships GitHub donations, stripe, crypto donations, and some others).
sammorrowdrums 7y ago
Most likely it'll drop at the kernel release in April I believe.
- Denvercoder9 7y ago
  Yeah, 5.6 will probably be released on the 28th of March or the 5th of April (depending upon whether Linus feels a -rc8 is needed).
Hikikomori 7y ago
Woud like to use for anything but personal use but cannot use it at work for anything but maybe site to site tunnels.
zx2c4 7y ago
Right. We'll stamp a 1.0 on the backports as soon as 5.6 is released and goes through the normal mainline release process. Stamping a 1.0 on the compat backport before mainline would be premature, but doing it the day of is the plan.
throw0101a 7y ago
> As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. As someone who does not do heavy NetOps, can you speak more about what's wrong with IPsec?
- mjevans 7y ago
  The over-summarized version is: IPSec is extensible and it's rather tedious to get every implementation to interoperate securely with every other implementation simultaneously (and in the correctly secure way). While using IPSec between supported devices, in an ideally configured setup, yield slight but real benefits with respect to attack resistance, a practical comparison of the difficulty involved and possible configuration mistakes makes other solutions more robust and less likely to be used incorrectly. This discussion covers most of the high level points, however it doesn't consider that Wireguard being adopted in 2020 and not 1995 means we've got 25 more years of public cryptography research and far more relevant defaults to include as the base of the standard. https://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac https://crypto.stackexchange.com/questions/202/should-we-mac... The answer here also provides some of the pitfalls of IPSec being more of a 'build your own crypto setup' than an off the shelf drop in solution. https://crypto.stackexchange.com/questions/56354/ipsec-vs-ssl-similarities-and-differences https://crypto.stackexchange.com/questions/56354/ipsec-vs-ss...
  - fulafel 7y ago
    The 1995 is a little unfair to the current IPsec: The complicated part of the protocol had a compatibility breaking & simplifying major revision in 2005 (IKEv2). I think the main reason of the less than polished IPsec experience is that operating systems didn't really promote it as a out of the box working feature, but instead just offered APIs that were mainly used by corporate VPN product vendors who didn't really want interoperation except as a checkbox feature. The early interop hassles are just a symptom of lack of testing and effort - when vendors are motivated and actually everyone's implementation of a standardised protocol to interoperate they organise interoperation testing events etc and make sure their products ship with configurations that actually do interoperate in the real world. Your linked StackOverflow answer muddies the water too much - IKE was always the official keying protocol[1]. Yes you can use lower level IPsec parts without it with manual keying if you are a masochist or have a very simple topology (like a 2-host tunnel with static IPs), but the other keying methods are fringe or academic. [1] IKE was finished later than the lower level parts of IPsec, technically there was a period in the beginning when it didn't exist and you had only manual key setup
hevisko 7y ago
Until Cisco (as well as Juniper/AltoPalo/FortiNet/CheckPoint/etc.) implements WG, IPsec will stay with us ;( I can't deploy WG before that haven't happened... thus time to get WG into RFCs!!!

johnebgd 7y ago

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain: https://www.patreon.com/zx2c4 https://www.patreon.com/zx2c4

ZiiS 7y ago
I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.
- Monory 7y ago
  You can support on Patreon for less than the minimum tier. It is just the cut-off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!
  - ZiiS 7y ago
    Thank you, they could make this clearer.
    - sundarurfriend 7y ago
      I didn't know this either. I guess that's why many projects have a fake $1 tier with just "the pleasure of knowing you contributed" or something like that as the "reward" for that tier. To let people know that that's still an option.
      - lukevp 7y ago
        I agree, I would have signed up for a $1 tier or perhaps $2 but $15 is far too high for the minimum tier. I support the Zig author for $1/mo and hope others would do the same for my open source projects in the future.
- acqq 7y ago
  Apart from knowing that 15 USD monthly is not a minimum possible donation there, please see other possibilities to donate on the official link for donations (also posted here). Patreon is only one of the options.
- ldoughty 7y ago
  If you go to wireguards donation page, you can make a one-time donation too.
- kragen 7y ago
  The minimum donation in Bitcoin is probably about US$0.01. Anyway that's what I've paid in transaction fees the last few times I made a donation where I didn't care how long it would take. (They were confirmed within a few hours.) Transaction fees for within-the-hour confirmation are around US$0.20.
- stjohnswarts 7y ago
  Don't let "it's not enough" stop you. Make a one time payment of what you can afford within reason. They don't expect you to put yourself out.
sansnomme 7y ago
If you work for a company that uses Wireguard, please ask your employer to contribute.
- deleted 7y ago
  [deleted]
- Sabinus 7y ago
  What's the rate of companies doing this?
  - mosselman 7y ago
    I have no real idea, but I wouldn't be surprised if it is less than 1%.
    - treesknees 7y ago
      The problem I ran into is that my company will match employee contributions to registered non-profits. Wireguard doesn't seem to be a project under a registered non-profit. My company won't donate to a random Patreon or PayPal link.
      - deleted 7y ago
        [deleted]
      - snowwrestler 7y ago
        There have been numerous threads here on HN about this: donating to people to support open source development does not match up with what companies usually do, so it runs into all sorts of corporate friction. Whereas a monthly or annual support contract is the sort of thing that companies do all the time, and at low dollar amounts it might not require much approval at all. Unfortunately it is up to open source developers themselves to set their business model, and many don't seem to like (or want to do the work of) setting up overtly commercial relationships like support contracts.
    - 7y ago
zx2c4 7y ago
Thanks for posting this; we appreciate it. More generally, donation options for the project are listed here: https://www.wireguard.com/donations/ https://www.wireguard.com/donations/
- acqq 7y ago
  That ( https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ -- repeating for completeness and exposure) is surely much better link for donations, as some of us would feel limited with a single "Patreon" option. There are other possibilities for individuals: "Monthly: GitHub Sponsors, Paypal, Patreon, Liberapay" "Once: Stripe, Bitcoin, Paypal" And also "for non-profit foundations and companies." Thanks!
- lostapathy 7y ago
  Any way you can add a "choose your amount" box on patreon, or a lower amount? I try to drop micro-contributions with creators via patreon and $15 is above the current budget for something I don't (yet?) make much use of.
  - jwbwater 7y ago
    Go to https://www.wireguard.com/donations/ https://www.wireguard.com/donations/ and click on GitHub Sponsors, there's a $5/month option there.
ldoughty 7y ago
it seems there are confusing / multiple sources of income, patreon is only one. I don't know if it's fair to say he's not making what he asks for.. or basing a 1/10th claim without knowing how much he gets from other sources. (Bronze/gold partnerships GitHub donations, stripe, crypto donations, and some others).

sammorrowdrums 7y ago

Most likely it'll drop at the kernel release in April I believe.

Denvercoder9 7y ago
Yeah, 5.6 will probably be released on the 28th of March or the 5th of April (depending upon whether Linus feels a -rc8 is needed).

Hikikomori 7y ago

Woud like to use for anything but personal use but cannot use it at work for anything but maybe site to site tunnels.

zx2c4 7y ago

Right. We'll stamp a 1.0 on the backports as soon as 5.6 is released and goes through the normal mainline release process. Stamping a 1.0 on the compat backport before mainline would be premature, but doing it the day of is the plan.

throw0101a 7y ago

> As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion. As someone who does not do heavy NetOps, can you speak more about what's wrong with IPsec?

mjevans 7y ago
The over-summarized version is: IPSec is extensible and it's rather tedious to get every implementation to interoperate securely with every other implementation simultaneously (and in the correctly secure way). While using IPSec between supported devices, in an ideally configured setup, yield slight but real benefits with respect to attack resistance, a practical comparison of the difficulty involved and possible configuration mistakes makes other solutions more robust and less likely to be used incorrectly. This discussion covers most of the high level points, however it doesn't consider that Wireguard being adopted in 2020 and not 1995 means we've got 25 more years of public cryptography research and far more relevant defaults to include as the base of the standard. https://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac https://crypto.stackexchange.com/questions/202/should-we-mac... The answer here also provides some of the pitfalls of IPSec being more of a 'build your own crypto setup' than an off the shelf drop in solution. https://crypto.stackexchange.com/questions/56354/ipsec-vs-ssl-similarities-and-differences https://crypto.stackexchange.com/questions/56354/ipsec-vs-ss...
- fulafel 7y ago
  The 1995 is a little unfair to the current IPsec: The complicated part of the protocol had a compatibility breaking & simplifying major revision in 2005 (IKEv2). I think the main reason of the less than polished IPsec experience is that operating systems didn't really promote it as a out of the box working feature, but instead just offered APIs that were mainly used by corporate VPN product vendors who didn't really want interoperation except as a checkbox feature. The early interop hassles are just a symptom of lack of testing and effort - when vendors are motivated and actually everyone's implementation of a standardised protocol to interoperate they organise interoperation testing events etc and make sure their products ship with configurations that actually do interoperate in the real world. Your linked StackOverflow answer muddies the water too much - IKE was always the official keying protocol[1]. Yes you can use lower level IPsec parts without it with manual keying if you are a masochist or have a very simple topology (like a 2-host tunnel with static IPs), but the other keying methods are fringe or academic. [1] IKE was finished later than the lower level parts of IPsec, technically there was a period in the beginning when it didn't exist and you had only manual key setup

hevisko 7y ago

Until Cisco (as well as Juniper/AltoPalo/FortiNet/CheckPoint/etc.) implements WG, IPsec will stay with us ;( I can't deploy WG before that haven't happened... thus time to get WG into RFCs!!!