7 ms·
With that, Ubuntu Core 20 should be a brilliant fire-and-forget VPN server.
by rainworld 7y ago
With that, Ubuntu Core 20 should be a brilliant fire-and-forget VPN server.
- kube-system 7y agoI'm excited for wireguard, but I'm not going to use it in production until the authors advise that it's ready for production.
- rainworld 7y agoOnly out of abundant caution, it seems. I mean, Cloudflare is using it.
- ownagefool 7y agoThe author has specifically said it'll be considered released when it's in the kernel, which makes the parents point kinda mute.
- panarky 7y agohttps://grammarist.com/usage/moot-mute/ https://grammarist.com/usage/moot-mute/
- ComputerGuru 7y agoCloudflare is not the golden standard for security.
- vsareto 7y agoWho is?
- all_blue_chucks 7y agoOpenBSD
- tptacek 7y agoI don't know a lot of serious systems security people who actually believe that. OpenBSD is fine, and smart people work on it, but it's been a long time since the early 2000's.
- all_blue_chucks 7y agoAFAIK it remains the single most selective platform out there. If a project is included in an OpenBSD release you know it has undergone serious whitebox scrutiny for security issues. I'm not aware of any platform that is quite so pedantic at the source code level.
- aquabeagle 7y agoAnd yet: https://news.ycombinator.com/item?id=22175431 https://news.ycombinator.com/item?id=22175431
- tptacek 7y agoI've said pretty much all I have to say about this, here: https://news.ycombinator.com/item?id=7071219 https://news.ycombinator.com/item?id=7071219
- coolsunglasses 7y agoWhat's the history there?
- PhilippGille 7y agoThe protocol yes, but don't they use their own implementation? https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun
- tw04 7y agoSure, but the underlying codebase hasn't had a public audit for boringtun or wireguard, so they're both in the same boat.
- Hamuko 7y agoCloudflare is also cautioning against using their own implementation in production.
- atonse 7y agoSecurity people are always like that (I love that about them). They freak out if a hash function will now take 50 million years to find a collision on a supercomputer, rather than 345 billion. It's worked flawlessly for me and many others the past year in our production environment. The fact that Ubuntu is including it, means that it's probably passed a critical mass of early adopters and then is probably seeping into the startup mainstream (as opposed to enterprise that wants 20 valid bells and whistles like authentication, auditing, etc).
- kube-system 7y agoThe authors say that their current version(s): > should not be considered real releases and they may contain security quirks (which would not be eligible for CVEs, since this is pre-release snapshot software) I figure they know better than I do.
- pedrocx486 7y agoIn ~2 months time Wireguard is reaching 1.0 along with Linux 5.6, I figure it's quite stable already and they say that (as anyone with a sane mind would) to keep their asses safe.
- pnako 7y agoI also use it, and it works, but this tells us nothing about its actual security. Security people are also subject to fads and fashion just like web developers or indeed any other technical group. Many will endorse the primitives developed for example by Dan Bernstein without understanding anything about how they actually work, or having read and understood papers describing their security. Just because he has some hacker "street cred" (arguably well deserved) as the developer of qmail, etc.
- Ar-Curunir 7y agoThe primitives codesigned/codiscovered by Dan Bernstein have become popular not because of hacker street cred but rather because they are peer reviewed and have good design rationale
- FDSGSG 7y agoI guess you're just left with no VPN software then? If WG isn't suitable for production, then OpenVPN, IPSec & co. definitely aren't.
- kube-system 7y agoI can only make informed decisions based on the information I have. I don't have the time or expertise to personally audit every piece of code I use. I have to leverage the available resources and evidence that others have put forward.
- FDSGSG 7y agoAnd all evidence put forward seems to suggest that all commonly deployed VPN solutions really suck. Do you simply ignore that evidence?
- kube-system 7y agoKnown weaknesses are actionable. Unknown weaknesses are not.
- FDSGSG 7y agoKnown weaknesses such as vast and messy codebases? What's the action there? A full rewrite?
- mekster 7y agoSecurity is only considered stable after being consumed long enough without holes, so not sure how you're measuring it.
- zx2c4 7y agoFrom the most recent wireguard-linux-compat release notes: https://lists.zx2c4.com/pipermail/wireguard/2020-January/004905.html https://lists.zx2c4.com/pipermail/wireguard/2020-January/004... > Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release. In other words, over the next ~10 weeks, Linus' kernel tree and Dave Miller's net.git tree will fill up with nice stabilization patches. At the end of that process, 5.6 will be released. At that time, our backports to older kernels (wireguard-linux-compat) will also become a "1.0". This also lines up with the 20.04 LTS release and such.