5 ms·

Glad someone did a rebuttal of that article. I came across it a few days ago and was shocked to discover it was by the guy behind ipfire, which I had previousl

Glad someone did a rebuttal of that article. I came across it a few days ago and was shocked to discover it was by the guy behind ipfire, which I had previously heard good things about.

wmf 7y ago
When somebody absolutely positively cannot give up their hardware VPN box yet gets inundated with "WireGuard or die", that's the kind of bitter defensiveness that results. It's just human nature.
- willis936 7y ago
  Who is giving “WireGuard or die” to people with hardware VPNs right now? It isn’t in any LTS releases right now and won’t be for another year.
  - tuukkah 7y ago
    This was released today: "WireGuard is included in Ubuntu 20.04 LTS and will be backported to Ubuntu 18.04 LTS to support widespread enterprise adoption."
  - brobinson 7y ago
    Not sure about hardware VPNs, but I've seen people begging for Wireguard support in Private Internet Access for at least a year. I can imagine the ipfire guy getting similar requests a lot.
    - tptacek 7y ago
      "The ipfire guy" is not in the situation described upthread.
      - brobinson 7y ago
        Oh, I see. Thanks for clearing that up. I thought the implication above was that he was also selling hardware VPNs. Apologies to the ipfire guy.
geofft 7y ago
Yes, agree - the original article displays such a bad understanding of security that customers should avoid taking any operational advice, security-related or not, from the person who wrote it. The author of the original article seems to be making the following assumptions: - "Secure" is only about what protocols you support, and not about the quality of implementation, whether the protocols are implemented accurately, etc. In the author's world, Heartbleed (which was introduced as part of DTLS, part of Cisco's VPN implementation) doesn't exist, the Pulse Secure vulnerability that left Travelex completely non-operational doesn't exist, etc. - That said, "3DES with MD5" is a good cryptographic protocol to use, and you should avoid fancier things like "AES-256 with SHA1." - You should only consider using black boxes from companies like Cisco and Juniper (authors of Pulse Secure). If it's not compatible with those appliances, it's not worth using. - You can't ever upgrade software in a reliable fashion. Everyone is running old, unpatched versions of software, and it's better for that unpatched software with all the well-known zero-days to connect to your corporate network than to be blocked from connecting. - You should directly connect your internal network to "third parties that you do not control," and you should let those third parties dictate your software choices instead of vice versa. In this world, you have nothing other than constant disasters. I guess it's good for job security, especially for someone whose job is professional support for IPsec. It's a shame it needed debunking, but I'm glad someone did.
- Spivak 7y ago
  I agree with his point about software upgrades. Everyone is running old unpatched versions of software! WireGuard just externalities the messy upgrade process that will accumulate over time when you have to support devices and services that only support specific versions of the protocol. You’ll end up having to run multiple WG instances in the “transition period” that never actually ends rather than just negotiating the most secure thing you both support. And you can still cut people off from broken algos. Having compatibility with the major vendors in the space is a real advantage because it’s a de facto standard I can get other companies and partners to agree on because they’re probably running one of those black boxes. You don’t have actually use any of them, but you will get a call down the road to interface with one of them. I think the main thing is that WireGuard is a beautiful clean protocol that is about to get buried under piles of shoddy middleware to deal with the messy real world.

Glad someone did a rebuttal of that article. I came across it a few days ago and was shocked to discover it was by the guy behind ipfire, which I had previously heard good things about.

wmf 7y ago

When somebody absolutely positively cannot give up their hardware VPN box yet gets inundated with "WireGuard or die", that's the kind of bitter defensiveness that results. It's just human nature.

willis936 7y ago
Who is giving “WireGuard or die” to people with hardware VPNs right now? It isn’t in any LTS releases right now and won’t be for another year.
- tuukkah 7y ago
  This was released today: "WireGuard is included in Ubuntu 20.04 LTS and will be backported to Ubuntu 18.04 LTS to support widespread enterprise adoption."
- brobinson 7y ago
  Not sure about hardware VPNs, but I've seen people begging for Wireguard support in Private Internet Access for at least a year. I can imagine the ipfire guy getting similar requests a lot.
  - tptacek 7y ago
    "The ipfire guy" is not in the situation described upthread.
    - brobinson 7y ago
      Oh, I see. Thanks for clearing that up. I thought the implication above was that he was also selling hardware VPNs. Apologies to the ipfire guy.

geofft 7y ago

Yes, agree - the original article displays such a bad understanding of security that customers should avoid taking any operational advice, security-related or not, from the person who wrote it. The author of the original article seems to be making the following assumptions: - "Secure" is only about what protocols you support, and not about the quality of implementation, whether the protocols are implemented accurately, etc. In the author's world, Heartbleed (which was introduced as part of DTLS, part of Cisco's VPN implementation) doesn't exist, the Pulse Secure vulnerability that left Travelex completely non-operational doesn't exist, etc. - That said, "3DES with MD5" is a good cryptographic protocol to use, and you should avoid fancier things like "AES-256 with SHA1." - You should only consider using black boxes from companies like Cisco and Juniper (authors of Pulse Secure). If it's not compatible with those appliances, it's not worth using. - You can't ever upgrade software in a reliable fashion. Everyone is running old, unpatched versions of software, and it's better for that unpatched software with all the well-known zero-days to connect to your corporate network than to be blocked from connecting. - You should directly connect your internal network to "third parties that you do not control," and you should let those third parties dictate your software choices instead of vice versa. In this world, you have nothing other than constant disasters. I guess it's good for job security, especially for someone whose job is professional support for IPsec. It's a shame it needed debunking, but I'm glad someone did.

Spivak 7y ago
I agree with his point about software upgrades. Everyone is running old unpatched versions of software! WireGuard just externalities the messy upgrade process that will accumulate over time when you have to support devices and services that only support specific versions of the protocol. You’ll end up having to run multiple WG instances in the “transition period” that never actually ends rather than just negotiating the most secure thing you both support. And you can still cut people off from broken algos. Having compatibility with the major vendors in the space is a real advantage because it’s a de facto standard I can get other companies and partners to agree on because they’re probably running one of those black boxes. You don’t have actually use any of them, but you will get a call down the road to interface with one of them. I think the main thing is that WireGuard is a beautiful clean protocol that is about to get buried under piles of shoddy middleware to deal with the messy real world.