9 ms·

Google Adds WireGuard VPN to Android 12’s Linux Kernel 5.4 Tree

154 points by vanburen 6y ago

hu3 6y ago
> Interested Pixel users can take advantage of this kernel acceleration right now by rooting their device and installing the prebuilt kernel module. Neat. I might try that.
- josteink 6y ago
  I would assume this applies to LineageOS users as well.
dessant 6y ago
Google prevents the developer of WireGuard from linking to the donation page of the project from their Android app, threatening the funding of open source apps maintained by independent developers. https://news.ycombinator.com/item?id=21268389 https://news.ycombinator.com/item?id=21268389
- heavyset_go 6y ago
  Anti-trust action can't come fast enough. Mobile platforms have been held hostage by Google and Apple for over a decade now, and costs haven't gone down at all.
  - tssva 6y ago
    Google allows 3rd party app stores and direct installation of apps on Android. If not allowing a donation link is an issue the author is free to distribute the Wireguard app purely through other means.
    - ocdtrekkie 6y ago
      That's basically like saying they are free to distribute their app on their own terms solely in North Dakota. And also, they put up a big sign telling everyone it's dangerous to go to North Dakota so stay out.
      - dessant 6y ago
        > And also, they put up a big sign telling everyone it's dangerous to go to North Dakota so stay out. That's such an apt analogy, considering that Google Play Protect will helpfully offer to remove sideloaded apps every chance it gets, citing security.
        lern_too_spel 6y ago
        I have not had this experience, and I sideload a lot of apps. What sideloaded apps has it offered to remove?
    - heavyset_go 6y ago
      Google has hindered Android such that app stores cannot compete with the Play Store on feature parity. App stores cannot implement batch installs, background installation or updates, or automatic upgrades, but the Play Store can.
      - izacus 6y ago
        I'm sorry, but that is not true at all. The altnerantive stores available on current phones (Samsung, Huawei, etc.) have all the capabilites of the builtin store. For all the crap Google does, you really don't have to make things up :/
        heavyset_go 6y ago
        Rooting phones or installing strange ROMs from XDA-Developers isn't something normal users are capable of. If I buy a LG phone, can I install the Samsung or Huawei store and use the features that the Play Store has without rooting my phone or using a weird ROM? Why is it that if I want to use an app store that works on every Android device like F-Droid, I need to root my phone to have some feature parity with the Play Store?
        izacus 6y ago
        > Why is it that if I want to use an app store that works on every Android device like F-Droid, I need to root my phone to have some feature parity with the Play Store? Because silently replacing software on your phone is a very problematic safety vector. To the point where Apple doesn't allow granting that to anyone ever.
        komali2 6y ago
        Why can't I decide to turn off that security "feature" on the computer I bought? Why can't I do what I want with my computer???
        dariusj18 6y ago
    - wolco2 6y ago
      As an android user I have to turn on untrusted sources in the settings to download outside of the playstore. It actively discourages you.
    - skrowl 6y ago
      In fact, they already do https://f-droid.org/en/packages/com.wireguard.android/ https://f-droid.org/en/packages/com.wireguard.android/ in this case, including a donation link on the app listing page
      - lern_too_spel 6y ago
        Having an F-Droid version that costs nothing but has a donation link and a Play Store version that is not free is a common monetization pattern for open source projects on Android. See also: https://play.google.com/store/apps/details?id=net.gcompris.full https://play.google.com/store/apps/details?id=net.gcompris.f... vs. https://f-droid.org/packages/net.gcompris.full https://f-droid.org/packages/net.gcompris.full https://play.google.com/store/apps/details?id=com.mkulesh.micromath.plus https://play.google.com/store/apps/details?id=com.mkulesh.mi... vs. https://f-droid.org/packages/com.mkulesh.micromath.plus https://f-droid.org/packages/com.mkulesh.micromath.plus When Google gives me free Play Store credit, I often "donate" it this way.
        ocdtrekkie 6y ago
        The problem is this is a very inefficient donation: A third of it goes to a greedy for-profit corporation that actively causes societal harm. If you're using Play Store credit for it, sure, nobody but Google is paying the bill. But for everyone else who buys the app, it's a pretty poor donation method.
        lern_too_spel 6y ago
        > The problem is this is a very inefficient donation: How is it inefficient? Google gave me that money for free, and I sent 70% of it to the project and 30% back to Google. > A third of it goes to a greedy for-profit corporation that actively causes societal harm. Also wrong. Less than a third of it goes to anybody but the app publisher. Of the 30% that doesn't go to the app publisher, some portion goes to the payment processor (usually card processor or mobile service provider, only Google if you pay with credits). > But for everyone else who buys the app, it's a pretty poor donation method. They can also donate via F-Droid, as I showed in my post. The fact that it costs anything at all on the Play Store encourages users to get the app from the author directly or from F-Droid, both of which give the app away for free and can show preferred donation links. They get to benefit from wide distribution and discovery via Play Store and better monetization via donation links. Compare to iOS, where the open source authors are screwed.
  - absolutelyrad 6y ago
    The hammer needs to be unleashed fast. I'm fed up of Apple and Google at their behavior. Make app stores monopolies illegal.
  - ksec 6y ago
    >and costs haven't gone down at all. I think that is only with respect to App / Play Store policy? Otherwise every part of Smartphone has seen substantial price reduction.
  - mechnesium 6y ago
    Luckily, new grassroots mobile platforms are sprouting up. I ordered a PinePhone[0] to tinker with. One can dream that a robust mobile Linux community will one day flourish, free from these corrupt monopolies. [0] https://en.wikipedia.org/wiki/PinePhone https://en.wikipedia.org/wiki/PinePhone
    - majewsky 6y ago
      You could have written that exact same comment with s/PinePhone/OpenMoko/ in 2008.
- izacus 6y ago
  Yeah, these stores should really have a mode where you opt-out from their advertising and billing services. Instead they should just issue the developer an invoice for bandwidth / store costs and not try to leech on their earnings.
  - jasonvorhe 6y ago
    Until there's a big run on some app, the developer didn't expect the enormous popularity and increase in cost and then they blog about how Google is basically bankrupting them.
    - cma 6y ago
      How much bandwidth is 10 copies to every android owner in the world for a small size app like this?
      - tgsovlerkhgsel 6y ago
        Assuming the app is 10 MB, 100 million users (out of 2.5 billion Android users) download it once (not 10 times as you suggested), that's one million gigabytes of traffic. Using the cheapest Google Cloud Storage egress rate of $0.08/GB, that's $80000 for each update the app pushes out.
        cma 6y ago
        Wireguard is 7.6MB. I thought even smaller since the article mentions the kernel extension was only around 4000 lines of code, but I guess the Android app is a bit more complex or pushed up by static dependencies and icons and stuff.
        AnthonyMouse 6y ago
        And this is why the stores are so problematic. At 10MB and $0.08/GB (which is really high FWIW, cloud providers overcharge for bandwidth like crazy), the cost per user is $0.0008. Meanwhile with ads on your own website you can get paid something like $0.002 per user. So if you could distribute the app on your own website and put an ad on it, you would get paid $120,000 for having a hundred million people download it for free. Even more if you use P2P distribution. But by forcing you to use their store, you lose money.
zimbatm 6y ago
WireGuard is a great example on how to do marketing for developers. It starts with technical elegance, something that speaks to us. Then great transparency and communication with no bullshit. And finally a lot of hard work. With that in hand, the project will be propagated automatically through organizations where developers have a say in the decision making process.
- throwaway-jeN0S 6y ago
  I have mixed feeling about this: it looks like the author believes only him can implement it right [1]. This not how internet protocols development work. The spec should be enough, including security considerations. And multiple competing and interoperable implementations should be seen as a good thing in my opinion. [1] http://mail-index.netbsd.org/tech-net/2020/08/thread1.html#007842 http://mail-index.netbsd.org/tech-net/2020/08/thread1.html#0...
  - aboringusername 6y ago
    > And multiple competing and interoperable implementations should be seen as a good thing in my opinion. How is that a good thing? We all understand and agree how IPv4 and IPv6 works (mostly), and how HTTP works, and how (mostly) the networking layer works. Introducing more competing standards leads to a complete mess, have you seen USB lately? USB-4 and its optional components, USB 4 gen 2x2 and USB 4 Gen 3X2 but there's also USB 4 Gen 3x1 and Gen 3x2 as well as 3x3 and 3x4, except I am lying about the last two, or maybe the first two? I can't remember the standards are confusing. Oh, that USB-C cable bricked your Nintendo Switch? Oh the Raspberry PI screwed up their type-c implementation? Yup, competing standards are amazing, especially when they compete with themselves! I agree with what you're saying partially, but at times you do need someone who can make a decision and be the decider of how things work. Do you really think you could type in this textarea today without people deciding that? I am sure of the 100's of processes involved in using a computer, writing in this text area, clicking "post" (http, browser, the OS, kernel, drivers, even electricity itself, ISPs, etc etc) somebody made a decision and that was that. We couldn't use the internet without a person being a dictator somewhere in the chain.
zokier 6y ago
It's nice that they did this, but at the same time annoying that we can't just run arbitrary mainline kernel on our devices easily
Phemist 6y ago
Slightly off-topic, but related because this happens to me on wireguard VPN through their (excellent) app. It seems like the VPN connection is not shared to devices if I allow them to connect to my phone's hotspot. This is annoying, because I have a number of devices that ephemerally use the hotspot, and for which it is quite a hassle (impossible) to individually set-up and whitelist a keypair. Is this something that would be fixed with the inclusion of Wireguard as an android native VPN protocol?
- katari_v 6y ago
  Can you try this https://play.google.com/store/apps/details?id=be.mygod.vpnhotspot https://play.google.com/store/apps/details?id=be.mygod.vpnho...
- vpx 6y ago
  I guess it should, given that my hot-spot settings has a "allow devices to use VPN" option. Not sure if it's the custom rom, I'm on Android 11.
deleted 6y ago
[deleted]
viro 6y ago
Nice I just recently started using wireguard with my pivpn ... its ALOT faster
- hiq 6y ago
  A lot faster than OpenVPN? How did you measure it? In my experience the handshake is faster, but I haven't measured anything so I wouldn't know with certainty.

154 points by vanburen 6y ago

hu3 6y ago

> Interested Pixel users can take advantage of this kernel acceleration right now by rooting their device and installing the prebuilt kernel module. Neat. I might try that.

josteink 6y ago
I would assume this applies to LineageOS users as well.

dessant 6y ago

Google prevents the developer of WireGuard from linking to the donation page of the project from their Android app, threatening the funding of open source apps maintained by independent developers. https://news.ycombinator.com/item?id=21268389 https://news.ycombinator.com/item?id=21268389

heavyset_go 6y ago
Anti-trust action can't come fast enough. Mobile platforms have been held hostage by Google and Apple for over a decade now, and costs haven't gone down at all.
- tssva 6y ago
  Google allows 3rd party app stores and direct installation of apps on Android. If not allowing a donation link is an issue the author is free to distribute the Wireguard app purely through other means.
  - ocdtrekkie 6y ago
    That's basically like saying they are free to distribute their app on their own terms solely in North Dakota. And also, they put up a big sign telling everyone it's dangerous to go to North Dakota so stay out.
    - dessant 6y ago
      > And also, they put up a big sign telling everyone it's dangerous to go to North Dakota so stay out. That's such an apt analogy, considering that Google Play Protect will helpfully offer to remove sideloaded apps every chance it gets, citing security.
      - lern_too_spel 6y ago
        I have not had this experience, and I sideload a lot of apps. What sideloaded apps has it offered to remove?
  - heavyset_go 6y ago
    Google has hindered Android such that app stores cannot compete with the Play Store on feature parity. App stores cannot implement batch installs, background installation or updates, or automatic upgrades, but the Play Store can.
    - izacus 6y ago
      I'm sorry, but that is not true at all. The altnerantive stores available on current phones (Samsung, Huawei, etc.) have all the capabilites of the builtin store. For all the crap Google does, you really don't have to make things up :/
      - heavyset_go 6y ago
        Rooting phones or installing strange ROMs from XDA-Developers isn't something normal users are capable of. If I buy a LG phone, can I install the Samsung or Huawei store and use the features that the Play Store has without rooting my phone or using a weird ROM? Why is it that if I want to use an app store that works on every Android device like F-Droid, I need to root my phone to have some feature parity with the Play Store?
        izacus 6y ago
        > Why is it that if I want to use an app store that works on every Android device like F-Droid, I need to root my phone to have some feature parity with the Play Store? Because silently replacing software on your phone is a very problematic safety vector. To the point where Apple doesn't allow granting that to anyone ever.
        komali2 6y ago
        Why can't I decide to turn off that security "feature" on the computer I bought? Why can't I do what I want with my computer???
        dariusj18 6y ago
  - wolco2 6y ago
    As an android user I have to turn on untrusted sources in the settings to download outside of the playstore. It actively discourages you.
  - skrowl 6y ago
    In fact, they already do https://f-droid.org/en/packages/com.wireguard.android/ https://f-droid.org/en/packages/com.wireguard.android/ in this case, including a donation link on the app listing page
    - lern_too_spel 6y ago
      Having an F-Droid version that costs nothing but has a donation link and a Play Store version that is not free is a common monetization pattern for open source projects on Android. See also: https://play.google.com/store/apps/details?id=net.gcompris.full https://play.google.com/store/apps/details?id=net.gcompris.f... vs. https://f-droid.org/packages/net.gcompris.full https://f-droid.org/packages/net.gcompris.full https://play.google.com/store/apps/details?id=com.mkulesh.micromath.plus https://play.google.com/store/apps/details?id=com.mkulesh.mi... vs. https://f-droid.org/packages/com.mkulesh.micromath.plus https://f-droid.org/packages/com.mkulesh.micromath.plus When Google gives me free Play Store credit, I often "donate" it this way.
      - ocdtrekkie 6y ago
        The problem is this is a very inefficient donation: A third of it goes to a greedy for-profit corporation that actively causes societal harm. If you're using Play Store credit for it, sure, nobody but Google is paying the bill. But for everyone else who buys the app, it's a pretty poor donation method.
        lern_too_spel 6y ago
        > The problem is this is a very inefficient donation: How is it inefficient? Google gave me that money for free, and I sent 70% of it to the project and 30% back to Google. > A third of it goes to a greedy for-profit corporation that actively causes societal harm. Also wrong. Less than a third of it goes to anybody but the app publisher. Of the 30% that doesn't go to the app publisher, some portion goes to the payment processor (usually card processor or mobile service provider, only Google if you pay with credits). > But for everyone else who buys the app, it's a pretty poor donation method. They can also donate via F-Droid, as I showed in my post. The fact that it costs anything at all on the Play Store encourages users to get the app from the author directly or from F-Droid, both of which give the app away for free and can show preferred donation links. They get to benefit from wide distribution and discovery via Play Store and better monetization via donation links. Compare to iOS, where the open source authors are screwed.
- absolutelyrad 6y ago
  The hammer needs to be unleashed fast. I'm fed up of Apple and Google at their behavior. Make app stores monopolies illegal.
- ksec 6y ago
  >and costs haven't gone down at all. I think that is only with respect to App / Play Store policy? Otherwise every part of Smartphone has seen substantial price reduction.
- mechnesium 6y ago
  Luckily, new grassroots mobile platforms are sprouting up. I ordered a PinePhone[0] to tinker with. One can dream that a robust mobile Linux community will one day flourish, free from these corrupt monopolies. [0] https://en.wikipedia.org/wiki/PinePhone https://en.wikipedia.org/wiki/PinePhone
  - majewsky 6y ago
    You could have written that exact same comment with s/PinePhone/OpenMoko/ in 2008.
izacus 6y ago
Yeah, these stores should really have a mode where you opt-out from their advertising and billing services. Instead they should just issue the developer an invoice for bandwidth / store costs and not try to leech on their earnings.
- jasonvorhe 6y ago
  Until there's a big run on some app, the developer didn't expect the enormous popularity and increase in cost and then they blog about how Google is basically bankrupting them.
  - cma 6y ago
    How much bandwidth is 10 copies to every android owner in the world for a small size app like this?
    - tgsovlerkhgsel 6y ago
      Assuming the app is 10 MB, 100 million users (out of 2.5 billion Android users) download it once (not 10 times as you suggested), that's one million gigabytes of traffic. Using the cheapest Google Cloud Storage egress rate of $0.08/GB, that's $80000 for each update the app pushes out.
      - cma 6y ago
        Wireguard is 7.6MB. I thought even smaller since the article mentions the kernel extension was only around 4000 lines of code, but I guess the Android app is a bit more complex or pushed up by static dependencies and icons and stuff.
      - AnthonyMouse 6y ago
        And this is why the stores are so problematic. At 10MB and $0.08/GB (which is really high FWIW, cloud providers overcharge for bandwidth like crazy), the cost per user is $0.0008. Meanwhile with ads on your own website you can get paid something like $0.002 per user. So if you could distribute the app on your own website and put an ad on it, you would get paid $120,000 for having a hundred million people download it for free. Even more if you use P2P distribution. But by forcing you to use their store, you lose money.

zimbatm 6y ago

WireGuard is a great example on how to do marketing for developers. It starts with technical elegance, something that speaks to us. Then great transparency and communication with no bullshit. And finally a lot of hard work. With that in hand, the project will be propagated automatically through organizations where developers have a say in the decision making process.

throwaway-jeN0S 6y ago
I have mixed feeling about this: it looks like the author believes only him can implement it right [1]. This not how internet protocols development work. The spec should be enough, including security considerations. And multiple competing and interoperable implementations should be seen as a good thing in my opinion. [1] http://mail-index.netbsd.org/tech-net/2020/08/thread1.html#007842 http://mail-index.netbsd.org/tech-net/2020/08/thread1.html#0...
- aboringusername 6y ago
  > And multiple competing and interoperable implementations should be seen as a good thing in my opinion. How is that a good thing? We all understand and agree how IPv4 and IPv6 works (mostly), and how HTTP works, and how (mostly) the networking layer works. Introducing more competing standards leads to a complete mess, have you seen USB lately? USB-4 and its optional components, USB 4 gen 2x2 and USB 4 Gen 3X2 but there's also USB 4 Gen 3x1 and Gen 3x2 as well as 3x3 and 3x4, except I am lying about the last two, or maybe the first two? I can't remember the standards are confusing. Oh, that USB-C cable bricked your Nintendo Switch? Oh the Raspberry PI screwed up their type-c implementation? Yup, competing standards are amazing, especially when they compete with themselves! I agree with what you're saying partially, but at times you do need someone who can make a decision and be the decider of how things work. Do you really think you could type in this textarea today without people deciding that? I am sure of the 100's of processes involved in using a computer, writing in this text area, clicking "post" (http, browser, the OS, kernel, drivers, even electricity itself, ISPs, etc etc) somebody made a decision and that was that. We couldn't use the internet without a person being a dictator somewhere in the chain.

zokier 6y ago

It's nice that they did this, but at the same time annoying that we can't just run arbitrary mainline kernel on our devices easily

Phemist 6y ago

Slightly off-topic, but related because this happens to me on wireguard VPN through their (excellent) app. It seems like the VPN connection is not shared to devices if I allow them to connect to my phone's hotspot. This is annoying, because I have a number of devices that ephemerally use the hotspot, and for which it is quite a hassle (impossible) to individually set-up and whitelist a keypair. Is this something that would be fixed with the inclusion of Wireguard as an android native VPN protocol?

katari_v 6y ago
Can you try this https://play.google.com/store/apps/details?id=be.mygod.vpnhotspot https://play.google.com/store/apps/details?id=be.mygod.vpnho...
vpx 6y ago
I guess it should, given that my hot-spot settings has a "allow devices to use VPN" option. Not sure if it's the custom rom, I'm on Android 11.

deleted 6y ago

[deleted]

viro 6y ago

Nice I just recently started using wireguard with my pivpn ... its ALOT faster

hiq 6y ago
A lot faster than OpenVPN? How did you measure it? In my experience the handshake is faster, but I haven't measured anything so I wouldn't know with certainty.