4 ms·

Have they done any audits or had critical analysis of their security code? These days I'm super hesitant to consider anything that hasn't had a lot of eyes on

Have they done any audits or had critical analysis of their security code? These days I'm super hesitant to consider anything that hasn't had a lot of eyes on it. It's just too easy for a tiny screwup in protocol design/implementation, random number generation, etc. that puts everything at risk. Why risk it when I can just use wireguard.

boulos 6y ago
cperciva is the author of spiped and a security expert [0]. But your question about an audit is still a good one! Tarsnap has bug bounties, but the top hit for “spiped security audit” led to a sort of amusing flame war on HN [1]. [0] https://www.tarsnap.com/about.html https://www.tarsnap.com/about.html [1] https://news.ycombinator.com/item?id=7539903 https://news.ycombinator.com/item?id=7539903
cperciva 6y ago
Lots of people have looked at the spiped source code; it has been around since 2011 and I've even handed out a few bug bounties. It's also considerably simpler than wireguard, which reduces the potential for vulnerabilities; and operates on a per-connection basis, which means you can do things like establishing a secure connection to another host but have a socket endpoint which can only be accessed by certain users.
- nirav 6y ago
  "lots of people looking at source code" is contemporarily a weak argument against audit and review by experts, I really love spiped.
  - cperciva 6y ago
    "lots of people looking at source code" is contemporarily a weak argument against audit and review by experts I would absolutely love to get some deliberate code review from experts. I know tedu has looked at some of the code -- he sent me some minor corrections -- and I would certainly count him as an expert, but I don't know if his review was systematic or if he just glanced at a handful of files.
- qbasic_forever 6y ago
  That's awesome, thanks for clarifying! Looks like a really handy and useful tool to keep in the toolbox.

boulos 6y ago

cperciva is the author of spiped and a security expert [0]. But your question about an audit is still a good one! Tarsnap has bug bounties, but the top hit for “spiped security audit” led to a sort of amusing flame war on HN [1]. [0] https://www.tarsnap.com/about.html https://www.tarsnap.com/about.html [1] https://news.ycombinator.com/item?id=7539903 https://news.ycombinator.com/item?id=7539903

cperciva 6y ago

Lots of people have looked at the spiped source code; it has been around since 2011 and I've even handed out a few bug bounties. It's also considerably simpler than wireguard, which reduces the potential for vulnerabilities; and operates on a per-connection basis, which means you can do things like establishing a secure connection to another host but have a socket endpoint which can only be accessed by certain users.

nirav 6y ago
"lots of people looking at source code" is contemporarily a weak argument against audit and review by experts, I really love spiped.
- cperciva 6y ago
  "lots of people looking at source code" is contemporarily a weak argument against audit and review by experts I would absolutely love to get some deliberate code review from experts. I know tedu has looked at some of the code -- he sent me some minor corrections -- and I would certainly count him as an expert, but I don't know if his review was systematic or if he just glanced at a handful of files.
qbasic_forever 6y ago
That's awesome, thanks for clarifying! Looks like a really handy and useful tool to keep in the toolbox.