4 ms·

Wireguard based solutions get all the attention these days, but I really love working with Nebula. It's dead simple to set up and the mobile client works well.

Wireguard based solutions get all the attention these days, but I really love working with Nebula. It's dead simple to set up and the mobile client works well. That said, Nebula feels way less popular, and I don't know if it's had a third party security audit. WG's popularity means it should presumably have had a lot of attention given to both its architecture and its code. This is one area where using a "niche" solution feels somewhat risky.

atonse 5y ago
Thankfully both Nebula and Wireguard are built on top of the Noise Framework. So neither is a compromise security-design wise.
- wolverine876 5y ago
  > Thankfully both Nebula and Wireguard are built on top of the Noise Framework. > So neither is a compromise security-design wise. Security involves much more than the crypto framework being used; just crypto requires much more than the framework. Noise could be implemented insecurely, as a basic example.
  - atonse 5y ago
    Yeah that’s probably true. But I meant in the sense of it’s not roll your own crypto.
    - wolverine876 5y ago
      Yes, absolutely. That reduces a lot of likely error.
KingMachiavelli 5y ago
Nebula is pretty great. However, the Android client does not allow for specifying a DNS server and breaks the Android system DNS over TLS. Google thinks the VPN app/client should handle DNS and Nebula app development seems very slow. This means you cannot use adblocking DNS while using Nebula.
- handrous 5y ago
  The semi-official (worked on by folks involved with the core product from, as far as I can tell, early on, but not released by Slack like core Nebula is) mobile clients don't have a license associated with them, which is a bit of a blocker to further development or distribution on certain stores (FOSS-only ones, for instance, and really no-one else can distribute them at all right now without risk).

atonse 5y ago

Thankfully both Nebula and Wireguard are built on top of the Noise Framework. So neither is a compromise security-design wise.

wolverine876 5y ago
> Thankfully both Nebula and Wireguard are built on top of the Noise Framework. > So neither is a compromise security-design wise. Security involves much more than the crypto framework being used; just crypto requires much more than the framework. Noise could be implemented insecurely, as a basic example.
- atonse 5y ago
  Yeah that’s probably true. But I meant in the sense of it’s not roll your own crypto.
  - wolverine876 5y ago
    Yes, absolutely. That reduces a lot of likely error.

KingMachiavelli 5y ago

Nebula is pretty great. However, the Android client does not allow for specifying a DNS server and breaks the Android system DNS over TLS. Google thinks the VPN app/client should handle DNS and Nebula app development seems very slow. This means you cannot use adblocking DNS while using Nebula.

handrous 5y ago
The semi-official (worked on by folks involved with the core product from, as far as I can tell, early on, but not released by Slack like core Nebula is) mobile clients don't have a license associated with them, which is a bit of a blocker to further development or distribution on certain stores (FOSS-only ones, for instance, and really no-one else can distribute them at all right now without risk).