3 ms·
It is a completely reasonable requirement of a large organization to ensure an endpoint meets certain criteria before being allowed access to an internal networ
by unethical_ban 5y ago
It is a completely reasonable requirement of a large organization to ensure an endpoint meets certain criteria before being allowed access to an internal network.
I'm not arguing that Wireguard has an obligation to tackle that problem themselves. I'm arguing against your assertion that VPN access should be completely decoupled from ensuring endpoint security.
- londons_explore 5y agoLets be honest, any malicious endpoint can easily bypass those 'endpoint security' checks. All they're good for is checking that unpatched (but not yet exploited/evil) endpoints can't connect to the network, which is of marginal benefit compared to allowing them to connect but requiring they patch before accessing risky resources (like the internet or email).
- d110af5ccf 5y agoI think there's an external issue here though. There might be regulation or some sort of liability concern regarding known unpatched clients connecting to the network. In that context simple checks make a lot of sense.
- unethical_ban 5y agoNot all compromised machines are the same. Is the user of the machine an insider threat or not? Does the login user have admin rights to the machine or not? And what you said in the last sentence is exactly how some VPN solutions can be configured: Limited access to network resources for updates and management, and only when fully matching version/anti-malware/etc. requirements can you connect to all resources. Anyway. Like I said, I think Wireguard is amazing - I used PiVPN (which can be installed on any .deb distro) to set up a simple gateway for my laptop and phone to be always connected for DNS and local-network access. I'm very grateful for its architecture and simplicity in that regard.