12 ms·
WireGuard Servers Running from RAM
- est 4y agoReminds me of old days when ed2k servers are entirely running on RAM to avoid raids.
- mbreese 4y agoI read this differently than intended. For the life of me, I couldn’t figure out why RAIDs were so troublesome. I mean, yes, they can be a little slow, so running in RAM would be much faster. Then I got it. Raid. Not RAID. Made so much more sense.
- taneq 4y agoThat's why it's more reliable, because you don't need to be spraying bug spray on it. nods
- saagarjha 4y agoOne would think that I’d be easier to eliminate the bugs beforehand?
- smileybarry 4y agoMaybe they just really don't like 25-man raids in WoW.
- _joel 4y agoLeeroy Jenkins disagrees
- BonoboIO 4y agoGood old times.
- SV_BubbleTime 4y agoI get the immediate appeal of “open source servers that run from RAM”… but it’s the same thing as always, you just have to believe your VPN provider. There is just no saying that they don’t swap gear out for the auditors or for the disk less servers or whatever it is. I like that they say the right things. But I think the current models of Facebook and Google show just how much money there is in data, so it’s just faith that the VPN provider won’t fall to temptation.
- c_o_n_v_e_x 4y agoWouldn't there be a clear performance difference between a RAM based and disk based (even if it's NVMe SSD) machine? If so, isn't that something you can routinely/programmatically authenticate?
- dietr1ch 4y agoWould it be clear from 100km+ away? I think that low latency can act as a proof of being close and fast, but once the apparent network latency goes up how do you know that server times are low if the server can claim the time was spent on the network?
- dundarious 4y agoI doubt there would be any detectable difference. Logging to disk can easily be done out of the hot loop, and I doubt any service with disks has any relevant memory in swap/page file. The point of the RAM-only server is not that it ensures that everything is operating from RAM. Everything is operating from RAM already even on servers that have attached disks. The point is that RAM-only means there is no intentional or even unintentional logging to non-volatile memory or storage. Think of it as a physics enforced capability system (no disk is physically connected).
- c_o_n_v_e_x 4y agoFair enough on there not being a performance difference. I suppose you could run an IPMI or redfish query (assuming they expose it to you) to get hardware specs on the server to see if any storage is physically connected? I guess there's a larger question - is it possible to construct a completely transparent architecture for customers who are trustless in you as a service provider?
- mbreese 4y agoRemember — (from their own article announcing these servers): > Running the system in RAM does not prevent the possibility of logging. It does however minimise the risk of accidentally storing something that can later be retrieved. This doesn’t mean you can’t be logged. Running in RAM just means that any system level logging is transient and largely accidental. But if there were a need to specific logging, data could always be sent to a different node with disks. From Mullvad’s point of view, there is a reliability benefit to having diskless nodes. But from a privacy point of view, your access could still be logged, if required. But it would probably require more “active” monitoring than “passive”/accidental logging. https://mullvad.net/en/blog/2022/1/12/diskless-infrastructure-beta-system-transparency-stboot/ https://mullvad.net/en/blog/2022/1/12/diskless-infrastructur...
- _8j50 4y agoNot if the whole os is a VM in ram, still though, network logging can happen by middleware.
- preisschild 4y agoSure you can. For example, with rsyslog you can just send all logs over the network to a logging server (which has disks).
- _8j50 4y agoThat's the network, someone looking at the logs via ssh is also a leak by that logic. Of course!
- deleted 4y ago[deleted]
- matja 4y agoEven without network logging, the hypervisor can still access the memory of the VM, parsing the kernel process and paging structures to read process memory, which can store transient logging information. Things like AMD SEV/SEV-ES are designed to mitigate that aspect, the implementation of which can be proven to end-users of the VM by remote attestation.
- voltagex_ 4y agohttps://github.com/mullvad/system-transparency https://github.com/mullvad/system-transparency seems to include the stboot mentioned in the article.
- rekoil 4y agoWould be pretty bad transparency if the code providing it wasn't transparent haha.
- aborsy 4y agoRunning entirely in RAM is same as running from an encrypted disk, with keys available only to whoever can dump the RAM. A better solution would be something like Apple’s private relay. Also, either you trust the provider or you don’t.
- stingraycharles 4y agoApple’s private relay is just CloudFlare WARP with some additional IP blocks + locality built in, not? I wouldn’t bet on it being super secure in case law enforcement comes after you, for example.
- mwint 4y agoHere’s the whitepaper: https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF https://www.apple.com/privacy/docs/iCloud_Private_Relay_Over... They do two hops, first to an Apple-controlled server, then to the “second relay” which is operated by Cloudflare in a lot of cases. Encryption is terminated at the second relay. So Cloudflare sees the content (or whatever is visible in a TLS stream), and Apple sees your real IP, but neither can know both without collaboration.
- aborsy 4y agoNot exactly. WARP hides your content and IP from anyone but the destination website. The website can still track the user. Apple mixed it with own relay such that neither Apple nor Cloudflare can track the IP and content simultaneously. It’s mostly an anti-tracking feature. But also now government needs cooperation from two companies. On another note, WARP is a VPN. But Mullvad is preferred to WARP, because Cloudflare most likely logs connections for some time.
- agsamek 4y agoSweden is going to join NATO soon. So do not expect VPNs operating from their teritory and under their law to be any different then the rest of Europe, as it was before.
- alrlroipsp 4y agoHow would you expect Sweden joining NATO to change privacy laws for that country?
- shapefrog 4y agoSweden is a 14 eyes country already.
- desperadovisa 4y agoMeh, I generally agree with the laws of my country and of the EU, so I don’t really care if they can obtain a warrant to wiretap me. I prefer to live in a society where law enforcement can be effective (with checks!) than one where bad things can happen with zero negative consequences.
- deleted 4y ago[deleted]
- Mave83 4y agoRunning from memory is no big deal. You gain all and everything like a normal system and can still log persistent to some lokal disk or a remote central log service as it is quite common. For example, all Ceph storage nodes bootet with croit.io run in RAM and have no OS installed. But you still have all logs and everything available right out of the box.
- panick21_ 4y agoRead what they are actually doing, its not just running from ram.
- deleted 4y ago[deleted]
- api 4y agoA trick I've used in the past for secrets on cloud providers: store them in "/dev/shm". Requires init after boot from a trusted source of course. It's absolutely not foolproof but reduces the odds of them ending up on a SAN somewhere where they might be found by someone scanning free space or gaining direct access to an iSCSI bus or similar.
- LinuxBender 4y agoAdding to this for completeness sake, if using tmpfs such as the default /dev/shm mount, one must ensure that swap is either encrypted or disabled as tmpfs is swap backed and data not being actively accessed/written can end up in swap on disk.
- ajvs 4y agoI think the only thing that would give more trust is a remote attestation setup similar to GrapheneOS[1] since it's the only way to prove that servers are running the software they publicly say they are. The configuration would have to be run at the hypervisor level, so that logging couldn't simply occur by nesting the server in a VM then logging that. [1] https://attestation.app https://attestation.app
- seanw444 4y agoI love that Mullvad is doing these public-facing experiments.
- infogulch 4y agoLets say, hypothetically, that there did exist some trustworthy VPN provider, one that behaved in a way that you would approve (where, if you had unlimited time and access to the internal operation of the provider to evaluate it, then you would eventually be convinced that it's "good", as good as reasonably, humanly possible). So assuming it exists, what would it look like? What would you see that would be positive or negative signs?