4 ms·
"First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit)." Do you have some evidence
by tssva 4y ago
"First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit)."
Do you have some evidence for that or is it just speculation?
"But more importantly, you can't just count lines of code as if they're all equivalent."
You're right but the Wireguard white paper conclusion claims an advantage for Wireguard based solely upon the lines of code needed to implement.
OpenVPN, Wireguard and IPsec all have their advantages and disadvantages. I have and will use all 3 where appropriate based upon them.
- tptacek 4y agoYes, there is plenty of evidence for this; see for instance the WireGuard paper. Numerous code size comparisons have been done here. Further, that is not what the WireGuard paper concludes. For instance: the paper makes a note of the fact that WireGuard is designed to be implemented without dynamic memory allocation, which is not a function of lines of code (in fact, it probably adds lines of code). You do you, but as a practitioner in this space, I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice. You might disagree, but I think you'd be in the minority of security engineers on the point. Feel free to ask around! The codebases for OpenVPN and the IPSECs are reviled.
- tssva 4y agoPlenty of code size comparisons with Wireguard and 3rd party apps providing feature parity with OpenVPN? Can you provide some links? The Wireguard paper makes notes of many things including the lines of code needed to implement. "I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice." Life is complicated and those type of concerns are almost always in play which means OpenVPN and IPsec are also always in play. Wireguard is great where it is a fit but there are characteristics of Wireguard which also make it the more complicated and fragile solution in some circumstances.
- pvg 4y agoYou were asking whether Wireguard's design goals and criteria still hold up and the answer to that is that they do.
- tssva 4y agoI never asked that! I said it would be interesting to see how the line count of Wireguard and the 3rd party software needed to bring it in feature parity with OpenVPN compared with OpenVPN since the line count of Wireguard by itself is touted as an advantage.
- pvg 4y agoIt's not 'touted as an advantage' based on line count alone and the 'feature parity' thing doesn't apply as explained in the comments above.
- stoplying1 4y agoThe hand waving and moving goalposts would be less glaring if you, you know, mention a single use case where WG is supposedly the inferior solution?
- tssva 4y agoWhat hand waving and moving of goalposts it that? All I stated was that it would be interesting to see a comparison of line count of Wireguard and the 3rd party tools needed to bring it into feature parity with OpenVPN to the line count of OpenVPN. My above comment just asked for references to studies doing just that which the comment I was responding to claimed to exist.