9 ms·

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at no

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all. https://mail-index.netbsd.org/current-users/2020/08/20/msg039393.html https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg039406.html https://mail-index.netbsd.org/current-users/2020/08/22/msg03... Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD.

dontbenebby 4y ago
>FreeBSD WireGuard drama Can you fill me in? I experimented with Wireguard a while back but it's been a few. (It sounds like concern about design choices not... gossip? Infosec has been insane the past fourish years.)
- pram 4y ago
  The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
  - deleted 4y ago
    [deleted]
  - rwaksmunski 4y ago
    This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.
    - gonzo 4y ago
      It’s also a lie that it wasn’t available for review. It was in review for about 10 months before it started to land in a release.
      - broknbottle 4y ago
        How about you provide links that backup your claims.. It's well documented that you'll go to great lengths to act in bad faith and make nonsense claims on the internet. https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2017-1828 https://www.wipo.int/amc/en/domains/search/text.jsp?case=D20... https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/
        gonzo 4y ago
        https://reviews.freebsd.org/D26137 https://reviews.freebsd.org/D26137
        voidwtf 4y ago
        It looks a lot like that was landed without completion of a proper review, and with several changes made without any review. I appreciated Netgate's commitment to improve the FreeBSD operating system, and to build the pfSense product. It's the attitude of Netgate's team, where an opportunity to offer a mea culpa and move forwards with the expertise of a core FreeBSD developer/maintainer and the subject matter expert was presented, was instead met with open hostility. It made it appear as if getting it done was more important than getting it right. Sometimes we get things wrong, we put a lot of work into code that we're proud of, then our project manager and peers come along and absolutely tear it down and rebuild it. It's an opportunity for growth, not a waste of effort or money. I'm glad things improved and that you guys brought on Christian McDonald.
    - Arnavion 4y ago
      It was released to production by Netgate in pfSense. That's why they threw such a hissy fit over it when the code quality was revealed and blew up publicly.
- Arnavion 4y ago
  https://news.ycombinator.com/item?id=30719403 https://news.ycombinator.com/item?id=30719403
codethief 4y ago
Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and harmful to your users. Rather than playing never ending whack-a-mole misery with this -- which is not a path I'm willing to go down here -- I'd like to re-examine how this is built from the ground-up and do some serious code study. (This response of his is corroborated by the article https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... which someone else posted further down.) He also mentions that he's not against having a WireGuard implementation included in NetBSD in general.
- Eisenstein 4y ago
  What about that describes why it should not be implemented? All he says is "I don't like it and it is not acceptable". If you write a paper and have it proof-read by many competent people, then hand that paper in to a teacher and get back an F with "This is no good, it has flaws I do not consider acceptable", would you think that was reasonable explanation for failing your paper?
  - codethief 4y ago
    1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...
    - Eisenstein 4y ago
      1) What isn't what he said? I paraphrased you and you quoted him 2) Short on time doesn't correlate with writing up three long replies all refusing to mention even one specific technical problem 3) Your link is in regards to FreeBSD and OpenBSD, and does not mention NetBSD, which is what we are talking about specifically.
riedel 4y ago
The "why" is IMHO simple if you look at the pattern: they didn't ask him for advise. I guess he really expects this. While I personally find this attitude/his comments in different places a bit toxic, he has unfortunately been proven right in the past (like in the freesbd case). I guess it sometimes just requires such people to something right with just enough rigour. I am also be really thankful for this beautiful bit of software in such a messed up space. However, I also totally understand the people who have not asked for his opinion before releasing (I guess this can be a downside).
wmf 4y ago
- detaro 4y ago
  except other people have implemented it and not gotten flamed.

dontbenebby 4y ago

>FreeBSD WireGuard drama Can you fill me in? I experimented with Wireguard a while back but it's been a few. (It sounds like concern about design choices not... gossip? Infosec has been insane the past fourish years.)

pram 4y ago
The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review: https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...
- deleted 4y ago
  [deleted]
- rwaksmunski 4y ago
  This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.
  - gonzo 4y ago
    It’s also a lie that it wasn’t available for review. It was in review for about 10 months before it started to land in a release.
    - broknbottle 4y ago
      How about you provide links that backup your claims.. It's well documented that you'll go to great lengths to act in bad faith and make nonsense claims on the internet. https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2017-1828 https://www.wipo.int/amc/en/domains/search/text.jsp?case=D20... https://opnsense.org/opnsense-com/ https://opnsense.org/opnsense-com/
      - gonzo 4y ago
        https://reviews.freebsd.org/D26137 https://reviews.freebsd.org/D26137
        voidwtf 4y ago
        It looks a lot like that was landed without completion of a proper review, and with several changes made without any review. I appreciated Netgate's commitment to improve the FreeBSD operating system, and to build the pfSense product. It's the attitude of Netgate's team, where an opportunity to offer a mea culpa and move forwards with the expertise of a core FreeBSD developer/maintainer and the subject matter expert was presented, was instead met with open hostility. It made it appear as if getting it done was more important than getting it right. Sometimes we get things wrong, we put a lot of work into code that we're proud of, then our project manager and peers come along and absolutely tear it down and rebuild it. It's an opportunity for growth, not a waste of effort or money. I'm glad things improved and that you guys brought on Christian McDonald.
  - Arnavion 4y ago
    It was released to production by Netgate in pfSense. That's why they threw such a hissy fit over it when the code quality was revealed and blew up publicly.
Arnavion 4y ago
https://news.ycombinator.com/item?id=30719403 https://news.ycombinator.com/item?id=30719403

codethief 4y ago

Thanks for the background. However, I believe your question > Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD. gets answered by Jason: > In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and harmful to your users. Rather than playing never ending whack-a-mole misery with this -- which is not a path I'm willing to go down here -- I'd like to re-examine how this is built from the ground-up and do some serious code study. (This response of his is corroborated by the article https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/ https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... which someone else posted further down.) He also mentions that he's not against having a WireGuard implementation included in NetBSD in general.

Eisenstein 4y ago
What about that describes why it should not be implemented? All he says is "I don't like it and it is not acceptable". If you write a paper and have it proof-read by many competent people, then hand that paper in to a teacher and get back an F with "This is no good, it has flaws I do not consider acceptable", would you think that was reasonable explanation for failing your paper?
- codethief 4y ago
  1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/006494.html https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...
  - Eisenstein 4y ago
    1) What isn't what he said? I paraphrased you and you quoted him 2) Short on time doesn't correlate with writing up three long replies all refusing to mention even one specific technical problem 3) Your link is in regards to FreeBSD and OpenBSD, and does not mention NetBSD, which is what we are talking about specifically.

riedel 4y ago

The "why" is IMHO simple if you look at the pattern: they didn't ask him for advise. I guess he really expects this. While I personally find this attitude/his comments in different places a bit toxic, he has unfortunately been proven right in the past (like in the freesbd case). I guess it sometimes just requires such people to something right with just enough rigour. I am also be really thankful for this beautiful bit of software in such a messed up space. However, I also totally understand the people who have not asked for his opinion before releasing (I guess this can be a downside).

wmf 4y ago

detaro 4y ago
except other people have implemented it and not gotten flamed.