zx2c4

30 ms·

301.
by zx2c4 9y ago
This is awesome. Very well done. 8 points.22 (2001:470:1f13:202:c000::16) 20.135 ms 9 I----------I (2001:470:1f13:202:8000::) 20.071 ms 10 I----------I (2001:470:1f13:202:8000::) 20.108 ms 11 I----------I (2001:47
302.
by zx2c4 9y ago
If by 10kLoC you actually mean less than 4kLoC, then I agree with you. :)
303.
by zx2c4 9y ago
From their security page: "We exclusively use VPN protocols which are known to be secure (OpenVPN and IKEv2)." OpenVPN and IKE both have terrible track records in terms of implementation security.
304.
by zx2c4 9y ago
> Only downside that I've seen users mention is that filenames are readable. People have made various pass extensions, by the way, to work around this.
305.
by zx2c4 9y ago
Firstly, it's ChaCha20. I don't think anybody in their right mind would advocate a 2 round ChaCha. Secondly, there _are_ steam cipher constructions to achieve the design requirements for something like TFS.
306.
by zx2c4 9y ago
While there are many good arguments to be made against AES in favor of ARX construction ciphers, the choice of SPECK for this is not okay. The correct choice of an ARX cipher would have been something like ChaCha20 or Salsa20.
307.
by zx2c4 9y ago
Yesterday's envelope-writing frenzy was a success, so I'm throwing caution into wind and posting this on HN today...
308.
I will mail you WireGuard stickers(lists.zx2c4.com)
1 points by zx2c4 9y ago|1 comments
309.
Linux kernel remote heap overflow vulnerability(lkml.org)
3 points by zx2c4 10y ago|0 comments
310.
Remote Heap Overflow in Linux Kernel(git.kernel.org)
2 points by zx2c4 10y ago|0 comments
311.
by zx2c4 10y ago
* Disabled CONFIG_NO_HZ_FULL to eliminate deadlocks on some instance types That... sounds like a bad bug?
312.
Next Generation MITnet(gist.github.com)
106 points by zx2c4 10y ago|41 comments
313.
by zx2c4 10y ago
For those who don't know, WireGuard -- https://www.wireguard.io/ -- is a next generation secure network tunnel for the Linux kernel. It was designed with many of Docker's requirements in mind, so I think it's
314.
Oss-Security: Alloca in Inline Functions Can Be Dangerous(openwall.com)
3 points by zx2c4 10y ago|0 comments
315.
by zx2c4 10y ago
France and UK when traveling by train.
316.
by zx2c4 10y ago
> hopefully we'll get easy to use software for macos/windows This is certainly in the works. A fella is working on a Go implementation right now that will be cross platform.
317.
WireGuard Presentation at FOSDEM17 [video](wireguard.io)
100 points by zx2c4 10y ago|36 comments
318.
by zx2c4 10y ago
Sidechannel free? High performance? Multi core? I'd love to see this. Sounds really interesting. What curve? Got source?
319.
by zx2c4 10y ago
> Second, with all due respect to the original author zx2c4 (who is currently working on the very promising WireGuard project) Indeed I am working on WireGuard. But I haven't forgotten pass. We're currently working on a new rel
320.
by zx2c4 10y ago
"Firstly…lets get something straight., The ‘cleverest’ programmers are not usually ‘hackers’. Firstly, its much easier to break something than build it. You build software with 100,000 lines of code and 1 line has a potential exploit?
321.
by zx2c4 10y ago
OpenBSD's libasr has been ported to Linux. http://man.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man3/... https://github.com/OpenSMTPD/libasr
322.
by zx2c4 10y ago
Curve25519 in pure PHP? Yikes. Have you done any measurements to verify that the implementation is constant time? https://github.com/paragonie/sodium_compat/tree/master/src/C...
323.
by zx2c4 10y ago
I don't intend to write these, but I know that people are working on things like plugins for Network Manager, which has a GUI, so I think a GUI-able WireGuard will be a reality at some point. I also have an Android client written but s
324.
by zx2c4 10y ago
Indeed DTLS is a "pipe", whereas pure Noise isn't, and pure Noise doesn't have any DoS protection, which DTLS does. But indeed DTLS is a mess for other reasons. For WireGuard I use Noise with stronger DoS resistance and
325.
by zx2c4 10y ago
I wrote WireGuard. Happy to answer any questions. https://www.wireguard.io/papers/wireguard.pdf That paper has a bit more in depth elaboration, if you're interested.
326.
by zx2c4 10y ago
> Again, I can understand that such a statement incites fear, but saying anything else would be a lie. Thanks for the honesty. It's very much appreciated. I'd hate for somebody to somehow miss critical facts like these, and mak
327.
by zx2c4 10y ago
"He says that is impossible and you need B's key to impersonate B when talking to A." Indeed this is what you'd expect out of any secure handshake, right? But that's not the case with the novice Tox one: The handsha
328.
by zx2c4 10y ago
The part that really got me was that after I had this terrible impression from reading the source, the developer wrote on the bug report: "We have a largely undocumented, untested, and not well-understood code base of about 19 ksloc (C
329.
Tox Handshake Vulnerable to KCI(github.com)
79 points by zx2c4 10y ago|64 comments
330.
LWN: SipHash in the Kernel(lwn.net)
3 points by zx2c4 10y ago|0 comments

More ›