zx2c4

21 ms·

181.
by zx2c4 8y ago
It's actually under fairly consistent and active development right now. Hopefully we'll have something to share soon.
182.
by zx2c4 8y ago
Posted v8 a few weeks ago. I'm working on v9 now. I'm mostly working on readying the new crypto api, Zinc -- https://lwn.net/SubscriberLink/770750/95c3c169634d1447/ -- and I'll be hopefully dis
183.
by zx2c4 8y ago
Our final frontier is Windows, actually. Hope to have that out soon!
184.
by zx2c4 8y ago
It's an email for a mailing list of people who already know about the project, not a press release, but somebody posted it here anyway. The main site -- https://www.wireguard.com -- has lots of info if you're curious.
185.
by zx2c4 8y ago
As the mailing list post mentions, this is a super new code base, and we could certainly use a hand, if any iOS developers out there are itching to help out. Opportunity to jump into a codebase while it's still pretty fresh, if that so
186.
Zinc: a new kernel cryptography API(lwn.net)
4 points by zx2c4 8y ago|0 comments
187.
by zx2c4 8y ago
A more direct link might be: https://lists.zx2c4.com/pipermail/wireguard/2018-November/00...
188.
by zx2c4 8y ago
I'll be discussing the Zinc library at the conference in Vancouver soon with other developers, and hopefully we'll get to a good place for the next cycle. This sort of thing is, evidently, a process of sorts.
189.
by zx2c4 8y ago
The kernel module version uses less, if you have a phone that supports it. The userspace version uses much less than ordinary VPNs -- because it doesn't send traffic when you're not using it -- but it's still Android userspac
190.
by zx2c4 8y ago
Tinc is really cool. I like that you can give it a partial mesh and it will figure out how to create a full mesh from it. A few years ago I was talking to the author, Guus, about using WireGuard as the underlying backhaul in Tinc while pres
191.
by zx2c4 8y ago
WireGuard even in userspace is generally pretty fast anyway, since it's multi-threaded.
192.
by zx2c4 8y ago
I think sshuttle is pretty cool. It does layer 3 tunneling over TCP in the right way. Usually when VPNs (like OpenVPN) try to tunnel IP packets over TCP, if those IP packets contain TCP data itself, then you have this problem with tunneling
193.
by zx2c4 8y ago
I still believe TunSafe's interoperability and standing security issues are significant, and that TunSafe's existence and confusion-potential are generally damaging to the WireGuard project, as has been the adversarial position of
194.
by zx2c4 8y ago
> It's good that they're not just going to plop the thing in there in a degraded state (with probably worse performance [and DoS resistance] than the current out of tree/dkms distributions of wireguard). Yea, indeed, I&#x2
195.
by zx2c4 8y ago
Right. So basically v2 of the Zinc patchset will address the nice points brought up on the list, and I think things should proceed nicely.
196.
by zx2c4 8y ago
> Having said that I still would have preferred for something like a single increasing integer as the "cipher suite version". This already essentially exists. If the first byte of an initiation message is 0x1, then it means you
197.
by zx2c4 8y ago
I don't think there's any disagreement. Tom and I are both referring to the same things using slightly different words.
198.
by zx2c4 8y ago
> If the authors had the intent Fortunately I know exactly what I was thinking. Each message has an explicit type. The set of types exists in the first byte with the remaining three reserved for future additional use, perhaps for naming
199.
by zx2c4 8y ago
> I've reread the technical paper just now, and recalled the (internal, with colleagues) discussion I had in the past, from which I had this conclusion - "whole protocol version" is an emergent property of wireguard, not a
200.
by zx2c4 8y ago
Those benchmarks are ancient and the values being reported are confusing, but they're certainly not faked. I need to run new ones on a wider variety of hardware in a wider variety of circumstances and provide scripts to reproduce easil
201.
by zx2c4 8y ago
Well... There's always https://github.com/taviso/ctypes.sh ...
202.
by zx2c4 8y ago
I wrote pass, originally just as just a dumb bash script that I was using privately, but then I put it on the Internet, and so all of the sudden there was a requirement to _not be awful_. The experience has been pretty frustrating, for prec
203.
by zx2c4 8y ago
I've been working on it with them actually. We'll see where that goes.
204.
by zx2c4 8y ago
You can use WireGuard with rather expensive but conservative PQ primitives like Classic McEliece using the PSK feature of WireGuard, giving you hybrid PQ secrecy. The PSK feature was explicitly designed for this. The idea is that first you
205.
by zx2c4 8y ago
Actually, I turned on inner-packet GRO a few weeks ago with this one-line change, resulting in surprisingly massive performance boosts for TCP: https://git.zx2c4.com/WireGuard/commit/?id=95951af7249912a43...
206.
by zx2c4 8y ago
It's even easier than that: $ git commit -s -m "man: add example for bla bla bla" $ git send-email --to=wireguard@lists.zx2c4.com HEAD~ And that's it! This is also, by the way, how submissions to the kernel
207.
by zx2c4 8y ago
> Why does this need to be included in the kernel directly and not just as a loadable module? From the patch: + tristate "WireGuard secure network tunnel" This means that it can be a built-in, a loadable module,
208.
by zx2c4 8y ago
[0/3] https://marc.info/?l=linux-netdev&m=153306429108040&w=2 [1/3] https://marc.info/?l=linux-netdev&m=153306429908043&w=2 [2/3] https://marc.info/?l=linux-ne
209.
by zx2c4 8y ago
Nah, if people freak out I'll just change it. I _prefer_ my insanely long lines, and if Dave & co are alright with my preference, great, but if not, Linux is a big project with many people, and I'm happy to accommodate for dif
210.
by zx2c4 8y ago
There are several other (and newer) presentations here as well: https://www.wireguard.com/presentations/

More ›