Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Upstream isn't responsive. I have had a bug open with them about broken TAP mode routing for years, with patch, and they've ignored it.

After seeing the codebase, I'm a lot warier of using OpenVPN. It's quite a mess. I'm personally looking forward to WireGuard becoming the standard, but I'm glad to see an OpenVPN fork. These things, even if they don't replace upstream, tend to motivate them to stop dragging their feet.



Not just you. Linus Torvalds [1] has said that Wireguard's code is a "work of art" when compared with the "horrors" that are OpenVPN and IPSec.

1: https://www.phoronix.com/scan.php?page=news_item&px=Linus-Li...


Nice misquote.

Full quote is: "Maybe the code isn't perfect, but I've skimmed it, and compared to the horrors that are OpenVPN and IPSec, it's a work of art."

Source: the given link.


I'm staring at both lines and I can't tell what you think is a misquote.


Uh...the parts he quoted are word for word...


Unfortunately it is blocked in mainland China where it is needed.


As a paid customer of OpenVPN I have to admit I find their attitude over certain matters incredibly frustrating.

Their continued lack of interest in IPv6 is a prime specimen. We're now in 2020, IPv4 depletion is no longer a distant thought, and yet OpenVPN still don't have full support for IPv6.

The lack of support for modern algos is also frustrating, although not exactly a deal breaker.

That said, to give them their due, when a CVE worthy issue arises, they are quick to react and issue a patch (or at least no slower than your average).

As for WireGuard, yes, I'm looking forward to it. But let's face the truth. The WireGuard homepage makes it quite clear in no uncertain terms that WireGuard is still a work in progress. Until such time as its had a full suite of codebase reviews, including multiple independent security audits, I refuse to touch it for production. Maybe in 12–24 months things might have changed at WireGuard to an extend that makes it more worthy for consideration.

So at the moment OpenVPN is the best we've got as an alternative to IPSec (which is quite frankly a pain to deal with, especially in NAT environments and so unsuitable for road warriors).


> Until such time as its had a full suite of codebase reviews, including multiple independent security audits, I refuse to touch it for production.

https://courses.csail.mit.edu/6.857/2018/project/He-Xu-Xu-Wi...

https://www.wireguard.com/papers/wireguard-formal-verificati...

https://www.wireguard.com/papers/dowling-paterson-computatio...

https://www.wireguard.com/papers/lipp-computational-2018.pdf

https://www.wireguard.com/papers/kobeissi-bhargavan-noise-ex...

Additionally: https://lists.zx2c4.com/pipermail/wireguard/2019-December/00...

If you use Linux 5.6 when it comes out, you have WireGuard available.

The code that's still under "heavy" development? Mostly the clients for other platforms (i.e. Windows).


WireGuard will completely replace OpenVPN with time.


Like IPv6 specified in the early 90s fully replaces Ipv4 with time.

Like reiserfs has become the standard Linux file system. Like btrfs is becoming the standard Linux file system (Redhat has announce to discontinue support)

Predictions are difficult, especially when they cover future developments...


Not really for the type of VPN AirVPN provides. Wireguard (still) has many issues in that area, some of them foundational.


Unsure what the downvotes are for.

Wireguard is not designed to provide any obfuscation. It has very clear fingerprints. This is by design. Jason is very clear that Wireguard does not consider obfuscating its packets to be in scope for the project.

AirVPN (I believe) attempts to provide a service that also features an obfuscated / hidden VPN.

This does not mean that Wireguard cannot become the underlay used by VPN providers like AirVPN. Just that they'll need an obfuscation overlay as well.


By "obfuscation" do you mean a way to disguise packets sent as some other protocol? What methods does OpenVPN provide for this?


I use wireguard with Mullvad since it launched without issues. They even have it in the official client. I talked to them about the article that one VPN provider wrote about it not being scalable and not privacy preserving and their response was that it was mostly FUD. I believe one of their technicians wrote a blog about it, but now I can't find it.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: