Hacker News Reader

Comment by givemefive | Hacker News Reader

Sounds like a move to sell more hardware. My pfsense barely does any crypto. This will push me over to openbsd.

If this was a move to sell more hardware, why wouldn't we make the decision for 2.4 (which is imminent) rather than 2.5, which is based on FreeBSD 12, when 12.0R isn't even scheduled?

I don't know. What is your reasoning? I don't really understand why you'd want to force people to upgrade HW when they don't need to.

There is a difference between a design decision reasonable people can disagree, even forcefully, about, and a design decision that is actually a deceptive attempt to get people to buy new hardware.

They spelled out the reasoning in the post:

“in order to support the increased cryptographic loads that we see as part of pfSense verison 2.5, pfSense Community Edition version 2.5 will include a requirement that the CPU supports AES-NI”

You may disagree with that but it's intellectually dishonest to argue as if they didn't provide clear, technically defensible rationale, especially at a time when much of the industry has been moving to hardware offload.

Wait, your argument is that isn't a way to sell more hardware is that you will do it later, not now?

If we only allowed people to load pfSense on hw that we sell,or have sold, you would have a point.

Since we don't even attempt same, my point stands.

That point no makes sense as this decision cuts out a lot of the cheaper hardware people ran pfSense on previously so when they look at their options now your own lower priced stuff becomes more attractive and oh yes it has AES-NI and is fully compatible.

This really feels like a long con to get people to upgrade their hardware to a pfSense unit.

Indeed, AES-NI is very rare. Few computers if any have it.

Edit: /s ... ?!

> Edit: /s ... ?!

Why are you surprised? If you are trying to make a point that AES-NI is common, just say so. Trying to do so by saying the opposite and expecting people will pick up on the sarcasm through a pure text medium without necessarily sharing the same knowledge to know whether that statement is true or not just adds confusion to the conversation.

The point itself is useful, but the manner in which you expressed it emphasizes the delivery over the content, to the degree the content is sometimes obscured.

Why do you say that? According to [1], AES-NI is not that rare.

[1] https://en.wikipedia.org/wiki/AES_instruction_set

I might be mistaken, but I thought it was in every non pentium/celeron/atom chip after 2010 and every chip after 2015 with some extensions.

My desktop and laptop have them and they're mid-high end but not upper high end.

For Intel CPUs (that are found on ARK):

With AES-NI: http://ark.intel.com/Search/FeatureFilter?productType=proces...

Without: http://ark.intel.com/Search/FeatureFilter?productType=proces...

Reply on news.ycombinator.com