Hacker News Reader

I would like to know this as well. Why is OpenVPN risky?

the algo faq gave sort of an answer: https://github.com/trailofbits/algo/blob/master/docs/faq.md#...

this mostly points to bad defaults and openssl being problems, which I don't see as problems with openvpn itself. I do agree it's a pain that there isn't a multi-platform client maintained by the project.

its Open, duh.

In seriousness though, the author is not a infosec expert so I would take the advice with a grain of salt.

you are very wrong about this; dan is most certainly an infosec expert and I take his recommendation not to use openvpn seriously.

Seems he was correct: https://ostif.org/the-openvpn-2-4-0-audit-by-ostif-and-quark...

the linked audit does reveal a DoS vuln that was patched, but I wouldn't discredit the project based on something so small. audits are a good thing for a project.

^ what he said.

Also, he's a business school grad. But you taking infosec advice from one is none of my business.

dont forget to downvote this one too on your way out.

Reply on news.ycombinator.com