Hacker News Reader

Comment by numbsafari | Hacker News Reader

As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion.

Now that it’s merged into Linus’s tree, any word on it getting an official release and the “this isn’t production ready, so no CVEs” disclaimer going away?

EDIT:

Further back in the thread, Donenfeld says “Please note that until Linux 5.6 is released, this snapshot is a snapshot rather than a secure final release.”, so perhaps real soon now?

https://lists.zx2c4.com/pipermail/wireguard/2020-January/004...

This is definitely big news!

View on HN

If you value WireGuard and can spare a few bucks the inventor/maintainer is getting about 1/10th what they publicly ask for to maintain:

https://www.patreon.com/zx2c4

If you work for a company that uses Wireguard, please ask your employer to contribute.

What's the rate of companies doing this?

I have no real idea, but I wouldn't be surprised if it is less than 1%.

The problem I ran into is that my company will match employee contributions to registered non-profits. Wireguard doesn't seem to be a project under a registered non-profit. My company won't donate to a random Patreon or PayPal link.

There have been numerous threads here on HN about this: donating to people to support open source development does not match up with what companies usually do, so it runs into all sorts of corporate friction. Whereas a monthly or annual support contract is the sort of thing that companies do all the time, and at low dollar amounts it might not require much approval at all.

Unfortunately it is up to open source developers themselves to set their business model, and many don't seem to like (or want to do the work of) setting up overtly commercial relationships like support contracts.

I finally emailed my bosses asking our company to give about 100$ a month spread over various projects. I thought not to ask too much as 100$ infinitely much more than 0.

We're not a very big company, could easily afford 1k a month though, but then it becomes an actual sum that's harder to motivate as we're mainly working with MS products.

I would place a bet on not greater than 0.1%

I do rely on Wireguard for some personal projects and I can spare a few bucks. However the reality is I can't get to $15/month the minimum tier. I rely on thousands of opensource projects. Upstreaming should help my arguments for adoption at work; they wouldn't think twice.

You can support on Patreon for less than the minimum tier. It is just the cut-off over which the rewards (such as stickers here) are given. Support for just $1! He'll still get it!

Thank you, they could make this clearer.

I didn't know this either. I guess that's why many projects have a fake $1 tier with just "the pleasure of knowing you contributed" or something like that as the "reward" for that tier. To let people know that that's still an option.

I agree, I would have signed up for a $1 tier or perhaps $2 but $15 is far too high for the minimum tier. I support the Zig author for $1/mo and hope others would do the same for my open source projects in the future.

Apart from knowing that 15 USD monthly is not a minimum possible donation there, please see other possibilities to donate on the official link for donations (also posted here). Patreon is only one of the options.

If you go to wireguards donation page, you can make a one-time donation too.

The minimum donation in Bitcoin is probably about US$0.01. Anyway that's what I've paid in transaction fees the last few times I made a donation where I didn't care how long it would take. (They were confirmed within a few hours.) Transaction fees for within-the-hour confirmation are around US$0.20.

Don't let "it's not enough" stop you. Make a one time payment of what you can afford within reason. They don't expect you to put yourself out.

Thanks for posting this; we appreciate it. More generally, donation options for the project are listed here: https://www.wireguard.com/donations/

That ( https://www.wireguard.com/donations/ -- repeating for completeness and exposure) is surely much better link for donations, as some of us would feel limited with a single "Patreon" option.

There are other possibilities for individuals:

"Monthly: GitHub Sponsors, Paypal, Patreon, Liberapay"

"Once: Stripe, Bitcoin, Paypal"

And also "for non-profit foundations and companies."

Thanks!

Any way you can add a "choose your amount" box on patreon, or a lower amount? I try to drop micro-contributions with creators via patreon and $15 is above the current budget for something I don't (yet?) make much use of.

Go to https://www.wireguard.com/donations/ and click on GitHub Sponsors, there's a $5/month option there.

it seems there are confusing / multiple sources of income, patreon is only one.

I don't know if it's fair to say he's not making what he asks for.. or basing a 1/10th claim without knowing how much he gets from other sources. (Bronze/gold partnerships GitHub donations, stripe, crypto donations, and some others).

Right. We'll stamp a 1.0 on the backports as soon as 5.6 is released and goes through the normal mainline release process. Stamping a 1.0 on the compat backport before mainline would be premature, but doing it the day of is the plan.

> As someone who regularly deals with IPSec in conservative network environments, Wireguard can’t gain broad adoption soon enough, in my opinion.

As someone who does not do heavy NetOps, can you speak more about what's wrong with IPsec?

The over-summarized version is: IPSec is extensible and it's rather tedious to get every implementation to interoperate securely with every other implementation simultaneously (and in the correctly secure way).

While using IPSec between supported devices, in an ideally configured setup, yield slight but real benefits with respect to attack resistance, a practical comparison of the difficulty involved and possible configuration mistakes makes other solutions more robust and less likely to be used incorrectly.

This discussion covers most of the high level points, however it doesn't consider that Wireguard being adopted in 2020 and not 1995 means we've got 25 more years of public cryptography research and far more relevant defaults to include as the base of the standard.

https://crypto.stackexchange.com/questions/202/should-we-mac...

The answer here also provides some of the pitfalls of IPSec being more of a 'build your own crypto setup' than an off the shelf drop in solution.

https://crypto.stackexchange.com/questions/56354/ipsec-vs-ss...

The 1995 is a little unfair to the current IPsec: The complicated part of the protocol had a compatibility breaking & simplifying major revision in 2005 (IKEv2).

I think the main reason of the less than polished IPsec experience is that operating systems didn't really promote it as a out of the box working feature, but instead just offered APIs that were mainly used by corporate VPN product vendors who didn't really want interoperation except as a checkbox feature. The early interop hassles are just a symptom of lack of testing and effort - when vendors are motivated and actually everyone's implementation of a standardised protocol to interoperate they organise interoperation testing events etc and make sure their products ship with configurations that actually do interoperate in the real world.

Your linked StackOverflow answer muddies the water too much - IKE was always the official keying protocol[1]. Yes you can use lower level IPsec parts without it with manual keying if you are a masochist or have a very simple topology (like a 2-host tunnel with static IPs), but the other keying methods are fringe or academic.

[1] IKE was finished later than the lower level parts of IPsec, technically there was a period in the beginning when it didn't exist and you had only manual key setup

Well, the main advantage of WireGuard then seems to be it doesn't give you any options, so you're less likely to mess it up. Of course there is only one (two?) implementation(s) of it, so "interoperability" as such is not really a thing.

IPsec can be/is complicated because we learnt as we went with it, but given the correct settings, it can be/is secure.

So just like with SSL/TLS, it may be necessary to 'simply' introduce new RFCs to deprecate the Bad Way(s) of configuring it. Doing a quick search, there's a BCP RFC:

* https://tools.ietf.org/html/rfc5406

(I haven't really used either, so am just spit-balling here.)

Until Cisco (as well as Juniper/AltoPalo/FortiNet/CheckPoint/etc.) implements WG, IPsec will stay with us ;(

I can't deploy WG before that haven't happened... thus time to get WG into RFCs!!!

Most likely it'll drop at the kernel release in April I believe.

Yeah, 5.6 will probably be released on the 28th of March or the 5th of April (depending upon whether Linus feels a -rc8 is needed).

Woud like to use for anything but personal use but cannot use it at work for anything but maybe site to site tunnels.

Reply on news.ycombinator.com