Hacker News Reader

Comment by commoner | Hacker News Reader

> So is everything said here true for Mullvad generally?

No, since the client apps are different. However, Mullvad has completed several audits, including 2 of their client app:

https://mullvad.net/en/blog/tag/audits/

View on HN

Clicked on it to find the following:

    Sorry, Web Safe has blocked this site
    
    This site has been blocked by Web Safe. It's listed as 
    having content that’s inappropriate for children, 
    involving either pornography, hate, crime, drugs, 
    violence, hacking, self harm or suicide.

Thank you, Virgin Media. At least they actually tell you they're blocking them now rather than just forcing a DNS failure.

Isn't that a UK thing which you need to opt out of, not a Virgin thing? They don't do that here in Ireland, while I was under the impression most UK ISPs at least had default on porn filters

It depends on the ISP. It a voluntary scheme and not all bother with it.

I got Zen (another UK ISP) and the page isn't blocked, and I'm a happy Mullvad customer. In fact, I haven't encountered a site that's blocked on the ISP level with them.

So it's a Virgin Media thing.

Spectrum does this as well in the U.S., yet some on HN wonder why the industry is rolling out ECH (formerly eSNI) and encrypted DNS.

> If you’re a Virgin Fibre customer, we’ll ask to you choose your Web Safe settings when you register for My Virgin Media.

I'm on Virgin, you can configure this. Log into your account and there's a whole range of categories you can select/unselect to block.

It's only sites involved in pirating that you can't choose and have to use a VPN.

Really? Your ISP treats you like this so blatantly? This is absurd, nonsense, being considered for practical purposes a child who needs to be controlled in their choices of "appropriate" viewing material. Disgusting. If you don't mind my asking, in which country is this?

I wonder if there's a better way to do this because the client updates often, and so any security report is going to be outdated in a month.

You could just use plain wiregaurd built into the linux kernel... Download a tiny config from mullvad (there is a separate config for each server), pop it in `/etc/wiregaurd`, `chmod 600` and `chown root:root` it and use the `wg-quick` command to bring it up e.g `wg-quick up config-name`. That's it, no appy apps needed. I believe this is all the apps are doing, they just make it easier by retrieving and installing the configs for you and of course add more attack vectors in the process.

This is how i use wiregaurd and it's pretty easy via the wg-quick interface. If using systemd you can also generate a unit for a particular config to bring it up at boot with: `systemctl enable wg-quick@config-name` where config-name is whichever one you want from your /etc/wiregaurd dir.

If you want to be able to check a file to see it's up, e.g for i3status bar or something, you can use /sys like this: `/sys/devices/virtual/net/mullvad*/dev_id` i'm using a wildcard but you can be more specific if you aren't going to be changing configs.

Interesting, thanks!

Apps do much more. You can change location with a click, force kill switch, blocks ads or malware, change to openVPN if UDP is blocked, automatically connect and switch between networks, etc.

It’s a better experience.

All of that will come to Linux UI once there's a network-manager-wireguard plugin, the same that one can do it for openVPN and the like now. Wireguard is still new, and network-manager was still finding the correct UX a year ago.

You can do all of this without the app. I would say it's an "easier" experience, better is subjective.

I used Wireguard clients by default and didn't even know Mullvad has a dedicated client!

Plug: if you want to obtain wireguard configurations for use with Mozilla VPN: https://github.com/NilsIrl/MozWire/

Is there any reason to use the client apps? There are opensource OpenVPN and WireGuard clients, both of which work fine with Mullvad.

Ease of setup. That’s pretty much it.

I need no advanced features, and I have no other WG servers to connect to besides Mullvad, so I’m simply using their app which handles everything for me.

Mullvad supports split-tunnel. Sure you can somehow set that up manually with the standard clients, but with Mullvad you can simply run a command with "mullvad-exclude" and the process will be exempt from VPN. Pretty convenient.

Reply on news.ycombinator.com