Hacker News Reader

It's a much more recent design that avoids this particular pitfall. This is mentioned in the tptacek's comment https://news.ycombinator.com/item?id=38684904

And is there any guarantee that 20 years later a similar weakness of WireGuard will not be found?

If sshd is behind wireguard, it's defense in depth.

The probability of an attacker targeting you having an exploit for both at the same time will be lower that having an exploit for either.

On the other hand, if the WireGuard implementation has a vulnerability, the attacker does not need to attack SSH at all and simply punch through WireGuard to have kernel-level access to the system.

It's not defense-in-depth; it's a security chain : only as strong as its weakest link.

Way fewer ciphers in the protocol, it basically has only one set of algorithms so there's way less negotiation.

You can restrict most of these options both client- and server-side in SSH, which is basically always a winning move, regardless of protocol. You can't be downgraded to a protocol version or cipher that you've explicitly disabled.

You can't select which ones get attention from the maintainers however.

It isolate the network? From my understanding the setup entails deploying sshd behind wireguard, thus only authenticated users can ssh.