2021-03-24


Cool

Worthy

  • WireGuard bounces off FreeBSD—for now (LWN.net)

    By all accounts, WireGuard itself is an excellent VPN solution, but it would seem that unlike the usual approach for a network protocol, where multiple implementations are made independently based on a specification, WireGuard needs to be treated differently. Donenfeld is justifiably proud of his accomplishment, but his requirements for other implementations seem far too rigid—at least for some communities. As we have seen in several different operating system projects (Linux, FreeBSD, NetBSD), Donenfeld often expects that the other, much larger projects conform to his exacting standards and methods. In the end, that attitude may discomfit more than just graybeards.

    • comment:

      From the imported Netgate code (https://cgit.freebsd.org/src/commit/sys/dev/if_wg?id=2338...), I think the "random sleep" are the 'pause("link_down", hz/4)' etc. And they were explicitly added to avoid race conditions (https://reviews.freebsd.org/D26137#611017). wg_allowedip_valid is a "validation functions that just returned true". __chacha20poly1305_decrypt looks like "random printf statements deep in crypto code". (The commented-out WARN_ON calls are sloppy but probably don't count).

      That doesn't look as terrible as Donenfeld implies, but his points seem basically true, and those are all quite obvious issues that suggest the code was merged without being reviewed to a high standard. Those specific issues could have been fixed with some iterations of reviewing and patching, but it seems hard to have much confidence that there aren't a lot of more subtle bugs that will slip past all those reviews, since it doesn't look like the code was developed with a particularly security-oriented mindset from the start.


Media / Ministry of Truthy

Identity Politics / Race Baiting / Re segregation