Hacker News Reader

Comment by marcrosoft | Hacker News Reader

How does this or ZeroTier compare to WireGuard besides the fact WireGuard doesn’t have much of a UI or key management?

WireGuard is like a modernized version of the SPTPS protocol --- SPTPS is a denatured variant of TLS --- that tinc uses, (ordinarily) coupled to the Linux networking stack. It is something you would build a modern version of tinc on top of, not a competitor to tinc. See Tailscale for an example of something that looks a lot like tinc, but built on WireGuard.

Tinc's security track record has not been especially great†, and while WireGuard and tinc are both written in C, tinc is a great ghastly blob of C, and WireGuard was written defensively by a vulnerability researcher to minimize attack surface --- the whole thing is about 4000 lines of code, and can be run without memory allocation.

So if you were just comparing SPTPS to WireGuard, it'd be no contest at all: you'd always, always prefer WireGuard. And that's what most people should do, because most people run simple access VPNs that don't need elaborate mesh routing features. For the minority that do, for now, there's Tailscale and Tinc; maybe Tinc can do a 2.0 on top of WireGuard, with its userland components in a memory-safe language.

† This, in particular, is not the commit message you want to see in a fix for an error oracle vulnerability: https://www.tinc-vpn.org/git/browse?p=tinc;a=commit;h=d3297f...

Thanks for the rundown. I’m already using wireguard so I’ll stick with that and hopefully figure out some of the kernel upgrade issues I’ve ran into.

Tailscale is an automatic no for me. I won’t use proprietary software for something as important as this. Even with tincs history I’d much rather go with opensource.

Hi, Tailscale person here.

If you haven't seen it, an open source implementation of the server: https://github.com/juanfont/headscale.

The Linux & Android clients are fully open source. The Mac GUI is closed, but the "Linux" client runs on macOS, sans GUI. (Also runs on BSDs, and I believe Windows)

At that point, only the iOS and Windows GUI app is closed, but they're both super thin wrappers around the open source Go implementations.

But, yes, it's true that we're not entirely open. We'd planned to release a simple server implementation when we got it cleaned up, but then Headscale beat us. That seems like the most important missing bit.

Tailscale is open source. Your data might route through their servers (e.g. STUN) but it's E2E encrypted, which you can verify easily.

It is NOT. It's a paid commercial software where only the client is open source.

There's no commit message here at all

  400 - Invalid hash parameter

Looks like the URL doesn't work because it picked up an asterisk somehow.

Fixed. Thanks!

I started off using tinc before wireguard existed, and now use both. Tinc provides a guaranteed full connectivity graph with indirect routing, nat punching, and local subnet discovery as needed. Wireguard is much more performant (eg it can be used to secure nfs without kerberos). Eventually someone will write a daemon for wireguard that provides tinc's features, but until then they are complimentary. I use wireguard between routers to carry full subnets, and tinc is setup on individual hosts to provide fallback access.

Have you tried Tailscale?

No... I'm not really interested in proprietary software, especially as security-critical foundation.

I would normally agree, but I trust both apenwarr and bradfitz. And Tailscale rocks.

Fair enough

Tinc and Zerotier are establishing n to m connections and meshed routing where Wireguard AFAIK does 1 to 1 connections.

Wireguard does more than 1-1 connections, every computer can connect to as many other computers as you like, you can have computer a connect to computer c via computer b, and vice versa, and longer chains.

In my experience this is basically a turnkey setup with Tinc though as it handles all the key sharing transparently, and in your example will only use computer b to do the initial handshake and then let computer a talk directly to computer c. This is especially useful when you have large mesh networks across various LANs and WAN.

I haven't used tinyc - but that does sound like an improvement over wireguard.

The tradeoff is performance vs features. WireGuard runs at the kernel level, is focused on performance but very minimalistic in terms of features.

Reply on news.ycombinator.com