Hacker News Reader

Comment by johnklos | Hacker News Reader

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all.

https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03...

Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD.

View on HN

Thanks for the background. However, I believe your question

> Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD.

gets answered by Jason:

> In its current form, there are implementation flaws and violations that I do not consider acceptable, and deploying this kind of thing is highly irresponsible and harmful to your users. Rather than playing never ending whack-a-mole misery with this -- which is not a path I'm willing to go down here -- I'd like to re-examine how this is built from the ground-up and do some serious code study.

(This response of his is corroborated by the article https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice... which someone else posted further down.)

He also mentions that he's not against having a WireGuard implementation included in NetBSD in general.

NetBSD just needs Rust support for kernel dev. ;)

I appreciate when folks take a reasonable stand against craptastic software engineering practices (cough OpenSSL cough) and insist on quality code.

I may be wrong but openssl was never deemed poor quality primarily due to the devs not giving a damn but because of legacy code and lack of funds.

He never stated any technical reasons at all - neither then, nor a week later, nor since. He was asked very specifically, by people who are extremely competent, on a technical list:

"Can you be specific about what is wrong?"

"I don't like it" isn't good technical reasoning.

I kind of understand him, WireGuard is connected to his Name, if a implementation is not matching his taste of quality (i especially used taste here) and something happens it backfires.

It's a bit the same as with pulse-audio in the beginning, where it backfired to poettering even if the code was not finished and the distributions, especially ubuntu integrated it pretty bad, told no one that it was alpha...and everyone was like:

What bad thing my sound worked with alsa before...i hate pulse-audio, poettering destroyed the "year of linux-desktop", now i hate him too ;)

What about that describes why it should not be implemented? All he says is "I don't like it and it is not acceptable". If you write a paper and have it proof-read by many competent people, then hand that paper in to a teacher and get back an F with "This is no good, it has flaws I do not consider acceptable", would you think that was reasonable explanation for failing your paper?

1) That's not at all what he said. 2) In his message he also mentions that he is short on time and would be willing to elaborate on why the code is flawed as well as collaborate on getting a polished implementation of WG into the kernel a week later. 3) As mentioned by the article I linked, he did follow up on his promises: https://lists.zx2c4.com/pipermail/wireguard/2021-March/00649...

1) What isn't what he said? I paraphrased you and you quoted him

2) Short on time doesn't correlate with writing up three long replies all refusing to mention even one specific technical problem

3) Your link is in regards to FreeBSD and OpenBSD, and does not mention NetBSD, which is what we are talking about specifically.

The message you link to is in regard to the FreeBSD implementation and not NetBSD.

If anyone wants to review the NetBSD implementation, see:

https://github.com/NetBSD/src/blob/trunk/sys/net/if_wg.c

The "why" is IMHO simple if you look at the pattern: they didn't ask him for advise. I guess he really expects this. While I personally find this attitude/his comments in different places a bit toxic, he has unfortunately been proven right in the past (like in the freesbd case). I guess it sometimes just requires such people to something right with just enough rigour. I am also be really thankful for this beautiful bit of software in such a messed up space. However, I also totally understand the people who have not asked for his opinion before releasing (I guess this can be a downside).

>FreeBSD WireGuard drama

Can you fill me in? I experimented with Wireguard a while back but it's been a few.

(It sounds like concern about design choices not... gossip? Infosec has been insane the past fourish years.)

The original implementation had a lot of issues, but more importantly it was pushed to head and deployed in production without a review:

https://arstechnica.com/gadgets/2021/03/buffer-overruns-lice...

This is a lie. The bad code was never "deployed in production", it was pulled before a release. FreeBSD users were never exposed to it. HEAD code branch is where reviews happen in BSDs, this code failed that review and was removed.

A a larger backer and contributor to freeBSD pushed wireguard kernel mode support out in one of their production releases and then slowly walked it back. Whether freeBSD likes it or not, this sort of thing reflects poorly on freeBSD as a whole when a large donor/backer and contributor that advertises freeBSD then releases something that is a pile of half baked shit.

https://www.netgate.com/blog/wireguard-removed-from-pfsense-...

https://lists.zx2c4.com/pipermail/wireguard/2021-March/00650...

I once deployed linux-next in production, it reflects poorly on linux.....

But yeah dont use pfsense but opnsense...but everyone should know that already....right?

It was released to production by Netgate in pfSense. That's why they threw such a hissy fit over it when the code quality was revealed and blew up publicly.

It’s also a lie that it wasn’t available for review. It was in review for about 10 months before it started to land in a release.

How about you provide links that backup your claims.. It's well documented that you'll go to great lengths to act in bad faith and make nonsense claims on the internet.

https://www.wipo.int/amc/en/domains/search/text.jsp?case=D20...

https://opnsense.org/opnsense-com/

https://reviews.freebsd.org/D26137

It looks a lot like that was landed without completion of a proper review, and with several changes made without any review. I appreciated Netgate's commitment to improve the FreeBSD operating system, and to build the pfSense product. It's the attitude of Netgate's team, where an opportunity to offer a mea culpa and move forwards with the expertise of a core FreeBSD developer/maintainer and the subject matter expert was presented, was instead met with open hostility. It made it appear as if getting it done was more important than getting it right. Sometimes we get things wrong, we put a lot of work into code that we're proud of, then our project manager and peers come along and absolutely tear it down and rebuild it. It's an opportunity for growth, not a waste of effort or money.

I'm glad things improved and that you guys brought on Christian McDonald.

https://news.ycombinator.com/item?id=30719403

Reply on news.ycombinator.com