News for hackers. Stuff that matters.

A comment on WireGuard: next generation in-kernel modern VPN. Parent comment

Re:WireGuard: next generation in-kernel modern VPN by wepple on Tuesday June 28, 2016 @02:17PM (#11996122)
I'm curious, you don't agree that the complexity of an access vuln + privesc vuln is a better defender position than a single vuln to ring-0?

It kind of seems to fly in the face of the multiple layers of userland and kernel separation engineering we've seen go into other attack surfaces like browsers?

[ Parent | on HN ]
Re:WireGuard: next generation in-kernel modern VPN by tptacek on Tuesday June 28, 2016 @02:20PM (#11996142)
All things being equal I do think it's better to be in the former position than the latter.

But all things are not equal. Any code execution on the VPN server practically implies that the attacker controls the VPN, which is game-over for most VPNs I've ever worked with. So my priority would be "not having those kinds of vulnerabilities at all". I'd rather have simpler, easier-to-audit code than userland, if I have to choose one.

[ Parent | on HN ]