News for hackers. Stuff that matters.

A comment on Vulnerabilities exploited in VPN products used worldwide. Parent comment

Re:Vulnerabilities exploited in VPN products used worldwide by tptacek on Friday October 04, 2019 @05:58PM (#21162257)
I have a lot of empathy for enterprises on this, and while I don't agree with you about "production-ready" (and don't think Jason Donenfeld does either), I do agree with you about giant insurance companies using WireGuard. They're stuck with horrible commercial VPN appliances. You don't have to be.
[ Parent | on HN ]
Re:Vulnerabilities exploited in VPN products used worldwide by numbsafari on Saturday October 05, 2019 @08:07AM (#21165061)
The latest release announcement, from Jason Donenfeld, on the wireguard mailing list contains the following:

> Hello,

> A new snapshot, `0.0.20190905`, has been tagged in the git repository.

> Please note that this snapshot is, like the rest of the project at this point in time, experimental, and does not constitute a real release that would be considered secure and bug-free. WireGuard is generally thought to be fairly stable, and most likely will not crash your computer (though it may). However, as this is a pre-release snapshot, it comes with no guarantees, and its security is not yet to be depended on; it is not applicable for CVEs.

> With all that said, if you'd like to test this snapshot out, there are a few relevant changes.

I think he’s being very responsible and transparent here. It’d be great if someone with money and/or skin in the game could help the project undergo an audit...

[ Parent | on HN ]
Re:Vulnerabilities exploited in VPN products used worldwide by aaronmdjones on Saturday October 05, 2019 @10:14AM (#21165605)
That's not the latest snapshot.

https://lists.zx2c4.com/pipermail/wireguard/2019-September/0...

[ Parent | on HN ]
Re:Vulnerabilities exploited in VPN products used worldwide by numbsafari on Saturday October 05, 2019 @01:23PM (#21166732)
You’re right, I was off by one. However, they both contain the same disclaimer, which is also repeated on the wireguard website. It’s not production software, according to its own author, despite being quite stable and based on solid theoretical foundations.
[ Parent | on HN ]