News for hackers. Stuff that matters.
Re:The spiped secure pipe daemon by jrockway on Monday July 04, 2011 @08:42PM (#2728295)
Why not use OpenVPN for secure tunnels?

I used to use ssh tunnels for tunneling irc from irssi-proxy to my local machine (since I don't trust irssi's authentication around the proxy). This involved several steps: binding the proxy to 127.0.0.1, and then sshing in from my desktop and forwarding the ports. And, with two transport layers, my irc client would disconnect if the irc connection failed or if the ssh connection failed. This was annoying.

I eventually switched to OpenVPN. I run a server on one of my hosts, and then the other networks I control connect to that and share their networks. The result is that I can bind irssi-proxy to the 10.0.42.0 interface and then directly connect from any other machine on my network.

This ends up being much less of a pain than the other setup, scales to many more services, and lets me do cool things like ssh-ing to my phone when it's on Sprint's network and my laptop is on a cafe's network.

(Oh, and if you do this yourself, don't use anything in 10.0.0.0/16 for your internal network; VPN or otherwise. You will end up in some coffee shop that reserves the whole /16 for itself when all it needs is some random /8, and then nothing works.)

Re:The spiped secure pipe daemon by tptacek on Monday July 04, 2011 @10:02PM (#2728414)
First, both SSH and OpenVPN are much more complicated than spiped, and thus more likely to have security flaws. OpenVPN as you know incorporates OpenSSL and makes use of an even greater fraction of its code than stunnel; Colin's primary goal in building spiped seems to have been avoiding the need for stunnel (or even stud).

Second, if all you're trying to do is hook one discrete component up to another, a full-on VPN isn't just overkill, it's also unnecessarily dangerous, since now you have to configure the network stacks to ensure that only the traffic you intended to allow is going to be able to get through after a minor compromise.