Show HN: Encrypted VPN in 2k lines of Go (opens in new tab)

There's also a work-in-progress Go implementation of Wireguard, found over here: https://git.zx2c4.com/wireguard-go/about/

My concern is that 'built on modern crypto' and 'reviewed by cryptographers' amounts to 'rolled our own crypto'. IMHO history has shown us time and time again that this is a bad idea - we should use the protocols and ciphers that have stood the test of time. Building subnet using TLS was an architectural choice to avoid playing the role of cryptographer and inevitably getting it wrong.

Thanks! This is definitely something I need to get around to once I read up a bit more on vendoring.

Good job! I'm looking into trying Go soon, is there something you'd recommend looking at for learning the Go ecosystem norms?

When I first saw Go I was put off by its syntax, but after giving it a chance I very quickly fell in love with it.

I've used C#, Python, Ruby, Java, C, Obj-C, JS and Go for mid-large scale projects. Go is the only language I've ever truly loved; sometimes I even feel like I'm writing poetry (as ridiculous as that may sound).

The community is really incredible^, I've yet to encounter anything that didn't have great documentation or solved by packages. My favorite SO answer of any language is probably this one by icza: https://stackoverflow.com/questions/22892120/how-to-generate... . I also feel that it's very easy to read and understand other peoples code compared to other languages (imo, the only aspect of Go that I think can be difficult for newcomers to grasp is pointers). All in all, I feel very confident that I'll still be writing Go code after ten years.

^ (Although I hate when certain "elitists" downvote questions because they feel they've been sufficiently answered elsewhere.. if a SO answer says how to display time to YYYY-MM-DD:HH-MM then don't complain if someone ask how to display time as YYYY-MM-DD.. I have a strong dislike towards jquery (or rather JS), but I think the great thing about jquery is that every imaginable edge-case seem to be documented)

I think Golang is very suitable for network programming tasks. It gives you wonderful libraries to work with sockets, strict rules to structure your code, automatic memory management, goroutines for concurrent programming etc.

Most network related small apps were written in C, now you can write them in Go. With the added benefit of simple libraries, memory management and goroutines. You don't have to mess arround with platform specific sockets, threading libraries etc. Plus every piece of code you open is written in understandable Go. With C, there is years of baggage, multiple standards, pre-compiled headers, undefined behaviour etc.

And lastly, new is always more exciting than old :)

No it's not you [0]. Rust, Go, R, and Python have the highest year-to-year growth.

[0] https://stackoverflow.blog/2017/09/06/incredible-growth-pyth...

Throughput: It depends on the link, but I'm getting 16mbps peak where my connection to my ISP gets me 20mbps peak.

Mobile: You have to use the APIs that are available on the platform to hook into the network layer. After that its pretty straightforward though - you open some TLS connections, do verification, and encapsulate network traffic in some simple structs.

A neat thing about sshuttle is that it restreams TCP connections inside of the SSH tunnel so that you don't incur the classic TCP-over-TCP problem [1].

[1] http://sshuttle.readthedocs.io/en/stable/how-it-works.html

Sshuttle is very cool. But it only does TCP and UDP. (no ICMP)

Correct. While simple, this does have the performance impact you're alluding to. On my 20mbps (down) connection, I peak out at 16mbps on subnet.

The 'double congestion-control' effect can be alleviated by opening 10 or so TLS connections and pumping the packets down those, to spread the effects of TCP congestion control.

I'm afraid not :/ Windows is a whole new kettle of fish to get working - you need a device driver to emulate TUN/TAP.

That said, I'm using a library called Water for the low-level networking, and that library just added support for Windows. Implementing full windows support only requires you to implement a few network methods (such as helpers_linux.go) - PRs welcome :)

>would anyone ever create a VPN client that doesn't use encryption?"

They do, but generally call it tunneling. L2TP and GRE links that don't use IPSEC are fairly common on private WANs.

I suspect the author was trying to point out that the encryption was included in the 2k lines, versus say, calling out to ssh.

I wouldn't use that repo as a representative of what "go code looks like". Most go repos are pretty similar in "structure", but I really don't know how to navigate this. The 'src' directory looks like the author is really fighting the gopath concept, but also trying to vendor dependencies. I agree, if my hook was "in xx lines of code" I would try to avoid boilerplate and keep it all together as much as possible.

I'm glad you're asking these kinds of questions, they need to come up more often especially in a software-supply-chain context.

I am a strong advocate of the saying 'trust but verify'. I believe you should closely audit whatever OSS software you are looking at using in light of your threat model.

To get round to your question: Why should I use subnet over OpenVPN/Tinc etc? That decision is entirely your prerogative. Subnet is small (quick(er) to audit), easy to understand, and has the bare minimum functionality needed to implement a VPN with full mutual authentication. OpenVPN and others have far more features and are almost certainty xx% faster. Where you want to draw the line is up to you.

It appears all the ISPs I use have figured out how to kill OpenVPN after a few Mbytes have passed, resulting in annoying VPN service interruptions and restarts (I need to figure out how to restart it automatically) - and the browser reacts to the interrupted transfer by restarting it on the now VPNless network connection. Obscurity might be a defense against this (but wouldn't be if one were targeted instead of getting caught in a driftnet).

Because you can easily read and understand the code.

Because your government banned those.

What do you mean? I don't think I saw a single Erlang file in that repository.

I think you commented on the wrong post :)