Not true. There are plenty of userspace TCP stacks in production today, just like there are also userspace IPsec stacks. UDP is also an option if TCP is too complex for your tastes.
Endianness of a nonce in cryptography does not matter and the rest of your statements are nonsense. You used AI to write that, didn't you? Please don't do that, it's disrespectful.
By that logic, we should avoid TCP as the Linux kernel implementation has had plenty of CVEs. Thankfully we don't use that logic.
That is not true unfortunately. io_uring only avoids the userspace copy/switch. There are many other copies in the Linux userspace network stack.
Replacing ChaCha20 with AES-GCM does not change the cryptographic guarantees of the WireGuard protocol whatsoever.
Yes, I agree, IPsec's complexity is definitely why client implementations are so universally finicky. That complexity is not needed by Tailscale.
It's only half the story. WireGuard uses chacha20-poly1305 and certain implementations can still achieve 100Gbps. Hardware acceleration is the path to 400Gbps and power efficiency though.
IPsec is a terrible fit. Tailscale uses a control plane for peer & key distribution and renders almost all of the complexity in the IPsec protocol useless.
1) Besides marketing, I see no reason that Tailscale needs to concern itself with the WireGuard protocol spec at all. Tailscale is already incompatible. 2) Tailscale's control plane model for peer distribution avoids…
You're correct, kernel isn't faster by default. With that said, the following is true: 1) the WireGuard kernel implementation, despite not even being zero-copy, exceeds the performance of the userspace implementation 2)…
Tailscale's netstack is barely even WireGuard and they aren't compatible whatsoever. It's all marketing at this point. So it's not that simple: it's impossible for Tailscale to use any existing kernel or accelerated…
In my opinion, this is Tailscale's largest issue. It is slow. It cannot achieve speeds of greater than 1Gbps on clients systems (Windows & Mac), where you'd normally see it being used. On Linux, it struggles to achieve…
Power usage is also very reasonable! 400GE switches and routers pull a ridiculous amount of power.
"there was a correction issue" is downplaying it. Etcd is truly the worst example of Raft. Etcd corruption and loss of quorum is extremely common in practice and the GitHub issues sit for years. The design is simple,…
Not speaking to their code, but to start GoBGP has the worst performance of any BGP daemon by a large margin [1]. [1] https://elegantnetwork.github.io/posts/comparing-open-source...
I don't think iPhone Upgrade Program was ever the best deal to be honest. It's just convenient.
I stand corrected! This doesn't look too bad then.
The Apple Upgrade lease model isn't even a replacement as you have to wait 24 months before upgrading. The entire point of the iPhone Upgrade Program was to make it painless to swap to the newest iPhone every year.…
You'd be surprised to know that this strategy works quite well! Pixel bots require a hardware fake display when faced with kernel anti-cheat. They also depend on color/pattern recognition, as AI is not yet capable of…
Aimbot is actually very solvable! 1) When DMA is fully blocked, Aimbot resorts to being a pixel bot. 2) Once you're relying on a pixel bot, all the anti-cheat has to do is "bait" the bot. After you click the bait a few…
> "How come replay analysis doesn’t catch more cheaters?" 1) There's too many players. 2) Closet cheaters are extremely subjective: automated & manual moderation would be full of false positives. In these cases,…
I feel someone doesn't need to play competitive games to be able to give an honest assessment of the privacy & security risks. I'm sad I'm not seeing that honesty elsewhere in this thread.
At least in Valorant, DMA is becoming impossible due to IOMMU / Memory Integrity enforcement. The only option is becoming pixel bots. As for faking the input device: I'm sure it's possible, but I'm also sure that…
In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the…
That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.
Not true. There are plenty of userspace TCP stacks in production today, just like there are also userspace IPsec stacks. UDP is also an option if TCP is too complex for your tastes.
Endianness of a nonce in cryptography does not matter and the rest of your statements are nonsense. You used AI to write that, didn't you? Please don't do that, it's disrespectful.
By that logic, we should avoid TCP as the Linux kernel implementation has had plenty of CVEs. Thankfully we don't use that logic.
That is not true unfortunately. io_uring only avoids the userspace copy/switch. There are many other copies in the Linux userspace network stack.
Replacing ChaCha20 with AES-GCM does not change the cryptographic guarantees of the WireGuard protocol whatsoever.
Yes, I agree, IPsec's complexity is definitely why client implementations are so universally finicky. That complexity is not needed by Tailscale.
It's only half the story. WireGuard uses chacha20-poly1305 and certain implementations can still achieve 100Gbps. Hardware acceleration is the path to 400Gbps and power efficiency though.
IPsec is a terrible fit. Tailscale uses a control plane for peer & key distribution and renders almost all of the complexity in the IPsec protocol useless.
1) Besides marketing, I see no reason that Tailscale needs to concern itself with the WireGuard protocol spec at all. Tailscale is already incompatible. 2) Tailscale's control plane model for peer distribution avoids…
You're correct, kernel isn't faster by default. With that said, the following is true: 1) the WireGuard kernel implementation, despite not even being zero-copy, exceeds the performance of the userspace implementation 2)…
Tailscale's netstack is barely even WireGuard and they aren't compatible whatsoever. It's all marketing at this point. So it's not that simple: it's impossible for Tailscale to use any existing kernel or accelerated…
In my opinion, this is Tailscale's largest issue. It is slow. It cannot achieve speeds of greater than 1Gbps on clients systems (Windows & Mac), where you'd normally see it being used. On Linux, it struggles to achieve…
Power usage is also very reasonable! 400GE switches and routers pull a ridiculous amount of power.
"there was a correction issue" is downplaying it. Etcd is truly the worst example of Raft. Etcd corruption and loss of quorum is extremely common in practice and the GitHub issues sit for years. The design is simple,…
Not speaking to their code, but to start GoBGP has the worst performance of any BGP daemon by a large margin [1]. [1] https://elegantnetwork.github.io/posts/comparing-open-source...
I don't think iPhone Upgrade Program was ever the best deal to be honest. It's just convenient.
I stand corrected! This doesn't look too bad then.
The Apple Upgrade lease model isn't even a replacement as you have to wait 24 months before upgrading. The entire point of the iPhone Upgrade Program was to make it painless to swap to the newest iPhone every year.…
You'd be surprised to know that this strategy works quite well! Pixel bots require a hardware fake display when faced with kernel anti-cheat. They also depend on color/pattern recognition, as AI is not yet capable of…
Aimbot is actually very solvable! 1) When DMA is fully blocked, Aimbot resorts to being a pixel bot. 2) Once you're relying on a pixel bot, all the anti-cheat has to do is "bait" the bot. After you click the bait a few…
> "How come replay analysis doesn’t catch more cheaters?" 1) There's too many players. 2) Closet cheaters are extremely subjective: automated & manual moderation would be full of false positives. In these cases,…
I feel someone doesn't need to play competitive games to be able to give an honest assessment of the privacy & security risks. I'm sad I'm not seeing that honesty elsewhere in this thread.
At least in Valorant, DMA is becoming impossible due to IOMMU / Memory Integrity enforcement. The only option is becoming pixel bots. As for faking the input device: I'm sure it's possible, but I'm also sure that…
In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the…
That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.