Next-Generation Secure Network Tunnel Announced For The Linux Kernel

[Djhg2000]

I don't care, the point is that consumer hardware is reliable enough for consumers where most units will not be run for so long and those that do will probably last enough with some luck, and even if they fail there is no big loss for everyone.

But for a company you need to be SURE that something is fire and forget and that tiny crappy fan or cheapo PSU will not come biting your ass 4 years down the line as the cost of sending a tech around is high and downtimes are fucking expensive.

Downtimes are indeed expensive but there's no reason why an Intel NUC would be doomed to fail within 4 years. Not even Intel would accept that poor of a yield on a market dominating product.

My NUC runs almost completely fanless most of the time and when it doesn't it's spinning very slowly. Unless you put it in a small enclosed space I don't see how the fan would be an issue, heck even the BRIX fan has held up just fine and that heavily used AMD toaster in there keeps it spinning fairly fast. These aren't single dollar fans from China.

The power supplies are far less complex than ATX supplies because they only have to supply a single voltage, typically 19V from what I've seen.

Google "PC Engines apu board"---> http://www.pcengines.ch/apu.htm

"PC Engines" is the brand name.

That's more or less professional hardware for competitive prices, fanless (heat spreader connected to heavy-duty metallic case), plenty of connectivity where it matters for an embedded or network device, and so on and so forth.

They are making a newer version with a more powerful quadcore jaguar APU, but for most things these boards are OK.

Wait, so you want to replace a large volume first party Intel machine with a third party AMD machine using a 5 year old architecture that inherently has the exact same power brick "issues" you complained about with the Intel NUC earlier? The only advantage I can find with the board you linked would be the 3x Ethernet ports but those have nothing to do with reliability.

From what I can tell PC Engines do not officially ship to EU either which immediately disqualifies them for worldwide use.

[starshipeleven]

Downtimes are indeed expensive but there's no reason why an Intel NUC would be doomed to fail within 4 years. Not even Intel would accept that poor of a yield on a market dominating product.

I'm not saying NUCs will fail within 4 years, I'm saying that it's not designed for that so it may or may not and if it does Intel does not give a shit about that in the slightest.

I'm not saying (some, random) consumer stuff isn't resilient, I've had boards survive multiple PSU meltdowns, PSU suffer multiple thunderstorms unscathed, and ancient PCs that still work after decades of service.

That's not the point. The point here is removing all possible points of failure, because a failure would be VERY expensive, MUCH more expensive than gold-plating all the devices we use, so there is no reason to save a few bucks on that.

These aren't single dollar fans from China.

They day I'm trusting a laptop-grade fan anything crucial has yet to come.
I've changed too much of them.

The power supplies are far less complex than ATX supplies because they only have to supply a single voltage, typically 19V from what I've seen.

Ehm, laptops and that kind of devices have onboard DC-DC converters that convert input voltage to the usual voltages expected by the hardware as stuff still runs at 3.3, 5 and 12 volts in that box.

The power brick itself remains the biggest issue tho, as it is the AC-DC converter. DC-DC converters are simple and easy, see "picoPSU" on google.

There is a reason why even the crappiest ARM-powered HP thin client has a Delta power brick (Delta = even their low end is on par with the best of most brands)

Wait, so you want to replace a large volume first party Intel machine with a third party AMD machine using a 5 year old architecture that inherently has the exact same power brick "issues" you complained about with the Intel NUC earlier?

Delta power bricks.
Also in case you missed it, most industrial and embedded hardware is third party and it's not an issue.
Consumer hardware is designed to certain standards (and to fit within certain price points), embedded and industrial to others (i.e. they have less performance, sometimes WAY less, cost A LOT, but are rated for and designed to not fail so easily).
Old architecture is irrelevant for the application. It's not going to use advanced instructions anyway.

From what I can tell PC Engines do not officially ship to EU either which immediately disqualifies them for worldwide use.

There is a link called "shop" on that site and it lands you (unsurprisingly) here:

http://www.pcengines.ch/order.php

note how most of that is b2b and not b2c.
When you're done playing blind please call me.

[droidhacker]

Bad idea. Avoid.

Does not use TCP => *really* silly idea

How do you figure that? Do you realize that use of TCP would be REALLY REALLY REALLY silly? Let me explain: the "special" characteristics of TCP are those related to *reliability*. This comes at a great expense in terms of PERFORMANCE. To simplify, TCP sends a packet, and waits for an acknowledgment from the other side that says that the packet has been received properly. So it is a back and forth protocol that adds latency and significant overhead.

Now when you're playing with a tunnel running over a UDP connection, the TCP protocol goes through the tunnel! That means that you do NOT lose the reliability that comes with TCP just because you are running everything through UDP. But what happens if you use TCP instead? It means that you are DOUBLING UP the TCP, and that is just CRAZY.

Does not use port 443 => will never work in 50%+ of places you need VPN

Says who? You can put it on whatever port you want.

Is not userspace and is new => so will 100% for sure have exploitable holes, running with root permissions...

Uhm... you're crazy.

Has no Forward-Secrecy => written by someone who doesn't seem to grasp cryptography or modern threats properly => not safe to use
Does not use multifactor => poor forward planning

I can't respond to this at this time.

Has no clients for ios/android/osx/windows, not that you would ever want (or be able to) use this in the 1st place.

Android *IS* Linux, so yes, there is definitely an Android client.

[Djhg2000]

I'm not saying NUCs will fail within 4 years, I'm saying that it's not designed for that so it may or may not and if it does Intel does not give a shit about that in the slightest.

I'm not saying (some, random) consumer stuff isn't resilient, I've had boards survive multiple PSU meltdowns, PSU suffer multiple thunderstorms unscathed, and ancient PCs that still work after decades of service.

That's not the point. The point here is removing all possible points of failure, because a failure would be VERY expensive, MUCH more expensive than gold-plating all the devices we use, so there is no reason to save a few bucks on that.

Not all Intel NUCs are consumer grade and they all come with a 3 year warranty. There's a few of them directly marketed towards businesses with vPro and all that stuff.

They day I'm trusting a laptop-grade fan anything crucial has yet to come.
I've changed too much of them.

That's fine by me but it's still an opinion. In my experience laptop fans will survive for longer than the rest of the machine if only you keep the speed down. Intel even claims you can remove the fan and keep the warranty, though they also say if it gets damaged because of overheating following the procedure they may place restrictions on future warranty claims.

Ehm, laptops and that kind of devices have onboard DC-DC converters that convert input voltage to the usual voltages expected by the hardware as stuff still runs at 3.3, 5 and 12 volts in that box.

The power brick itself remains the biggest issue tho, as it is the AC-DC converter. DC-DC converters are simple and easy, see "picoPSU" on google.

There is a reason why even the crappiest ARM-powered HP thin client has a Delta power brick (Delta = even their low end is on par with the best of most brands)

I'm well aware of the need for internal regulators and have previously even considered buying a couple of picoPSUs myself, I'm doing a lot of hobby electronics so I've probably mangled pretty much every common voltage to another by now and if it wasn't for NUC class machines I would've bought a many of them by now.

Delta makes quality stuff and I'm not going to argue that, but what exactly keeps you from using a Delta power brick with an Intel NUC? The FSP made brick supplied with the NUC seems beefy enough to outlive the machine, but on machines so critical you can't afford any downtime whatsoever you should have failover circuits with redundant power supplies anyway.

This whole discussion started from x86 machines replacing routers (from context I assume off the shelf home routers), how many routers have you seen shipped with Delta power bricks if I may ask?

Delta power bricks.
Also in case you missed it, most industrial and embedded hardware is third party and it's not an issue.
Consumer hardware is designed to certain standards (and to fit within certain price points), embedded and industrial to others (i.e. they have less performance, sometimes WAY less, cost A LOT, but are rated for and designed to not fail so easily).
Old architecture is irrelevant for the application. It's not going to use advanced instructions anyway.

Right, but then the first party is Intel somebody probably put some effort into making it reliable. Again, not all NUCs are intended for the consumer market in the first place.

There is a link called "shop" on that site and it lands you (unsurprisingly) here:

http://www.pcengines.ch/order.php

note how most of that is b2b and not b2c.
When you're done playing blind please call me.

It's right there on the page you linked: "Because of unbelievable bureaucratic recycling regulations, PC Engines will NOT sell directly to end users within the EU."

I somehow missed the authorized distributors list, but PC Engines still won't ship to EU consumers and I'd imagine warranty claims could take a while as a result.

[Mathias]

Not that I checked the code, but:

Is not userspace and is new => so will 100% for sure have exploitable holes, running with root permissions...

VS

It makes conservative and reasonable choices and has been reviewed by cryptographers.

WireGuard has been designed with ease-of-implementation and simplicity in mind. It is meant to be easily implemented in very few lines of code, and easily auditable for security vulnerabilities. Compared to behemoths like *Swan/IPsec or OpenVPN/OpenSSL, in which auditing the gigantic codebases is an overwhelming task even for large teams of security experts, WireGuard is meant to be comprehensively reviewable by single individuals.

Sure, being new, it probably has some bugs, but I see the benefit of having a small auditable codebase.


And:

Has no Forward-Secrecy => written by someone who doesn't seem to grasp cryptography or modern threats properly => not safe to use

VS

Behind the scenes there is much happening to provide proper privacy, authenticity, and perfect forward secrecy, using state-of-the-art cryptography.

[starshipeleven]

Not all Intel NUCs are consumer grade and they all come with a 3 year warranty. There's a few of them directly marketed towards businesses with vPro and all that stuff.

Still thinking like a consumer. Warranty is irrelevant as it covers the cost of the device (maybe), and with a huge downtime (weeks/months to RMA the unit around) and whatever they do that's peanuts compared to the damage caused by its failure when in production.
If the device running the VPN that connects 2-3 different branches of a company in different physical places, or the device that coordinates the VOIP telephone system dies I'm not giving a fuck about the 300$ device itself as the company will lose orders of magnitude more in wages going to people that cannot do their job as the infrastructure is down.

To make another example, a small company (a bunch of photographers) came weeping to the place I work in asking if we could recover the data off the 8-drive raid5 of a consumer NAS that died and store it somewhere. They could have sent the faulty NAS back to have it fixed under warranty (and they did), but that thing was their main data repository and without it they could not work.
They ended purchasing a support service contract from us (not much choice anyway), so we sent over a guy (me) with a PC that could run these 8 drives as a NAS for the time their crappy device returned from the RMA (2 months or so).

NUCs are targeted mostly at low-end workstation jobs, not embedded usage. Just look at the ports. For embedded usage there have always been loads upon loads upon loads of boxes with embedded-oriented Intel and AMD chips lines.

That's fine by me but it's still an opinion.

No it is not. Consumer hardware quality control is aimed at keeping costs down enough to be affordable for consumers (selling NUCs at 3x their current price isn't going to be good for sales), which is why there are warranties at all, because it's cheaper to just replace the small x% that breaks instead of making sure that stuff coming out of the fab will not break at all.

But in a company, for devices doing critical jobs like networking, you cannot just rely on that, you want stuff that will not break period.

For the sake of saying that some fans indeed die in NUCs:

https://communities.intel.com/thread/46963

(multiple users here)

http://forums.overclockers.com.au/showthread.php?t=1159390

wrong bios settings for fan cause lockups (overheat?)

http://techreport.com/news/24286/intel-tackles-nuc-heat-issues-with-fan-speed-tweak-ssd-fix

The FSP made brick supplied with the NUC seems beefy enough to outlive the machine,

Some will, some won't, they made their calculations. Consumer device as said above. To keep costs down enough they decrease quality control and accept that some will fail, and provide a warranty to compensate for that.

but on machines so critical you can't afford any downtime whatsoever you should have failover circuits with redundant power supplies anyway.

Yes, but when it costs more to send the guy to replace a failed redundant cheaper unit than placing a high-reliability one (redundant or not) in the first place, there is no reason to go cheapo.

This whole discussion started from x86 machines replacing routers (from context I assume off the shelf home routers), how many routers have you seen shipped with Delta power bricks if I may ask?

Delta sells power bricks to everyone that wants to buy them.

I somehow missed the authorized distributors list, but PC Engines still won't ship to EU consumers and I'd imagine warranty claims could take a while as a result.

FYI: by EU warranty law (and many EU country internal laws too), the seller must give 2 years of warranty on any device he sells.

[starshipeleven]

stupid unapproved.

Not all Intel NUCs are consumer grade and they all come with a 3 year warranty. There's a few of them directly marketed towards businesses with vPro and all that stuff.

Still thinking like a consumer. Warranty is irrelevant as it covers the cost of the device (maybe), and with a huge downtime (weeks/months to RMA the unit around) and whatever they do that's peanuts compared to the damage caused by its failure when in production.
If the device running the VPN that connects 2-3 different branches of a company in different physical places, or the device that coordinates the VOIP telephone system dies I'm not giving a fuck about the 300$ device itself as the company will lose orders of magnitude more in wages going to people that cannot do their job as the infrastructure is down.

To make another example, a small company (a bunch of photographers) came weeping to the place I work in asking if we could recover the data off the 8-drive raid5 of a consumer NAS that died and store it somewhere. They could have sent the faulty NAS back to have it fixed under warranty (and they did), but that thing was their main data repository and without it they could not work.
They ended purchasing a support service contract from us (not much choice anyway), so we sent over a guy (me) with a PC that could run these 8 drives as a NAS for the time their crappy device returned from the RMA (2 months or so).

NUCs are targeted mostly at low-end workstation jobs, not embedded usage. Just look at the ports. For embedded usage there have always been loads upon loads upon loads of boxes with embedded-oriented Intel and AMD chips lines.

That's fine by me but it's still an opinion.

No it is not. Consumer hardware quality control is aimed at keeping costs down enough to be affordable for consumers (selling NUCs at 3x their current price isn't going to be good for sales), which is why there are warranties at all, because it's cheaper to just replace the small x% that breaks instead of making sure that stuff coming out of the fab will not break at all.

But in a company, for devices doing critical jobs like networking, you cannot just rely on that, you want stuff that will not break period.

For the sake of saying that some fans indeed die in NUCs:

https://communities.intel.com/thread/46963

(multiple users here)
http://forums.overclockers.com.au/sh....php?t=1159390

wrong bios settings for fan cause lockups (overheat?)
http://techreport.com/news/24286/int...-tweak-ssd-fix

The FSP made brick supplied with the NUC seems beefy enough to outlive the machine,

Some will, some won't, they made their calculations. Consumer device as said above. To keep costs down enough they decrease quality control and accept that some will fail, and provide a warranty to compensate for that.

but on machines so critical you can't afford any downtime whatsoever you should have failover circuits with redundant power supplies anyway.

Yes, but when it costs more to send the guy to replace a failed redundant cheaper unit than placing a high-reliability one (redundant or not) in the first place, there is no reason to go cheapo.

This whole discussion started from x86 machines replacing routers (from context I assume off the shelf home routers), how many routers have you seen shipped with Delta power bricks if I may ask?

Delta sells power bricks to everyone that wants to buy them.

I somehow missed the authorized distributors list, but PC Engines still won't ship to EU consumers and I'd imagine warranty claims could take a while as a result.

FYI: by EU warranty law, the seller must give 2 years of warranty on any device he sells.

EDIT: please note that I'm not a PC Engines fanboy, I brought them up only because they are one of the brands of relatively serious stuff I used in relatively small-to-medium-sized companies that isn't true industrial/military-rated gold-plated 100k-or-more-bulk-purchase embedded stuff that is used by those working on much larger scales than my own.

[computerquip]

Bad idea. Avoid.

Does not use TCP => *really* silly idea
Does not use port 443 => will never work in 50%+ of places you need VPN
Is not userspace and is new => so will 100% for sure have exploitable holes, running with root permissions...
Has no Forward-Secrecy => written by someone who doesn't seem to grasp cryptography or modern threats properly => not safe to use
Does not use multifactor => poor forward planning

Has no clients for ios/android/osx/windows, not that you would ever want (or be able to) use this in the 1st place.

1. The fact he doesn't use TCP is probably a good thing for performance reasons.
2. I have no clue what you're talking about port 443. It can probably be configured regardless.
3. "Has no Forward-Secrecy" - Can you indicate how you came to that conclusion? He mentions forward secrecy several times in his whitepaper.
4. I'm not entirely sure what you mean by multifactor.
5. "Has no clients for ios/android/osx/windows, not that you would ever want (or be able to) use this in the 1st place." - He addresses this in that he needs to create a userspace alternative and is a priority.

Not that I'm for or against the software but your reasoning for it being a "bad idea" isn't great.

[Djhg2000]

stupid unapproved.

I'm having that issue as well. For the record I'm saving this comment in a temporary file until I know whether the comment is approved or not.

Still thinking like a consumer. Warranty is irrelevant as it covers the cost of the device (maybe), and with a huge downtime (weeks/months to RMA the unit around) and whatever they do that's peanuts compared to the damage caused by its failure when in production.
If the device running the VPN that connects 2-3 different branches of a company in different physical places, or the device that coordinates the VOIP telephone system dies I'm not giving a fuck about the 300$ device itself as the company will lose orders of magnitude more in wages going to people that cannot do their job as the infrastructure is down.

To make another example, a small company (a bunch of photographers) came weeping to the place I work in asking if we could recover the data off the 8-drive raid5 of a consumer NAS that died and store it somewhere. They could have sent the faulty NAS back to have it fixed under warranty (and they did), but that thing was their main data repository and without it they could not work.
They ended purchasing a support service contract from us (not much choice anyway), so we sent over a guy (me) with a PC that could run these 8 drives as a NAS for the time their crappy device returned from the RMA (2 months or so).

NUCs are targeted mostly at low-end workstation jobs, not embedded usage. Just look at the ports. For embedded usage there have always been loads upon loads upon loads of boxes with embedded-oriented Intel and AMD chips lines.

Those were two points lumped together; Intel says their product is good for at least 3 years of use and they have a business lineup.

Good thing you sorted out their NAS but I don't see how that's relevant? HDDs have a limited lifespan and consumer drives won't last as long as business drives, but that's hardly news is it? Or was it the NAS itself which died? Either way something as critical as a NAS isn't something I would expect large corporations cheaping out on without consequences.

No it is not. Consumer hardware quality control is aimed at keeping costs down enough to be affordable for consumers (selling NUCs at 3x their current price isn't going to be good for sales), which is why there are warranties at all, because it's cheaper to just replace the small x% that breaks instead of making sure that stuff coming out of the fab will not break at all.

But in a company, for devices doing critical jobs like networking, you cannot just rely on that, you want stuff that will not break period.

For the sake of saying that some fans indeed die in NUCs:

https://communities.intel.com/thread/46963

(multiple users here)
http://forums.overclockers.com.au/sh....php?t=1159390

wrong bios settings for fan cause lockups (overheat?)
http://techreport.com/news/24286/int...-tweak-ssd-fix

Finding instances where the fan died on a NUC doesn't get us anywhere, these machines can run fanless according to Intel so a failed fan does not equal a failed board. The links you posted were relevant to the earlier generations of NUCs and the BIOS issue was affecting a subset of the consumer lineup.

Some will, some won't, they made their calculations. Consumer device as said above. To keep costs down enough they decrease quality control and accept that some will fail, and provide a warranty to compensate for that.

To my knowledge FSP makes more than just consumer grade power bricks.

Yes, but when it costs more to send the guy to replace a failed redundant cheaper unit than placing a high-reliability one (redundant or not) in the first place, there is no reason to go cheapo.

I'm confused by this statement. "A" failed redundant? If you only have one then it's not redundant. Furthermore if I assume you mean an internally redundant cheap PSU then that one will keep working with a failure indication where the expensive non-redundant will just die.

Delta sells power bricks to everyone that wants to buy them.

I would assume they do but you're dodging the question. How many off the self home routers have you seen shipped with Delta power bricks?

FYI: by EU warranty law, the seller must give 2 years of warranty on any device he sells.

EDIT: please note that I'm not a PC Engines fanboy, I brought them up only because they are one of the brands of relatively serious stuff I used in relatively small-to-medium-sized companies that isn't true industrial/military-rated gold-plated 100k-or-more-bulk-purchase embedded stuff that is used by those working on much larger scales than my own.

Actually, now that I think about it, why are we discussing business grade hardware when the original post was about home routers? Wouldn't it make sense to discuss small PC boards in the context of replacing a home router instead?

[starshipeleven]

Those were two points lumped together; Intel says their product is good for at least 3 years of use and they have a business lineup.

Wrong. Intel says they will fix the stuff you bought if it breaks within 3 years. Completely different thing, not necessarily means the devices are more reliable as Intel might be playing marketing games to sell more NUCs I'm not interested in following.

Good thing you sorted out their NAS but I don't see how that's relevant?

The nas itself died, the disks were fine.
It was an example of how warranties are useless for companies, as the photographers could not use the device for 2 months while it was getting RMA'd.

Either way something as critical as a NAS isn't something I would expect large corporations cheaping out on without consequences.

Large corporations have servers and internal staff, not commercial NAS devices and third-party techsupport contracts.
I said the customers in that example were a bunch of photographers, not the local Weitland-Yutani branch.
There is some pretty large amount of small and midsize companies here, the most smart choice they can do in their life is hiring third-party techsupport companies like the one I work in, to deal with these things as they are totally clueless (and defenseless) on technology matters.

Finding instances where the fan died on a NUC doesn't get us anywhere, these machines can run fanless according to Intel so a failed fan does not equal a failed board. The links you posted were relevant to the earlier generations of NUCs and the BIOS issue was affecting a subset of the consumer lineup.

No, it sets a precedent. What if newer units suffer the same fate due to error or cost-cutting?
Can you predict that? Can you predict with 100% certainity that NO NUC in a specific 100-unit lot I buy will fail in the next 10-15 years of 24/7 service?
If I buy fanless units I'm 100% certain that the fan will not fail.

And no, if they have a fan but can work also without it means that under load without fan they will throttle and that's not appreciated.

To my knowledge FSP makes more than just consumer grade power bricks.

Irrelevant.

I'm confused by this statement. "A" failed redundant? If you only have one then it's not redundant. Furthermore if I assume you mean an internally redundant cheap PSU then that one will keep working with a failure indication where the expensive non-redundant will just die.

Uhm, I mean that if I place a redundant PSU and one of the two psu fails (I used "unit" to say PSU, not clear I know, but PSU is Power Supply Unit so it could be within reach), we must send someone to go and change the failed PSU, or from that time on the device is no more under redundant PSUs.

I would assume they do but you're dodging the question. How many off the self home routers have you seen shipped with Delta power bricks?

None, but we don't use off-the-shelf home routers (for critical applications) either, so what's your point again?
Although I've not seen a great deal of dead routers without an obvious cause (thunderstorm usually), while I've seen tons upon tons of failed PCs for random reasons, that's why I used them as an example of more reliable device.

Actually, now that I think about it, why are we discussing business grade hardware when the original post was about home routers? Wouldn't it make sense to discuss small PC boards in the context of replacing a home router instead?

1. becausethe thread is about a feature that is more useful for businness than it is for home use as home users can slap a random x86 machine and will be fine with the current more CPU-heavy applications, while businnesses need to take stuff that isn't as likely to break, and you cannot always buy gold-plated Cisco hardware to do Voip of 20 phones or something.

2. because some dumbass started claiming that their consumer-grade shit was more reliable than single-board embedded solutions, which is flat-out wrong.