frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

GotaTun -- Mullvad's WireGuard Implementation in Rust

https://mullvad.net/en/blog/announcing-gotatun-the-future-of-wireguard-at-mullvad-vpn
145•km•2h ago

Comments

nevi-me•1h ago
If anyone working on the implementation is here, was it not possible to upstream your changes to BoringTun? The blog mentions some changes but doesn't go into detail on that aspect.
embedding-shape•1h ago
I'm guessing because BoringTun has been in a state of "currently undergoing a restructuring" for something like 3 years by now, I'm guessing Mullvad wasn't too keen to maybe/maybe not be able to contribute, and much more prefer being in 100% control of their own implementation.

As someone who wants to see Wireguard succeed and in even wider use, this move makes sense from that perspective too. The more implementations we have available, the more we can trust that the protocol is secure and stable enough. Personally I also have about 100x more trust in Mullvad than Cloudflare both in terms of security but more importantly privacy, but that's just the cherry on top.

ur-whale•1h ago
One meta thing I've always wondered ... Are multiple implementations of the same protocol good or bad for security?

Probably naively, I'm thinking:

    - diversity: good
    - doubling the attack surface: real bad
What do the security folks out there think of the topic?
stevefan1999•1h ago
That's really good because it means it will be able to have more exposure, more exposure means more improvement, more improvement eventually dig out bad bugs and reduces the attack surface in the long run
embedding-shape•1h ago
I think the general consensus is that it improves security of the protocol, but obviously that won't matter much if the implementation gets something wrong or has worse security by itself.

Issues in the protocol itself would need all implementations to change, but issues in the implementation would obviously be isolated to one implementation. For something like Wireguard, I'd wager a guess that issues in the implementations are more common than issues in the protocol, at least at this stage.

mwalser•1h ago
I wouldn't say that multiple implementations are duplicating the attack surface since most users will not end up running them in parallel.
ur-whale•1h ago
I meant at a global level (think as if you're attacking all wireguard users, not a single one)
swiftcoder•42m ago
The increased attack surface mostly only affects that one particular implementation though. So, yes, twice as many implementations that may contain exploitable bugs, but each new implementation could only be used to exploit a fraction of the total user base
rlpb•38m ago
> could only be used to exploit a fraction

If anything this is a even a good thing, since it means that each individual vulnerability an attacker finds is less valuable to them.

turblety•1h ago
Nice, I love WireGuard. I ended up building WrapGuard [1] to run applications without root access to the host and choose Go to write it in. I don't really know Rust, but does it make more sense for firmware/networking type software? Is there even a difference?

1. https://github.com/puzed/wrapguard

skylurk•1h ago
Pick the devil you know, as they say.
unrealhoang•1h ago
from TFA, the main advantage would be for embedded (as a library) use case, FFI with Go is harder.
maxmcd•39m ago
I believe you are making use of gVisor’s userspace TCP implementation. I’m not sure if there is something similar in Rust that would be so easy to set up like this.
chjj•8m ago
Very cool project. Is it always an LD_PRELOAD or can it function as a standalone SOCKS proxy similar to wireproxy?
imcritic•1h ago
I wish they would improve wireguard-the-protocol as well: wireguard doesn't stand a chance against gov/isp blocks.
razighter777•1h ago
That's more of a job for an encapsulating protocol. (shadowsocks or similar) Wireguard isn't designed to be obfuscating alone. It's just a simple l3 udp tunnel with a minimal attack surface.
Hendrikto•26m ago
> It's just a simple l3 udp tunnel

Wait, isn’t UDP L4? Am I missing something?

eurg•8m ago
Yes, but it tunnels arbitrary IP packets encapsulated in UDP.
gwehrli•5m ago
Wireguard is a L3 VPN that uses UDP (L4) for tunneling. Thats probably what was meant.
tvshtr•1h ago
There are forks of wg because of this. Like amnezia-wg
DANmode•7m ago
This is a neat project!

https://docs.amnezia.org/documentation/amnezia-wg/

tetris11•1h ago
Anywhere I can read more about this?
DANmode•27m ago
Known Limitations

WireGuard is a protocol that, like all protocols, makes necessary trade-offs. This page summarizes known limitations due to these trade-offs.

Deep Packet Inspection

WireGuard does not focus on obfuscation. Obfuscation, rather, should happen at a layer above WireGuard, with WireGuard focused on providing solid crypto with a simple implementation. It is quite possible to plug in various forms of obfuscation, however.

tl;dr Read the docs.

Hakkin•1h ago
I definitely noticed the performance boost on my Pixel 8, for some reason it seems to really not like wireguard-go, it struggled to pull even 100mbps, maybe something unoptimized on Google's custom hardware. With the new GotaTun version I can pull 500mbps+, though unfortunately it also seems to have introduced a bug that randomly prevents the phone from entering a deep sleep state, so occasionally my battery will randomly start draining at 10x normal speed if I have it enabled until I reboot.
Hasnep•23m ago
Oh, this is the reason the Mullvad app on my Pixel 6a was suddenly able to connect in less than a second where before it would take 5-10 seconds, nice!
vjerancrnjak•7m ago
Same behavior on raspberry pi 5. Might be just lack of arm optimizations.
intsunny•57m ago
Its funny, this is another of the billions of reasons why Mullvad should be the VPN of choice. But so many fucking people can't ever get over that their favorite social media influencer/Youtuber is offering a code for 200% off of NordShark VPN, now with extra AI.
tumdum_•32m ago
You do know that NordSec maintains its own rust fork of BoringTun: https://github.com/NordSecurity/NepTUN ? :)
eatbitseveryday•30m ago
It became less of a choice for many after they sadly had to disable port forwarding.
jorvi•11m ago
Yeah, their reasoning is solid (easy to abuse) but it is still a very useful feature.

AFAIK, at the moment your choices are AirVPN and ProtonVPN. AirVPN has static port forwarding and Proton has UPNP port forwarding.

alias_neo•37m ago
Is there any way to switch to this implementation for generic WireGuard users?

I tried downloading their Android app, but it's not generally usable for people who host our own WireGuard, which is fair enough.

wasmitnetzen•24m ago
The github repo is linked in the post which has build instructions: https://github.com/mullvad/gotatun

Ask HN: Has putting yourself in the "right rooms" improved your life?

1•shannonalp•33s ago•0 comments

We built a universal installer for agent skills based on the new open standard

https://github.com/skillcreatorai/Ai-Agent-Skills
1•skillcreator•59s ago•1 comments

An unreasonable book (1976) [pdf]

http://jmc.stanford.edu/artificial-intelligence/reviews/weizenbaum.pdf
1•andsoitis•1m ago•0 comments

Ask HN: Was Google Search just down for a short period for anyone else?

1•exploraz•2m ago•0 comments

Registry You Can Actually Query

https://writethat.blog/reg.html
1•psarna•3m ago•0 comments

Efficient Attention Mechanisms for Large Language Models: A Survey

https://arxiv.org/abs/2507.19595
1•belter•4m ago•0 comments

An integrated view of the structure and function of the human 4D nucleome

https://www.nature.com/articles/s41586-025-09890-3
1•bookofjoe•5m ago•0 comments

YouTube Is Degraded

https://downdetector.co.uk/status/youtube/
5•alphawong•6m ago•0 comments

Timing 'Hello World'

https://antonz.org/timing-hello-world/
1•blenderob•6m ago•0 comments

YouTube Outage [video]

https://www.youtube.com/watch?v=3MG_Dm4kefc
3•vettyvignesh•7m ago•2 comments

It's the Great AGI Rebrand

https://www.theverge.com/ai-artificial-intelligence/845890/ai-companies-rebrand-agi-artificial-ge...
1•sandbach•7m ago•0 comments

Computer Power and Human Reason (1976) [pdf]

http://blogs.evergreen.edu/cpat/files/2013/05/Computer-Power-and-Human-Reason.pdf
1•andsoitis•8m ago•0 comments

JWT Playground for Developers

https://www.devglan.com/online-tools/jwt-decoder-validator
1•only2dhir•9m ago•0 comments

AI Can Write Your Code. It Can't Do Your Job

https://terriblesoftware.org/2025/12/11/ai-can-write-your-code-it-cant-do-your-job/
1•antfarm•9m ago•0 comments

Football Pools

https://en.wikipedia.org/wiki/Football_pools
2•zeristor•11m ago•0 comments

NASA's Webb Observes Exoplanet Whose Composition Defies Explanation

https://science.nasa.gov/missions/webb/nasas-webb-observes-exoplanet-whose-composition-defies-exp...
2•taubek•11m ago•0 comments

Pa Supreme Ct allows non-warranted access to your Google searches

https://reason.com/volokh/2025/12/16/are-there-fourth-amendment-rights-in-google-search-terms/
2•mwexler•13m ago•0 comments

Show HN: Liquid Glass dev and design resources for platforms beyond iOS&macOS

https://www.liquidglassresources.com/
1•andraskindler•13m ago•0 comments

Ask HN: Incorporate in Which Country?

2•finnvyrn•14m ago•1 comments

Carving Nature at Your Joints

https://planktonvalhalla.com/20251219-carving-nature-at-your-joints/
1•mrcgnc•17m ago•0 comments

Chasing Your Tail

https://xania.org/202512/19-tail-call-optimisation
1•hasheddan•18m ago•0 comments

The AI Agents Roadmap Nobody Is Teaching You

https://www.decodingai.com/p/ai-agents-foundations-course
2•pauliusztin•20m ago•1 comments

Sleep Cots and Graham Crackers at Elon Musk's Child Care Program

https://www.nytimes.com/2025/12/18/technology/elon-musk-daycare-school.html
1•reaperducer•21m ago•0 comments

We Put an AI Vending Machine in Our Office. It Gave Away Everything [video]

https://www.youtube.com/watch?v=SpPhm7S9vsQ
1•lordleft•22m ago•0 comments

Show HN: We built a small app with my wife to track promises we do

https://lovechecks.app/
1•warkanlock•22m ago•0 comments

Engineers who dismiss AI

https://terriblesoftware.org/2025/12/19/the-strange-case-of-engineers-who-dismiss-ai/
38•matheusml•25m ago•41 comments

Build a Coding Agent from Scratch

https://thefocus.ai/reports/coding-agent/
1•combray•25m ago•0 comments

Don't stuff beans up your nose

https://en.wikipedia.org/wiki/Wikipedia:Don%27t_stuff_beans_up_your_nose
2•cyanf•26m ago•0 comments

Making a game on a custom bytecode VM in 7 days and 3kB

https://laurent.le-brun.eu/blog/making-a-game-on-a-custom-bytecode-vm-in-7-days-and-3kb
1•laurentlb•27m ago•0 comments

Show HN: Consulting-as-Code – A deterministic, neuro-symbolic agent architecture

https://vuduvations.github.io/Consulting-as-Code/
1•vuduvations•28m ago•1 comments