Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #229435 > unrolled thread

VPN ideas

Back to article view | Back to linux.debian.user

Contents

  VPN ideas ellanios82 <ellanios82@gmail.com> - 2020-12-07 22:30 +0100
    Re: VPN ideas Roberto C. Sánchez <roberto@debian.org> - 2020-12-07 22:40 +0100
      Re: VPN ideas ellanios82 <ellanios82@gmail.com> - 2020-12-07 23:40 +0100
      Re: VPN ideas Mark Fletcher <mark27q1@gmail.com> - 2020-12-08 00:50 +0100
    Re: VPN ideas Georgi Naplatanov <gosho@oles.biz> - 2020-12-07 22:50 +0100
    Re: VPN ideas Charles Curley <charlescurley@charlescurley.com> - 2020-12-08 02:00 +0100
      Re: VPN ideas john doe <johndoe65534@mail.com> - 2020-12-08 08:20 +0100
        Re: VPN ideas <tomas@tuxteam.de> - 2020-12-08 09:50 +0100
          Re: VPN ideas Alex Mestiashvili <amestia@rsh2.donotuse.de> - 2020-12-08 10:00 +0100
          Re: VPN ideas Celejar <celejar@gmail.com> - 2020-12-08 14:00 +0100
    Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-08 10:50 +0100
      Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-08 11:20 +0100
      Re: VPN ideas Joe <joe@jretrading.com> - 2020-12-08 13:30 +0100
        Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 11:00 +0100
          Re: VPN ideas Joe <joe@jretrading.com> - 2020-12-09 11:30 +0100
            Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 12:00 +0100
              Re: VPN ideas Joe <joe@jretrading.com> - 2020-12-09 12:10 +0100
                Re: VPN ideas Stefan Monnier <monnier@iro.umontreal.ca> - 2020-12-09 15:30 +0100
                Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 16:10 +0100
                  Re: VPN ideas Celejar <celejar@gmail.com> - 2020-12-09 18:10 +0100
                Re: VPN ideas Henning Follmann <hfollmann@itcfollmann.com> - 2020-12-09 16:10 +0100
                  Re: VPN ideas Joe <joe@jretrading.com> - 2020-12-09 20:10 +0100
                    Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 09:10 +0100
      Re: VPN ideas Celejar <celejar@gmail.com> - 2020-12-08 20:50 +0100
        Re: VPN ideas Roberto C. Sánchez <roberto@debian.org> - 2020-12-08 23:10 +0100
          Re: VPN ideas Celejar <celejar@gmail.com> - 2020-12-08 23:40 +0100
            Re: VPN ideas Long Wind <longwind2@yahoo.com> - 2020-12-09 03:10 +0100
            Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-09 11:10 +0100
              Re: VPN ideas Celejar <celejar@gmail.com> - 2020-12-09 18:00 +0100
                Re: VPN ideas Andrei POPESCU <andreimpopescu@gmail.com> - 2020-12-10 09:50 +0100
                  Re: VPN ideas Celejar <celejar@gmail.com> - 2020-12-10 18:50 +0100
          Re: VPN ideas <tomas@tuxteam.de> - 2020-12-09 09:50 +0100
            Re: VPN ideas Henning Follmann <hfollmann@itcfollmann.com> - 2020-12-09 15:30 +0100
            Loadbearing services Henning Follmann <hfollmann@itcfollmann.com> - 2020-12-09 16:00 +0100
              Re: Loadbearing services Stefan Monnier <monnier@iro.umontreal.ca> - 2020-12-09 16:40 +0100
                Re: Loadbearing services Henning Follmann <hfollmann@itcfollmann.com> - 2020-12-09 17:40 +0100

Page 2 of 2 — ← Prev page 1 [2]

#229555

On Wed, Dec 09, 2020 at 11:00:41AM +0000, Joe wrote:
> On Wed, 9 Dec 2020 12:49:44 +0200
> Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> 
> > On Mi, 09 dec 20, 10:21:46, Joe wrote:
> > > On Wed, 9 Dec 2020 11:49:45 +0200
> > > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > >   
> > > > On Ma, 08 dec 20, 12:27:40, Joe wrote:  
> > > > > 

[...]

> > 
> > Let me rephrase that: how is connecting to the internet from some
> > public hot-spot decreasing my security?
> > 
> > I can think of possibly messing with DNS queries (use "own" DNS
> > server instead, maybe with DNSSEC) and possible some attacks are
> > easier via the local network (e.g. by other hot-spot users or local
> > staff).
> > 
> > Other that that, as far as I'm aware, the biggest threat are the
> > servers I access with my client software (typically web sites
> > accessed with a browser), in which case it doesn't make any
> > difference whether I access them via some VPN and/or (home) firewall.
> > 
> > (Assuming one doesn't run NFS, Samba, etc. *listening* software on
> > the laptop in which case stopping those and/or running a firewall
> > would be indicated.)
> > 
> 
> I suppose it may depend on where you are. In the UK, public wifi
> normally uses no encryption, because there are no local staff who can
> help with problems. So any unencrypted protocol you use can be
> overheard.
> 

So let me be devils advocat here.

Is the network connection from your ISP encrypted?
I guess not. So why is it more secure or trustworthy?

-H




-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#229577

On Wed, 9 Dec 2020 10:03:59 -0500
Henning Follmann <hfollmann@itcfollmann.com> wrote:

> On Wed, Dec 09, 2020 at 11:00:41AM +0000, Joe wrote:
> > On Wed, 9 Dec 2020 12:49:44 +0200
> > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> >   
> > > On Mi, 09 dec 20, 10:21:46, Joe wrote:  
> > > > On Wed, 9 Dec 2020 11:49:45 +0200
> > > > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > > >     
> > > > > On Ma, 08 dec 20, 12:27:40, Joe wrote:    
> > > > > >   
> 
> [...]
> 
> > > 
> > > Let me rephrase that: how is connecting to the internet from some
> > > public hot-spot decreasing my security?
> > > 
> > > I can think of possibly messing with DNS queries (use "own" DNS
> > > server instead, maybe with DNSSEC) and possible some attacks are
> > > easier via the local network (e.g. by other hot-spot users or
> > > local staff).
> > > 
> > > Other that that, as far as I'm aware, the biggest threat are the
> > > servers I access with my client software (typically web sites
> > > accessed with a browser), in which case it doesn't make any
> > > difference whether I access them via some VPN and/or (home)
> > > firewall.
> > > 
> > > (Assuming one doesn't run NFS, Samba, etc. *listening* software on
> > > the laptop in which case stopping those and/or running a firewall
> > > would be indicated.)
> > >   
> > 
> > I suppose it may depend on where you are. In the UK, public wifi
> > normally uses no encryption, because there are no local staff who
> > can help with problems. So any unencrypted protocol you use can be
> > overheard.
> >   
> 
> So let me be devils advocat here.
> 
> Is the network connection from your ISP encrypted?
> I guess not. So why is it more secure or trustworthy?
> 

It's not more secure, (apart from using wifi only occasionally) but the
kind of people looking at other peoples' network activities are more
likely to target public wifi than to sit outside my house. It will
require significantly more resources and risk to tap into an ISP cable
than to sit in a cafe somewhere with a laptop (running Linux) and some
black hat software.

-- 
Joe

[toc] | [prev] | [next] | [standalone]

#229601

[Multipart message — attachments visible in raw view] — view raw

On Mi, 09 dec 20, 19:06:27, Joe wrote:
> 
> It's not more secure, (apart from using wifi only occasionally) but the
> kind of people looking at other peoples' network activities are more
> likely to target public wifi than to sit outside my house. It will
> require significantly more resources and risk to tap into an ISP cable
> than to sit in a cafe somewhere with a laptop (running Linux) and some
> black hat software.

Apparently you are assuming that in order to compromise your internet 
connection (spy, subvert, etc.) one has to physically tap into the cable 
between the ISP and your premises.

As far as I understand (from my limited knowledge of networking and 
security) this would indeed make some (class of) attacks easier, but is 
*not* a strict requirement.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#229487

On Tue, 8 Dec 2020 11:44:36 +0200
Andrei POPESCU <andreimpopescu@gmail.com> wrote:

...

>    Unless you have access to a system on the internet to set up your own 
>    VPN server you have to rely on (paid) VPN providers.

There are free ones as well, e.g.:

https://www.techradar.com/vpn/best-free-vpn

I don't know how good they are - but then, again, I don't know how good
all the paid ones are, as well ;)

Celejar

[toc] | [prev] | [next] | [standalone]

#229495

On Tue, Dec 08, 2020 at 02:48:26PM -0500, Celejar wrote:
> On Tue, 8 Dec 2020 11:44:36 +0200
> Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> 
> ...
> 
> >    Unless you have access to a system on the internet to set up your own 
> >    VPN server you have to rely on (paid) VPN providers.
> 
> There are free ones as well, e.g.:
> 
> https://www.techradar.com/vpn/best-free-vpn
> 
> I don't know how good they are - but then, again, I don't know how good
> all the paid ones are, as well ;)
> 
If something is free, you aren't the customer, you are the product.

Regards,

-Roberto

-- 
Roberto C. Sánchez

[toc] | [prev] | [next] | [standalone]

#229498

On Tue, 8 Dec 2020 17:00:44 -0500
Roberto C. Sánchez <roberto@debian.org> wrote:

> On Tue, Dec 08, 2020 at 02:48:26PM -0500, Celejar wrote:
> > On Tue, 8 Dec 2020 11:44:36 +0200
> > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > 
> > ...
> > 
> > >    Unless you have access to a system on the internet to set up your own 
> > >    VPN server you have to rely on (paid) VPN providers.
> > 
> > There are free ones as well, e.g.:
> > 
> > https://www.techradar.com/vpn/best-free-vpn
> > 
> > I don't know how good they are - but then, again, I don't know how good
> > all the paid ones are, as well ;)
> > 
> If something is free, you aren't the customer, you are the product.

A fair point, but an overstatement insofar as you're implying that one
*cannot rely* upon a free VPN service. Many people are willing to rely
upon free services for at least some of their online activity. After
all, Andrei himself is using Gmail (as am I).

Celejar

[toc] | [prev] | [next] | [standalone]

#229510

[Multipart message — attachments visible in raw view] — view raw

 On Wednesday, December 9, 2020, 6:38:06 AM GMT+8, Celejar <celejar@gmail.com> wrote: 
A fair point, but an overstatement insofar as you're implying that one
*cannot rely* upon a free VPN service. Many people are willing to rely
upon free services for at least some of their online activity. After
all, Andrei himself is using Gmail (as am I).

Celejar

i use free vpn for android to bypass censorship, it works better than nordVPN 
  

[toc] | [prev] | [next] | [standalone]

#229534

[Multipart message — attachments visible in raw view] — view raw

On Ma, 08 dec 20, 17:37:43, Celejar wrote:
> On Tue, 8 Dec 2020 17:00:44 -0500
> Roberto C. Sánchez <roberto@debian.org> wrote:
> 
> > On Tue, Dec 08, 2020 at 02:48:26PM -0500, Celejar wrote:
> > > On Tue, 8 Dec 2020 11:44:36 +0200
> > > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > > 
> > > ...
> > > 
> > > >    Unless you have access to a system on the internet to set up your own 
> > > >    VPN server you have to rely on (paid) VPN providers.
> > > 
> > > There are free ones as well, e.g.:
> > > 
> > > https://www.techradar.com/vpn/best-free-vpn
> > > 
> > > I don't know how good they are - but then, again, I don't know how good
> > > all the paid ones are, as well ;)
> > > 
> > If something is free, you aren't the customer, you are the product.

I'd have a reasonable degree of trust in ProtonVPN.

> A fair point, but an overstatement insofar as you're implying that one
> *cannot rely* upon a free VPN service. Many people are willing to rely
> upon free services for at least some of their online activity. After
> all, Andrei himself is using Gmail (as am I).

I'm using Gmail to post to public mailing lists or similar. All private 
correspondence currently goes to a ProtonMail account.

I still have my contacts on Gmail, because of the convenient integration 
with Android, though I'd like to migrate those away as well at some 
point.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#229568

On Wed, 9 Dec 2020 12:03:33 +0200
Andrei POPESCU <andreimpopescu@gmail.com> wrote:

> On Ma, 08 dec 20, 17:37:43, Celejar wrote:
> > On Tue, 8 Dec 2020 17:00:44 -0500
> > Roberto C. Sánchez <roberto@debian.org> wrote:
> > 
> > > On Tue, Dec 08, 2020 at 02:48:26PM -0500, Celejar wrote:
> > > > On Tue, 8 Dec 2020 11:44:36 +0200
> > > > Andrei POPESCU <andreimpopescu@gmail.com> wrote:
> > > > 
> > > > ...
> > > > 
> > > > >    Unless you have access to a system on the internet to set up your own 
> > > > >    VPN server you have to rely on (paid) VPN providers.
> > > > 
> > > > There are free ones as well, e.g.:
> > > > 
> > > > https://www.techradar.com/vpn/best-free-vpn
> > > > 
> > > > I don't know how good they are - but then, again, I don't know how good
> > > > all the paid ones are, as well ;)
> > > > 
> > > If something is free, you aren't the customer, you are the product.
> 
> I'd have a reasonable degree of trust in ProtonVPN.
> 
> > A fair point, but an overstatement insofar as you're implying that one
> > *cannot rely* upon a free VPN service. Many people are willing to rely
> > upon free services for at least some of their online activity. After
> > all, Andrei himself is using Gmail (as am I).
> 
> I'm using Gmail to post to public mailing lists or similar. All private 
> correspondence currently goes to a ProtonMail account.

Of course. My point just was that most people are willing to put up
with "being the product" when they consider the cost of "being the
product" to be low ;)

As to ProtonMail, as we've discussed in the past, I'm sort of tempted,
but I'm not willing to give up standards based email, nor am I that
interested in running their proprietary (albeit apparently GPL?) bridge
application.

> I still have my contacts on Gmail, because of the convenient integration 
> with Android, though I'd like to migrate those away as well at some 
> point.

At this point, I pretty much use Gmail only for public list traffic
(although my other email accounts are also with (other) free services).
I keep thinging I really should go with either one of the inexpensive,
dedicated email providers (like Newsguy that John Hasler
often recommends) or a self-hosting solution (but I'm scared of the
apparently enormous hassle necessary to ensure reliable delivery, etc.).

Celejar

[toc] | [prev] | [next] | [standalone]

#229606

[Multipart message — attachments visible in raw view] — view raw

On Mi, 09 dec 20, 11:53:20, Celejar wrote:
> 
> As to ProtonMail, as we've discussed in the past, I'm sort of tempted,
> but I'm not willing to give up standards based email, nor am I that
> interested in running their proprietary (albeit apparently GPL?) bridge
> application.

Yes, lack of IMAP/SMTP support is definitely a hassle and the bridge 
would just ad complexity.

One thing that is difficult to replace though is their support for 
encrypted communication with *non*subscribers.

> > I still have my contacts on Gmail, because of the convenient integration 
> > with Android, though I'd like to migrate those away as well at some 
> > point.

And some of my calendar, will migrate that to ProtonMail as well, as 
soon as the (limited) free calendar is available (currently still in 
beta and only for paying customers).

For the avoidance of doubt, I'm not affiliated with ProtonMail in any 
way, I'm just quite happy with their free services and their stance on 
privacy and freedom (including free software).

> At this point, I pretty much use Gmail only for public list traffic
> (although my other email accounts are also with (other) free services).
> I keep thinging I really should go with either one of the inexpensive,
> dedicated email providers (like Newsguy that John Hasler
> often recommends) or a self-hosting solution (but I'm scared of the
> apparently enormous hassle necessary to ensure reliable delivery, etc.).

Similar thoughts here, though I'm rather interested in Kolab Now.

This is already off-topic for debian-user so I'll stop here.

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#229642

On Thu, 10 Dec 2020 10:47:13 +0200
Andrei POPESCU <andreimpopescu@gmail.com> wrote:

> On Mi, 09 dec 20, 11:53:20, Celejar wrote:
> > 
> > As to ProtonMail, as we've discussed in the past, I'm sort of tempted,
> > but I'm not willing to give up standards based email, nor am I that
> > interested in running their proprietary (albeit apparently GPL?) bridge
> > application.
> 
> Yes, lack of IMAP/SMTP support is definitely a hassle and the bridge 
> would just ad complexity.
> 
> One thing that is difficult to replace though is their support for 
> encrypted communication with *non*subscribers.

There's apparently Open-Xchange / OX Guard - no idea how well it works
or how easy it is to set up:

https://www.wired.com/2014/09/oxguard/
https://www.oxpedia.org/wiki/index.php?title=AppSuite:Open-Xchange_Installation_Guide_for_Debian_10.0

> This is already off-topic for debian-user so I'll stop here.

This part of the discussion at least is certainly relevant to Debian,
so I'm leaving it here.

Celejar

[toc] | [prev] | [next] | [standalone]

#229526

[Multipart message — attachments visible in raw view] — view raw

On Tue, Dec 08, 2020 at 05:00:44PM -0500, Roberto C. Sánchez wrote:

[...]

> If something is free, you aren't the customer, you are the product.

All generalizations suck.

Cheers
 - t

[toc] | [prev] | [next] | [standalone]

#229548

On Wed, Dec 09, 2020 at 09:46:07AM +0100, tomas@tuxteam.de wrote:
> On Tue, Dec 08, 2020 at 05:00:44PM -0500, Roberto C. Sánchez wrote:
> 
> [...]
> 
> > If something is free, you aren't the customer, you are the product.
> 
> All generalizations suck.
> 

chuckle,
that was a good one.

:)

-H


-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#229551 — Loadbearing services

On Wed, Dec 09, 2020 at 09:46:07AM +0100, tomas@tuxteam.de wrote:
> On Tue, Dec 08, 2020 at 05:00:44PM -0500, Roberto C. Sánchez wrote:
> 
> [...]
> 
> > If something is free, you aren't the customer, you are the product.
> 
> All generalizations suck.
> 

This reminds me of an article from ESR.
He pointed out that there are essential pieces we use everyday
without any afterthought or payment. There are people who maintain
software or services for free on their own time we could not
live without. NTP comes to mind. I thing gnupg is basically maintained
by one person.

But in general I agree with the statement: "if you are not paying,
you are the product".

-H





-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#229561 — Re: Loadbearing services

> This reminds me of an article from ESR.
> He pointed out that there are essential pieces we use everyday
> without any afterthought or payment. There are people who maintain
> software or services for free on their own time we could not
> live without. NTP comes to mind. I thing gnupg is basically maintained
> by one person.

Indeed.  Part of the distinction is one of resources: NTP does not
require much resources, so it costs very little to maintain an
NTP server even if used by a fairly large number of clients.

In contrast, maintaining a VPN service used by a large number of clients
can be costly because of the needs to encrypt/decrypt or because of the
amount of bandwidth it uses.

If it's cheap enough, you'll probably be able to find people willing to
offer the service just because it makes them feel good.  But past
a certain monetary cost it's going to be hard to find such people and
you'll instead have to start figuring out how to actually pay for it,
either by selling the service or by selling its clients or a mix of
the two.

And then there are those services which are offered for free as a form
of advertisement, because serious users of the service are willing to
pay for it and hence subsidize the non-paying users.  This is the case
of most gratis dynamic-dns services, for example.  This always risks
sliding into selling the clients, of course.


        Stefan

[toc] | [prev] | [next] | [standalone]

#229566 — Re: Loadbearing services

On Wed, Dec 09, 2020 at 10:30:52AM -0500, Stefan Monnier wrote:
> > This reminds me of an article from ESR.
> > He pointed out that there are essential pieces we use everyday
> > without any afterthought or payment. There are people who maintain
> > software or services for free on their own time we could not
> > live without. NTP comes to mind. I thing gnupg is basically maintained
> > by one person.
> 
> Indeed.  Part of the distinction is one of resources: NTP does not
> require much resources, so it costs very little to maintain an
> NTP server even if used by a fairly large number of clients.
> 
> In contrast, maintaining a VPN service used by a large number of clients
> can be costly because of the needs to encrypt/decrypt or because of the
> amount of bandwidth it uses.
> 
> If it's cheap enough, you'll probably be able to find people willing to
> offer the service just because it makes them feel good.  But past
> a certain monetary cost it's going to be hard to find such people and
> you'll instead have to start figuring out how to actually pay for it,
> either by selling the service or by selling its clients or a mix of
> the two.
>
[...]

I think you are missing the point.
Sure these services are cheap. Still some of them are essential,
and there is only one person caring for it.
Raymond pointed out one case where this one person was already
retired. He was one of these old unix geeks and being old
dealing with some (severe) health issues. I forgot already what
exactly he was maintaining (see I also totally block this out),
but just imagine what happens when this one person maintaining
an essential piece dies or gets a stroke.
There are no classifieds for "time zone changes management" apprenticeships.
You might be right that it doesn't need much resources but there
is a lower limit and that might be "the last person" willing to do this.

-H

-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.debian.user

csiph-web