It's natively supported by more operating systems. Namely, macOS and iOS. Also generates mobileprofile files that you can AirDrop to your device and have it set up in an instant.
On the flipside, it introduces monstrous dependency (strongSwan) written in memory unsafe C, is nowhere near as flexible as OpenVPN and is blocked by many networks since it can't operate over arbitrary ports and forces you to manage/own the server-end.
1) If I wanted to do that, I'd use OpenVPN rather than strongSwan. They're both written in C, but I get extra flexibility by using OpenVPN. Their "TLS is suspect" stance doesn't hold water in my view.
2) When I don't want to set up my own server, OpenVPN allows me to use or even chain lots of third party servers and create my own nested VPN topologies. Installing an OpenVPN client on my phone or tablet takes a few minutes.
So, to summarize, Algo would be interesting if it didn't introduce dependency on memory unsafe code or minimized such dependency. But it doesn't. On the client, I do not see why I should trust Apple's IPSEC implementation (racoon?) more than OpenVPN client which is another point they tried to make. As it currently stands, it does not compare favorably to OpenVPN in any way.
I use it just to secure open or shifty public wi-fi in cafes and such. I do trust the data center the VPN terminates in more than the open wifi at the corner cafe, so it works for me.
Or reconsider the need for a VPN at all. By using a VPN you cut yourself off from participating as an equal citizen on the net. If it's just for browsing the web, irc, or the like it's much easier and better just to use a socks 5 proxy to a cheap VPS. I like shadowsocks-libev.
But then again I don't use popular browsers that cram in fancy new features every week to expose new leaks and attack surfaces.
True enough. But they also aren't participating in the net. They're using other people and companies' resources to do things rather than participating yourself.
And that's bad because it leads to centralization. And centralization leads to perverse incentives to spy and censor.
I’m not sure why you have that idea. I’m not entirely familiar with how most off-the-shelf VPN providers work, but I have a simple IKEv2 VPN hosted on Digitalocean that just gives me a public IP address, to which I can route a thing I want. This service appears be be specifically tailored for that use case, though I know nothing about it: https://staticvpnip.com
> If I wanted to host servers, I'd host them somewhere else, not on my home internet connection.
But why? You probably have a tens to hundreds of megabit connection that is always on. You have powerful computers that wouldn't even notice a webserver running. Buying a domain costs $8 and pointing it at home is as simple as changing the DNS entry a couple times a year or using DynDNS services.
And what you don't have is a need for all the complexity and requirements that most automatically assume they need just because they're drowing in them in their day job.
Hosting from home is more than enough for a personal website. It cuts the gordian knot of deciding what types of speech and content will be allowed on any given service. It prevents the perverse incentives of spying and selling users. It allows you to add things to your site on a whim just by copying a file to your web directory or opening an text editor. All the tools of your operating system, this refined and extremely usable software is now just there. Now you don't need a database. No need for a CMS. No need for scaling or containers or 99.9999% uptime.
Hosting from home allows you to participate in the 'net in a way that is just natural. When there's not 5 layers of abstraction between you and the web you really can participate and build whatever you want.
And since you don't need all that abstraction, dynamic content, and CMS (your OS is the CMS!) the security problems everyone loves to jump on simply vanish.
Say you want to monitor your logs, well, you don't need to go install some dynamic language parser and prettifier full of attack surfaces. You just tail the log and grep. You open it in OpenOffice if you really have to have a GUI. You can set alerts as easily as tailing a log.
You see day to day the type of bots, people, and referers and how they come to your site all without google analytics. You can respond to people using your site in real time; I love adding personal messages to people as they browse my site(s).
This is what I mean by participating in the net. Getting down into it. It's a beautiful thing and it solves so many problems that can't even be approached when you're using someone elses computer and someone else's connection.
And if you're in the USA you completely bypass third party doctorine and actually have an expectation of real privacy.
I just don't get the hostility to the concept I see on HN.
> Hosting from home is more than enough for a personal website. It cuts the gordian knot of deciding what types of speech and content will be allowed on any given service.
Cool, and then when I post something to my self-hosted blog that pisses someone off, my home internet gets DDoS'd and I lose my Internet access. It has happened before on IRC. I banned a user because they were spamming racial slurs, and they responded with a DDoS. I was offline for an hour while struggling to get someone on my ISP's support line that understood what it meant to force my IP address to change. Now I use an IRC bouncer in AWS to hide my home IP address.
> It allows you to add things to your site on a whim just by copying a file to your web directory or opening an text editor. All the tools of your operating system, this refined and extremely usable software is now just there. Now you don't need a database. No need for a CMS. No need for scaling or containers or 99.9999% uptime.
I think you misunderstand the reasons people use CMS. It makes it so I can just fill out a single text box and click "Post" and have all the indexes and links on the entire web site update automatically to include that post. I can allow people to write comments. I can create the ability for users of my site to search it.
And maximum uptime is still important. My home internet died shortly after I got to work a couple days ago, and I wasn't able to fix it until I got home. 10 hours of straight unplanned downtime is unacceptable for any server, even a personal website, IMO.
> And since you don't need all that abstraction, dynamic content, and CMS (your OS is the CMS!) the security problems everyone loves to jump on simply vanish.
The truth is quite literally the opposite. If I'm hosting it myself, and my server gets hacked, my entire home network becomes at risk.
> Say you want to monitor your logs, well, you don't need to go install some dynamic language parser and prettifier full of attack surfaces. You just tail the log and grep.
Uh...people can tail and grep logs from any server. You misunderstand there's a reason people use dynamic language parsers and prettifiers. Look at raw logs is awful. It's far easier to fire up a log analyzer and see "Oh, there are a lot of people making requests to X resource and it's creating a bottleneck."
> It's a beautiful thing and it solves so many problems that can't even be approached when you're using someone elses computer and someone else's connection.
It creates more problems than it solves. It puts my home network at risk. It makes me in charge of dealing with hardware failures. If whatever I'm hosting gets popular, and I can't scale.
> I just don't get the hostility to the concept I see on HN.
Because what you're proposing shows extreme naivete.
>Because what you're proposing shows extreme naivete.
I've done it for 20 years without any of the problems you describe. I've never been DDoS'd at home but I suppose if you run in some circles it happens once or twice in a lifetime. On the otherhand the servers and upstream of my paid VPS providers I run other websites on have been DDoS'd and usually once or twice a year. AWS isn't immune from other types of outages either. It's someone elses computer.
>Now I use an IRC bouncer in AWS to hide my home IP address.
If you can do that you can use simple ssh port forwarding of 80 to AWS (or whatever) too.
>10 hours of straight unplanned downtime is unacceptable for any server, even a personal website, IMO.
I've been offline some for tens of hours too but it didn't matter at all because I'm not running an ecommerce site or some business. Is your personal site really that important that it can't ever go offline for half a day? I'd argue that it isn't a personal site if you're using it as a reputation device for work or portfolio or the like. The inability to separate work from life complicates things.
> and see "Oh, there are a lot of people making requests to X resource and it's creating a bottleneck."
And if you don't bring the work mindset home and run all those pretty tools on your server with the $cms turnkey of the month you don't ever run into bottlenecks because you're not running excess crap with 5 more layers of abstraction that create things dynamically when there's no reason to.
> I can allow people to write comments. I can create the ability for users of my site to search it.
A comment system is a bit of a challenge with my mindset. You can always just embed something like discus but I know that's not a strong argument. I personally implemented it with perl script parsing the logs and editing text files and iframes plus 1 line of JS. While parsing the perl script only accepts characters from a list of something like 30 that are harmless. I admit this is definitely not for everyone.
As for search you and I both know that everyone only uses google anyway and it'll work better than whatever you implement.
> If I'm hosting it myself, and my server gets hacked, my entire home network becomes at risk.
The biggest security hole for everyone is using their browser for EVERYTHING by running JS apps instead of self-hosting and just using a native application on their OS. Some 0-day for nginx or $serversoftware is far less likely than the constant stream of browser exploits and far more likely to be patched quickly.
You keep saying it creates a security risk at home that doesn't exist otherwise. But that's only if you make it that way and even then it's magnitudes less of a risk than simply running a modern browser.
The WebRTC implementation in Firefox isn't as configurable as it could be, it just assumes that you are behind a firewall that doesn't understand SCTP so encapsulates everything in UDP and searches for the best way to escape to the internet.
