Hummingbird – AirVPN's free and open source OpenVPN 3 client

https://gitlab.com/AirVPN/hummingbird/tree/master

by monkin • 7 years ago

115 33 7 years ago

saurik2• 7 years ago

Based on OpenVPN 3 library fork by AirVPN with tons of critical bug fixes from the main branch, new ciphers support and never seen before features

Why are these changes not being contributed upstream? It does not inspire my trust to hear these people are making "critical bug fixes" and then hoarding them without explanation. Did OpenVPN3 refuse the updates, or are otherwise dragging their feet? Or, more likely, did AirVPN decide it was more interesting/important to use these fixes as a competitive advantage / differentiator for their fork, to get people to use their client or even leave upstream?

jlgaddis• 7 years ago

Or, more likely, did AirVPN decide it was more interesting/important to use these fixes as a competitive advantage / differentiator for their fork ... ?

You mean these fixes that are available in this repo that are available to absolutely anyone?

red_phone• 7 years ago

The code’s been released under the GPL, so seems unlikely to be an issue of hoarding.

saurik2• 7 years ago

Look: I work on a lot of open source projects; I assert a bunch of undocumented changes without any attempt at organizing them, pushed to a fork on GitHub is still close enough to "hoarding".

bscphil3• 7 years ago

Why are these changes not being contributed upstream?

Perhaps more importantly, what are these supposedly "critical bug fixes"? How do you make a claim like that without clearly documenting it? Are there security impacts? CVEs?

Edit: if you click through to the actual library page[1], it makes no claims that I can find about "tons of critical bug fixes". I'm beginning to suspect that may be some extremely misleading marketing speak that made it into the README.

Edit: looking through the list of changes[2] does not inspire a lot of confidence in their fork.

[1] https://github.com/AirVPN/openvpn3-airvpn

[2] https://github.com/OpenVPN/openvpn3/compare/master...AirVPN:...

tim--• 7 years ago

does not inspire a lot of confidence in their fork

Just out of interest, what reasons do you have for this?

Much of the code seems... incomplete? I don't want to sound too harsh, but what scares me looking glancing at the changes, are the functions `set_ncp_disable` and `set_ncp_enabled`.

Surely it's good though that someone has started adding ChaCha20 and Poly1305 to OpenVPN?

marcan_42• 7 years ago

Upstream isn't responsive. I have had a bug open with them about broken TAP mode routing for years, with patch, and they've ignored it.

After seeing the codebase, I'm a lot warier of using OpenVPN. It's quite a mess. I'm personally looking forward to WireGuard becoming the standard, but I'm glad to see an OpenVPN fork. These things, even if they don't replace upstream, tend to motivate them to stop dragging their feet.

gonzo• 7 years ago

WireGuard will completely replace OpenVPN with time.

quanticle• 7 years ago

Not just you. Linus Torvalds [1] has said that Wireguard's code is a "work of art" when compared with the "horrors" that are OpenVPN and IPSec.

1: https://www.phoronix.com/scan.php?page=news_item&px=Linus-Li...

traceroute66• 7 years ago

As a paid customer of OpenVPN I have to admit I find their attitude over certain matters incredibly frustrating.

Their continued lack of interest in IPv6 is a prime specimen. We're now in 2020, IPv4 depletion is no longer a distant thought, and yet OpenVPN still don't have full support for IPv6.

The lack of support for modern algos is also frustrating, although not exactly a deal breaker.

That said, to give them their due, when a CVE worthy issue arises, they are quick to react and issue a patch (or at least no slower than your average).

As for WireGuard, yes, I'm looking forward to it. But let's face the truth. The WireGuard homepage makes it quite clear in no uncertain terms that WireGuard is still a work in progress. Until such time as its had a full suite of codebase reviews, including multiple independent security audits, I refuse to touch it for production. Maybe in 12–24 months things might have changed at WireGuard to an extend that makes it more worthy for consideration.

So at the moment OpenVPN is the best we've got as an alternative to IPSec (which is quite frankly a pain to deal with, especially in NAT environments and so unsuitable for road warriors).

QueenSasha3• 7 years ago

The changes have been committed as far as I can see and refused with absurd explanation IMHO, but check yourself, it's only my opinion.

What I know for sure, because it's public, is that AirVPN forked only after a long (harsh?) public debate on the commits with the main branch maintainer.

I can see bug fixes summarized in the changelog, look at "Changelog 3.3.2 AirVPN - Release date: 10 October 2019". Then look at the fixes in the code: the AirVPN developers are indeed right as far as I can see, without those fixes the library could have never worked (and the main branch still does not work!) in Linux.

I wonder whether AirVPN would have forked were those commits accepted. Surely they forked only after some time the commits were there, available, as a precious gift IMHO, but still refused without any serious analysis.

woodruffw• 7 years ago

I might be missing it, but where is the actual OpenVPN source for this fork? There are only a few files in the `src` directory, and most of them appear to be wrapping shell commands and the iptables/netfilter API.

Edit: It appears to be here: https://github.com/AirVPN/openvpn3-airvpn

basicplus2• 7 years ago

Whenever i hear of Hummingbird i think of Hummingbird Host Explorer...

Now opentext host explorer

https://www.opentext.com/products-and-solutions/products/spe...

ur-whale• 7 years ago

Why are people still investing time on OpenVPN in the wireguard era?

dimtion• 7 years ago

Wireguard is still very early stage, and many features that are useful for enterprise Software are not available (or even not possible) with Wireguard.

For example as of today Wireguard only works with static ip addresses. Using the official client it is not possible to assign IP (or pass DNS information) through a DHCP.

vorpalhex• 7 years ago

There is a dynamic ip project in the works, but it's not yet ready for public consumption from my understanding. https://git.zx2c4.com/wg-dynamic

therealmarv• 7 years ago

Many VPN providers (I think even AirVPN was in that list) even say today that Wireguard is too unproven (client and server) in day to day life (still new) and not audited. So VPN providers stick to the proven software for now (and some of the VPNs are simply to lazy to adopt to new tech).

rb6662• 7 years ago

I love AirVPN, going to test this out for sure.

zaarn• 7 years ago

I'm not quite certain, it seems the only change is integratio of ChaPoly1305 as an encryption method. But really, you should be switching to Wireguard, if all your devices support it.

OpenVPN is a mess, both in code and configuration, getting it to work as you want can be more difficult than editing Xorg.conf.

Wireguard is very very easy to setup (simple enough to fit the entire configuration plus encryption keys into an QR code you can scan with the Android App).

Hummingbird – AirVPN's free and open source OpenVPN 3 client

Related Stories