6 ms·
Meshbird – distributed private networking
- win_ini 8y agoIs this like Hamachi but for servers/command line?
- vageli 8y agoHow does the meshing/peer discovery work? Is connection information encoded in the key?
- naikrovek 8y agoDHT
- gduffy 8y agoNot anymore. # Changelog ## v2.0 - removed DHT [...] - bootstraping and peer exchange from one or more nodes
- forgotmypw 8y agoThrough existing friendships, perhaps?
- audi0slave 8y agoNo tests?
- huhtenberg 8y agoAnd no documentation.
- ukd1 8y agoIs this like zerotier?
- narak 8y agoLooks like a decentralized version of ZeroTier[1] (No affiliation) Would be interested in hearing from Adam[2] the trade-offs between fully and partially decentralized architectures 1: https://www.zerotier.com/ https://www.zerotier.com/ 2: https://news.ycombinator.com/user?id=api https://news.ycombinator.com/user?id=api
- viraptor 8y agoNot Adam, but I believe this: > All traffic transmit directly to recepient peer without passing any gateways. Meshbird do not require any centralized servers. means you can't have a NAT on both sides of connection. Zerotier falls back to proxying the traffic if you can't connect directly.
- hunter2_ 8y agoWait, can't something in this list of techniques handle a NAT on both sides? https://en.m.wikipedia.org/wiki/NAT_traversal https://en.m.wikipedia.org/wiki/NAT_traversal If not, please pardon my ignorance; not a networking expert.
- viraptor 8y agoKind of. What I meant is "it won't work for all double NAT setups". In practice, if you have upnp on both sides or a setup which allows holepunching for any source it will work. (usually) But after working for a VoIP provider, I don't trust those anymore. Your home router will have some edge cases, or the mapping detection will fail, or something else will happen. If you're trying to connect 2 parties reliably, they need a proxy or direct access on one side.
- yardstick 8y agoThere’s two issues here- 1) They switched away from UDP, now use TCP. So NAT traversal / punching isn’t possible. 2) Even if UDP was used there’s still some network setups that aren’t traversal friendly, such as most cellular/LTE networks where port mappings are unpredictable.
- dcow 8y agoPrevious discussion: https://news.ycombinator.com/item?id=13638636 https://news.ycombinator.com/item?id=13638636
- deleted 8y ago[deleted]
- nodesocket 8y agoIn the previous discussion HN users were complaining about "AES-256 in CBC mode but without an authentication tag (HMAC)". Is this still the case or has it been addressed? Also, any idea the overhead in terms of CPU pushing around 100Mbps?
- viraptor 8y agoSeems like it was replaced with GCM in https://github.com/meshbird/meshbird/commit/f4e50d5596b05d0c5924fb42ec0d449f53ed76df https://github.com/meshbird/meshbird/commit/f4e50d5596b05d0c...
- newman314 8y ago"Unfortunately I wasn't able to understand this piece of code and what it was aiming to, so I didn't changed." That seems alarming for a commit message.
- miovoid 8y agohttps://github.com/meshbird/meshbird/blob/master/src/meshbird/transport/server_conn.go#L97 https://github.com/meshbird/meshbird/blob/master/src/meshbir...
- RootKitBeerCat 8y agoWhat’s the catch?
- DiabloD3 8y agoSo, wget a random sh script and run it? Really?
- prophesi 8y agoYeah, there's a lot of unknowns with this project. https://github.com/meshbird/meshbird/issues/85 https://github.com/meshbird/meshbird/issues/85
- eponeponepon 8y agoSeems to be the fashion these days. I do not applaud it.
- ChristianBundy 8y agoHow does this compare to cjdns?
- nik1aa5 8y agoHow does this compare to tinc-vpn.org?
- galadran 8y agoThis project has so many cryptographic wrong answers, I don't know where to begin. Glaring problems: - The same unchanging aes key is shared between all nodes on a network. Compromise one, compromise all. Additionally a bad node can impersonate any other node. - The 96 bit nonce is derived randomly and there is no rekeying which means sending more than 2^32 messages will leak your (static, unchanging) key to the world. That's 2^32 total between all clients on a network. Hope everyone is manually updating their keys! - Default unchanging password of `hello-world` is set. Everyone remembers to change that environment variable right? - The KDF is md5, which means attackers can brute force guess the key incredibly fast. - There's no perfect forward secrecy (aging out of old keys). Amazingly, this is still better than their last version, which used AES-CBC and used the same value for both the key and the IV (which is transmitted over the network). Summary: Stick to Wireguard!
- deleted 8y ago[deleted]
- johnchristopher 8y agoFunny how the submitted URL isn't the https one ^^.
- KaiserPro 8y agoHmm, I would be keen to try it, however: There are scant details on the website as to _how_ it works. They don't appear to backup the claim that its "distributed" Are they just using a DHT to distribute IP addresses, then use wireguard to connect? how is routing configured? is it dynamic. All of the basics seem to require looking into the code, which seems a little obtuse also, wget'ing a script direct into sh, not a healthy start. easy installers == great, but not when its piped directly into sh. Tar.gz and make it obvious that your not hiding stuff, and make sure you post a hash of the tar.
- atheiste 8y agoThe quality seems a bit low. There is a similar project based on academic routing protocol Babel and implemented reliably by a professional called Re6st https://re6st.nexedi.com https://re6st.nexedi.com Re6st indeed is more focused on connectivity than performance because it re-establish connection even when the Chinese great firewall kicks in.
- bayesian_horse 8y agoIt shouldn't matter but if I read English text with all the third-person "s" missing I somehow assume the worst. And it is a bit strange their English is mostly correct and then they make this mistake consistently. Maybe not a mistake?
- snambi 8y agoHow does it work?
- auxten 8y agoThe website is fancy, but I believe https://github.com/CovenantSQL/CovenantSQL/tree/develop/rpc https://github.com/CovenantSQL/CovenantSQL/tree/develop/rpc is way better “distributed private networking”