5 ms·

It feels like their issues would have been solved by a service mesh using e.g. consul or istio. If so, I'd wonder writing a tool from scratch was the right use

by dastx 7y ago

It feels like their issues would have been solved by a service mesh using e.g. consul or istio. If so, I'd wonder writing a tool from scratch was the right use of engineering time. Anyway, as an engineer, I'd certainly have found this a fun project. Kudos to slack for trying something new and open sourcing it.

tptacek 7y ago
This is effectively a service mesh implemented directly at the IP layer, integrated with the OS.
KaiserPro 7y ago
Not entirely as it only really allows stuff thats running in that service mesh's world to connect to the network. But they want a global VPN for _everything_ including laptops. This means some level of access control. What I like here is the use of lighhouses, to allow external nodes to punch in and discover the rest of the network. Something which is very difficult to do if you are relying on a service mesh in an unknown and unconnectable network.
- hedwall 7y ago
  With Consul intentions and edge gateways you may be able to have the same functionality, but those are quite recent and was not present 2 years ago.
- thu2111 7y ago
  How does this differ from cjdns?
  - KaiserPro 7y ago
    I suspect that the goals are slightly different. The thing that immediately stands out is the routing. It looks like cjdns is a traditional-ish multi-hop network. The DHT routing table allows you to map out a route to peer A via peer B, R, & D. What wireguard and nebula allow is for the underlying network to figure out most of the routing, and effectively create a massive point to-point network. whilst you can have concentrators/gateways, the idea is that most of the traffic goes direct from peer to peer. This can reduce load considerably.
    - thu2111 7y ago
      I think cjdns allows arbitrary peering, so you can certainly set up a full mesh if you want point-to-point traffic, with multiple hops only for cases where the underlying network topology requires it.
      - neilalexander 7y ago
        Right, cjdns and Yggdrasil will both forward on behalf of other nodes where no direct paths are available.

by dastx 7y ago

tptacek 7y ago

This is effectively a service mesh implemented directly at the IP layer, integrated with the OS.

KaiserPro 7y ago

Not entirely as it only really allows stuff thats running in that service mesh's world to connect to the network. But they want a global VPN for _everything_ including laptops. This means some level of access control. What I like here is the use of lighhouses, to allow external nodes to punch in and discover the rest of the network. Something which is very difficult to do if you are relying on a service mesh in an unknown and unconnectable network.

hedwall 7y ago
With Consul intentions and edge gateways you may be able to have the same functionality, but those are quite recent and was not present 2 years ago.
thu2111 7y ago
How does this differ from cjdns?
- KaiserPro 7y ago
  I suspect that the goals are slightly different. The thing that immediately stands out is the routing. It looks like cjdns is a traditional-ish multi-hop network. The DHT routing table allows you to map out a route to peer A via peer B, R, & D. What wireguard and nebula allow is for the underlying network to figure out most of the routing, and effectively create a massive point to-point network. whilst you can have concentrators/gateways, the idea is that most of the traffic goes direct from peer to peer. This can reduce load considerably.
  - thu2111 7y ago
    I think cjdns allows arbitrary peering, so you can certainly set up a full mesh if you want point-to-point traffic, with multiple hops only for cases where the underlying network topology requires it.
    - neilalexander 7y ago
      Right, cjdns and Yggdrasil will both forward on behalf of other nodes where no direct paths are available.