4 ms·

Is Spiped similar in-concept to a VPN?

cpach 5y ago
Yes. When spiped was released (2011) there were no really good VPN solutions out there. Now there is WireGuard, but it wasn’t launched until 2016.
- amarshall 5y ago
  OpenVPN may have its issues (complicated setup vs. e.g. Wireguard, but not vs. e.g. IPsec), but I wouldn’t call it “not good” and it predates spiped by a decade.
  - cpach 5y ago
    Ok. I don’t agree there. What I’ve heard from security experts is that WireGuard is vastly superior to OpenVPN. Addendum: OpenVPN was released in 2001 and there where lots of cryptography-related systems from that era that certainly didn’t age well – IMO OpenVPN is one of those examples.
    - LukeShu 5y ago
      OpenVPN's encryption is just TLS. It uses OpenSSL for this, not rolling their own implementation. Yes, there are parts of SSL/TLS that haven't aged well, but... it's good enough for the world's web traffic.
    - amarshall 5y ago
      > security experts is that WireGuard is vastly superior to OpenVPN Superior doesn’t imply the other is “not good”. > lots of cryptography-related systems from that era that certainly didn’t age well This doesn’t really mean anything. > IMO OpenVPN is one of those example That’s your opinion, but so far you’ve given no evidence. As the other commenter said: OpenVPN is just TLS via OpenSSL. Yes, at some points it has used now-insecure algorithms, but so have web browsers and most everything else. One wouldn’t configure OpenVPN today the way they did in 2001. Not that it necessarily means much, but AWS Client VPN is just OpenVPN. AWS, GCP, & Azure all support IPsec VPN which dates back to the ’90s. Just because something has been around for a long time doesn’t mean it hasn’t evolved its cryptography at all.
cperciva 5y ago
Sort of. Not really. spiped operates at the level of individual stream connections, so you can e.g. make one end a local socket in a filesystem and use UNIX permissions to control access to it. In fact that's exactly why I wrote it -- so I could have a set of daemons designed to communicate via local sockets and transparently (aside from performance) have them running on different systems.
- tiffanyh 5y ago
  Thanks Colin! Love all the things you create :)
- sillysaurusx 5y ago
  Is it possible to use tarsnap's deduplication code on my own server? We're setting up an ML dataset distribution box, and I was hoping to avoid storing e.g. imagenet as a tarball + untar'd (so that nginx can serve each photo individually) + imagenet in TFDS format. https://github.com/xolox/dedupfs https://github.com/xolox/dedupfs was the closest I found, but it has a lot of downsides. Has anyone made an interface to tarsnap's tarball dedup code? A python wrapper around the block dedup code would be ideal, but I doubt it exists. (Sorry for the random question -- I was just hoping for a standalone library along the lines of tarsnap's "filesystem block database" APIs. I thought about emailing this to you instead, but I'm crossing my fingers that some random HN'er might know. I'm sort of surprised that filesystems don't make it effortless. In fact, I delayed posting this for an hour to go research whether ZFS is the actual solution -- apparently "no, not unless you have specific brands of SSDs: https://www.truenas.com/community/resources/my-experiments-in-building-a-home-server-capable-of-handling-fast-consistent-deduplication.148/ https://www.truenas.com/community/resources/my-experiments-i..." which rules out my non-SSD 64TB Hetzner server. But like, dropbox solved this problem a decade ago -- isn't there something similar by now?) EDIT: How timely -- Wyng (https://news.ycombinator.com/item?id=28537761 https://news.ycombinator.com/item?id=28537761) was just submitted a few hours ago. It seems to support "Data deduplication," though I wonder if it's block-level or file-level dedup. Tarsnap's block dedup is basically flawless, so I'm keen to find something that closely matches it.
  - 5y ago
acatton 5y ago
Not really. spiped is more an equivalent to mutual SSL (aka "Client certs SSL"). It basically just encrypts and mutually auths individual connections. It works at the TCP level, not the IP level.

Yes. When spiped was released (2011) there were no really good VPN solutions out there. Now there is WireGuard, but it wasn’t launched until 2016.

amarshall 5y ago
OpenVPN may have its issues (complicated setup vs. e.g. Wireguard, but not vs. e.g. IPsec), but I wouldn’t call it “not good” and it predates spiped by a decade.
- cpach 5y ago
  Ok. I don’t agree there. What I’ve heard from security experts is that WireGuard is vastly superior to OpenVPN. Addendum: OpenVPN was released in 2001 and there where lots of cryptography-related systems from that era that certainly didn’t age well – IMO OpenVPN is one of those examples.
  - LukeShu 5y ago
    OpenVPN's encryption is just TLS. It uses OpenSSL for this, not rolling their own implementation. Yes, there are parts of SSL/TLS that haven't aged well, but... it's good enough for the world's web traffic.
  - amarshall 5y ago
    > security experts is that WireGuard is vastly superior to OpenVPN Superior doesn’t imply the other is “not good”. > lots of cryptography-related systems from that era that certainly didn’t age well This doesn’t really mean anything. > IMO OpenVPN is one of those example That’s your opinion, but so far you’ve given no evidence. As the other commenter said: OpenVPN is just TLS via OpenSSL. Yes, at some points it has used now-insecure algorithms, but so have web browsers and most everything else. One wouldn’t configure OpenVPN today the way they did in 2001. Not that it necessarily means much, but AWS Client VPN is just OpenVPN. AWS, GCP, & Azure all support IPsec VPN which dates back to the ’90s. Just because something has been around for a long time doesn’t mean it hasn’t evolved its cryptography at all.

cperciva 5y ago

Sort of. Not really. spiped operates at the level of individual stream connections, so you can e.g. make one end a local socket in a filesystem and use UNIX permissions to control access to it. In fact that's exactly why I wrote it -- so I could have a set of daemons designed to communicate via local sockets and transparently (aside from performance) have them running on different systems.

tiffanyh 5y ago
Thanks Colin! Love all the things you create :)
sillysaurusx 5y ago
Is it possible to use tarsnap's deduplication code on my own server? We're setting up an ML dataset distribution box, and I was hoping to avoid storing e.g. imagenet as a tarball + untar'd (so that nginx can serve each photo individually) + imagenet in TFDS format. https://github.com/xolox/dedupfs https://github.com/xolox/dedupfs was the closest I found, but it has a lot of downsides. Has anyone made an interface to tarsnap's tarball dedup code? A python wrapper around the block dedup code would be ideal, but I doubt it exists. (Sorry for the random question -- I was just hoping for a standalone library along the lines of tarsnap's "filesystem block database" APIs. I thought about emailing this to you instead, but I'm crossing my fingers that some random HN'er might know. I'm sort of surprised that filesystems don't make it effortless. In fact, I delayed posting this for an hour to go research whether ZFS is the actual solution -- apparently "no, not unless you have specific brands of SSDs: https://www.truenas.com/community/resources/my-experiments-in-building-a-home-server-capable-of-handling-fast-consistent-deduplication.148/ https://www.truenas.com/community/resources/my-experiments-i..." which rules out my non-SSD 64TB Hetzner server. But like, dropbox solved this problem a decade ago -- isn't there something similar by now?) EDIT: How timely -- Wyng (https://news.ycombinator.com/item?id=28537761 https://news.ycombinator.com/item?id=28537761) was just submitted a few hours ago. It seems to support "Data deduplication," though I wonder if it's block-level or file-level dedup. Tarsnap's block dedup is basically flawless, so I'm keen to find something that closely matches it.
- 5y ago

acatton 5y ago

Not really. spiped is more an equivalent to mutual SSL (aka "Client certs SSL"). It basically just encrypts and mutually auths individual connections. It works at the TCP level, not the IP level.