11 ms·

Yggdrasil P2P mesh E2EE IPv6 network

216 points by jesprenj 5y ago

p1mrx 5y ago
This project squats on the 0200::/7 prefix, which was originally allocated by https://datatracker.ietf.org/doc/html/rfc1888 https://datatracker.ietf.org/doc/html/rfc1888 in 1996.
- octoberfranklin 5y ago
  RFC1888 is obsolete. There is even a subsequent RFC whose title is, exactly, "RFC 1888 Is Obsolete": https://datatracker.ietf.org/doc/html/rfc4048 https://datatracker.ietf.org/doc/html/rfc4048 Moreover, RFC1888 never moved beyond "experimental" status. Look at its heading, where it says "Obsoleted by: 4048 Category: Experimental", and its preface which explicitly states that "This memo does not specify an Internet standard of any kind."
  - p1mrx 5y ago
    Yes, that's why I provided a reference, but it remains true that they're squatting the prefix. What is your point?
    - thomaszander 5y ago
      Using. Can't squat something that is officially discontinued. What is yours?
      - eadmund 5y ago
        It's not officially allocated, either. You can squat something that is not available for use. I see that they don't use ULA after all, but their approach still spends 7 bits on the prefix.
        thomaszander 5y ago
        > their approach still spends 7 bits on the prefix. The Yggdrasil people are very clear that this is a research project. Not to be used in production, to be used at your own risk etc etc etc. In that light I find it unfair to claim it spends addressspace. Which, I might add, is pretty darn huge and we are not going to run out of addresses any time soon. If ever. Maybe pedantic, but needed to point out that the 7 in `0200/7` of the usage is the opposite of being spent. The 7 first bits are the mask you need to apply to indicate that it is INSIDE the yggdrasil address-space. Which means that they only 'spend' 1 bit from from the first byte. Not 7.
        eadmund 5y ago
        My comment about spending bits makes more sense in the context of my other comment about the cryptographic (in)security of Yggdrasil addresses. I agree with you — in the context of IPv6 addressing in general, who cares about 7 bits? Heck, who cares about 64 bits?
        thomaszander 5y ago
        > the cryptographic (in)security of Yggdrasil addresses. Fair enough, I didn't catch that one. The addresses generated has changed already from 0.3 to 0.4 (which is the series we see today), I expect that something will change again in future to make brute forcing harder. Notice that in all cases the same IPv6 range was used, reusing the same space as upgrades change the individuals' IP address.
- SSLy 5y ago
  I happen to work in the industry that made NSAPs, and let me tell you, _no one_ uses them for routing over IP. And the CLNS setups are dying out.
- MayeulC 5y ago
  Ideally the project would use link-local addresses, but to quote Arceliar [1] (one of the devs): > there's no standard way to specify these interfaces across platforms / number these interfaces intelligently. if there was, we could have set aside a specific interface number for ygg, and then just used link-local addresses, which is technically more correct than using a global address that isn't actually global [1]: https://matrix.to/#/!vVtVcVdzAdhGFLzFwm:matrix.org/$qpV7j6LYu4FgZUUn5O9DoZJsVbOCyFWVdasAxQcrmj0?via=matrix.org&via=libera.chat&via=tchncs.de https://matrix.to/#/!vVtVcVdzAdhGFLzFwm:matrix.org/$qpV7j6LY...
deleted 5y ago
[deleted]
hestefisk 5y ago
This is very cool. Any plans for an OpenBSD port?
- nix23 5y ago
  You can do it if you want, should be a matter of minutes with this starting-point: https://github.com/yggdrasil-network/yggdrasil-package-freebsd https://github.com/yggdrasil-network/yggdrasil-package-freeb...
- nyx_land 5y ago
  Already exists. I'm using ygg on OpenBSD 7.0 right now: https://openports.se/net/yggdrasil-go https://openports.se/net/yggdrasil-go
dragonsh 5y ago
Previous discussion https://news.ycombinator.com/item?id=27577201 https://news.ycombinator.com/item?id=27577201 (102 comments)
SlavikCA 5y ago
I read the website. I read the "About" page. I read project's Github page. Still - can't figure out what the project does and what would be practical application for it?. Is it something like Tailscale?
- zamadatix 5y ago
  Very similar in use, a bit different in how it does it (decentralized), a lot earlier in it's development.
- yepguy 5y ago
  > Is it something like Tailscale? Kind of, in that you can use it to replace Tailscale if you want. Using Yggdrasil as a DIY Tailscale replacement is probably less work than manually configuring WireGuard, because it handles the mesh features of Tailscale for you. All nodes are publicly routable rather than private, though. If you want to lock everything down to emulate Tailscale, you can just configure your firewall to only allow traffic from a whitelist of your devices' Yggdrasil addresses[1]. [1]: https://yggdrasil-network.github.io/2018/07/15/remote-access.html https://yggdrasil-network.github.io/2018/07/15/remote-access...
  - discardedrefuse 5y ago
    > All nodes are publicly routable rather than private, though. As long as you don't add a public peer to any of your nodes, your network is private.
    - yepguy 5y ago
      Yes, but then you have to worry about routing again. The whole point of something like Tailscale or Yggdrasil is to handle the routing problem for me.
      - discardedrefuse 5y ago
        I don't really understand what you mean. Yggdrasil will automatically discover and peer with other hosts running Yggdrasil on your network. Connecting your network, across the internet to another network is no different than connecting to a public peer. My biggest concern with Yggdrasil is that, without careful configuration of every node, anyone can connect to your Yggdrasil network and potentially expose it to the public Yggdrasil network. I've moved on to experimenting with Nebula (made by Slack). This is made specifically for closed networks and has built in tools to restrict access. I still REALLY like Yggdrasil and will continue to experiment with it; just not for private meshing.
viraptor 5y ago
Another similar solution which is production ready is ZeroTier. That one supports IPv4 on your private network as well.
- gaius_baltar 5y ago
  > Another similar solution which is production ready is ZeroTier. That one supports IPv4 on your private network as well. With a centralized server and usage limits and depending on proprietary software. No, thanks.
  - viraptor 5y ago
    Once 2.0 comes out, the centralised root will go away. But even now you don't have to use the project's infra. Private roots are possible if you want to be independent: https://docs.zerotier.com/zerotier/moons/ https://docs.zerotier.com/zerotier/moons/
  - sockaddr 5y ago
    You can run your own infra completely independent of them. Also, their approach is to decentralize until it hurts, then centralize until it works. Calling it centralized is a bit of a stretch.
octoberfranklin 5y ago
It is really frustrating that I can't find a whitepaper anywhere on this website. Or a protocol spec. Or an RFC.
- gpm 5y ago
  There's an old and incomplete looking protocol spec if you look through the organizations GitHub repos (would link but not at a computer) for what it's worth. Found it yesterday when someone posted this on lobste.rs, not sure how much it reflects the current version of the software.
- deleted 5y ago
  [deleted]
infogulch 5y ago
When I looked into yggdrasil they were talking about repartitioning the address space to give more bits to the network id which is derived from a public key pair because network ids were small enough that collisions were being actively found. I feel like 128 bits is a lot for address space but not enough for encryption.
- runeks 5y ago
  > I feel like 128 bits is a lot for address space but not enough for encryption. Yes, collisions take sqrt(2^128) = 2^64 operations to find on average. Usually 256 bits is chosen to make that 2^128 operations if finding a collision poses problems.
- boogerlad 5y ago
  https://github.com/yggdrasil-network/yggdrasil-go/issues/779#issuecomment-821560931 https://github.com/yggdrasil-network/yggdrasil-go/issues/779...
lorenzo95 5y ago
It's awesome. Have been using it for a while. Ipv6 overlay network with e2e encryption. And it works well. Dns is blockchain based at the moment. It's neat. You can use it standalone or join the public one. There is also a mail system yggmail and a matrix chat implementation. All work as advertised. Would recommend to try it
- discardedrefuse 5y ago
  Yggdrasil only does routing. DNS is not part of it. There are people running DNS severs on the network. And some of them are blockchain based, but that's not part of the Yggdrasil project.
  - JeremyNT 5y ago
    I really appreciate that clarification. The "blockchain based" DNS server concept the parent mentioned almost caused me to bounce off of this project, which is otherwise very interesting to me.
nyx_land 5y ago
I started using yggdrasil yesterday. The ability to get a static IPv6 address on a meshnet, with encrypted traffic by default, and the option to only accept inbound connections from public keys I trust is incredibly cool. Just like that I can access any of my devices that run ygg from anywhere using standard tools like git or ssh (or git-annex). It makes it really easy to network my devices together without having to screw around with split tunneling a wireguard server and create a DIY set of services to, for example, remotely manage my devices or sync things from one to the other, and that's just for starters. Feels like the Unix philosophy actually being useful for once.
- amaccuish 5y ago
  How does key distribution work though? Is it TOFU? I couldn't find anything, just some hand-wavey everything is encrypted.
  - mawalu 5y ago
    Your IPv6 address is the hash of your public key
    - p_l 5y ago
      So it's effectively Host Identity Protocol? Just perhaps with something other than IPsec underneath?
      - thomaszander 5y ago
        > So it's effectively Host Identity Protocol? The software is essentially a 'node', doing the routing. Whenever it starts it reads the config file to see if there is a private key in there. If no, it will generate a new one for you and that is your identity on the network. > Just perhaps with something other than IPsec underneath? That is correct, it uses standard, but not ipsec, encryption based on public key cryptography. A host that saves its private key will thus forever have the same IP address and if it runs services you connect to them using the encryption to its public key. A node that is configured to connect to the wider yggdrasil public network will thus be reachable on a single IP with an identity that is based on public key cryptography, even if the machine is moving from network to network or even another continent.
mkj 5y ago
Does this randomly choose random peers based on hashing, or will it try using some latency metric too? It would be nice if there were protocol docs.
- thomaszander 5y ago
  The protocol does not add peers, you will have to look for nearby ones yourself and add then in the config. If you add more than one, you might start routing between those nodes. Probably Ok on desktop, not so much on mobile. For next steps, it picks one 'main' peer for your outgoing traffic, based on speed. (once an hour). On a higher level, the system builds a tree out of the peers that are connected and you send data from one node to the other by directions. Think "left at church, right at heardresser". Or in yggdrasil it is "Go to node 10, then from there to node 1, then to node 5, then to node 6". In short; a tree is built based on the elected root sending out a package and which peer sends it to you first. Indicating that that is the fastest. You send data the shortest route though the mesh using local directions only. Actual traffic is encrypted for the destination peer, so other than some headers needed to route, everyone in the middle will just forward an unreadable blob.
simmanian 5y ago
I feel a bit dumb because I can't figure out how to use this on my m1 mac. I installed the package, edited the configuration file to include some of the public peers, and tried to click on some yggdrasil links on the website. It keeps timing out. Am I doing something wrong?
- encryptluks2 5y ago
  It's very possible the website has links to nodes that are no longer up.
- thomaszander 5y ago
  From your text; after configuring you need to restart the service. you can run 'yggdrasilctl getpeers' to see if it actually connected to any peers. Use https://publicpeers.neilalexander.dev/ https://publicpeers.neilalexander.dev/ to find some local ones. Ygg does not include a DNS, so use IP addresses directly. Notice that in most webbrowsers you need to add square brackets to indicate an IPv6 address. Also notice that since yggdrasil automatically does end-to-end encryption, a lot of websites don't bother with ssl. So explicitly type http and turn off any plugins that turn your http into https. Example: http://[21e:e795:8e82:a9e2:ff48:952d:55f2:f0bb]/ http://[21e:e795:8e82:a9e2:ff48:952d:55f2:f0bb]/
xdxfw 5y ago
why not i2p? https://geti2p.net/en/ https://geti2p.net/en/
- eisbaw 5y ago
  different use-case: i2p/tor anonymity -- slow ygg : fast Though I must admit I don't yet know how Yggdrasil does routing.
altilunium 5y ago
Successfully tested it on Windows. https://rtnf.substack.com/p/yggdrasil-on-windows https://rtnf.substack.com/p/yggdrasil-on-windows
londons_explore 5y ago
Would it be possible to make a gateway between Yggdrasil and the public IPv6 internet so that nodes in one can communicate with nodes in the other? Are the address spaces disjointed, or might a particular 128 bit address contact someone different in each network?
- thomaszander 5y ago
  The design behind yggdrasil is to keep as much the same as possible. I have some projects running on ygg using simple, existing, TCP-socket tech. Works great. So, to get the big issue out of the way. There is a lot of compatibility already there. The gateway possibility is there, someone needs to do it, is all. There are instructions on the website on how to setup such a gateway on your local router, so you do not need to install the binary on each device to access ygg services. The main reason why there isn't really anyone really doing this is that this is a research project and most people that use it, use it for their own usecases. Not to offer some websites which aren't already on mainnet.
- MayeulC 5y ago
  You can send a router advertisement packet on your local network to tell machines to send you packets to the yggdrasil network/prefix, so it's easy to hook up a whole LAN to yggdrasil. On the other hand, you would have to run an Internet gateway on one of the nodes, and give that address as a default route. It would work, but with a bit more manual work. IIRC someone ran a public Internet gateway at some point. The yggdrasil address-space is different from the one used to give public IPv6 addresses.
thomaszander 5y ago
Background piece; https://read.cash/@TomZ/mesh-networking-with-yggdrasil-e300d18e https://read.cash/@TomZ/mesh-networking-with-yggdrasil-e300d... > To understand what the value of Yggdrasil is, let's take a look at what we use today for networking.
_joel 5y ago
This looks interesting, OpenWRT port too (although I'll need to upgrade to 21.04)
imwillofficial 5y ago
Talk about a great project with a terrible name. I have no idea how to pronounce this out the gate.
- omnicognate 5y ago
  It's unusual, but pretty unambiguous from the spelling. https://www.howtopronounce.com/yggdrasil https://www.howtopronounce.com/yggdrasil How else could it be pronounced?
  - imwillofficial 5y ago
    I just tried, it sounded like Klingon. If you can pronounce it easily, then all I can say is “Glory to you and your house”
- sumosudo 5y ago
  https://en.m.wikipedia.org/wiki/Yggdrasil https://en.m.wikipedia.org/wiki/Yggdrasil
kevincox 5y ago
I think the next version of IP needs to be anonymous. That is if I connect to multiple endpoints they should not be able to know that I am the same person. It may even be a good idea to allow multiple connections to the same host to be impossible to relate together, but that has some negative connotations for DoS attacks. Right now there are a myriad of problems based around the fact that sharing IP addresses is becoming frowned upon. It is a serious threat to any P2P and even just the ability to follow links without fear (for example asks you to confirm every link you click to prevent IP leak + DoS attack).

216 points by jesprenj 5y ago

This project squats on the 0200::/7 prefix, which was originally allocated by https://datatracker.ietf.org/doc/html/rfc1888 https://datatracker.ietf.org/doc/html/rfc1888 in 1996.

octoberfranklin 5y ago
RFC1888 is obsolete. There is even a subsequent RFC whose title is, exactly, "RFC 1888 Is Obsolete": https://datatracker.ietf.org/doc/html/rfc4048 https://datatracker.ietf.org/doc/html/rfc4048 Moreover, RFC1888 never moved beyond "experimental" status. Look at its heading, where it says "Obsoleted by: 4048 Category: Experimental", and its preface which explicitly states that "This memo does not specify an Internet standard of any kind."
- p1mrx 5y ago
  Yes, that's why I provided a reference, but it remains true that they're squatting the prefix. What is your point?
  - thomaszander 5y ago
    Using. Can't squat something that is officially discontinued. What is yours?
    - eadmund 5y ago
      It's not officially allocated, either. You can squat something that is not available for use. I see that they don't use ULA after all, but their approach still spends 7 bits on the prefix.
      - thomaszander 5y ago
        > their approach still spends 7 bits on the prefix. The Yggdrasil people are very clear that this is a research project. Not to be used in production, to be used at your own risk etc etc etc. In that light I find it unfair to claim it spends addressspace. Which, I might add, is pretty darn huge and we are not going to run out of addresses any time soon. If ever. Maybe pedantic, but needed to point out that the 7 in `0200/7` of the usage is the opposite of being spent. The 7 first bits are the mask you need to apply to indicate that it is INSIDE the yggdrasil address-space. Which means that they only 'spend' 1 bit from from the first byte. Not 7.
        eadmund 5y ago
        My comment about spending bits makes more sense in the context of my other comment about the cryptographic (in)security of Yggdrasil addresses. I agree with you — in the context of IPv6 addressing in general, who cares about 7 bits? Heck, who cares about 64 bits?
        thomaszander 5y ago
        > the cryptographic (in)security of Yggdrasil addresses. Fair enough, I didn't catch that one. The addresses generated has changed already from 0.3 to 0.4 (which is the series we see today), I expect that something will change again in future to make brute forcing harder. Notice that in all cases the same IPv6 range was used, reusing the same space as upgrades change the individuals' IP address.
SSLy 5y ago
I happen to work in the industry that made NSAPs, and let me tell you, _no one_ uses them for routing over IP. And the CLNS setups are dying out.
MayeulC 5y ago
Ideally the project would use link-local addresses, but to quote Arceliar [1] (one of the devs): > there's no standard way to specify these interfaces across platforms / number these interfaces intelligently. if there was, we could have set aside a specific interface number for ygg, and then just used link-local addresses, which is technically more correct than using a global address that isn't actually global [1]: https://matrix.to/#/!vVtVcVdzAdhGFLzFwm:matrix.org/$qpV7j6LYu4FgZUUn5O9DoZJsVbOCyFWVdasAxQcrmj0?via=matrix.org&via=libera.chat&via=tchncs.de https://matrix.to/#/!vVtVcVdzAdhGFLzFwm:matrix.org/$qpV7j6LY...

deleted 5y ago

[deleted]

hestefisk 5y ago

This is very cool. Any plans for an OpenBSD port?

nix23 5y ago
You can do it if you want, should be a matter of minutes with this starting-point: https://github.com/yggdrasil-network/yggdrasil-package-freebsd https://github.com/yggdrasil-network/yggdrasil-package-freeb...
nyx_land 5y ago
Already exists. I'm using ygg on OpenBSD 7.0 right now: https://openports.se/net/yggdrasil-go https://openports.se/net/yggdrasil-go

dragonsh 5y ago

Previous discussion https://news.ycombinator.com/item?id=27577201 https://news.ycombinator.com/item?id=27577201 (102 comments)

SlavikCA 5y ago

I read the website. I read the "About" page. I read project's Github page. Still - can't figure out what the project does and what would be practical application for it?. Is it something like Tailscale?

zamadatix 5y ago
Very similar in use, a bit different in how it does it (decentralized), a lot earlier in it's development.
yepguy 5y ago
> Is it something like Tailscale? Kind of, in that you can use it to replace Tailscale if you want. Using Yggdrasil as a DIY Tailscale replacement is probably less work than manually configuring WireGuard, because it handles the mesh features of Tailscale for you. All nodes are publicly routable rather than private, though. If you want to lock everything down to emulate Tailscale, you can just configure your firewall to only allow traffic from a whitelist of your devices' Yggdrasil addresses[1]. [1]: https://yggdrasil-network.github.io/2018/07/15/remote-access.html https://yggdrasil-network.github.io/2018/07/15/remote-access...
- discardedrefuse 5y ago
  > All nodes are publicly routable rather than private, though. As long as you don't add a public peer to any of your nodes, your network is private.
  - yepguy 5y ago
    Yes, but then you have to worry about routing again. The whole point of something like Tailscale or Yggdrasil is to handle the routing problem for me.
    - discardedrefuse 5y ago
      I don't really understand what you mean. Yggdrasil will automatically discover and peer with other hosts running Yggdrasil on your network. Connecting your network, across the internet to another network is no different than connecting to a public peer. My biggest concern with Yggdrasil is that, without careful configuration of every node, anyone can connect to your Yggdrasil network and potentially expose it to the public Yggdrasil network. I've moved on to experimenting with Nebula (made by Slack). This is made specifically for closed networks and has built in tools to restrict access. I still REALLY like Yggdrasil and will continue to experiment with it; just not for private meshing.

viraptor 5y ago

Another similar solution which is production ready is ZeroTier. That one supports IPv4 on your private network as well.

gaius_baltar 5y ago
> Another similar solution which is production ready is ZeroTier. That one supports IPv4 on your private network as well. With a centralized server and usage limits and depending on proprietary software. No, thanks.
- viraptor 5y ago
  Once 2.0 comes out, the centralised root will go away. But even now you don't have to use the project's infra. Private roots are possible if you want to be independent: https://docs.zerotier.com/zerotier/moons/ https://docs.zerotier.com/zerotier/moons/
- sockaddr 5y ago
  You can run your own infra completely independent of them. Also, their approach is to decentralize until it hurts, then centralize until it works. Calling it centralized is a bit of a stretch.

octoberfranklin 5y ago

It is really frustrating that I can't find a whitepaper anywhere on this website. Or a protocol spec. Or an RFC.

gpm 5y ago
There's an old and incomplete looking protocol spec if you look through the organizations GitHub repos (would link but not at a computer) for what it's worth. Found it yesterday when someone posted this on lobste.rs, not sure how much it reflects the current version of the software.
deleted 5y ago
[deleted]

infogulch 5y ago

When I looked into yggdrasil they were talking about repartitioning the address space to give more bits to the network id which is derived from a public key pair because network ids were small enough that collisions were being actively found. I feel like 128 bits is a lot for address space but not enough for encryption.

runeks 5y ago
> I feel like 128 bits is a lot for address space but not enough for encryption. Yes, collisions take sqrt(2^128) = 2^64 operations to find on average. Usually 256 bits is chosen to make that 2^128 operations if finding a collision poses problems.
boogerlad 5y ago
https://github.com/yggdrasil-network/yggdrasil-go/issues/779#issuecomment-821560931 https://github.com/yggdrasil-network/yggdrasil-go/issues/779...

lorenzo95 5y ago

It's awesome. Have been using it for a while. Ipv6 overlay network with e2e encryption. And it works well. Dns is blockchain based at the moment. It's neat. You can use it standalone or join the public one. There is also a mail system yggmail and a matrix chat implementation. All work as advertised. Would recommend to try it

discardedrefuse 5y ago
Yggdrasil only does routing. DNS is not part of it. There are people running DNS severs on the network. And some of them are blockchain based, but that's not part of the Yggdrasil project.
- JeremyNT 5y ago
  I really appreciate that clarification. The "blockchain based" DNS server concept the parent mentioned almost caused me to bounce off of this project, which is otherwise very interesting to me.

nyx_land 5y ago

I started using yggdrasil yesterday. The ability to get a static IPv6 address on a meshnet, with encrypted traffic by default, and the option to only accept inbound connections from public keys I trust is incredibly cool. Just like that I can access any of my devices that run ygg from anywhere using standard tools like git or ssh (or git-annex). It makes it really easy to network my devices together without having to screw around with split tunneling a wireguard server and create a DIY set of services to, for example, remotely manage my devices or sync things from one to the other, and that's just for starters. Feels like the Unix philosophy actually being useful for once.

amaccuish 5y ago
How does key distribution work though? Is it TOFU? I couldn't find anything, just some hand-wavey everything is encrypted.
- mawalu 5y ago
  Your IPv6 address is the hash of your public key
  - p_l 5y ago
    So it's effectively Host Identity Protocol? Just perhaps with something other than IPsec underneath?
    - thomaszander 5y ago
      > So it's effectively Host Identity Protocol? The software is essentially a 'node', doing the routing. Whenever it starts it reads the config file to see if there is a private key in there. If no, it will generate a new one for you and that is your identity on the network. > Just perhaps with something other than IPsec underneath? That is correct, it uses standard, but not ipsec, encryption based on public key cryptography. A host that saves its private key will thus forever have the same IP address and if it runs services you connect to them using the encryption to its public key. A node that is configured to connect to the wider yggdrasil public network will thus be reachable on a single IP with an identity that is based on public key cryptography, even if the machine is moving from network to network or even another continent.

mkj 5y ago

Does this randomly choose random peers based on hashing, or will it try using some latency metric too? It would be nice if there were protocol docs.

thomaszander 5y ago
The protocol does not add peers, you will have to look for nearby ones yourself and add then in the config. If you add more than one, you might start routing between those nodes. Probably Ok on desktop, not so much on mobile. For next steps, it picks one 'main' peer for your outgoing traffic, based on speed. (once an hour). On a higher level, the system builds a tree out of the peers that are connected and you send data from one node to the other by directions. Think "left at church, right at heardresser". Or in yggdrasil it is "Go to node 10, then from there to node 1, then to node 5, then to node 6". In short; a tree is built based on the elected root sending out a package and which peer sends it to you first. Indicating that that is the fastest. You send data the shortest route though the mesh using local directions only. Actual traffic is encrypted for the destination peer, so other than some headers needed to route, everyone in the middle will just forward an unreadable blob.

simmanian 5y ago

I feel a bit dumb because I can't figure out how to use this on my m1 mac. I installed the package, edited the configuration file to include some of the public peers, and tried to click on some yggdrasil links on the website. It keeps timing out. Am I doing something wrong?

encryptluks2 5y ago
It's very possible the website has links to nodes that are no longer up.
thomaszander 5y ago
From your text; after configuring you need to restart the service. you can run 'yggdrasilctl getpeers' to see if it actually connected to any peers. Use https://publicpeers.neilalexander.dev/ https://publicpeers.neilalexander.dev/ to find some local ones. Ygg does not include a DNS, so use IP addresses directly. Notice that in most webbrowsers you need to add square brackets to indicate an IPv6 address. Also notice that since yggdrasil automatically does end-to-end encryption, a lot of websites don't bother with ssl. So explicitly type http and turn off any plugins that turn your http into https. Example: http://[21e:e795:8e82:a9e2:ff48:952d:55f2:f0bb]/ http://[21e:e795:8e82:a9e2:ff48:952d:55f2:f0bb]/

xdxfw 5y ago

why not i2p? https://geti2p.net/en/ https://geti2p.net/en/

eisbaw 5y ago
different use-case: i2p/tor anonymity -- slow ygg : fast Though I must admit I don't yet know how Yggdrasil does routing.

altilunium 5y ago

Successfully tested it on Windows. https://rtnf.substack.com/p/yggdrasil-on-windows https://rtnf.substack.com/p/yggdrasil-on-windows

londons_explore 5y ago

Would it be possible to make a gateway between Yggdrasil and the public IPv6 internet so that nodes in one can communicate with nodes in the other? Are the address spaces disjointed, or might a particular 128 bit address contact someone different in each network?

thomaszander 5y ago
The design behind yggdrasil is to keep as much the same as possible. I have some projects running on ygg using simple, existing, TCP-socket tech. Works great. So, to get the big issue out of the way. There is a lot of compatibility already there. The gateway possibility is there, someone needs to do it, is all. There are instructions on the website on how to setup such a gateway on your local router, so you do not need to install the binary on each device to access ygg services. The main reason why there isn't really anyone really doing this is that this is a research project and most people that use it, use it for their own usecases. Not to offer some websites which aren't already on mainnet.
MayeulC 5y ago
You can send a router advertisement packet on your local network to tell machines to send you packets to the yggdrasil network/prefix, so it's easy to hook up a whole LAN to yggdrasil. On the other hand, you would have to run an Internet gateway on one of the nodes, and give that address as a default route. It would work, but with a bit more manual work. IIRC someone ran a public Internet gateway at some point. The yggdrasil address-space is different from the one used to give public IPv6 addresses.

thomaszander 5y ago

Background piece; https://read.cash/@TomZ/mesh-networking-with-yggdrasil-e300d18e https://read.cash/@TomZ/mesh-networking-with-yggdrasil-e300d... > To understand what the value of Yggdrasil is, let's take a look at what we use today for networking.

_joel 5y ago

This looks interesting, OpenWRT port too (although I'll need to upgrade to 21.04)

imwillofficial 5y ago

Talk about a great project with a terrible name. I have no idea how to pronounce this out the gate.

omnicognate 5y ago
It's unusual, but pretty unambiguous from the spelling. https://www.howtopronounce.com/yggdrasil https://www.howtopronounce.com/yggdrasil How else could it be pronounced?
- imwillofficial 5y ago
  I just tried, it sounded like Klingon. If you can pronounce it easily, then all I can say is “Glory to you and your house”
sumosudo 5y ago
https://en.m.wikipedia.org/wiki/Yggdrasil https://en.m.wikipedia.org/wiki/Yggdrasil

kevincox 5y ago

I think the next version of IP needs to be anonymous. That is if I connect to multiple endpoints they should not be able to know that I am the same person. It may even be a good idea to allow multiple connections to the same host to be impossible to relate together, but that has some negative connotations for DoS attacks. Right now there are a myriad of problems based around the fact that sharing IP addresses is becoming frowned upon. It is a serious threat to any P2P and even just the ability to follow links without fear (for example asks you to confirm every link you click to prevent IP leak + DoS attack).