4 ms·

ZeroTier and Tailscale, yes, maybe. Nebula, as I understand it, no... it's a fully Open Source project, the mesh is P2P, and the "lighhouse nodes" which serve

by jbotz 5y ago

ZeroTier and Tailscale, yes, maybe. Nebula, as I understand it, no... it's a fully Open Source project, the mesh is P2P, and the "lighhouse nodes" which serve as tunnel end-point directories, you run yourself as well. There is no "vendor" involved.

aborsy 5y ago
For nebula, if you run the coordination server yourself (lighthouse or moon), obviously the concern I mentioned is not applicable. It will be self hosted; the company is not even involved to be responsible for anything. My comment applies only if Slack provides the lighthouse. I don’t know if it does; usually the company operates a default one for users and provides the option to self host it as well (Tailscale does not offer one, but there is third party code).
- jbotz 5y ago
  Exactly. Slack does not offer "lighthouses as a service". Here is a quote by the authors from the Nebula GH repository README... "Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo DigitalOcean droplets as lighthouses."
- linsomniac 5y ago
  Slack does not offer lighthouses or any part of Nebula. They spun off a company, Defined Networks, which is enhancing Nebula, and they offer a hosted CA with key rotation and push configuration updates to your fleet, currently in a kind of early beta. You still run your own lighthouses, but they are entirely in control of your CA, so they can sign certs for nodes at their will. That could allow third parties into your networks, but I'm not sure if that would imply any ability to redirect or decrypt traffic.

4 ms·

ZeroTier and Tailscale, yes, maybe. Nebula, as I understand it, no... it's a fully Open Source project, the mesh is P2P, and the "lighhouse nodes" which serve

by jbotz 5y ago

aborsy 5y ago
For nebula, if you run the coordination server yourself (lighthouse or moon), obviously the concern I mentioned is not applicable. It will be self hosted; the company is not even involved to be responsible for anything. My comment applies only if Slack provides the lighthouse. I don’t know if it does; usually the company operates a default one for users and provides the option to self host it as well (Tailscale does not offer one, but there is third party code).
- jbotz 5y ago
  Exactly. Slack does not offer "lighthouses as a service". Here is a quote by the authors from the Nebula GH repository README... "Nebula lighthouses allow nodes to find each other, anywhere in the world. A lighthouse is the only node in a Nebula network whose IP should not change. Running a lighthouse requires very few compute resources, and you can easily use the least expensive option from a cloud hosting provider. If you're not sure which provider to use, a number of us have used $5/mo DigitalOcean droplets as lighthouses."
- linsomniac 5y ago
  Slack does not offer lighthouses or any part of Nebula. They spun off a company, Defined Networks, which is enhancing Nebula, and they offer a hosted CA with key rotation and push configuration updates to your fleet, currently in a kind of early beta. You still run your own lighthouses, but they are entirely in control of your CA, so they can sign certs for nodes at their will. That could allow third parties into your networks, but I'm not sure if that would imply any ability to redirect or decrypt traffic.