- The project is actually currently in the middle of some performance comparison testing. I myself am not conducting the tests and I'd like to review the method

- The project is actually currently in the middle of some performance comparison testing. I myself am not conducting the tests and I'd like to review the methodology we use for the tests but initial reports I'm hearing are quite good. I do have first-hand anecdotal evidence from a heavy user of OpenZiti indicating from Australia to the US he'll usually pull 40-50mbps over open internet. OpenZiti often pulls 50 consistently while still being a zero trust overlay. One of the knocks on OpenZiti is the mTLS between links, and full end to end encryption on by default being "overkill". This anecdotal evidence however, seems to suggest that the CPU burden of "all that encryption" is not significant at all. - The private, authenticated DNS provided by the tunnellers has not been a problem whatsoever for nearly every user. Sure there are times when bugs creep in, but I'd say for the majority of times people use any of the tunneling apps the way we do private DNS has been no issue. The OP of this article might have more to offer here. He's very well versed with DNS in general. I don't recall exactly how this works in linux but we have some advanced linux users doing "interesting" things and I know of no major issues... yet... :) If you try OpenZiti, I hope you won't be the first! Each OS is a little different here too. The Windows clients work differently and the MacOS ones a bit differently. All "somewhat" the same but sometimes with subtle nuances - "For Nebula this would be by delivering the certificate to the machine" - realistically that's exactly the same process with OpenZiti's "regular/most common" type of enrollment - the "one time token" approach (using jwts). You deliver a jwt however you like with email being just one option. Then you just re-enroll that jwt which creates a primary key and cert right then/there on that machine, and off you go... You might find another feature interesting though, OpenZiti also supports 3rd party CA enrollment. This means you can register a CA with OpenZiti and if any device connects and presents a certificate signed by YOUR CA (you don't even have to trust OpenZiti, you can run your own PKI) then you can set that device up for "automatic enrollment" which is truly automatic. You don't need to deliver a new certificate (but you could). This is a somewhat detailed topic and I don't think I could fit enough words on this post and keep it legible. Would be happy to continue that conversation here or in the OpenZiti discourse forum. One other interesting thing you might like... We just released our first release of a python sdk for OpenZiti. It's able to monkey patch python to allow us to use ansible over OpenZiti. So hopefully soon we should be able to demonstrate ansible over OpenZiti. I've seen it working but it's not __quite__ ready to share to the world. Soon, I'm sure!