4 ms·

Isn't syncthing P2P all by itself? Why run it over something else? Is it encrypted or is its encryption suspect? I'm also not a huge fan of the "put thing A on

by api 4y ago

Isn't syncthing P2P all by itself? Why run it over something else? Is it encrypted or is its encryption suspect? I'm also not a huge fan of the "put thing A on top of general purpose thing that can host all things of the same class as A" trope. Tailscale gives you a virtual network so you can run absolutely anything that speaks IP over it. It's like "how to run (insert random Linux service) in Docker" and similar blogspam.

proactivesvcs 4y ago
Yes, it's P2P by default. It's all TLS-encrypted and I've not come across anything suggesting syncthing's implementation is suspect, since most of it is just using Go's libraries. You can also run your own (private or public) discovery and/or relay servers. I agree that this is adding in two additional levels of complexity, including managing an online account which could be compromised, just to avoid exposing a single service to the Internet. At first glance this seems to be undermining the idea of keeping the network secure. One could even have the reverse proxy on port 80 forward requests to Syncthing on the inside.
mleo 4y ago
To prevent any use of the relay servers and have them always connect. I disabled the relay on my syncthing services between laptop and work VMs. This means they only sync when the laptop is connected to VPN.
nvrspyx 4y ago
From the blog post: > Tailscale here is optional as Syncthing does the NAT traversal for you and also uses a secure protocol. Syncthing will do its best to establish a peer to peer connection and that’s great! > However, with Tailscale I can access my “shared directory” via SAMBA on my other devices, anywhere. And also don’t need any “Relay Server” only if my device can’t talk peer-to-peer as Tailscale will do it for me :))
- chrisweekly 4y ago
  "don't need any... only if.. can't" this is so hard to parse, could you rephrase for clarity?

by api 4y ago

proactivesvcs 4y ago

Yes, it's P2P by default. It's all TLS-encrypted and I've not come across anything suggesting syncthing's implementation is suspect, since most of it is just using Go's libraries. You can also run your own (private or public) discovery and/or relay servers. I agree that this is adding in two additional levels of complexity, including managing an online account which could be compromised, just to avoid exposing a single service to the Internet. At first glance this seems to be undermining the idea of keeping the network secure. One could even have the reverse proxy on port 80 forward requests to Syncthing on the inside.

mleo 4y ago

To prevent any use of the relay servers and have them always connect. I disabled the relay on my syncthing services between laptop and work VMs. This means they only sync when the laptop is connected to VPN.

nvrspyx 4y ago

From the blog post: > Tailscale here is optional as Syncthing does the NAT traversal for you and also uses a secure protocol. Syncthing will do its best to establish a peer to peer connection and that’s great! > However, with Tailscale I can access my “shared directory” via SAMBA on my other devices, anywhere. And also don’t need any “Relay Server” only if my device can’t talk peer-to-peer as Tailscale will do it for me :))

chrisweekly 4y ago
"don't need any... only if.. can't" this is so hard to parse, could you rephrase for clarity?