2 ms·
Yes, I think that's a fair statement. I'd say it's closer to ZeroTier, because ZeroTier has ACLs and the "libzt" that you can embed in applications. Though in
by linsomniac 4y ago
Yes, I think that's a fair statement. I'd say it's closer to ZeroTier, because ZeroTier has ACLs and the "libzt" that you can embed in applications. Though in the case of libzt you are embedding a full TCP stack and talking on ports, where I get the impression OpenZiti is more like a pipe with credentials.
Or: It's like Tailscale, if Tailscale had mutual TLS client/server baked into it as well as VPN.
- dovholuknf 4y ago> OpenZiti is more like a pipe with credentials That's a better way to think about it, I can see that. The idea of authorizing before connect to an open, listening port is great, but not having a listening port at all in your app is so much more powerful imo. It makes it all that much harder for worms and ransomware and the like to propagate when there are no listening ports to attack. OpenZiti uses a full TCP stack in the tunneling apps - the agent-like things you would install for brownfield type of things but for app embedded zero trust it doesn't need any of that.
- PLG88 4y agoTailscale would also need to natively provide segmentation, least privilege, attribute based access, endpoint posture checks, and do authentication/authorisation before connectivity is established. I believe they recommend a firewall does some of this. Also the SDKs.