7 ms·

Zrok: Open-source peer to peer

289 points by whack 4y ago

AlbertoGP 4y ago
There was a post one day ago, apparently from the creator of Zrok, giving more context on this: https://news.ycombinator.com/item?id=34693988 https://news.ycombinator.com/item?id=34693988 > In the discussions about v0.2, the (now obvious) idea came up to implement something that we're calling "private sharing". It works a lot like the traditional on-demand reverse proxy, except instead of exposing the private endpoint through a public HTTP listener, it binds the shared resource onto an OpenZiti network, where it can be accessed securely by another zrok client. This "other" zrok client exposes an HTTP listener wherever the user wants... but it's usually put on the loopback interface of that user's system. This allows the user to securely access the shared resource on their system as if it's local, even though it's somewhere else on a zero-trust network. > As we've started working through the development of v0.3, we've realized that we can incorporate other useful capabilities, like streamlined file sharing (elegant WebDAV integration is coming). From a quick look, it seems that the self-hostable part (https://github.com/openziti/zrok/blob/main/docs/guides/v0.3_self_hosting_guide.md https://github.com/openziti/zrok/blob/main/docs/guides/v0.3_...) is written in Go, and there are SDKs for connecting to it from a variety of languages. Oracle has an article on the underlying network layer which is called OpenZiti, which defines ZeroTrust: > Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned). Authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established. All of this sounds very interesting to me, but I have no experience with these kinds of network stacks. Has anyone here evaluated it? Would this be useful for adding document sharing to applications I write, for instance, a hypothetical word processor? I mean sharing with other people working on a document. The SDKs seem to be clients, so to interchange files between two applications with an embedded SDK, does it still need a third machine running an API server?
- michaelquigley 4y ago
  > Would this be useful for adding document sharing to applications I write, for instance, a hypothetical word processor? I mean sharing with other people working on a document. The SDKs seem to be clients, so to interchange files between two applications with an embedded SDK, does it still need a third machine running an API server? We could certainly incorporate an "embeddable" SDK so that zrok can be incorporated into other applications. As it currently stands, you would need access to a zrok "service instance" ("cloud"), running the zrok controller (providing API access). But we could certainly look at other kinds of use cases where that control plane is potentially enabled ephemerally or on-demand. I have some ideas for things we might be able to do. Neither of these are on the immediate roadmap. But if people ask for them, we could certainly build them.
codethief 4y ago
How does this compare to Tailscale, beyond being based on OpenZiti instead of Wireguard?
- dovholuknf 4y ago
  I am a dev on the OpenZiti project. I personally think Tailscale is more similar to OpenZiti. It's making wireguard administration really easy. zrok is very clearly based heavily on inspiration from the amazing tool called ngrok. If you haven't checked them out you should. They are widely loved for lots of good reasons. Other product/projects in this category is Tailscale's funnels or Cloudflare tunnels. Key differences to ngrok are it being fully open source and fully self hostable. zrok allows you to do public/anonymous type sharing too but also has this private sharing feature that you might find neat. Basically it'll hide your app behind two "localhost" type proxies all transparently (to most people).
  - bogwog 4y ago
    I just looked up ngrok right now and it looks really cool, but I wonder what people actually use it for? Are people actually running production software this way, or is it just for sharing e.g. demos with coworkers? If the latter, it seems to me like a narrow use case that can already be served by automated devops stuff. Again this is new to me, so I'm probably missing some obvious use cases. Do you use it for anything in particular?
    - dovholuknf 4y ago
      Easily sharing local resources is a common need as a dev, for sure. If I'm making changes to a web form, updating online doc, etc. it's dreadfully convenient to just share that resource for some short amount of time... I've used similar tech when collaborating with a fella recently, he stood up a vault server and I hit his private API over an ngrok share because that was the tool he had used, liked and was familiar with. It's just super handy to do that sort of thing when/as you need to
    - Agrue8u 4y ago
kerkeslager 4y ago
This... sounds like something I would be interested in, but I cannot for the life of me understand what this does. Is this decentralized file sharing?
- dovholuknf 4y ago
  It's more peer to peer file sharing and web content sharing than truly distributed sharig but with a globally available service, it's "distributed" ina way. It's not doing sharding or anything fancy like that (yet anyway). Right now, it's a dev-focused tool similar to the other projects out there like ngrok/tailscale funnels/cloudflare tunnels etc. There's a fair number of them now-a-days. :) But it doesn't need to stay that way and might change. This one is built on top of OpenZiti (I am a dev on that project) which is a secure, zero trust overlay network. It's fully self-hostable and open source which some people find attractive. The hosted version our company is sponsoring for free (at least 'for now'). The key goal is to make it super easy and safe to share files/web content.
- spaniard89277 4y ago
  It seems to me that is some kind of tunnel/vpn a-la-zerotier?
  - dovholuknf 4y ago
    Trying to keep it short, I would say OpenZiti is similar to zerotier moreso than zrok. This zrok tool though is closer to ngrok. I mentioned that in another comment so hopefully that's easy enough to find in the page.
  - AlbertoGP 4y ago
    In this video from 11 months ago, at 25 min. they say this: “Ziti is only providing a pipe. That’s also very important. Some people might think that there is more going on there, but Ziti is literally, just… just a black hole, from one side to the other, and how it gets there… it’s like an SSH tunnel. https://www.youtube.com/watch?v=qyjM5y8Op_I&t=1509s https://www.youtube.com/watch?v=qyjM5y8Op_I&t=1509s He goes on to say “I’m going say it publicly: my mission is to kill REST. […] I’m going to bring us all the way back to the 1990s, and we’re going to do RPC all over again” The linked article is about Zrok, which seems to be an application on top of that OpenZiti overlay network on top of the Internet.
omani 4y ago
[flagged]
- wyager 4y ago
  The fact that whatever you're talking about has a blockchain built in tells me everything I need to know.
- vineyardmike 4y ago
  The purpose of the shared project has nothing to do with nkn, either in usage or ahem a blockchain. The shared project is more of a p2p VPN to access remote services privately, as opposed to a VPN for accessing the broader internet. Yes, there are other services that do something similar to Zrok, but this actually builds on one (openZiti) presumably to handle the connections more abstractly (and also presumably to launch their own paid SaaS endpoint?). I could see this more competing with Tailscale to access Internal tools at a company, or for home-lab users who want to access/share services they're running remotely.
- orthecreedence 4y ago
  How is NKN different from, like, the internet? Nothing on the homepage tells me why there is a blockchain involved. Nothing it talks about cannot be done with TCP/TLS/etc etc. If it's a p2p framework then something like libp2p, holochain, or p2panda would be much more appropriate than a blockchain with "incentivized miners" (incentivized to do what??). I think the reason people are reinventing the wheel is because blockchain tech has extremely limited use-cases and all the people who tried (or are trying) to use it outside of its applicable domain are misguided, prompting further exploration into the p2p space that isn't tethered (no pun intended) to a global state that has to be shared by every node in the system which is an inherently unscalable solution for anything beyond a handful of performant nodes (ie, sharing transactions between banks or something).
  - omani 4y ago
    > (incentivized to do what??) to route traffic. NKN is a CHORD overlay on top of the internet. clients connect to nodes and nodes route traffic from one node to another until the packet reaches its destination. clients stay anonymous (no IP leakage). end-to-end encrypted communication. "Proof-of-Relay" algorithm for mining. consensus via MOCA. the only state of the art blockchain technology I know of. and they dont even pay me to say this.
deleted 4y ago
[deleted]
Maursault 4y ago
I doubt Activision cares, but what does this have to do with Infocom and Z-machine?
- dovholuknf 4y ago
  man, those were the days. I actually played it on my Atari 800
- cyberge99 4y ago
  I thought about the American muscle car: Camaro I Roc Z
  - mxuribe 4y ago
    I'm glad i was not the only one thinking the same! lol :-D
jhoechtl 4y ago
Can this be used for a P2P pair editing session?
- tpoacher 4y ago
  maybe it could be used to share a tmux session? (which is my favourite way for collaborative editing)
  - dovholuknf 4y ago
    Not at this time. Right now zrok is for web (http) and file sharing. It's possible that sharing other UDP/TCP type sharing could be added in the future. Right now the overlay network (OpenZiti) would be able to support that right now if you were looking for any TCP/UDP.
- dovholuknf 4y ago
  I wouldn't think so tbh. Unless whatever editor you're using is sharing a web resource... In that case, sure. If you need/want UDP/TCP type sharing you could use the underlying OpenZiti overlay network for that, but out of the gate, at this time I don't think it'd support most "P2P editing". zrok certainly doesn't provide that type of functionality at this time
deleted 4y ago
[deleted]
squarefoot 4y ago
Seems interesting, but I think it needs some use case examples to show how it differentiates from a tunnel, VPN etc. As an example, would it be the right tool to access IoT data from small sensors (and actuators, therefore two ways) in a private LAN from external machines, including mobile, on untrusted public networks? Or what if I wanted on all my laptops a shared directory that replicated on all machines what is being written on one, no matter which networks they're connected to, NAT etc. etc...
- dovholuknf 4y ago
  I said somewhere else in the comments I was working with a fella and he shared his vault instance with me via ngrok (zrok didn't exist at the time). So ngrok/zrok are great, dev-focused tools (p2p). (zrok might grow past being a great dev/p2p-focused tool too) For what you're describing, the OpenZiti overlay might be more your ball of wax. It's a bit more complex than just "share" this and "access" that so there's more to learn (which is why ngrok/zrok are so nice, they are *EASY* to use) but you might find value in the tech that is under zrok, that OpenZiti overlay
whisk 4y ago
Okay, after reading the homepage of OpenZiti, now I have a zero-trust-phobia.
aidenn0 4y ago
What does "zero trust" mean in this context? I assume the network isn't trusted, but is anything else trusted? How are peers authenticated and/or authorized to access a zrok end-point?
- dovholuknf 4y ago
  There's always a "root" of trust somewhere/somehow. Ideally it's a human that you trust. In the case of zrok, it uses a secure zero trust overlay provided by openziti. you "enabling" zrok in your shell is that root of trust. you get a x509 certificate which is then used to attach to the zero trust overlay. On the other side when you "zrok access" you provide a unique token that has been shared with you by someone you trust (presumably). So you, as the person doing the sharing are the real "root" of the trust. You're trusting that zrok isn't compromised and that the certificate that is returned to you from the overlay is trustworthy etc. I could go on - but that's hopefully enough of an overview
  - aidenn0 4y ago
    Thanks; that's exactly the ELI5 I was looking for.
    - PLG88 4y ago
      Along those lines, I wrote a blog on how I described my job and zero trust to my daughter (who is 5) by using Harry Potter analogies - https://netfoundry.io/demystifying-the-magic-of-zero-trust-with-my-daughter-and-opensource/ https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...
fellellor 4y ago
So it’s like cloudflared or localtunnel?
- dovholuknf 4y ago
  Similar yes. Open source and self hostable are notable differences, but yep.
parentheses 4y ago
How is this establish a route to an IP that cannot be routed directly to? Sounds like there’s a central server to coordinate and transmit piped data. If so, does the central server have to transmit all data?
- dovholuknf 4y ago
  Yes that's exactly correct. The underpinning of zrok is an OpenZiti overlay network. That network relies on a fabric of routers all meshed together. (self hosters would probably have _one_ router, but you get the point). Both ends attach to the overlay, then the overlay mesh fabric is responsible for getting traffic from one place to the other securely in a zero trust way (you can read about OpenZiti if you want but I think you 'get it' already, but let us know if you have other questions)
apitman 4y ago
Always happy to see more open source options in this space. I maintain a list of similar tools (including OpenZiti) here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- dovholuknf 4y ago
  I put a PR up for zrok... :) https://github.com/anderspitman/awesome-tunneling/pull/82 https://github.com/anderspitman/awesome-tunneling/pull/82
- PLG88 4y ago
  Nice work on maintaining that by the way! Can we get zrok added to the list of 'Open source (at least with a reasonably permissive license)'??
byteshock 4y ago
Very interesting product! How does this compare to something like Nebula? Have you done benchmarks against other solutions? If i remember correctly, Nebula implements its own protocol and underperforms compared to Wireguard. Is this the same case? Looking forward to trying it out!
- PLG88 4y ago
  I am writing some comparisons to other tech incl. Nebula, its not publicly published yet, but I can give a few bullets. WRT to performance, better to compare OpenZiti to Nebula rather than zrok, we did some last year - https://netfoundry.io/benchmark/benchmarking%20open%20source%20networking.pdf https://netfoundry.io/benchmark/benchmarking%20open%20source.... A few points of comparison: - Nebula is focused on connecting machines, OpenZiti is on securing services. This is due to Ziti implementing zero trust networking principles – e.g., you can authorize only a single port without needing to set up ACLs or firewall rules. - While Nebula requires open inbound ports or UDP hole punching, OpenZiti allows you to have all inbound and most outbound ports completely closed while providing truly private, zero trust DNS entries with unique naming – if you wanted to call your service "my.secret.service" you can do that, it does not force you to have a valid Top Level Domain. - OpenZiti also goes a layer deeper to bring zero trust principles directly into your application. If you're a developer, you can embed all those ideas into your app and not rely on the network or side-loaded agents. This is both client and server-side and doesn't require the app to "listen" on an IP address (the underlay). Instead, you can choose to "listen" on the overlay.
edpichler 4y ago
So is it like Tailscale (amazing btw) but, instead of secure connecting computers, I can secure connect services?
- PLG88 4y ago
  zrok.io is more comparable to Tailscale Funnel. Lets break this down :) - Tailscale Funnel is their feature to allow you to route traffic from the wider internet to one or more of your Tailscale nodes (public sharing). It is closed source SaaS. Tailscale is a SaaS built on open source wireguard. - zrok.io is a SaaS for public or private sharing of content, files, websites, webhooks etc. It is built on top of zrok, an open source 'ziti-native' app. It is built on top of OpenZiti which is also open source. If you want SaaS, then we have CloudZiti. To the 2nd part, 100%. Wireguard (and thus Tailscale) is focused on connecting computers as default-open. Ziti connects services, default-closed, without the need for firewalls, ACLs etc. Myself and another wrote deeper comparisons on this thread so I will just link there: - https://news.ycombinator.com/reply?id=34713131&goto=item%3Fid%3D34709487%2334713131 https://news.ycombinator.com/reply?id=34713131&goto=item%3Fi... - https://news.ycombinator.com/reply?id=34714123&goto=item%3Fid%3D34709487%2334714123 https://news.ycombinator.com/reply?id=34714123&goto=item%3Fi...
p4bl0 4y ago
The file sharing part of this project made me think of RetroShare (https://retroshare.cc/ https://retroshare.cc/). Too bad this project never really had traction. It was really file sharing + social network in a truly decentralized fashion.
- prmoustache 4y ago
  Retroshare may not be viable as a worlwide social network but it is definitely useful for smaller circles, families, etc. AFAIK it is still maintained.
Uptrenda 4y ago
It says it uses an over-lay network? If the topology is just like: peer A <---> overlay (server N ...) <---> Peer B And your design is to try get packets between the peers then this is going to be very slow. They will have to go via the routes on the overlay network which may have multiple virtual hops to reach their destination. This is a massive increase in round trip time. I'm not sure if I understand the solution right though as I took a brief look. But I don't see how this solves port forwarding or NAT issues as the actual instances still need to be publicly reachable. I wrote a library for peer-to-peer networking recently and unlike libraries like Libp2p -- my emphasis was on getting direct connectivity to work between peers. I'm not using an overlay for this. I use a range of techniques [direct cons, reverse con, tcp hole punching, TURN] to make the connections happens. With some minor signalling traffic happening over public MQTT servers. My software is at https://github.com/robertsdotpm/p2pd https://github.com/robertsdotpm/p2pd if anyone finds it interesting. Sorry for the shameless self-plug but I figure it is related. We're both free open source projects. I don't provide a tunnelling solution but you could easily build something like ngrok with this software without relying on proxying as the primary solution. Currently the software has no way to easily get another peers 'address' so using this will need to solve that problem. But a simple key-value store would be enough tbh. Going to improve usability when I next have time.
- PLG88 4y ago
  While OpenZiti can do P2P connections, having a overlay in between gives you many advantages incl. outbound connections at source/destination to circumvent NAT/port forward/inbound ports etc. What's cool about it is that we built the overlay to do smart routing so it calculates the lowest latency paths and rebuilds, thus, as you have more nodes, you have the ability to actually circumvent BGP and deliver lower latency. We welcome the shameless plug, everything open source is our friend! zrok solves the peer address issue by providing the reverse proxy so that you can share a URL for public share or endpoint and URL for fully private share.
  - Uptrenda 4y ago
    It's a cool idea. I do see the use-cases for it. What you said about BGP is also interesting.
StopHammoTime 4y ago
Is this hitatchi
- PLG88 4y ago
  Do you mean Hamachi? Hamachi is a VPN capable of establishing direct links between computers that are behind network address translation (NAT) firewalls without requiring reconfiguration. zrok is a reverse proxy to easily share resources (http, files, web content) via a public URL or private share. zrok is built on top of OpenZiti. OpenZiti is more comparable to Hamachi but being open source, more powerful and modern.
robtherobber 4y ago
I hope a GUI will emerge from this, enabling the comfortable, the less knowledgeable and the less technical to avoid fiddling with terminal commands and all that.
- PLG88 4y ago
  We had this question in another thread so I will copy paste the answer :) Yes! We're currently targeting an end-user UI for v0.5. My crystal ball is imperfect with regards to timing, so don't hold me to it... but I would imagine that this will probably come out sometime in the summer. https://github.com/openziti/zrok/issues/221 https://github.com/openziti/zrok/issues/221 And I would imagine some sort of mobile-first interface would happen after that.
  - robtherobber 4y ago
    I did not expect anyone to answer my comment, so many thanks for that. I actually look forward to the UI.

289 points by whack 4y ago

There was a post one day ago, apparently from the creator of Zrok, giving more context on this: https://news.ycombinator.com/item?id=34693988 https://news.ycombinator.com/item?id=34693988 > In the discussions about v0.2, the (now obvious) idea came up to implement something that we're calling "private sharing". It works a lot like the traditional on-demand reverse proxy, except instead of exposing the private endpoint through a public HTTP listener, it binds the shared resource onto an OpenZiti network, where it can be accessed securely by another zrok client. This "other" zrok client exposes an HTTP listener wherever the user wants... but it's usually put on the loopback interface of that user's system. This allows the user to securely access the shared resource on their system as if it's local, even though it's somewhere else on a zero-trust network. > As we've started working through the development of v0.3, we've realized that we can incorporate other useful capabilities, like streamlined file sharing (elegant WebDAV integration is coming). From a quick look, it seems that the self-hostable part (https://github.com/openziti/zrok/blob/main/docs/guides/v0.3_self_hosting_guide.md https://github.com/openziti/zrok/blob/main/docs/guides/v0.3_...) is written in Go, and there are SDKs for connecting to it from a variety of languages. Oracle has an article on the underlying network layer which is called OpenZiti, which defines ZeroTrust: > Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned). Authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established. All of this sounds very interesting to me, but I have no experience with these kinds of network stacks. Has anyone here evaluated it? Would this be useful for adding document sharing to applications I write, for instance, a hypothetical word processor? I mean sharing with other people working on a document. The SDKs seem to be clients, so to interchange files between two applications with an embedded SDK, does it still need a third machine running an API server?

michaelquigley 4y ago
> Would this be useful for adding document sharing to applications I write, for instance, a hypothetical word processor? I mean sharing with other people working on a document. The SDKs seem to be clients, so to interchange files between two applications with an embedded SDK, does it still need a third machine running an API server? We could certainly incorporate an "embeddable" SDK so that zrok can be incorporated into other applications. As it currently stands, you would need access to a zrok "service instance" ("cloud"), running the zrok controller (providing API access). But we could certainly look at other kinds of use cases where that control plane is potentially enabled ephemerally or on-demand. I have some ideas for things we might be able to do. Neither of these are on the immediate roadmap. But if people ask for them, we could certainly build them.

codethief 4y ago

How does this compare to Tailscale, beyond being based on OpenZiti instead of Wireguard?

dovholuknf 4y ago
I am a dev on the OpenZiti project. I personally think Tailscale is more similar to OpenZiti. It's making wireguard administration really easy. zrok is very clearly based heavily on inspiration from the amazing tool called ngrok. If you haven't checked them out you should. They are widely loved for lots of good reasons. Other product/projects in this category is Tailscale's funnels or Cloudflare tunnels. Key differences to ngrok are it being fully open source and fully self hostable. zrok allows you to do public/anonymous type sharing too but also has this private sharing feature that you might find neat. Basically it'll hide your app behind two "localhost" type proxies all transparently (to most people).
- bogwog 4y ago
  I just looked up ngrok right now and it looks really cool, but I wonder what people actually use it for? Are people actually running production software this way, or is it just for sharing e.g. demos with coworkers? If the latter, it seems to me like a narrow use case that can already be served by automated devops stuff. Again this is new to me, so I'm probably missing some obvious use cases. Do you use it for anything in particular?
  - dovholuknf 4y ago
    Easily sharing local resources is a common need as a dev, for sure. If I'm making changes to a web form, updating online doc, etc. it's dreadfully convenient to just share that resource for some short amount of time... I've used similar tech when collaborating with a fella recently, he stood up a vault server and I hit his private API over an ngrok share because that was the tool he had used, liked and was familiar with. It's just super handy to do that sort of thing when/as you need to
  - Agrue8u 4y ago

kerkeslager 4y ago

This... sounds like something I would be interested in, but I cannot for the life of me understand what this does. Is this decentralized file sharing?

dovholuknf 4y ago
It's more peer to peer file sharing and web content sharing than truly distributed sharig but with a globally available service, it's "distributed" ina way. It's not doing sharding or anything fancy like that (yet anyway). Right now, it's a dev-focused tool similar to the other projects out there like ngrok/tailscale funnels/cloudflare tunnels etc. There's a fair number of them now-a-days. :) But it doesn't need to stay that way and might change. This one is built on top of OpenZiti (I am a dev on that project) which is a secure, zero trust overlay network. It's fully self-hostable and open source which some people find attractive. The hosted version our company is sponsoring for free (at least 'for now'). The key goal is to make it super easy and safe to share files/web content.
spaniard89277 4y ago
It seems to me that is some kind of tunnel/vpn a-la-zerotier?
- dovholuknf 4y ago
  Trying to keep it short, I would say OpenZiti is similar to zerotier moreso than zrok. This zrok tool though is closer to ngrok. I mentioned that in another comment so hopefully that's easy enough to find in the page.
- AlbertoGP 4y ago
  In this video from 11 months ago, at 25 min. they say this: “Ziti is only providing a pipe. That’s also very important. Some people might think that there is more going on there, but Ziti is literally, just… just a black hole, from one side to the other, and how it gets there… it’s like an SSH tunnel. https://www.youtube.com/watch?v=qyjM5y8Op_I&t=1509s https://www.youtube.com/watch?v=qyjM5y8Op_I&t=1509s He goes on to say “I’m going say it publicly: my mission is to kill REST. […] I’m going to bring us all the way back to the 1990s, and we’re going to do RPC all over again” The linked article is about Zrok, which seems to be an application on top of that OpenZiti overlay network on top of the Internet.

omani 4y ago

[flagged]

wyager 4y ago
The fact that whatever you're talking about has a blockchain built in tells me everything I need to know.
vineyardmike 4y ago
The purpose of the shared project has nothing to do with nkn, either in usage or ahem a blockchain. The shared project is more of a p2p VPN to access remote services privately, as opposed to a VPN for accessing the broader internet. Yes, there are other services that do something similar to Zrok, but this actually builds on one (openZiti) presumably to handle the connections more abstractly (and also presumably to launch their own paid SaaS endpoint?). I could see this more competing with Tailscale to access Internal tools at a company, or for home-lab users who want to access/share services they're running remotely.
orthecreedence 4y ago
How is NKN different from, like, the internet? Nothing on the homepage tells me why there is a blockchain involved. Nothing it talks about cannot be done with TCP/TLS/etc etc. If it's a p2p framework then something like libp2p, holochain, or p2panda would be much more appropriate than a blockchain with "incentivized miners" (incentivized to do what??). I think the reason people are reinventing the wheel is because blockchain tech has extremely limited use-cases and all the people who tried (or are trying) to use it outside of its applicable domain are misguided, prompting further exploration into the p2p space that isn't tethered (no pun intended) to a global state that has to be shared by every node in the system which is an inherently unscalable solution for anything beyond a handful of performant nodes (ie, sharing transactions between banks or something).
- omani 4y ago
  > (incentivized to do what??) to route traffic. NKN is a CHORD overlay on top of the internet. clients connect to nodes and nodes route traffic from one node to another until the packet reaches its destination. clients stay anonymous (no IP leakage). end-to-end encrypted communication. "Proof-of-Relay" algorithm for mining. consensus via MOCA. the only state of the art blockchain technology I know of. and they dont even pay me to say this.

deleted 4y ago

[deleted]

Maursault 4y ago

I doubt Activision cares, but what does this have to do with Infocom and Z-machine?

dovholuknf 4y ago
man, those were the days. I actually played it on my Atari 800
cyberge99 4y ago
I thought about the American muscle car: Camaro I Roc Z
- mxuribe 4y ago
  I'm glad i was not the only one thinking the same! lol :-D

jhoechtl 4y ago

Can this be used for a P2P pair editing session?

tpoacher 4y ago
maybe it could be used to share a tmux session? (which is my favourite way for collaborative editing)
- dovholuknf 4y ago
  Not at this time. Right now zrok is for web (http) and file sharing. It's possible that sharing other UDP/TCP type sharing could be added in the future. Right now the overlay network (OpenZiti) would be able to support that right now if you were looking for any TCP/UDP.
dovholuknf 4y ago
I wouldn't think so tbh. Unless whatever editor you're using is sharing a web resource... In that case, sure. If you need/want UDP/TCP type sharing you could use the underlying OpenZiti overlay network for that, but out of the gate, at this time I don't think it'd support most "P2P editing". zrok certainly doesn't provide that type of functionality at this time

deleted 4y ago

[deleted]

squarefoot 4y ago

Seems interesting, but I think it needs some use case examples to show how it differentiates from a tunnel, VPN etc. As an example, would it be the right tool to access IoT data from small sensors (and actuators, therefore two ways) in a private LAN from external machines, including mobile, on untrusted public networks? Or what if I wanted on all my laptops a shared directory that replicated on all machines what is being written on one, no matter which networks they're connected to, NAT etc. etc...

dovholuknf 4y ago
I said somewhere else in the comments I was working with a fella and he shared his vault instance with me via ngrok (zrok didn't exist at the time). So ngrok/zrok are great, dev-focused tools (p2p). (zrok might grow past being a great dev/p2p-focused tool too) For what you're describing, the OpenZiti overlay might be more your ball of wax. It's a bit more complex than just "share" this and "access" that so there's more to learn (which is why ngrok/zrok are so nice, they are *EASY* to use) but you might find value in the tech that is under zrok, that OpenZiti overlay

whisk 4y ago

Okay, after reading the homepage of OpenZiti, now I have a zero-trust-phobia.

aidenn0 4y ago

What does "zero trust" mean in this context? I assume the network isn't trusted, but is anything else trusted? How are peers authenticated and/or authorized to access a zrok end-point?

dovholuknf 4y ago
There's always a "root" of trust somewhere/somehow. Ideally it's a human that you trust. In the case of zrok, it uses a secure zero trust overlay provided by openziti. you "enabling" zrok in your shell is that root of trust. you get a x509 certificate which is then used to attach to the zero trust overlay. On the other side when you "zrok access" you provide a unique token that has been shared with you by someone you trust (presumably). So you, as the person doing the sharing are the real "root" of the trust. You're trusting that zrok isn't compromised and that the certificate that is returned to you from the overlay is trustworthy etc. I could go on - but that's hopefully enough of an overview
- aidenn0 4y ago
  Thanks; that's exactly the ELI5 I was looking for.
  - PLG88 4y ago
    Along those lines, I wrote a blog on how I described my job and zero trust to my daughter (who is 5) by using Harry Potter analogies - https://netfoundry.io/demystifying-the-magic-of-zero-trust-with-my-daughter-and-opensource/ https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...

fellellor 4y ago

So it’s like cloudflared or localtunnel?

dovholuknf 4y ago
Similar yes. Open source and self hostable are notable differences, but yep.

parentheses 4y ago

How is this establish a route to an IP that cannot be routed directly to? Sounds like there’s a central server to coordinate and transmit piped data. If so, does the central server have to transmit all data?

dovholuknf 4y ago
Yes that's exactly correct. The underpinning of zrok is an OpenZiti overlay network. That network relies on a fabric of routers all meshed together. (self hosters would probably have _one_ router, but you get the point). Both ends attach to the overlay, then the overlay mesh fabric is responsible for getting traffic from one place to the other securely in a zero trust way (you can read about OpenZiti if you want but I think you 'get it' already, but let us know if you have other questions)

apitman 4y ago

Always happy to see more open source options in this space. I maintain a list of similar tools (including OpenZiti) here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

dovholuknf 4y ago
I put a PR up for zrok... :) https://github.com/anderspitman/awesome-tunneling/pull/82 https://github.com/anderspitman/awesome-tunneling/pull/82
PLG88 4y ago
Nice work on maintaining that by the way! Can we get zrok added to the list of 'Open source (at least with a reasonably permissive license)'??

byteshock 4y ago

Very interesting product! How does this compare to something like Nebula? Have you done benchmarks against other solutions? If i remember correctly, Nebula implements its own protocol and underperforms compared to Wireguard. Is this the same case? Looking forward to trying it out!

PLG88 4y ago
I am writing some comparisons to other tech incl. Nebula, its not publicly published yet, but I can give a few bullets. WRT to performance, better to compare OpenZiti to Nebula rather than zrok, we did some last year - https://netfoundry.io/benchmark/benchmarking%20open%20source%20networking.pdf https://netfoundry.io/benchmark/benchmarking%20open%20source.... A few points of comparison: - Nebula is focused on connecting machines, OpenZiti is on securing services. This is due to Ziti implementing zero trust networking principles – e.g., you can authorize only a single port without needing to set up ACLs or firewall rules. - While Nebula requires open inbound ports or UDP hole punching, OpenZiti allows you to have all inbound and most outbound ports completely closed while providing truly private, zero trust DNS entries with unique naming – if you wanted to call your service "my.secret.service" you can do that, it does not force you to have a valid Top Level Domain. - OpenZiti also goes a layer deeper to bring zero trust principles directly into your application. If you're a developer, you can embed all those ideas into your app and not rely on the network or side-loaded agents. This is both client and server-side and doesn't require the app to "listen" on an IP address (the underlay). Instead, you can choose to "listen" on the overlay.

edpichler 4y ago

So is it like Tailscale (amazing btw) but, instead of secure connecting computers, I can secure connect services?

PLG88 4y ago
zrok.io is more comparable to Tailscale Funnel. Lets break this down :) - Tailscale Funnel is their feature to allow you to route traffic from the wider internet to one or more of your Tailscale nodes (public sharing). It is closed source SaaS. Tailscale is a SaaS built on open source wireguard. - zrok.io is a SaaS for public or private sharing of content, files, websites, webhooks etc. It is built on top of zrok, an open source 'ziti-native' app. It is built on top of OpenZiti which is also open source. If you want SaaS, then we have CloudZiti. To the 2nd part, 100%. Wireguard (and thus Tailscale) is focused on connecting computers as default-open. Ziti connects services, default-closed, without the need for firewalls, ACLs etc. Myself and another wrote deeper comparisons on this thread so I will just link there: - https://news.ycombinator.com/reply?id=34713131&goto=item%3Fid%3D34709487%2334713131 https://news.ycombinator.com/reply?id=34713131&goto=item%3Fi... - https://news.ycombinator.com/reply?id=34714123&goto=item%3Fid%3D34709487%2334714123 https://news.ycombinator.com/reply?id=34714123&goto=item%3Fi...

p4bl0 4y ago

The file sharing part of this project made me think of RetroShare (https://retroshare.cc/ https://retroshare.cc/). Too bad this project never really had traction. It was really file sharing + social network in a truly decentralized fashion.

prmoustache 4y ago
Retroshare may not be viable as a worlwide social network but it is definitely useful for smaller circles, families, etc. AFAIK it is still maintained.

Uptrenda 4y ago

It says it uses an over-lay network? If the topology is just like: peer A <---> overlay (server N ...) <---> Peer B And your design is to try get packets between the peers then this is going to be very slow. They will have to go via the routes on the overlay network which may have multiple virtual hops to reach their destination. This is a massive increase in round trip time. I'm not sure if I understand the solution right though as I took a brief look. But I don't see how this solves port forwarding or NAT issues as the actual instances still need to be publicly reachable. I wrote a library for peer-to-peer networking recently and unlike libraries like Libp2p -- my emphasis was on getting direct connectivity to work between peers. I'm not using an overlay for this. I use a range of techniques [direct cons, reverse con, tcp hole punching, TURN] to make the connections happens. With some minor signalling traffic happening over public MQTT servers. My software is at https://github.com/robertsdotpm/p2pd https://github.com/robertsdotpm/p2pd if anyone finds it interesting. Sorry for the shameless self-plug but I figure it is related. We're both free open source projects. I don't provide a tunnelling solution but you could easily build something like ngrok with this software without relying on proxying as the primary solution. Currently the software has no way to easily get another peers 'address' so using this will need to solve that problem. But a simple key-value store would be enough tbh. Going to improve usability when I next have time.

PLG88 4y ago
While OpenZiti can do P2P connections, having a overlay in between gives you many advantages incl. outbound connections at source/destination to circumvent NAT/port forward/inbound ports etc. What's cool about it is that we built the overlay to do smart routing so it calculates the lowest latency paths and rebuilds, thus, as you have more nodes, you have the ability to actually circumvent BGP and deliver lower latency. We welcome the shameless plug, everything open source is our friend! zrok solves the peer address issue by providing the reverse proxy so that you can share a URL for public share or endpoint and URL for fully private share.
- Uptrenda 4y ago
  It's a cool idea. I do see the use-cases for it. What you said about BGP is also interesting.

StopHammoTime 4y ago

Is this hitatchi

PLG88 4y ago
Do you mean Hamachi? Hamachi is a VPN capable of establishing direct links between computers that are behind network address translation (NAT) firewalls without requiring reconfiguration. zrok is a reverse proxy to easily share resources (http, files, web content) via a public URL or private share. zrok is built on top of OpenZiti. OpenZiti is more comparable to Hamachi but being open source, more powerful and modern.

robtherobber 4y ago

I hope a GUI will emerge from this, enabling the comfortable, the less knowledgeable and the less technical to avoid fiddling with terminal commands and all that.

PLG88 4y ago
We had this question in another thread so I will copy paste the answer :) Yes! We're currently targeting an end-user UI for v0.5. My crystal ball is imperfect with regards to timing, so don't hold me to it... but I would imagine that this will probably come out sometime in the summer. https://github.com/openziti/zrok/issues/221 https://github.com/openziti/zrok/issues/221 And I would imagine some sort of mobile-first interface would happen after that.
- robtherobber 4y ago
  I did not expect anyone to answer my comment, so many thanks for that. I actually look forward to the UI.