5 ms·
Mycoria is an open and secure overlay network that connects all participants
- doener 2y agoVia https://news.ycombinator.com/item?id=43923287 https://news.ycombinator.com/item?id=43923287
- ghostrss 2y ago[flagged]
- ramaro 2y agoThis looks really interesting and great job on the docs! I need to give it a shot but the first question that comes to mind is if mycoria exposes the full node in the network, requiring the use of a firewall to restrict access to ports, etc? Asking because this is something that is required in yggdrasil: https://yggdrasil-network.github.io/faq.html#will-my-machine-be-exposed-to-other-users-of-the-network https://yggdrasil-network.github.io/faq.html#will-my-machine...
- dhaavi 2y agoMycoria is secure by default and requires pretty much no configuration to set up. No-one can access your device by default. You have to actively allow them via the "services" section in the config.
- tornadofart 2y agoLooks interesting. What I understood: it is basically overlaying privacy and net neutrality on the internet. I am therefore restricted to communicating with other users of mycoria and can't access "the whole Internet" via mycoria. Am I correct? What isn't clear for end users, IMO: - What's the primary use case it was built for? Are there applications using it for chatting / exchanging data / whatever? - what's the difference to similar projects like, say, yggdrasil? - what's the difference to using a VPN?
- dhaavi 2y agoYes, the primary focus is connectivity within the network. You can use it for pretty much anything you would use a VPN for, but it is much easier to configure and secure by default with a built-in firewall. Only services you actively expose are reachable by others - by default nothing on your device can be accessed by others. In the future, it will also provide some amount of privacy on the network. I think the biggest user-facing difference is the ease of configuration (ie. none) - if Mycoria had proper installers.
- gspr 2y ago> You can use it for pretty much anything you would use a VPN for, but it is much easier to configure Ease of configuration is very much also a feature of the finest VPN software I've ever used, Wireguard.
- dhaavi 2y agoWireguard is absolutely great for its use case! Mycoria aims to interconnect participants. Eg. you and your friend all have their home server. Everyone wants to connect to their own server, but also to the server of their friends. All of this is super easy with Mycoria. Let a new friend install Mycoria, add them to your friends in the config and give them a URL for accessing. Voila! Also, Mycoria is an automatic mesh network, I think Wireguard requires a fixed set of peers you configure.
- gspr 2y agoYou certainly can add an remove peers from your Wireguard network on the fly. Granted, this is something you have to do yourself, not something Wireguard has automatic tooling for, so I guess that's a difference :)
- ignoramous 2y ago> Wireguard requires a fixed set of peers you configure Not really. One can add as many peers (though there's a artificial limit to just how many, I think) at runtime. It isn't fixed. Products like Tailscale couldn't be built otherwise.
- dhaavi 2y agoAuthor here - thanks for the post! A little more background info for my fellow HN people: I've spent that last 8 years building privacy technology at Safing as Co-Founder/CTO. The biggest technological achievement there was undoubtedly the SPN (previously called Port17/Gate17): A privacy network (ie. a layer-5 proxy), fitting in the niche between VPNs and Tor. Impossible to misconfigure, good speeds and way superior privacy to VPNs using onion encryption and decoupled authentication/authorization. Funnily enough, this (decoupled auth) is what was later implemented by Apple Private Relay and Google One VPN. SPN worked great for the most part, but scaling was hard. With the decision to make it a layer-5 proxy for decreased metadata and improved privacy, this meant that also traffic and congestion control had to be re-implemented - no easy feat, and still causing issues. Meanwhile, I have followed and read a lot about cjdns and Yggdrasil over the past few years and was intrigued by their ideas how to do networking. After some interesting talks in November 2023, I was at the point where I just wanted to know how far I would get - with all the experience and knowledge I had up to that point - implementing a scalable layer-3 mesh network, that still allowed for some privacy and full security. I spent most evenings of a couple months building it and was surprised how well it went. Sadly, after a decent MVP and a first friend using it in small scale production, I did not have the time to work on it further. But I am currently starting a new project, where I will make good use of it, so it will see quite some more development in the coming years! So, Mycoria works, at least on small scale for now, but is more or less MVP. Thanks for reading, I hope you have fun poking around and trying it out! I am also happy to answer any questions you have here!
- tornadofart 2y agoGreat technical achievement. What is, for you, the sweet spot between VPN and TOR? What's the tradeoff there?
- dhaavi 2y agoIf you want Tor for your _whole_ existing system, not just the browser, good luck. If you want actually good privacy with a VPN, also good luck with that. (There are very few good companies doing the best they can here, but they are still limited technologically.) SPN can be seen as my attempt to solve both of these issues.
- attila-lendvai 2y agois this something like libp2p, but comes bundled with some tools to be a standalone thing? a rationale/comparison section on the front page would be nice.
- dhaavi 2y agoInteresting, did not expect that question. I would have thought libp2p is library enough to not be comparable. Am I wrong? Mycoria is a ready-to-run software.
- sibellavia 2y agothat's correct. libp2p is designed as an agnostic library that could be used in projects similar to Mycoria. it offers the building blocks to build a p2p network. as a side-note, I've tried to use libp2p in the past, but ended up writing transports, NAT traversal, and fundamental structs for my p2p network from scratch, ditching libp2p.
- jonathanstrange 2y agoIMHO, libp2p has the worst API and project structure I've ever seen in an open source project. The project almost feels like sabotage. For example, I once asked whether there is an example of using libp2p to send one file from an endpoint to another one. Someone answered a year later and explained that there was no such functionality. They were really surprised someone might want to use libp2p to send a file from A to B. I eventually figured out how to do it but decided not to use the library. However, there is still a real need for an easy to use p2p library for Go that can do some NAT traversal. It's a real pity that the developer of github.com/perlin-network/noise stopped working on it.
- rixed 2y agoDid you eventually made your work available somewhere?
- attila-lendvai 2y agoalso, how does this compare to something like https://ethswarm.org https://ethswarm.org ?
- dhaavi 2y agoI'll have to read up on that. But to be honest, the web3 / blockchain vibes are an instant turn off. (Let's see how the votes turn out for this comment. ;) ) Note: If you _need_ a blockchain in your VPN, I would say https://nym.com/ https://nym.com/ is the most trustworthy of them out there at the moment.
- tornadofart 2y agoBlockchain- the tech still waiting for its use case :)
- jksflkjl3jk3 2y agoEvading government capital controls and taxation has proven to be a pretty solid use case, even if frowned upon by some.
- ignoramous 2y ago> Note: If you _need_ a blockchain in your VPN, I would say nym.com is the most trustworthy of them out there at the moment. There's a wholespace of what's known as "dVPNs". I like the concept behind saurik et al's https://orchid.com/vpn https://orchid.com/vpn; it was specifically marketed as a Tor replacement (with built-in micropayments): https://news.ycombinator.com/item?id=15576457 https://news.ycombinator.com/item?id=15576457
- thenthenthen 2y ago(How) does this deal with DNS poisoning like the GFW ?( https://dl.acm.org/doi/10.1145/2994620.2994636 https://dl.acm.org/doi/10.1145/2994620.2994636 )
- dhaavi 2y agoThe DNS is not central. Everyone maintains their own local mapping. When accessing a website on mycoria, you open a ULR like this that first creates the mapping and then forwards you to it: http://router.myco/open/speedtest.de.myco/fd13:6239:a07a:eb46:2d51:52f:d4e1:6d0c/ http://router.myco/open/speedtest.de.myco/fd13:6239:a07a:eb4...
- 9dev 2y agoHave you seen Reticulum[0] yet? How much overlap does the Mycoria networking layer have with it? [0]: https://github.com/markqvist/Reticulum https://github.com/markqvist/Reticulum
- dhaavi 2y agoI think I have seen it, but that was a while ago. Will read through it later! Thanks!
- Ey7NFZ3P0nzAe 1y agoI too am very interested in the difference with reticulum
- ilaksh 2y agoHow does this compare to tinc?
- immibis 2y agoSeems more like a Yggdrasil or Reticulum type of project than a tinc or Wireguard.
- OsrsNeedsf2P 2y agoWhat is the average latency of this? I was running a game server on I2P for fun (since I was getting ~100ms ping vs 600ms on Tor) but I'm curious if this can do better
- dhaavi 2y agoIt's quite fast. Especially if you host a server near you and connect to it.
- dgrr19 2y agoIs this like tailscale?
- sebstefan 2y ago> Every Mycoria Router has an ID. For example: > fd1f:2cf7:903:b50b:e4cb:5c4c:270e:360c > This does not merely look like an IPv6 address, it is one. But it's also more than that: These addresses are generated by first creating a public/private key pair and then hashing the public key. This means, this IPv6 address is also the fingerprint of the public key of the router > This way you can distribute both the Mycoria address of a router and its public key with a single data point: An IPv6 address. What? * Then how does a computer figure out how to ping that? * You say it's distributing both the address and the public key with a single data point, but you're hashing it. So, you can restore the public key from the IP if you already know the public key, does everyone store every public key that's currently in use? Are there central stores somewhere that are eventually consistent?
- goodpoint 2y agoDoes it do onion routing like Tor? Does it protect from traffic correlation or timing attacks?
- dhaavi 2y agoNope. I did that with the last network I built: https://safing.io/spn/ https://safing.io/spn/ Mycoria focuses a more on scalability, but still has some privacy focus.
- elia_42 2y agoVery interesting. I really enjoyed reading how you handled scalable routing with geo-localised prefixes and with the distance between addresses for packets within the same country code.
- dhaavi 2y agoThanks!
- eqvinox 2y ago> No spooking: Everthing is authenticated This does generally mean no anonymity (and limited privacy)…
- scoot 2y agoShould it say "No spoofing" rather than "No spooking"?
- dhaavi 2y agoIf nobody knows who you are, you are still anonymous, even if there is an ID. With private addresses (in the future) this will also be solved, as Mycoria will be able to temporary addresses / IDs.
- eqvinox 2y agoIt'd help if you could clarify what "everything is authenticated" really means, I can't find it on the website. Do you just mean the fact that things are bound to the cryptographic ID in the address?
- mattlondon 2y agoI love these sort of things generally from a technical perspective (I kinda have these fun day-dreams of a cadre of cool nerds and geeks setting up their own commune-networks against all odds in some distant future where they just have basic infrastructure etc)... But ultimately I always feel uneasy and reluctant to get involved in general decentralized type things as I feel like I'll just be facilitating people sharing/distributing kiddie porn. At least with Tailscale things are "private", but with this it feels like I would be part of the wider network. Will I be using my nodes to help route CP traffic?
- lez 2y agoYou must abolish all privacy from the internet, and even then, you wouldn't be able to stop CP to happen. Good luck, Mr. Big Brother!
- aethertron 2y agoDoes my computer get involved when person A sends something illicit to person B? As a normal user on the internet, no. That's between them, and the law only deals with them. With certain decentralised anonymous systems, the answer is different. Now there are legal liability issues, at least.
- Lerc 2y ago"Gracious madam, I that do bring the news made not the match."
- linsomniac 2y agoThe biggest reason I've never run a Tor exit node, either back when I was running a hosting company or now that I have unmetered gigabit (with 10 gig available) is that I don't want the feds to come knocking about CP and the like activity on my IP.
- lionkor 2y agoAnything you build will eventually be used for something illegal. The Internet should never have been invented, then, right? Same with letters, Facebook, cars, guns, knifes, farming, ...
- theknarf 2y agoHow does this compare to Veilid (https://veilid.com/ https://veilid.com/)?
- dhaavi 2y agoVeilid is new to me, will have to read about it first. Thanks the pointer!
- immibis 2y agoYet another one. How is it different from Yggdrasil and Reticulum?
- dmos62 2y agoImpressive. I like ZeroTier, would you consider Mycoria a dropin replacement?
- dhaavi 2y agoProbably - depending on your use case. Mycoria is still more or less MVP though.
- eabeezxjc 2y agoreticulum.network
- namecast 2y agoThis is very cool @dhaavi! Can definitely see where you've taken lessons learned from cjdns and yggdrassil. I hate to nitpick but this project looks promising enough - and the new project you mentioned interesting enough - that I feel the need to. From your FAQ: > First, there is some structure to the router IPs. While there are special purpose prefixes, most IPs will be in a geo-marked prefix. Every country (+ States in the US) has their own prefix within Mycoria. This means that on the global level, Mycoria routers in the same country share the same prefix. These prefixes are also (tendentially) similar to nearby countries. Second, within a country prefix, Mycoria uses address-distance routing. This means that packets are sent in the direction of the "address-nearest" other router known. While this is not the most efficient way to route packets, it does work quite well with some additional steps - especially if confined to a smaller geographic region, as Mycoria is doing. My commentary: One of the unfortunate lessons we learned from the IPv4 internet and management of IANA IPs by the different RIRs (and the subsequent tagging of IPv4 blocks with geographic information) is that layer-8 folks love the idea of layering policy on top of geographic tags. (E.g.: Maxmind says your address is in Pakistan, and according to Pakistani law content offered by another address is verboten, ergo you are blocked.) Geographic awareness built in to network prefixes may be used against your users in ways that you'd prefer to avoid. Or perhaps it's an acceptable tradeoff for you - it's easy to envision scenarios where 'the juice is worth the squeeze' and users derive enough benefit from geo-aware prefixes to accept the drawbacks. If it's the former, I'd recommend investigating moving from geo-aware prefixes ("I'm within X miles of other people in this jurisdiction") to latency-aware prefixes ("I'm within X ms of other people within this prefix"). (Steelmanning my own recommendation - it's possible that anyone trying to implement layer 8 policies on top of geographical-aware prefixes will just willfuly misinterpret latency-aware prefixes as being close enough to them, which would mean a lot of wasted effort for nothing). Anyway, just my two cents. Again, very cool project, looking forward to seeing what you build on top of it!
- dhaavi 2y agoThanks for taking the time for this feedback. This is what I hope to solve with the private addresses: These are not geo-marked and not routable. Eg. they are randomly generated and cannot be attributed to a geographic location (easily).
- csande17 2y agoI might be totally missing something here, but does Mycoria attempt to prevent network participants from learning the public-Internet IP address corresponding to a Mycoria router ID? The "iana" field in the configuration kind of suggests that this is not a goal, and this system is basically Tailscale but with IPv6 and a global namespace. But if this is the case, I don't really understand the emphasis on "routing", since pretty much every Internet host can reach pretty much every other Internet host directly using NAT traversal techniques (like BitTorrent does). If you are trying to hide public-Internet IP addresses (like Tor hidden services do), the routing scheme still doesn't make a ton of sense to me, because presumably you wouldn't want to leak data by picking routes with a deterministic or latency-dependent strategy.
- dhaavi 2y agoMycoria is built for resilience - so not relying on the current Internet backbone working flawlessly. Even if the current Internet works "normally", many users of similar network have reported better connectivity with the overlay network routing. Eg. routing on the IANA Internet is highly influenced. If you let Mycoria generate a config for you, it will include your current public Interfaces on the device, so this will only be true for servers. Mycoria does not rely on IANA addresses, but uses them to improve the network structure automatically: Finding better routes between routers over the IANA Internet.
- deleted 2y ago[deleted]
- krunck 2y agoThere are so many projects like this but how many have had an outside audit of their code? Yay, it's got encryption and stuff! But how well has it been implemented?
- TeeMassive 2y agoThis reminds me of my old university days where we would setup a Minecraft server and make it accessible through Hamachi (which has enshitified and therefore never really took off beyond those simple use cases). Semi-public authorized access networking really is the future of a more private but more distributed Internet in the age of state sponsored hackers and IoT DDoS bot farms.
- deleted 2y ago[deleted]
- Inuit 2y ago[dead]
- TeeMassive 2y agoI'm not that experienced in VPNs and other distributed services. Can I use this to access my self-hosted servers at home and access them from the outside; without having a VPN or a reverse-proxy? Or, "explain like I'm 5" version, can I use this to host my Minecraft server at home and play with my friend?
- areyourllySorry 2y agonot saying you shouldn't build things, but maybe your efforts would be more useful if you were contributing to already existing networks like i2p
- KennyBlanken 2y agoNot just i2p - there are established, existing projects nearly identical. Most of these have fallen on their faces because they can't get sufficient adoption rates, and a big part of that is because they refuse to acknowledge that 90%+ of the desktop computer market isn't running Linux or BSD. Some of them include a half-assed attempt at a Windows client and few if any support MacOS despite it having something like 20-30% of the desktop market
- johnisgood 2y agoPlease provide a list of existing projects. I want to look around.
- dovholuknf 2y agoThe project I am a maintainer on, OpenZiti is an open source project that has high-quality MacOS, iOS, Windows, Android and linux clients https://openziti.io/docs/learn/introduction/ https://openziti.io/docs/learn/introduction/ OpenZiti underpins the private connectivity from zrok, another opensource project and is one of the ones that is __not__ riding on wireguard which many people think is a good thing, but sometimes people are interested in a wireguard-based approach. There is a huge list of alternatives as well you can find at https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling. You can find OpenZiti and zrok on there but the github urls if interested are https://github.com/openziti/ziti https://github.com/openziti/ziti and https://github.com/openziti/zrok https://github.com/openziti/zrok
- deleted 1y ago[deleted]
- 1y ago
- pidgeon_lover 2y agoHow does this compare to zrok (https://zrok.io/ https://zrok.io/)? Looking forward to experimenting, though I'm a little worried as it sounds like it's not private by default.
- dhaavi 2y agoFor the use case given by Zrok, Mycoria is very similar. Nothing can access your device by default. You will have to define services and add "friends" (your other devices) to allow them to access.