13 ms·

Dumb Pipe

• zb3 1y ago
  You mean using "curl | sh" is a dumb pipe? Well, couldn't agree more :)
• Liftyee 1y ago
  I wonder how much reimplementation there is between this and Tailscale, as it seems like there are many needs in common. One would think that there are already low level libraries out there to handle going through NATs, etc. (but maybe this is just the first of said libraries!)
  • mpalmer 1y ago
    This is made using iroh, which aims to be a low level framework for distributed software. Involves networking but also various data structures that enable replication and consistency between networked nodes.
    • danenania 1y ago
      Does it include reconnection logic? I presume that's not considered "low level", but it does always annoyingly have to be reimplemented every time you deal with long-lived socket connections in production.
      • b_fiive 1y ago
        yes, to an extent. It will time out if the connection completely dies for more than the timeout interval, but all connections are designed to survive changes to network changes like IP address or network interface (eg: switching from WiFi to ethernet, or cellular)
  • max-privatevoid 1y ago
    iroh is meant to be this library, but there is also libp2p, which existed before iroh.
    • binary132 1y ago
      Part of the problem with libp2p is that the canonical implementations are in Go which isn’t really well-suited to use from C++, JS, or Rust. The diversity of implementations in other languages makes for varying levels of quality and features. They really should have just picked one implementation that would be well-suited to use via C FFI and provided ergonomic wrappers for it.
  • cr125rider 1y ago
    Isn’t tailscale a wrapper around WireGuard? With some other hole-punch sprinkles?
    • nine_k 1y ago
      ...and DNS, and host provisioning, and SSO, and RBAC, and other stuff you need to sell to enterprises.
    • odo1242 1y ago
      Well, WireGuard and WebRTC, but yes. The real feature of Tailscale is being able to connect to devices without worrying about where they are.
      • bradfitz 1y ago
        There's no WebRTC in Tailscale.
        • snapplebobapple 1y ago
          Isnt a derp server juat webrtc with minor changes?
          • rollcat 1y ago
            You don't need the whole of WebRTC for NAT traversal, TURN/STUN will do the job.
      • homebrewer 1y ago
        You might be confusing it with netbird, which is the 601st implementation of a mesh network that does use both WebRTC and WireGuard.
      • odo1242 1y ago
        Edit: apparently it uses STUN/TURN but not WebRTC
    • scosman 1y ago
  • benreesman 1y ago
    Theres overlap but i can see complementary uses as well. It uses some of the same STUN-family of tecniques. I have no plans to stop using TailScale (or socat) but i think i use this every day now too.
  • TechDebtDevin 1y ago
    Connecting phones on mobile/cignat with Tailscale is really one of the few software "Aha" moments I've had.
  • homebrewer 1y ago
    Who cares at this point, Tailscale itself is the 600th reimplementation of the same idea, with predecessors like nebula and tinc. They came at the right time, with WireGuard being on the rise, and poured millions into advertisements that their community "competitors" didn't have since most of them isn't riding on VC money.
    • api 1y ago
      I've met a lot of people who think Tailscale invented what it does. Prior to Tailscale there were companies -- ZeroTier and before it Hamachi -- and as you say many FOSS projects and academic efforts. Overlay networks aren't new. VPNs aren't new. Automated P2P with relay fallback isn't new. Cryptographic addressing isn't new. They just put a good UX in front of it, somewhat easier to onboard than their competitors, and as you say had a really big marketing budget due to raising a lot when money was cheap. Very few things are totally new. In the past ten years LLMs are the only actually new thing I've seen. Shill disclosure: I'm the founder of ZeroTier, and we've pivoted a bit more into the industrial space, but we still exist as a free thing you can use to build overlays. Still growing too. Don't have any ill will toward Tailscale. As I said nobody "owns" P2P and they're doing something a bit different from us in terms of UX and target market. These "dumb pipe" tools -- CLI tooling for P2P pipes -- are cool and useful and IMHO aren't exactly the same thing as ZT or TS etc. They're for a different set of use cases. The worst thing about the Internet is that it evolved into a client-server architecture. I remain very cautiously optimistic that we might fix this eventually, or at least enable the other paradigm to a much greater extent.
      • rollcat 1y ago
        I know it wasn't a "new" idea, but still, ZT was a paradigm shift for me. I was suddenly on the same LAN with people I cared about. Thank you for making it happen.
      • udev4096 1y ago
        As much as hyped tailscale is, at least there is an option to fully self-host coordination server. Do you have something like that?
  • conradev 1y ago
    Iroh is much better suited for the application layer. You can multiplex multiple QUIC streams over the same connection, each for a specific purpose. All you need is access to QUIC, no virtual network interface. It’s a bit like gRPC except you control each byte stream and can use one for, say, a voice call while you use another for file transfer and yet another for simple RPC. It’s probably most similar to WebRTC but you have more options than SCTP and RTMP(?).
  • rklaehn 1y ago
    Iroh is one of these low level libraries. It is basically p2p QUIC, where p2p means 1. addressing by node id and 2. hole punching. Dumbpipe is meant to be an useful standalone tool, but also a very simple showcase for what you can do with iroh.
• qudat 1y ago
  At pico.sh we built something similar but using SSH: https://pipe.pico.sh https://pipe.pico.sh
  • geek_at 1y ago
    in a direct benchmark against dumbpipe. What do you think the results would be like?
    • tionis 1y ago
      Well pipe.pico.sh always uses a proxy server so throughput and latency are worse, but you have your own namespace for the pipes and thus don't have to synchronize random connection strings
• benreesman 1y ago
  The marketing is brilliant. The name of the company (number0) is mad hackerish man, right up my alley in the words of Charlie Murphy. I'm going to try this in my GCE on bare metal "unvirtualizer" today (number0 is what a Linux kernel would call the first tuntap with number as its prefix if you had such a patch). These are my kind of people!
• binarymax 1y ago
  Does this require a 3rd party host, or is it peer-to-peer?
  • nine_k 1y ago
    Peer to peer, unless both ends are behind NAT, then you need to run a relay.
    • justusthane 1y ago
      They provide a default relay. It’s not clear to me whether you can manually specify a different relay.
      • avtar 1y ago
        They have docs for using self-hosted relays: https://github.com/n0-computer/iroh/blob/main/iroh/docs/local_relay_node.md https://github.com/n0-computer/iroh/blob/main/iroh/docs/loca...
        • DrillShopper 1y ago
          It'd be nice if the Getting Started link on the n0des page went here instead of immediately asking me to sign up before I know what the hell I'm signing up for
        • aniviacat 1y ago
          Unfortunately the link to the Config struct is broken. It should be: https://github.com/n0-computer/iroh/blob/main/iroh-relay/src/main.rs https://github.com/n0-computer/iroh/blob/main/iroh-relay/src...
      • rklaehn 1y ago
        Dumbpipe is using our set of relays. It is meant as a standalone tool as well as a showcase for what you can do with iroh. If you use iroh as a library, you can specify your own relays. It is important to mention that relays are interoperable, so you don't have isolated bubbles of nodes using certain relay networks. I can have the n0 relays specified and still talk to another node that is using a different set of relays.
• chrisallick 1y ago
  About once or twice a year a solution comes out that does this. Here is a great one for orchestrating connections: https://docs.spacebrew.cc/ https://docs.spacebrew.cc/
  • latchkey 1y ago
    "In 2023 it's..."
  • x2tyfi 1y ago
    While that may be true, the branding of this particular project seems unbeatable. A literal dumb pipe man with wacky arms. It just works.
    • alt227 1y ago
      I feel it was the same for IFTTT over a decade ago. People always move on to the next shiny thing.
• nine_k 1y ago
  I wonder how much different it is from Wireguard + netcat. Both run encrypted channels over UDP, but somehow differently. What does QUIC offer that Wireguard does not?
  • TheDong 1y ago
    QUIC includes a standard for peer address discovery: https://www.ietf.org/archive/id/draft-ietf-quic-address-discovery-00.html https://www.ietf.org/archive/id/draft-ietf-quic-address-disc... Wireguard doesn't, which is why tailscale took off so much, since it offers basically that at its core (with a bunch of auxiliary features on top). Show me some wireguard discovery/relay servers if I'm wrong. Also, QUIC is more language-agnostic. The canonical user-space implementation of wireguard is in Go, which can't really do C FFI bindings, and the abstractions are about dealing with "wireguard devices", not "a single dump pipe", so wireguards userspace library also makes it surprisingly difficult to implement this simple thing without also bringing a ton of baggage (like tun devices, gateways, ip address management, etc) along for the ride. If you already have a robust wireguard setup, then of course you don't need this and can just use socat or whatever.
  • bastawhiz 1y ago
    Wireguard is a tunneling protocol. Netcat lets you write things over a socket. But netcat doesn't implement mechanisms for guaranteeing that all your packets arrive over UDP mode, so you're forced to tunnel TCP over UDP for reliability. QUIC is all UDP, handling the encryption, resending lost packets, and reordering packets if they arrive out of order. The whole point of QUIC is to make it so you can get files transferred quickly. WireGuard doesn't know the data you're sending, and netcat+TCP is stuck with the limitations of every packet needing to be sent and acknowledged sequentially.
  • kevindamm 1y ago
    Wireguard is opaque about the independent streams in its connection. So, while they both can encapsulate multiple concurrent streams in one connection, QUIC can do things like mitigate Head-of-Line Blocking and manage encryption at the transport layer. It also uses a connection ID on these substreams which helps make transitioning across network changes seamless.
• bob1029 1y ago
  I've always found this path to be more compelling: https://github.com/samyk/pwnat https://github.com/samyk/pwnat It has more edges and doesn't handle all cases, but it also avoids the need for any kind of intermediary.
  • rsyring 1y ago
    Older solution that seems to have issues with some modern routers: https://github.com/samyk/pwnat/issues/18 https://github.com/samyk/pwnat/issues/18
    • mrbluecoat 1y ago
      Heh, I was the last one to leave a comment on that issue 5 years ago.. My tool of choice is https://github.com/hyprspace/hyprspace https://github.com/hyprspace/hyprspace
  • kragen 1y ago
    But most of all, Samy is my hero.
  • jeroenhd 1y ago
    I didn't know about this tool, that's pretty useful! Too bad the broken nature of NAT means this approach will just ignore any firewall rules you have configured and any malicious device or program can leverage it to open inbound connections.
  • mmsc 1y ago
    https://github.com/samyk/slipstream https://github.com/samyk/slipstream is the new one
• csteubs 1y ago
  Just a head's up, I'm getting a 404 on the link to the relay docs (https://www.iroh.computer/docs/layers/connections https://www.iroh.computer/docs/layers/connections) when attempting to click through.
  • mcstafford 1y ago
    https://www.iroh.computer/docs https://www.iroh.computer/docs works
  • ramfox 1y ago
    appreciate this, the links on dumbpipe.dev are updated now!
  • b_fiive 1y ago
    Thanks for the heads up! We've fixed: https://github.com/n0-computer/dumbpipe.dev/pull/11 https://github.com/n0-computer/dumbpipe.dev/pull/11
• dangoodmanUT 1y ago
  iroh is awesome, and this is such a good demo of how stupid simple it is to use
• ilovefood 1y ago
  iroh is fantastic tech. I attended Rüdiger's (N0) workshop 2 weeks ago at the web3 summit in Berlin and was left super inspired. The code for building something like this is available here https://github.com/rklaehn/iroh-workshop-web3summit2025 https://github.com/rklaehn/iroh-workshop-web3summit2025 and I highly recommend checking out the slides too :)
  • rklaehn 1y ago
    Thank you for the praise! It is nice to hear that people enjoy these workshops. I would love to see what people would build if they had a little bit more time with help from the n0 team. A one hour or even three hour workshop is too short.
• scirob 1y ago
  Oh they use Iroh notice!
• amelius 1y ago
  "Dumb pipe" sounds like they forgot about security.
  • klysm 1y ago
    I don't understand this perspective. Dumb primitives that are secure is _exactly_ how you build secure system!
    • amelius 1y ago
      > ... that are secure ... That's a huge assumption I wouldn't make after reading "dumb". And from the article: > Easy, direct connections that punch through NATs & stay connected as network conditions change. This sounds more like a pipe that is trying to be smart. According to your principle, not something to build a secure system with.
    • remram 1y ago
      You could describe this same project as "a smart pipe that punches through NATs & stays connected (...)" and it wouldn't be any more surprising or inaccurate than the current description. So maybe it is not that descriptive.
• rs_rs_rs_rs_rs 1y ago
  I've been using this for some years now https://magic-wormhole.readthedocs.io/en/latest/index.html https://magic-wormhole.readthedocs.io/en/latest/index.html
  • ahazred8ta 1y ago
    user lotharrr https://news.ycombinator.com/user?id=lotharrr https://news.ycombinator.com/user?id=lotharrr is the author of magic wormhole
• remram 1y ago
  You can do this with ssh (and socat or mkfifo): # receiver socat UNIX-RECV:/tmp/foobar - | my-command # sender my-command | ssh host socat - UNIX-SENDTO:/tmp/foobar You can relay through any other SSH server if your target is behind a firewall or subject to NAT (for example the public service ssh-j.com). This is end-to-end encrypted (SSH inside SSH): # receiver ssh top-secret@ssh-j.com -N -R ssh:22:localhost:22 socat UNIX-RECV:/tmp/foobar - | my command # sender my-command | ssh -J top-secret@ssh-j.com ssh socat - UNIX-SENDTO:/tmp/foobar (originally posted on the thread for "beam": https://news.ycombinator.com/item?id=42593135 https://news.ycombinator.com/item?id=42593135)
  • actinium226 1y ago
    Never knew about ssh-j.com. Neat.
  • kragen 1y ago
    This doesn't do most of what dumbpipe claims to do: it doesn't use QUIC, doesn't avoid using relays when possible, doesn't pick a relay for you, and doesn't keep your devices connected as network connections change. It also depends on you doing the ssh key management out-of-band, while dumbpipe appears to put the keys into random ASCII strings. WireGuard is more similar.
    • nightfly 1y ago
      Wireguard doesn't do most of those either
      • kragen 1y ago
        That's true, just some.
  • cakealert 1y ago
    First sentence after following the link this topic is about: Dumb pipe punches through NATs, using on-the-fly node identifiers. It even keeps your machines connected as network conditions change.
• behrlich 1y ago
  https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling - for anyone interested in the landscape of tunneling tools like this.
• amdivia 1y ago
  Reminds me of https://docs.pears.com/tools/hyperbeam https://docs.pears.com/tools/hyperbeam
• 100pctremote 1y ago
  Very handy. We've developed an industrialized variant of this in RelayKit designed for fleets of fielded devices at scale with Anycast, mTLS, multiplexing of services through a single tunnel, Bring Your Own PKI and some other fleet management features that together become a somewhat smarter pipe: https://farlight.io https://farlight.io
• jauntywundrkind 1y ago
  The surface being http is super nice to have. It's a streams-over-http general utility, quic powered. I'm struggling to remember what but there's a simple http service called like patchbay or some such that's a store and forward pattern. This idea of very simple very generic http powered services has a high appeal to me. Looking forward to a future version that can do WebTransport
• smusamashah 1y ago
  Somewhat relevant, I have a list of (mostly browser based + few no-setup cli) tools [1] to send files from A to B. I keep sharing this list here to fish more tools whenever something like this comes up. [1]: https://gist.github.com/SMUsamaShah/fd6e275e44009b72f64d0570256bb3b2 https://gist.github.com/SMUsamaShah/fd6e275e44009b72f64d0570...
  • b_fiive 1y ago
    same team behind dumbpipe makes sendme, which is much closer to this use case! https://github.com/n0-computer/sendme https://github.com/n0-computer/sendme
  • Liquix 1y ago
    I love LocalSend for quick transfers between your own devices, just werks on every OS. https://github.com/localsend/localsend https://github.com/localsend/localsend
    • voidmain0001 1y ago
      One limitation of iOS is the inability to use Bluetooth to transfer an image/video file to a Bluetooth receiver such as Windows. The Apple documentation requires a wired connection. https://support.apple.com/en-ca/120267 https://support.apple.com/en-ca/120267 If LocalSend is running on iOS and Windows does LocalSend have the ability to send photos?
      • sampullman 1y ago
        It should work, though I haven't actually tried it. That's not a limitation of iOS, just Apple's own syncing app/protocol. LocalSend is basically an http client/server with network device discovery, as far as I know.
      • future10se 1y ago
        > If LocalSend is running on iOS and Windows does LocalSend have the ability to send photos? Yes, I use it all the time. Both devices need to be on the same network (LAN / WiFi), however. LocalSend does not use Bluetooth.
• qgin 1y ago
  This is really good marketing presentation for a command line tool
• punnerud 1y ago
  Good article from Tailscale on how direct connections is established, even when both nodes is behind NAT: https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
• mrighele 1y ago
  I remember doing something like this with Skype many years ago (at least 15, I guess). The old Skype, the one that was a real p2p app and before it got bought by Microsoft, was very good slicing through firewalls and NATs and it offered a plugin api, so it was easy to implement a TCP tunnel with it.
• AtlasBarfed 1y ago
  Kinda related to this, but is there something that runs a daemon on your local machine, where if a "file request document" is uploaded to mega or Google drive or something similar the (,polling) daemon recognizes the request and pushed the document/file to the file store service?
  • bravesoul2 1y ago
    Dropbox :) Or whatever ftp thing they mentioned on the Dropbox show HN ;)
• kwakubiney 1y ago
  Is there a way I can use this to run remote commands on another host? Something similar to what ssh does?
  • makeworld 1y ago
    You could pipe to bash?
    • kwakubiney 1y ago
      Ah right, but this does not support bidirectional streaming so I won't be able to get the remote stdout on the client, I guess.
      • scottmf 1y ago
        Couldn’t you just pipe the stdout to another dumbpipe
        • kwakubiney 1y ago
          Not a very friendly API
          • scottmf 1y ago
            This works: Remote: $ socat TCP-LISTEN:4321,reuseaddr,fork EXEC:"bash -li",pty,stderr,setsid,sigint,rawer& $ dumbpipe listen-tcp --host 127.0.0.1:4321 using secret key fe82...7efd Forwarding incoming requests to '127.0.0.1:4321'. To connect, use e.g.: dumbpipe connect-tcp nodeabj...wkqay Local: $ dumbpipe connect-tcp --addr 127.0.0.1:4321 nodeabj...wkqay& using secret key fe82...7efd $ nc 127.0.0.1 4321 root@localhost:~#
• gnarlouse 1y ago
  Neato
• Aardwolf 1y ago
  I wonder why it's not standard that you can simply connect two PC's to each other with a USB cable and have them communicate/transfer files. With same protocol in all OSes, of course. Seems like it should have been one of the first features USB could have had since the beginning, imho I know there's something about USB A to USB A cables not existing in theory, but this would have been a good reason to have it exist, and USB C of course can do this Also, Android to PC can sort of do it, and is arguably two computers in some form (but this was easier when Android still acted like a mass storage device). But e.g. two laptops can't do it with each other.
  • thebruce87m 1y ago
    FireWire did the IIRC. When buying a new Mac you would connect them via a single cable to do the data transfer.
    • ericwood 1y ago
      Macs still have target disk mode but it requires rebooting. Highly recommend using thunderbolt to transfer over to a new computer!
  • meindnoch 1y ago
    But then nobody could analyze your files... :/
  • xandrius 1y ago
    You mean a cross ethernet cable? Or using Bluetooth? Or using local WiFi (direct or not).
    • deathanatos 1y ago
      > You mean a cross ethernet cable? If both machines have an Ethernet port. > Or using Bluetooth? Half the time I need a dumb pipe, it's from personal to work. Regrettably, work forces me to use macOS, and macOS's bluetooth implementation is just an utter tire fire, and doesn't work 90% of the time. I usually fall back to networks, for that reason. Of course, MBPs also have the "no port" problem above. > Or using local WiFi (direct or not) If I'm home, yeah. But TFA is advertising the ability to hole-punch, and if I'm traveling, that'd be an advantage.
• kocial 1y ago
  You can also do this via "netcat", running the commands below in a terminal. Receiver (listening to port 31337): `nc -l -p 31337` Sender (connecting to receiver IP): `nc <receiver_ip> 31337` Want to send a message to the receiver: `echo "Hello from Kocial" | nc <receiver_ip> 31337` == if you want to send a file == Receiver: `nc -l -p 31337 > hackernews.pdf` Sender: `nc <receiver_ip> 313337 < hackernews.pdf`
  • miniBill 1y ago
    This doesn't punch through NATs at all, which is the point of Dumb Pipe
• darzu 1y ago
  Does anyone know if this tech (or Iroh) is suitable for real-time networking for games? Basically, once connection is established, what's the overhead on top of UDP in terms of latency and bandwidth? Edit: after digging a little, Iroh uses QUIC which looks like a reliable, ordered protocol as opposed to the unreliable, unordered nature of UDP which is what many games need. Now what I'd love to figure out is if there's a way to use their relay hopping and connection management but send/receive data through a dumb UDP pipe.
  • b_fiive 1y ago
    Yep! It's totally usable for games, and used in a few! One of my favs is the godot engine plugin: https://github.com/tipragot/godot-iroh https://github.com/tipragot/godot-iroh QUIC can do both reliable & unreliable streams, as can iroh
  • CGamesPlay 1y ago
    > QUIC which looks like a reliable, ordered protocol as opposed to the unreliable, unordered nature of UDP which is what many games need. This isn't right, as a sibling comment mentions. QUIC is a UDP-based protocol that handles stream multiplexing and encryption, but you can send individual, unordered, unreliable datagrams over the QUIC connection, which effectively boils down to UDP with a bit of overhead for the QUIC header. The relevant method in Iroh is send_datagram: https://docs.rs/iroh-net/latest/iroh_net/endpoint/struct.Connection.html#method.send_datagram https://docs.rs/iroh-net/latest/iroh_net/endpoint/struct.Con...
    • zackmorris 1y ago
      It would be nice if dumbpipe revealed the local and remote IP and UDP port numbers via something like STDERR or a signal so that apps could send UDP datagrams on them with ordinary socket calls. I'm guessing that QUIC uses a unique header in its first few bytes, so the app could choose something different and not interfere with the reliable stream. A better solution would be to expose the iroh send_datagram and read_datagram calls somehow. Maybe if dumbpipe accepted a datagram flag like -d, then a second connection to a peer could be opened. It would recognize that the peer has already been found and maybe reuse the iroh instance. Then the app could send over either stream when it needs to be reliable or best effort. This missing datagram feature was the first thing I thought of too when I read the post, so it's disappointing that it doesn't discuss it. Mostly all proof of concept tools like this are MVP, so don't attempt to be feature-complete, which forces the user to either learn the entirety of the library just to use it, or fork it and build their own. IMHO that's really disappointing and defeats the purpose of most software today, since developers are programmed to think that the "do one thing and do it well" unix philosophy is the only philosophy. It's a pet peeve of mine because nearly the entirety of the labor I'm forced to perform is about working around these artificial and unintentional limitations. Ok I just looked at https://www.dumbpipe.dev/install.sh https://www.dumbpipe.dev/install.sh if [ "$OS" = "Windows_NT" ]; then echo "Error: this installer only works on linux & macOS." 1>&2 exit 1 else So it appears to be linux and macOS only, which is of little use for games. I'm shocked, just shocked that I'll have to write my own..
• gosub100 1y ago
  10 years ago I made an "encrypted voice channel" by chaining the following 3 commands together (I dont remember exactly how it looked, this is just a sketch): arecord - | openssl aes-128-cbc -pass:'secretstring' - | nc <dest ip> <dest port> on the receiving end nc -l <dest port> | openssl aes-128-cbc -pass:'secretstring' | aplay - I don't remember exactly which audio device I used back then. It worked okay-ish, but there was definitely lag from somewhere. Just kind of neat that you can build something so useful without a bloated app, just chaining a few commands together.
  • israrkhan 1y ago
    This is cool
• CGamesPlay 1y ago
  If you are in the mood for a slightly less dumb pipe, I’ve been building a tunnel manager CLI built on Iroh. Supports forwarding ports over TCP, UDP, and UNIX sockets. https://gitlab.com/CGamesPlay/qtm https://gitlab.com/CGamesPlay/qtm
• jaimex2 1y ago
  Who is paying for the relays and why?
  • rklaehn 1y ago
    We (n0) are running one set of relays. They are rate limited, so they basically only help with the hole punching process. Projects or companies that use iroh can either run their own relays or use our service https://n0des.iroh.computer/ https://n0des.iroh.computer/ , which among many other things allows spinning up a set of dedicated relays.
• kiitos 1y ago
  > In the iroh world, you dial another node by its NodeId, a 32-byte ed25519 public key. Unlike IP addresses, this ID is globally unique, and instead of being assigned, ok but my network stack doesn't speak nodeID, it speaks tcp/ip -- so something has to resolve your public keys to a host and port that I can actually connect to. this is roughly the same use case that DNS solves, except that domain names are generally human-compatible, and DNS servers are maintained by an enormous number of globally-distributed network engineers it seems like this system rolls its own public key string to actual IP address and port mapping/discovery system, and offers a default implementation based on dns which the authors own and operate, which is fine. but the authors kind of hand-wave that part of the system away, saying hey you don't need to use this infra, you can use your own, or do whatever you want! but like, for systems like this, discovery is basically the entire ball game and the only difficult problem that needs to be solved! if you ignore the details of node discovery and name mapping/resolution like this, then of course you can build any kind p2p network with content-addressable identifiers or whatever. it's so easy a cave man can do it, just look at ipfs
  • makeworld 1y ago
    In practice, the "ticket" provided by dumbpipe contains your machine's IP and port information. So I believe two machines could connect without any need for discovery infra, in situations that use tickets. (And have UPnP enabled or something.) See also https://www.iroh.computer/docs/concepts/discovery https://www.iroh.computer/docs/concepts/discovery
    • kiitos 1y ago
      OK so given $ ./dumbpipe listen ... To connect use: ./dumbpipe connect nodeecsxraxj... that `nodeecsxraxj...` is a serialized form of some data type that includes the IP address(es) that the client needs to connect to? forgive me for what is maybe a dumb question, but if this is the case, then what is the value proposition here? is it just the smushing together of some IPs with a public key in a single identifier?
      • rklaehn 1y ago
• 44za12 1y ago
  Every time someone calls a product “dumb,” I get a little excited, because it usually means it’s actually smart. The internet is drowning in “smart” stuff that mostly just spies on you and tries to sell you socks. Sometimes, I just want a pipe that does what it says on the tin; move my bits, shut up, and don’t ask for my mother’s maiden name.
  • josephg 1y ago
    > and tries to sell you socks I've been writing raw POSIX net\ code today. A lot of variables shorten "socket" to "sock". And my brain was like.. um, bad news! This is trying to sell us on their special sock(et)s!
    • lozf 1y ago
      I thought it was quite a fun pun for the same reason.
  • Sateeshm 1y ago
    Dumb is now 'we don't steal your data'
  • thuridas 1y ago
    But what about the enterprise ready AI features so that they can train on your data?
• deleted 1y ago
  [deleted]
• zx8080 1y ago
  Every time I see `curl ..| sh` I feel bad. It shouldn't be a norm to run a downloaded script in shell.
  • zekica 1y ago
    And especially not run the script while it's downloading. The remote server can detect timing difference (let's say the script has "sleep 30" and the buffer fills) and send a different response (really easy if using chunked encoding or HTTP2 data frames).
    • GoblinSlayer 1y ago
      The script is 790 bytes, you can't fill a pipe with that.
• Surac 1y ago
  Perfect for malware
• bravesoul2 1y ago
  Dumb question: can I port forward using this?
  • rklaehn 1y ago
    You can forward a locally running TCP service using dumbpipe listen-tcp. E.g. you got a local development webserver running on 127.0.0.1:3000. You can expose this via dumbpipe using dumbpipe listen-tcp --host 127.0.0.1:3000 You get a node ticket that contains details on how to connect. Put it into https://ticket.iroh.computer/ https://ticket.iroh.computer/ if you want to know what's in it. Then on the other side, e.g. on a small box in the cloud, you can do this: dumbpipe connect-tcp --addr 0.0.0.0:80 <ticket> Any TCP request to the cloud box on port 80 will be forwarded to the dev webserver.
• dignifiedquire 1y ago
  thanks everyone for all the love <3 [maintainer of iroh here]
• oc1 1y ago
  > In 2023 it's hard to connect two devices directly It's not. Use tailscale.
• trklausss 1y ago
  Question: What is the security level behind this? I guess if it is "dumb" _anyone_ can input your identifier for the pipe and connect to it?? Or even listen on it?
  • rklaehn 1y ago
    Anybody who has the ticket and therefore has the public key can connect. Once connected, the connection is encrypted using TLS with the raw public keys in TLS extension ( https://datatracker.ietf.org/doc/html/rfc7250 https://datatracker.ietf.org/doc/html/rfc7250 ).
    • trklausss 1y ago
      So if it single-point, there will be a really small window where someone could try to brute-force it (almost impossible, I know), but if it is multi-point (i.e. multiple users can connect to that endpoint) then it could be brute-forced and connect to it? I couldn't see if it is single-point of multiple-send... Let me know if my understanding is incorrect, I don't have much experience with QUIC :)
      • rklaehn 1y ago
        I am not one of the cryptographers on the team, but I will try to answer to the best of my knowledge. QUIC is specifying TLS, specifically TLS 1.3 or larger. From the RFC 9001 (Using TLS to Secure QUIC): "Clients MUST NOT offer TLS versions older than 1.3.". For the first request, brute forcing would mean guessing a 32 byte Ed25519 public key. That is not realistically possible. For subsequent requests, even eavesdropping on the first request does not allow you to guess the public key, since the part of the handshake that contains the public key is already encrypted in TLS 1.3. With all that being said, if you want to have a long running dumbpipe listen, you might want to restrict the set of nodes that are allowed to connect to it. We got a PR for this, but it is not yet merged. https://github.com/n0-computer/dumbpipe/pull/68 https://github.com/n0-computer/dumbpipe/pull/68
• Thorrez 1y ago
  >These dumb pipes use QUIC over a magic socket. It may be dumb, but it still has all the features of a full QUIC connection: UDP-based, stream-multiplexing and encrypted. How is multiplexing used here? On the surface it looks like a single stream. Is the file broken into chunks and the chunks streamed separately?
  • rklaehn 1y ago
    In this particular example there is no multiplexing. It's just one QUIC stream. In other iroh based protocols the ability to have many cheap QUIC streams without head-of-line blocking is very useful. E.g. we got various request/response style protocols where a large number of requests can be in flight concurrently, and each request just maps to a single QUIC stream.
• Alifatisk 1y ago
  This reminds me a lot of the holepunch.to (previously hypercore-protocol) What I wonder is this, is there a clever and simple way to share the secret phrase between two devices? The example is pretty long to manually enter "nodeecsxraxjtqtneathgplh6d5nb2rsnxpfulmkec2rvhwv3hh6m4rdgaibamaeqwjaegplgayaycueiom6wmbqcjqaibavg5hiaaaaaaaaaaabaau7wmbq"
• alexalx666 1y ago
  I love the Mr. Dumb Pipe character
• edem 1y ago
  Dumb is the new smart.
• 1vuio0pswjnm7 1y ago
  (2023)
• zackmorris 1y ago
  After writing a response about using this for games below, it occurred to me that most tunneling solutions have one or more fatal flaws that prevent them from being "the one true" tunnel. There are enough footguns that maybe we need a checklist similar to the "Why your anti-spam idea won’t work" checklist: https://trog.qgl.org/20081217/the-why-your-anti-spam-idea-wont-work-checklist/ https://trog.qgl.org/20081217/the-why-your-anti-spam-idea-wo... I'll start: Your solution.. ( ) Can't punch through NAT ( ) Isn't fully cross-platform ( ) Must be installed at the OS level and can't be used standalone by an executable ( ) Only provides reliable or best-effort streams but not both ( ) Can't handle when the host or peer IP address changes ( ) Doesn't checksum data ( ) Doesn't automatically use encryption or default to using it ( ) Doesn't allow multiple connections to the same peer for channels or load balancing ( ) Doesn't contain window logic to emulate best-effort datagrams over about 1500 bytes ( ) Uses a restrictive license like GPL instead of MIT Please add more and/or list solutions that pass the whole checklist!
  • rklaehn 1y ago
    Nice list. I think iroh checks all the boxes but one. ( ) Doesn't contain window logic to emulate best-effort datagrams over about 1500 bytes So you want a way to send unreliable datagrams larger than one MTU. We don't have that, since we only support datagrams via https://datatracker.ietf.org/doc/html/rfc9221 https://datatracker.ietf.org/doc/html/rfc9221 . You could just use streams - they are extremely lightweight. But those would then be reliable datagrams, which comes with some overhead you might not want. So how hard would it be to implement window logic on top of RFC9221 datagrams?
    • GoblinSlayer 1y ago
      Also there's no solution to punch through NAT.
      • flub 1y ago
        There might be some confusion here, holepunching is a core functionality of iroh. There are still some firewall configurations that iroh can not yet holepunch and that can still be improved, but in general the holepunching works rather well.
• xgpyc2qp 1y ago
  Wondering about a speed. What transport it uses? Is it establishing a p2p connection? Or transfering all through central server?
• MrNet32823 1y ago
  Is there a network topology where two hosts, each behind one or more layers of NAT, can both initiate outbound connections to public internet services (e.g., google.com), but are unable to establish a direct peer-to-peer connection due to NAT traversal limitations? I understand that NAT hole punching can work with a single level of NAT, but does it still function reliably across multiple layers of LAN/NAT hierarchy?
• sourcecodeplz 1y ago
  hamachi anyone?