5 ms·
Iroh is QUIC. We are not trying to reinvent the wheel here, just combining existing IETF RFCs in a creative way. Here is a concrete problem we solve. You have
by rklaehn 4mo ago
Iroh is QUIC. We are not trying to reinvent the wheel here, just combining existing IETF RFCs in a creative way.
Here is a concrete problem we solve. You have one device in your home WLAN behind a NAT. Your other device is in a 4g network, or behind another NAT at work.
In most cases we can give you a direct connection between the two devices very quickly via hole punching, so you get the highest possible bandwidth and the lowest possible latency.
This was not a solved problem until now.
- handoflixue 4mo agoExcuse my ignorance on the subject, but what does this solve that VPNs didn't already address?
- milkshakes 4mo agovpns typically add at least one hop. this has the possibility of connecting directly via hole punching
- tux3 4mo agoModern VPNs based on wireguard can do direct connections with hole punching. It's just a lot more work to setup on your own, or you have to sign-up to a SaaS like tailscale and use their relays, and they'll do the hole punching for you. Here this is a decentralized network with a lot of existing public relays. But in principle a VPN can solve a lot of the same problems. It's just that commercial VPNs are not decentralized, and doing your own wireguard setup is a pain.
- kkapelon 4mo agoAlready possible with taiscale, netmaker, zerotier etc. https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
- danudey 4mo agoBut only for devices already on that tailnet. This allows you to provide information to an arbitrary person (a friend/coworker/etc) to let them access the thing without them having to jump through all the extra hoops of joining your tailnet/them joining yours/adding a VPN/etc.
- kkapelon 4mo agobut what exactly is the use case? I was responding to the nat traversal topic.. If I wanted to share something internal with a friend I would use ngrok or any of the million alternatives. Anyway, this is exactly why my top-level comment says that this project needs a "versus" page in the docs.
- 9dev 4mo agoWith Tailscale at least, you can pretty easily share a node with someone else. If your target audience are solo developers or hobbyists, making it even easier to share access is surely nice; from the perspective of someone in charge of making sure our company IT is balancing security and ease of networking, the literal last thing I want is making it easier to grant someone access. There are policies defining who can talk to what; they are deployed from a GitHub repository with defined rules on who can modify them and who has to review them; there are zero scenarios where I want an alternative way of granting access to any device or service under our control.
- UltraSane 4mo agoCisco Dynamic Multipoint VPN will start by connecting to a central VPN server and then learn the public IPs of endpoints and automatically create VPN tunnels to them. It can scale to thousands of endpoints.
- mtndew4brkfst 4mo agoPresumably this has significant literal costs (because Cisco) and maybe a hardware or virtual-appliance requirement?
- UltraSane 4mo agoEnterprise networking is neither simple or cheap but it should be reliable.
- gslepak 4mo agoVPNs do not allow you to connect two devices directly, they have to go through the VPN. They also do not allow you to connect devices that are not on the VPN. Iroh does P2P connections and punches holes through NATs when needed, so you can connect directly to devices on different networks that are behind firewalls.
- combyn8tor 4mo ago> VPNs do not allow you to connect two devices directly, they have to go through the VPN Not true. Depends on the VPN protocol.
- TalkingCodeMonk 4mo agoIt sounds like the key difference people are missing is that VPN's operate at the network layer, so they require separate integrations for every device os/arch and network stack, where Iroh is embedded at the application layer, so any app can be a P2P VPN client without worrying about device network integrations. Sounds great to me, and would be a boon for self-hosting and decentralization in general, which is sorely needed considering how captured, authoritarian, and anti civil liberties every democracy is becoming. If I'm not mistaken, I believe I read a tailscale blog about them envisioning application layer embedding at some point as well.
- deleted 4mo ago[deleted]
- pkulak 4mo agoFrom my VERY brief understanding: this is like if you want the hole-punching of a VPN, but your stuff is public, so not only do you not want all the security of a VPN, but it works against you. But I'm happy to be corrected!
- Arqu 4mo agoYou don't have to have it public. You can have your app gate against any auth method you like to implement on top. And you can have private relays to segregate your traffic and discovery depending on setup.
- kkapelon 4mo agoisn't this exactly what tailscale (and also zerotier, netmaker) do? https://tailscale.com/blog/how-nat-traversal-works https://tailscale.com/blog/how-nat-traversal-works
- moritzruth 4mo agoThose are intended to solve the problem at the OS layer, while Iroh (being a library) does it at the application layer.
- kkapelon 4mo agoLike https://tailscale.com/docs/features/tsnet https://tailscale.com/docs/features/tsnet ?
- ben-schaaf 4mo agoFrom reading that, it lets you establish connections within your tailscale vpn. Iroh let's you establish connections between devices regardless of their network.
- __float 4mo agoI think everyone in this thread agrees on that part already. The similarities are in an application lib to connect, and that tail net IPs correspond to device keys like in Iroh. The service using the Go library has its own Tailscale identity.
- 9dev 4mo agoThere might be a misunderstanding of what Tailscale offers here. There is no "VPN" in the classic "virtual network" way. With Tailscale, you can - as with Iroh, IIUC - connect arbitrary nodes to each other, where a node can be a device or an application (via tsnet). All nodes get CGNAT IPs and an addressable hostname, so there is one giant "network" of all your nodes with automatic DNS resolution baked in.
- aliasxneo 4mo agoIs that not what libp2p already offers? Not sure if it has QUIC out of the box, but hole-punching to UDP connectivity and then running QUIC over it isn't that hard.
- karissa 4mo agoThe folks who made iroh worked on libp2p first, but found many limitations in libp2p's design. iroh is a better more flexible and powerful version of libp2p
- orthecreedence 4mo agoLibp2p does have quic, at least the rust implementation.
- dignifiedquire 4mo agoYes, but libp2p was mainly designed around the limitations of tcp, as quic simply wasn't there yet when the design started. Iroh gets the benefit of having been designed and built from the ground up, based on quic.
- rklaehn 4mo agolibp2p does have QUIC, but it is one of many possible transports. So libp2p builds many things on top of the underlying transport where we use QUIC directly and use existing mechanisms such as TLS ALPNs for protocol negotiation. We also use the stream multiplexing that is built into QUIC instead of putting a stream multiplexer on top of QUIC. You can think about it like this: libp2p abstracts transports as streams, and then puts many required features on top (protocol negotiation, stream multiplexing) Iroh uses QUIC and abstracts transports below QUIC. We can work with any unreliable datagram transport that has (or can be hacked to have) a minimum MTU of 1200 bytes (needed to be QUIC compliant).
- ianopolous 4mo agoMinor clarifications, but libp2p also uses TLS ALPN for protocol negotiation, and also uses native quic streams - there is no additional muxer layer when using quic. Iroh is still awesome.
- system2 4mo agoIs bypassing the router a good idea?
- Arqu 4mo agoYes if you want to. Routers are a necessary abstraction from the IPv4 days and seems it will stick around for a long time, and we need solutions sometimes around those topologies.
- johndevor 4mo agoI made a demo showing it work: https://hw-e4592d7e.web.hallway.com/ https://hw-e4592d7e.web.hallway.com/
- ryandrake 4mo agoIt doesn't seem to do anything when you click Run Live, besides updating the status to "Connecting to DERP relay, exchanging endpoint info..."
- johndevor 4mo agoYou can get it to run by hitting "Edit" at the top - needs a real dev container to run, not a web worker.
- bicepjai 4mo agoSo iroh.network is something that they maintain like tor or vpn ?
- kfarr 4mo agoClassic... want to cast to the chromecast but I'm on the wifi
- ElijahLynn 4mo agoThis might be the ~next~ best example, and the one that Iroh should lead with in all of their marketing materials and videos! They really need to dumb this down to make it accessible if it's going to spread.
- BetterThanSober 4mo agoThe chromecast should be running iroh, no?
- opem 4mo agoSo iroh is basically WebRTC, except it works in and outside of a browser. Relays seems quite similar to TURN/STUN servers except they also handle fallback traffic much like TOR guard/relay nodes
- Sean-Der 4mo agoDoes WebRTC not work inside/outside of the browser anywhere?
- nunobrito 4mo agoIt works outside the browser too, I've been using it that way.
- opem 4mo agoYes it does! I was trying to draw an analogy there, I think it would be better to state as - iroh is similar to WebRTC + PeerJS[1] which only works on browsers, generally[2]. [1]: PeerJS(https://peerjs.com/ https://peerjs.com/) is a library to use WebRTC w/o any boilerplate code. [2]: WebRTC functionality can be enabled in non-browser envs like Node.js by using third-party native addons (like node-webrtc) that provide bindings to the underlying C++ WebRTC library.
- syllogistic 4mo agoIt's backwards! Unlike webrtc, iroh doesn't work inside a browser. It's for the case where you have two native apps that need to talk to each other p2p. For browser / webapps you want webrtc.
- ben-schaaf 4mo ago> We built & continually check that iroh can compile to WASM & run in the browser
- rklaehn 4mo ago
- 1vuio0pswjnm7 4mo ago"This was not a solved problem until now."
- neuralkoi 4mo agoSkype was doing this back in 2003.
- 1vuio0pswjnm7 4mo agoNapster "solved" it in 1999 Peers _always_ connected directly to transfer files A third party server kept an index and provided search, it did not forward traffic between peers https://docs.iroh.computer/concepts/nat-traversal.md https://docs.iroh.computer/concepts/nat-traversal.md "If NAT traversal fails, iroh automtically falls back to routing traffic through the relay server" It has not "solved" the hole punching problem any better than anyone in the past Alas, it does worse than predecessors by adding a non-P2P default (cf. option)