5 ms·

In case anyone was wondering why I wrote spiped...

FiloSottile 13y ago
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
- cperciva 13y ago
  A lot of people are doing spiped-like things using stunnel.
  - FiloSottile 13y ago
    Oh. Sigh.
  - midas007 13y ago
    Basically, for internal infrastructure, where autossh wont work and/or where something simpler than ssh is desired. So the strawmen arguments about it not replacing TLS is not the point. stud, nginx, stunnel, f5 load balancers and cloudflare will still be needed for now, until 'moxie0 or someone comes up with a viable CA alternative AND something way, way simpler than TLS (brain-hurt ASN1, even with Wireshark).
- atmosx 13y ago
  > Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. What would something simpler, less error-prone which would give the same benefits in a client-server connection? EDIT: Spiped is one, I got it (I'm on it right now and might even use it actually on a side-project), anything else that we should know about? :-)
peterwwillis 13y ago
Well, since you mention it, why did you write spiped? It seems like if you just wanted to protect network services from the internet you could have A) segmented your network, B) used ssh, C) used one of the myriad other existing non-TLS tunneling protocols. Doing A might expose you to less risk than B or C, since with tunnels if your client is owned your server is still vulnerable. Of course if you just wanted to code something for fun I totally understand that too. But it seems like there were already alternatives to stunnel (and I don't really get why people use stunnel to begin with)
- cperciva 13y ago
  Segmenting my network isn't an option when "my network" involves machines on multiple continents. I avoided ssh because sshd is an effectively unauditable mess, and breaks the "transient network glitches don't kill quiescent connections" assumption.
  - otterley 13y ago
    How do transient network glitches kill the connection? I'm not completely familiar with the ssh wire protocol, but to my knowledge TCP is largely responsible for ensuring the reliability of the virtual circuit even in the event of a transient lower-layer failure.
    - wiml 13y ago
      ssh frequently uses either application-level or TCP-level keepalives. But it doesn't have to; you can just turn off ssh keepalives and your quiescent connections will survive network outages.
drdaeman 13y ago
But isn't spiped mostly irrelevant here? I mean, it's not a TLS replacement, as it's based on PSK (thus only useable between two mutually trusting peers like me and myself), not PKI.
- cperciva 13y ago
  spiped should be irrelevant here. But there are a lot of people using PKI where they could be using PSK.
  - otterley 13y ago
    Who, exactly? Distributing shared secrets securely is a non-trivial exercise.
    - tripzilch 13y ago
      You mean like wifi-passwords? :) Everybody seems to manage distributing those just fine?
lawl 13y ago
But it's written in C. So it can't be good! (Sorry, I'm just still pissed at HN's simple mindedness and try to get more downvotes: https://news.ycombinator.com/item?id=7549916 https://news.ycombinator.com/item?id=7549916)
- dang 13y ago
  Please don't post comments to HN that have no real content.
- deleted 13y ago
  [deleted]

Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).

cperciva 13y ago
A lot of people are doing spiped-like things using stunnel.
- FiloSottile 13y ago
  Oh. Sigh.
- midas007 13y ago
  Basically, for internal infrastructure, where autossh wont work and/or where something simpler than ssh is desired. So the strawmen arguments about it not replacing TLS is not the point. stud, nginx, stunnel, f5 load balancers and cloudflare will still be needed for now, until 'moxie0 or someone comes up with a viable CA alternative AND something way, way simpler than TLS (brain-hurt ASN1, even with Wireshark).
atmosx 13y ago
> Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead. What would something simpler, less error-prone which would give the same benefits in a client-server connection? EDIT: Spiped is one, I got it (I'm on it right now and might even use it actually on a side-project), anything else that we should know about? :-)

peterwwillis 13y ago

Well, since you mention it, why did you write spiped? It seems like if you just wanted to protect network services from the internet you could have A) segmented your network, B) used ssh, C) used one of the myriad other existing non-TLS tunneling protocols. Doing A might expose you to less risk than B or C, since with tunnels if your client is owned your server is still vulnerable. Of course if you just wanted to code something for fun I totally understand that too. But it seems like there were already alternatives to stunnel (and I don't really get why people use stunnel to begin with)

cperciva 13y ago
Segmenting my network isn't an option when "my network" involves machines on multiple continents. I avoided ssh because sshd is an effectively unauditable mess, and breaks the "transient network glitches don't kill quiescent connections" assumption.
- otterley 13y ago
  How do transient network glitches kill the connection? I'm not completely familiar with the ssh wire protocol, but to my knowledge TCP is largely responsible for ensuring the reliability of the virtual circuit even in the event of a transient lower-layer failure.
  - wiml 13y ago
    ssh frequently uses either application-level or TCP-level keepalives. But it doesn't have to; you can just turn off ssh keepalives and your quiescent connections will survive network outages.

drdaeman 13y ago

But isn't spiped mostly irrelevant here? I mean, it's not a TLS replacement, as it's based on PSK (thus only useable between two mutually trusting peers like me and myself), not PKI.

cperciva 13y ago
spiped should be irrelevant here. But there are a lot of people using PKI where they could be using PSK.
- otterley 13y ago
  Who, exactly? Distributing shared secrets securely is a non-trivial exercise.
  - tripzilch 13y ago
    You mean like wifi-passwords? :) Everybody seems to manage distributing those just fine?

lawl 13y ago

But it's written in C. So it can't be good! (Sorry, I'm just still pissed at HN's simple mindedness and try to get more downvotes: https://news.ycombinator.com/item?id=7549916 https://news.ycombinator.com/item?id=7549916)

dang 13y ago
Please don't post comments to HN that have no real content.
deleted 13y ago
[deleted]