PLG88

16 ms·

151.
by PLG88 3y ago
Not quite. 802.1x provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. Tailscale is describing to add E2E encryption between device to server so that if a malicious actor is on the underlay, they only see encr
152.
by PLG88 3y ago
This is a great blog, goes really deep on the technologies you looked out. Out of interest, did you consider OpenZiti as part of your test? I work on the project. OpenZiti is an overlay network with similarities to Tailscale but fully open
153.
Enhance Your Network Security with Zero Trust and OTP (Yubikey)(zerotrust.natashell.me)
3 points by PLG88 4y ago|0 comments
154.
by PLG88 4y ago
I work on the open source OpenZiti project. We recently released zrok ( https://zrok.io/ ), we have Local Debugging Interface in the backlog - https://github.com/openziti/zrok/issues/73 .
155.
by PLG88 4y ago
I work on the open source OpenZiti project. We recently released zrok ( https://zrok.io/ ), we have Local Debugging Interface in the backlog - https://github.com/openziti/zrok/issues/73 .
156.
by PLG88 4y ago
So is zrok - https://zrok.io/ . Also fully open source, can self-host and has an option for 'private share'.
157.
by PLG88 4y ago
Looks like it cannot today - https://github.com/juanfont/headscale/issues/1040
158.
by PLG88 4y ago
If you want a similar project which 'just works' then consider using zrok. Its fully opensource which you can self-host or use the free hosted version - https://zrok.io/
159.
by PLG88 4y ago
Unless I am mistaken, only the Tailscale endpoints are open source (e.g., this SDK), the control and dataplane is closed source. While Headscale exists I am not aware of it providing Funnel functionality. I understand the Funnel infra is al
160.
by PLG88 4y ago
OpenZiti project is 100% open source and has SDKs for many languages - e.g., Go, Python, C, C#, Java, NodeJS, Javascript, Kotlin, Swift, etc. We also built zrok which is a 'ziti-native' app to prvide ngrok type functionality. It i
161.
by PLG88 4y ago
Another open source option is zrok ( https://zrok.io/ ), we have just released v0.32. Its built on top of OpenZiti.
162.
by PLG88 4y ago
Not if you use open source and self-host it yourself. For example, I work on the OpenZiti project which makes it easy to embed zero trust networking principles into (almost) anything - https://docs.openziti.io/
163.
by PLG88 4y ago
I know OpenZiti very well (I work on the project)... whats the question?
164.
by PLG88 4y ago
We had this question in another thread so I will copy paste the answer :) Yes! We're currently targeting an end-user UI for v0.5. My crystal ball is imperfect with regards to timing, so don't hold me to it... but I would imagine t
165.
by PLG88 4y ago
Do you mean Hamachi? Hamachi is a VPN capable of establishing direct links between computers that are behind network address translation (NAT) firewalls without requiring reconfiguration. zrok is a reverse proxy to easily share resources (h
166.
by PLG88 4y ago
Along those lines, I wrote a blog on how I described my job and zero trust to my daughter (who is 5) by using Harry Potter analogies - https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...
167.
by PLG88 4y ago
zrok.io is more comparable to Tailscale Funnel. Lets break this down :) - Tailscale Funnel is their feature to allow you to route traffic from the wider internet to one or more of your Tailscale nodes (public sharing). It is closed source S
168.
by PLG88 4y ago
I am writing some comparisons to other tech incl. Nebula, its not publicly published yet, but I can give a few bullets. WRT to performance, better to compare OpenZiti to Nebula rather than zrok, we did some last year - https://n
169.
by PLG88 4y ago
Nice work on maintaining that by the way! Can we get zrok added to the list of 'Open source (at least with a reasonably permissive license)'??
170.
by PLG88 4y ago
While OpenZiti can do P2P connections, having a overlay in between gives you many advantages incl. outbound connections at source/destination to circumvent NAT/port forward/inbound ports etc. What's cool about it is that
171.
by PLG88 4y ago
Great question. I am in the process of creating some public documentation for the OpenZiti project vs [insert tech]. OpenZiti is more akin to Wireguard (i.e., open source), CloudZiti is more comparable to Tailscale (hosted SaaS) Here are so
172.
by PLG88 4y ago
Here is a blog too on external IdP for OpenZiti - https://blog.openziti.io/openziti-authentication-api-integra...
173.
by PLG88 4y ago
Thanks for the insights. OpenZiti can definitely replace Wireguard, I am have a long form comparison (which I need to publish soon) if you want me to share? Performance wise, it depends. Wireguard is UDP-based so for some use cases it gets
174.
by PLG88 4y ago
Better to just say zero trust, identity driven/MFA approach... Duo is not zero trust, worse, its fail open by default - https://www.n00py.io/2018/08/bypassing-duo-two-factor-authen...
175.
by PLG88 4y ago
Nice. How is it better/worse/different to Ngrok?
176.
by PLG88 4y ago
Any framing which helps one to reduce systematic risk is fine by me and fully agreed that authentication is discrete from authorization. My framing is set by the open source project I work on ( https://openziti.github.io/ ) w
177.
by PLG88 4y ago
Quote from NIST, "Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterpri
178.
by PLG88 4y ago
Visibility and analytics is a key component of zero trust... but the comment above seems to forget that the core concept of zero trust is about any person, device, or application trying to access a network cannot be trusted until authentica
179.
by PLG88 4y ago
What does bad bot mean?
180.
by PLG88 4y ago
You can almost entirely prevent perimeter breaches (from untrusted attacks) by implementing authenticate-before-connect with strong identity incl. closing all inbound ports at source and destination.

More ›