dovholuknf

10 ms·

61.
by dovholuknf 4y ago
A bunch of us (me included) used to work in the IoT world. You can *TRY* to simulate 100k assets using "20 or so" nodes but truthfully it's just never *really* the same. So, to be transparent, no. It's really, really, re
62.
by dovholuknf 4y ago
zero tier is layer 2 - openziti is layer 3, 4 or 7 depending on what you're doing. it's similar to zero tier in ways, but very, very different in others. openziti's main goal is to bring application embedded, zero trust into
63.
by dovholuknf 4y ago
And fwiw - a better link that talks about the SaaS is actually the pricing link https://netfoundry.io/pricing/ for anyone interested in "not" hosting it themselves... :)
64.
by dovholuknf 4y ago
That's the SaaS stuff. NetFoundry is the company behind OpenZiti but OpenZiti is 100% open source and you can go install it and run it all yourself. https://openziti.github.io/ziti/quickstarts/quickstart-overv
65.
by dovholuknf 4y ago
I am a dev on the project... The kinds of people I engage with aren't necessarily trying "to keep all this stuff in a box, control it, etc?". The cool thing about OpenZiti is that it's a split vpn by default. Only the tr
66.
by dovholuknf 4y ago
I was hoping to hear a few classic trombone sounds. womp womp womp
67.
by dovholuknf 4y ago
Yeah. We use that address space too and currently we take up the whole /10. Some of us are like, "heck ya, all your ips belong to us" and some of us are like "hey, that's a lot of ips, how about we use a /16 in
68.
Ask HN: List of Carrier-Grade-NATs (CGN/RFC1918) Used
3 points by dovholuknf 4y ago|3 comments
69.
by dovholuknf 4y ago
i left lastpass a few weeks ago because their browser integration was going to crap for me... then the breach announcement.. now this... I'm happy to give bitwarden my money (for now) :)
70.
by dovholuknf 4y ago
I keep trying to get my kid to remove tiktok but they don't listen at a certain age (and I don't feel like __enforcing__ them not having it)... So I'd say I'm a good 6.5/10
71.
by dovholuknf 4y ago
I like the way metadat put it: "a Raw Sewage network". Zero trust is the idea that all networks are hostile and you shouldn't trust any of them. Worst case scenario, when you attach to an unknown network (public WiFi) without
72.
by dovholuknf 4y ago
Not gonna lie - "Raw Sewage network" is pretty spot on. A huge part of zero trust principles is that all networks are untrustworthy, raw sewage networks. So the types of attacks that this protects against are all the 0day CVEs tha
73.
by dovholuknf 4y ago
Yes. If it needs to reroute, it will do so as long as the "terminating" site doesn't go offline. That's the one maintaining the "final" TCP stream so that one can't be rerouted. Multicast support has been
74.
by dovholuknf 4y ago
Yes. All connections are synthesized over the same connection to the overlay, making all your traffic look like "port 443" (or whatever port you use for the data plane). Inferring traffic from port number is thus made even harder.
75.
by dovholuknf 4y ago
Sorry, I should clarify. The overlay network definitely has a listening port/s. The network will be somewhere (usually best on the open internet) listening that is quite correct, that port is listening. The "no open ports" bi
76.
by dovholuknf 4y ago
Not OP but I also work on the OpenZiti project. Yeah that's basically the idea. The biggest difference is that the "VPN Connection" is basically entirely handled by the SDKs on both sides and only available to strong identiti
77.
by dovholuknf 4y ago
Digataur, it was great having you working on the OpenZiti project, buddy! Thanks so much for giving Ziggy some fodder :)
78.
by dovholuknf 4y ago
> I like the promise of OpenZiti, but man is it hard to set up. clearly that's not an acceptable user experience! I will take this to heart and try to make a much more clear guide on this. Probably one which does some kind of matrix
79.
by dovholuknf 4y ago
Gah. I need to file an issue to provide better help here. Both openziti and NetFoundry instructions should be just fine. Your command is just missing the resultant identity file... the -i flag and produces NO helpful output :( Below I made
80.
by dovholuknf 4y ago
- The project is actually currently in the middle of some performance comparison testing. I myself am not conducting the tests and I'd like to review the methodology we use for the tests but initial reports I'm hearing are quite g
81.
by dovholuknf 4y ago
Yikes an hour??? I need to do a better job at explaining it then! Thanks very much for taking the time to provide feedback. Figuring out identities vs IP addresses - yeah I can see how that might be a bit of a leap. Makes me want to produce
82.
by dovholuknf 4y ago
You'll still have open ports on the LAN. With OpenZiti you can even shut down the host firewall from having any open ports which I think is pretty cool. :) Plus you'll be able to access Jenkins from anywhere at that point - even f
83.
by dovholuknf 4y ago
Also embracing OpenZiti allows you to give users access to Jenkins securely (or any other app you want/need to keep off the public internet) without using a classic style VPN.
84.
by dovholuknf 4y ago
It definitely was *the way* to do it before OpenZiti and other zero trust overlay networks started to take off. Being "in the VPN" is similar to participating on the OpenZiti overlay network. VPNs allow for horizontal movement muc
85.
by dovholuknf 4y ago
> How do you get everyone to run the tunneler on all the machines that they could use? There's apps in the stores for Android/iOS/MacOS and installers for Windows. It's basically equivalent to running any other "
86.
by dovholuknf 4y ago
It's probably "similarly complex" but it's more complex at start because you won't have an OpenZiti overlay network already... So that's more complex for starters. Once you are familiar with OpenZiti it'll
87.
by dovholuknf 4y ago
As someone working on OpenZiti itself, I'd be interested in why choose Nebula over OpenZiti. I assume it'd just be due to the cache that Nebula has, since it comes from Slack? I am biased, I know, but OpenZiti offers a lot of int
88.
by dovholuknf 4y ago
Article author here. Basically we forked the latest Prometheus and embedded the golang OpenZiti SDK into the server to allow listening and dialing over the overlay network. Find that code at https://github.com/openziti-test-
89.
by dovholuknf 4y ago
You don't need to dream about it. You can absolutely do this today with OpenZiti. You just need to be able to set it up which is - imo (I am a dev on the project and wrote the quickstarts) just as easy to get up and running as anything
90.
Host a Dark Service with Java, Spring Boot, and OpenZiti(blogs.oracle.com)
3 points by dovholuknf 5y ago|1 comments

More ›