Viewing profile — geoctl

Cordium is a FOSS, self-hosted, identity-based, general-purpose, horizontally scalable sandbox platform that is built on k8s and Octelium, my main work. The main differentiator for…

I don't think the point here is to fully replace deterministic with non-deterministic-based access control. The point is to combine the traditional manual/coarse-grained determinis…

Actually zero trust can be seen as an optimization problem, you almost certainly want to globally deny every single request, even for authenticated users under all circumstances to…

I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already b…

Hello HN. Cordium is a FOSS, self-hosted, identity-based, general-purpose sandbox platform that I've been working on for a long time now that is built on Kubernetes and Octelium, m…

I discovered this bash trick by chance when I was once trying to healthCheck the Envoy's official OCI image container which didn't include curl or wget while forcing the envoy admi…

Honestly I am happy that more remote access products are using QUIC, not WireGuard, for tunneling and realizing its technical benefits (e.g. AES hardware acceleration, dynamic endp…

Cordium is a FOSS, self-hosted, identity-based, general-purpose sandbox platform that I've been working on for a long time now that is built on Kubernetes and Octelium, my main pro…

Hello HN , Cordium is a FOSS, self-hosted, general-purpose sandbox platform that I've been working on for a long time now that is built on Kubernetes and Octelium https://github.co…

Hello HN, Cordium is a general-purpose sandbox platform built on Kubernetes and Octelium, may main work https://github.com/octelium/octelium , that can be used for various use case…

Hello HN, Cordium is a project that I have been working on for a long time and now I am open sourcing it under Apache 2.0. It was initially meant as a remote development environmen…

Yes, every resource that needs to be protected is represented by a "Service" that's implemented as a L7-aware identity-aware proxy in the Octelium Cluster, which is a distributed s…

Thank you, I haven't accepted any contributions so far primarily because of this reason but things might change in the future. As mentioned in the README and docs, Octelium is desi…

Well, yes, Octelium is technically a VPN from a layer-3 perspective since it uses WireGuard/QUIC tunneling, but the tunnel doesn't directly terminate to the destination like in VPN…

(Shamless plug) I am also working on a similar FOSS, self-hosted project called Octelium https://github.com/octelium/octelium that you might find interesting if you are interested …

I wonder whether the current huge funding in AI will ever lead to a revolution in computer architecture. Modern PCIe/CXL is already starting to blur the difference between memory a…

With modern CXL/PCIe, I guess it's not going to be that stupid to claim that RAM/memory controller is slowly becoming I/O on its own.

Is it? I honestly kinda believe that etcd is probably the weakest point in vanilla k8s. It is simply unsuitable for heavy write environments and causes lots of consistency problems…

TCP over WireGuard is unavoidable because that's the whole point of tunneling. But TCP over WireGuard over QUIC just doesn't make any sense, neither from performance nor from secur…

There is actually. A way more interesting re-implementation of a popular L7 is SSH over QUIC. SSH has to implement its own mutual authentication and transport embedded in the proto…

You can just do that by using QUIC-based tunneling directly instead of using WireGuard-over-QUIC and basically stacking 2 state machines on top of one another.

QUIC isn't really about the web, it's more of a TCP+TLS replacement on top of UDP. You can build your own custom L7 on top of QUIC.

WireGuard-over-QUIC does not make any sense to me, this lowers performance and possibly the inner WireGuard MTUs. You can just replace WireGuard with QUIC altogether if you just wa…