Viewing profile — rhuber

These models are basically a compression of everything we already made. Our books, our code, every stack overflow answer, the dumb forum arguments we had at 2am. The companies crea…

That's totally reasonable, and I agree that using something hosted entirely by a 3rd party makes sense for some use cases. Our reason goes a bit beyond security concerns, in this c…

Thanks Harrison, hope you're well!

That's a great question! One of the things I enjoyed during my time at Slack was their willingness to contribute to open source projects. We had similar IP clauses, but asking perm…

(*blog post author here) Thanks for sharing this on HN! I'll keep an eye on the comments and try to answer questions that come up.

We need to do a better job of this and I'm really sorry you had a not-great experience with expiration. Totally agree with your take.

We have an automated set of ansible scripts that spin up large groups of hosts for Nebula performance regression testing, and a while back I added zerotier, tailscale, wireguard-us…

I mean... the title of the Tailscale blog post is "Tailscale raises $100M… to fix the Internet", and that's pretty massive scale. /s I don't have 100k hosts on a large network to t…

The Nebula CA we built at Slack was very specific to Slack's internal devops, and just wasn't generalizable. It is highly automated there, and is custom tooling, just as you descri…

Another fair criticism. We will publish the benchmarks and make them repeatable (which most existing ones I've found don't bother to do). We hadn't done so because Tailscale isn't …

Fair enough. I am sure the key distribution is fast and all that, but not needing peer key distribution at all was a goal and the overhead associated is less scalable than just not…

It does! In fact replacing AWS security groups and making them cross region and cross platform was probably the first goal of the project. My coauthor, Nate, wrote Nebula's interna…

(Nebula coauthor here) People sometimes ask me to describe the differences between Nebula and Tailscale. One of the most important relates to performance and scale. Nebula can hand…

(coauthor of Nebula) We briefly considered building something atop Wireguard in the early days of Nebula, but decided not to do so because of scaling. Wireguard's protocol necessit…

Actually it does do that, you can trust multiple CAs in a single instance and even write firewalls scoped to CAs.

"Hey guys, remember when freenode was taken over by one guy?" (It was, like, yesterday.) It's hard to overstate the dangers of over-centralisation like this, and I say it as a pers…

I wasn't commenting on the strength of RSA-1024, per se, but on the assumed age of that key. OpenSSH's ssh-keygen hasn't defaulted to 1024 bit RSA keys since before version 4.2, in…

The author of this article should consider following their own advice, since they have a woefully outdated RSA-1024 ssh key securing their GitHub account. $ curl -s https://github.…

It is, admittedly, impossible for me to be unbiased in this discussion (coauthor of Nebula, hi), but I strongly disagree that your client code is your most important component, fro…

Every aspiring programmer should learn C. They should also learn multiple dialects of ASM. Learning these things helps you better understand how computers fundamentally work, and k…

Hi - Ryan from the blog post here. eBPF is great, and we plan to support it as our collection mechanism, but not today and maybe not soon. When we wrote go-audit, there were few, (…