I wonder if this could be used in a trustless context to create a mesh of contributed internet nodes.
Nebula, Slack's Open Source Global Overlay Network
21–30 of 71 posts
Re: Nebula, Slack's Open Source Global Overlay Network
#22I wonder if this could be used in a trustless context to create a mesh of contributed internet nodes.
[deleted]
Re: Nebula, Slack's Open Source Global Overlay Network
#23This is really interesting news!! Ryan was at the Gophercon 2018 and was talking casually about his pet '20%' project with some of us. Happy to see if finally released in the opensource. Great work Ryan!. His off the record remarks really made me change my mind about Slack engineering team in general. Otherwise, I was always cursing them about their electron client.
Re: Nebula, Slack's Open Source Global Overlay Network
#24If anyone has detailed knowledge, it would be interesting to learn how Nebula is similar, and different, from e.g. Consul Connect and ZeroTier.
The BSD license is a pretty big difference.
[EDIT] MIT, that is, of course.
Re: Nebula, Slack's Open Source Global Overlay Network
#25It feels like their issues would have been solved by a service mesh using e.g. consul or istio. If so, I'd wonder writing a tool from scratch was the right use of engineering time. Anyway, as an engineer, I'd certainly have found this a fun project. Kudos to slack for trying something new and open sourcing it.
Not entirely as it only really allows stuff thats running in that service mesh's world to connect to the network.
But they want a global VPN for _everything_ including laptops. This means some level of access control.
What I like here is the use of lighhouses, to allow external nodes to punch in and discover the rest of the network. Something which is very difficult to do if you are relying on a service mesh in an unknown and unconnectable network.
Re: Nebula, Slack's Open Source Global Overlay Network
#26Earlier quoted context omitted.
They may have decided that ZT's encryption isn't proven well enough for their needs. It's also posssible they rejected ZT because they didn't want to use ZT's centralized infrastructure. Two years ago was long before ZT started working on making that optional.
ZT allows you to run your own "Moons", meaning you dont need their infrastructure... bit more config required on the client end, but less reliance on Zerotier....
We are about to make that much easier and also allow true infrastructure federation -- you won't have to have your nodes contact our roots directly. We came up with something very interesting.
As for crypto: we plan some improvements in 2.0, but note that these days easily >90% of the traffic over ZeroTier networks (or any other VPN / overlay) tends to be already encrypted via SSH, SSL, etc. Another layer of encryption in the overlay just provides some additional defense in depth. We're rapidly moving to a world where everything layer 3 and above encrypts everything. That's why we have not prioritized sexier crypto for our L2 overlay tech. It's a bit redundant.
Re: Nebula, Slack's Open Source Global Overlay Network
#27If anyone has detailed knowledge, it would be interesting to learn how Nebula is similar, and different, from e.g. Consul Connect and ZeroTier.
The BSD license is a pretty big difference. [EDIT] MIT, that is, of course.
Consul Connect is under MPLv2, which is a perfectly reasonable license unless you want to do shady things. There may be other differentiators, but this is not one.
Re: Nebula, Slack's Open Source Global Overlay Network
#28Earlier quoted context omitted.
ZT allows you to run your own "Moons", meaning you dont need their infrastructure... bit more config required on the client end, but less reliance on Zerotier....
Moons are going to be deprecated soon and as far as I understand never actually worked how people wanted. I.e. they still needed ZTs root servers, even if you were running your own controller. To contrast, with Nebula you run your own root(s) (lighthouses) and you don't need a controller because important config (ip, group, hostname) is signed by the same CA.
"Moons" are being deprecated in favor of true federation:
https://www.zerotier.com/zerotier-2-0-status/
https://www.zerotier.com/lf-announcement/
The moon terminology will also go away since there will no longer be a difference between these and our core roots. They'll all just be roots and will be interchangeable. The use of a common underlying key/value store will allow ZeroTier to keep its unified namespace and easy ability to join anyone's network or communicate with anyone regardless of what roots they're using (as long as their roots are on the same global network as you... obviously you can't hop air gaps).
Re: Nebula, Slack's Open Source Global Overlay Network
#29How does this differ from WireGuard?
Like wireguard, Nebula is using the Noise Protocol Framework[1], but it seems that Nebula is using a ca-cert authority to tie together the peers in the same Nebula network[2] [1] https://www.noiseprotocol.org/noise.html#introduction [2] https://github.com/slackhq/nebula#3-a-nebula-certificate-aut...
I get a certificate error for `www.noiseprotocol.org`. It turns out they're serving a certificate for `noiseprotocol.org` instead. The URL is still valid without `www.` [0].
Re: Nebula, Slack's Open Source Global Overlay Network
#30This looks like an open source Zerotier, my dream has come true.
Zerotier is open source?