Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

github.com

Post reply on HN
Print view View original

71–80 of 157 posts

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#71

Post by geoctl »

wkat4242 wrote: post #65

There are so so many of these already... - Tinc (the OG of P2P VPN) - Hamachi (not open though) - ZeroTier - Nebula (from Slack) - Tailscale - Netbird I wonder why people keep building more. I know each has its own quirks and things they're better at, but the difference is really quite minimal. One of the things I really would like is zero-trust 'lighthouses'. With current Zerotier and Tailscale, you really have to t…

With all respect, regardless of the fact that Octelium can replace the products you just mentioned, its context of interest is much larger and focused towards zero trust rather than just merely a yet another VPN/a remote access tool to access internal resources. I'd really appreciate it if you could read the docs first so that you can understand the features and architecture of Octelium and what it is meant to be. Every product claims to be "zero trust" these days, even VPNs and simple tunneling applications, however, actual zero trust architectures as defined by NIST (i.e. architectures built upon L7-aware identity-aware proxies, policy-decision-points, L7-aware and context-aware per-request access control via policy-as-code and ABAC, centralized identity and policy management, integrating context information from external tools such as SIEM, SSO and threat intelligence tools into per-request access control decisions, etc...) and there are many commercial products that are "true" ZTAs (e.g. Cloudflare Access, Teleport, Google BeyondCorp, StrongDM, Zscaler, etc...). The term is being however abused by the companies, some of which are extremely well funded, to distort reality and the fact that their products were not even built for zero trust. What these fake "zero trust" vendors are trying to achieve is something like: "either we all are zero trust, or zero trust doesn't really exist or mean anything at all and it's merely a buzzword, it's your choice".

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#72

Post by mdavid626 »

geoctl wrote: post #43
sureglymop wrote: post #34

Earlier quoted context omitted.

But that's what I'm getting at. Even if it is much more, is all of that immediately relevant to a curious/potential new user? I understand it may not be easy to narrow down the explanation, especially if you invested a lot of time and don't want to do a disservice to yourself by underselling it. Looking at the Tailscale tagline I quoted, it is small and ambiguous enough that it works marketing wise, regardless of all…

I am sorry that you find whatever I say as nothing but "jargon". I assume that those interested in Octelium are already interested in zero trust architectures as defined by NIST, simply products such as Cloudlfare Access, Teleport, StrongDM, Google BeyondCorp, Zscaler ZTNA, etc... I will do my best to simplify the README soon.

I’ve read “zero trust” more times today, than ever before in my life. Still don’t know what this project does.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#73

Post by bdesimone »

geoctl wrote: post #60
dudeinjapan wrote: post #58

Earlier quoted context omitted.

How about: “Octelium is a secure, policy-based access gateway to your HTTP services, with both VPN tunnel-based and OAuth/zero-trust modes available. (And it can do a lot more!)”

Thank you. I think your description is great but I, as a user myself, might see it as an identity-aware proxy (i.e. something like Pomerium and Ory Oathkeeper IaPs which are great projects) as opposed to a complete Kubernetes-tier platform that does the entire process of remote access, access control, visibility and auditing, user and identtiy management, centralized policy management, etc... from a data-plane and co…

Quick note since it was mentioned. Pomerium does support Kubernetes at pretty much every level you mentioned (although I'm not entirely sure what a "a complete Kubernetes-tier platform" means) including:

- "remote access" : https://www.pomerium.com/docs/capabilities/kubernetes-access

- "access control" https://www.pomerium.com/docs/capabilities/authorization

- "visibility and auditing" : https://www.pomerium.com/docs/capabilities/audit-logs

- "user and identtiy management" https://www.pomerium.com/docs/capabilities/authentication to which I'd add device identity as well.

- "centralized policy management": https://www.pomerium.com/docs/capabilities/authorization & https://www.pomerium.com/docs/internals/ppl

- deployments using Ingress Controller or GatewayAPI https://www.pomerium.com/docs/deploy/k8s/ingress, https://www.pomerium.com/docs/deploy/k8s/gateway-api

- "for an arbitrary number of resources" not sure what to link to but there's no limit here

Congrats on the release. I saw your thread on MCP and completely agree with the approach. Happy to trade notes :)

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#74

Post by dudeinjapan »

geoctl wrote: post #69
dudeinjapan wrote: post #62

Earlier quoted context omitted.

Much of this writing is about finding the right level of detail to communicate the core ideas. “Octelium is a full-featured access control platform, which provides API gateways and/or VPN tunnels to your HTTP services, paired with an intuitive user, policy, and auditing backplane and policy-as-code.” Something like the above would be much more enticing to potential users including myself. I can get a rough idea of wh…

I completely agree with you. And tbqh since almost everybody in the thread is complaining about the README then I must be really doing something wrong explaining Octelium and what it does. I will certainly put more effort to make the README and especially the main description section more useful and easier to understand without transforming it into more of a marketing pitch. As I mentioned in other replies, it's actu…

One more pointer would be to be very explicit on the homepage about the problems the product solves.

For example, many organizations use a mix of gated HTTP over public internet AND VPN, each one will have its own vendor auth product(s), user whitelisting, it's difficult to control or regularly audit. Octelium centralizes this management and gives admins the flexibility to control how services are exposed and to whom, presumably via simple policy change git commits. SOC2, etc. then becomes a breeze to export the state of the world, onboard/offboard employees, etc.

Defining the product in terms of use cases/problems/solutions rather that competing alternatives (Tailscale, Okta, ORY Hydra, etc.) will go a long way to increase clarity.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#75

Post by geoctl »

bdesimone wrote: post #73
geoctl wrote: post #60

Earlier quoted context omitted.

Thank you. I think your description is great but I, as a user myself, might see it as an identity-aware proxy (i.e. something like Pomerium and Ory Oathkeeper IaPs which are great projects) as opposed to a complete Kubernetes-tier platform that does the entire process of remote access, access control, visibility and auditing, user and identtiy management, centralized policy management, etc... from a data-plane and co…

Quick note since it was mentioned. Pomerium does support Kubernetes at pretty much every level you mentioned (although I'm not entirely sure what a "a complete Kubernetes-tier platform" means) including: - "remote access" : https://www.pomerium.com/docs/capabilities/kubernetes-access - "access control" https://www.pomerium.com/docs/capabilities/authorization - "visibility and auditing" : https://www.pomerium.com/docs…

I apologize if my reply was seen as critical in any way. I only wanted to make a difference between Octelium as a complete platform compared to Pomerium (I meant the open source project not the entire Enterprise offering which is obviously a complete BeyondCorp solution) and Ory Oathkeeper as identity-aware proxies. A more technical description for Octelium is that it is for IaPs similar to what Kubernetes is for containers. It simply provides a complete control plane to manage and deploy IaPs on top of Kubernetes itself. In fact, I am a fan of Pomerium and their work (I still remember your great work related to Golang's Webauthn and its attestation-related stuff ~3 years ago) if you're part of the team. Funnily enough, Octelium started as a sidecar ext_authz svc for Envoy instances to operate as an IaP but I ended up creating my own Golang-based IaP, Vigil, from scratch because Envoy was just nothing but pain outside HTTP-based resources.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#76

Post by metmac »

wkat4242 wrote: post #65

There are so so many of these already... - Tinc (the OG of P2P VPN) - Hamachi (not open though) - ZeroTier - Nebula (from Slack) - Tailscale - Netbird I wonder why people keep building more. I know each has its own quirks and things they're better at, but the difference is really quite minimal. One of the things I really would like is zero-trust 'lighthouses'. With current Zerotier and Tailscale, you really have to t…

Reading through the docs. I feel like a lot of people are missing the value here. This could be a diamond in the rough if it actually delivers on its docs.

What enterprises want is to move away from perimeter based security models towards the promise that Google überProxy/BeyondCorp popularized many years ago. Which has been lost in the buzzword soup. It’s very simple.

1. A clean separation between Prod, Corp, and the public internet. And the UX to hop between them as an employee is as transparent as possible. (Often times network segmentation comes with additional painful friction for engineerings.)

2. One pipe to observe, and clearly attenuate permissions as traffic/messages flows between these boundaries.

3. Strong proofing of identity for every client, as an inherit requirement.

The problem is everyone outside Google has incredibly diverse protocol ecosystems. It makes those three promises incredibly difficult to deliver on as a vendor. (I’ve evaluated many)

To build a proxy that is protocol aware, only solves half the problem. It gets you some coarse grain decision making and a good logging story.

To build a proxy that is also able to perform type-inference at the request layer, allows for a much richer authZ story. One where businesses can build an authorization layer at the proxy better than their in-house apps could even do natively. (As it turns out, having all the predicates of the request available to a policy engine is super useful).

The docs are a little verbose, the marketing maybe isn’t amazing. But this is inherently a complex problem. No one has fully solved.

Teleport was first to the market to OSS and commercialize a lot of these ideas. StrongDM also is doing really interesting work in this space. I wish Hashicorp had invested more in this space.

Disclaimer: my opinions are my own.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#77

Post by bdesimone »

geoctl wrote: post #75
bdesimone wrote: post #73

Earlier quoted context omitted.

Quick note since it was mentioned. Pomerium does support Kubernetes at pretty much every level you mentioned (although I'm not entirely sure what a "a complete Kubernetes-tier platform" means) including: - "remote access" : https://www.pomerium.com/docs/capabilities/kubernetes-access - "access control" https://www.pomerium.com/docs/capabilities/authorization - "visibility and auditing" : https://www.pomerium.com/docs…

I apologize if my reply was seen as critical in any way. I only wanted to make a difference between Octelium as a complete platform compared to Pomerium (I meant the open source project not the entire Enterprise offering which is obviously a complete BeyondCorp solution) and Ory Oathkeeper as identity-aware proxies. A more technical description for Octelium is that it is for IaPs similar to what Kubernetes is for con…

Genuinely, didn't take it that way at all! I don't expect you to be an expert on Pomerium.

> Funnily enough, Octelium started as a sidecar ext_authz svc for Envoy instances to operate as an IaP but I ended up creating my own Golang-based IaP, Vigil, from scratch because Envoy was just nothing but pain outside HTTP-based resources.

That's really funny... we went the opposite direction as the original versions were based on a custom Go proxy. Of course there are tradeoffs either way. Envoy is blazing fast, and does great with HTTP naturally, but has a giant configuration surface area (both pro and con), but we are now having to write some pretty low level filters /protocol capabilities in envoy for the other protocols we support (SSH, MCP, and so on) in C++ which does not spark joy. So I totally feel what you are saying.

Thanks for the kind words, though I am one of the contributors my colleague did the heavy lifting on the WebAuthN side.

Genuinely happy to see the release and where you are headed on the AI/MCP side. If you (or others) are interested, I am trying to bring more light to this model in the spec if you (or others) would like to weigh in: https://github.com/modelcontextprotocol/modelcontextprotocol...

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#78

Post by geoctl »

bdesimone wrote: post #77
geoctl wrote: post #75

Earlier quoted context omitted.

I apologize if my reply was seen as critical in any way. I only wanted to make a difference between Octelium as a complete platform compared to Pomerium (I meant the open source project not the entire Enterprise offering which is obviously a complete BeyondCorp solution) and Ory Oathkeeper as identity-aware proxies. A more technical description for Octelium is that it is for IaPs similar to what Kubernetes is for con…

Genuinely, didn't take it that way at all! I don't expect you to be an expert on Pomerium. > Funnily enough, Octelium started as a sidecar ext_authz svc for Envoy instances to operate as an IaP but I ended up creating my own Golang-based IaP, Vigil, from scratch because Envoy was just nothing but pain outside HTTP-based resources. That's really funny... we went the opposite direction as the original versions were bas…

Thank you. Honestly if I had the right to give you my opinion, I'd just advise you to go back to full custom Go-based proxies regardless of how overwhelming that might sound. Octelium itself still does use Envoy as an ingress for the BeyondCorp mode to route to the intended Service based on the FQDN, however, Envoy as great as it is for ingress and HTTP-based service mesh purposes especially when it comes to memory/CPU usage under huge load conditions, it really shows weakness when it comes to building generic multi L7-protocol aware (e.g. HTTP, SSH, Postgres, MySQL, RDP, etc...) IaPs where you need to understand L7 for each of these protocols to provide access control, modifications to the protocol specific messages and providing L7 aware visibility. The amount of work you need to do in ext_proc, ext_authz, proxy-wasm, etc... is just ridiculous and error prone due to the extra round trips yet it is equivalent to what you could have done if you owned the entire data plane yourself.

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#79

Post by mikevm »

geoctl wrote: post #71
wkat4242 wrote: post #65

There are so so many of these already... - Tinc (the OG of P2P VPN) - Hamachi (not open though) - ZeroTier - Nebula (from Slack) - Tailscale - Netbird I wonder why people keep building more. I know each has its own quirks and things they're better at, but the difference is really quite minimal. One of the things I really would like is zero-trust 'lighthouses'. With current Zerotier and Tailscale, you really have to t…

With all respect, regardless of the fact that Octelium can replace the products you just mentioned, its context of interest is much larger and focused towards zero trust rather than just merely a yet another VPN/a remote access tool to access internal resources. I'd really appreciate it if you could read the docs first so that you can understand the features and architecture of Octelium and what it is meant to be. Ev…

[dead]

Re: Show HN: Octelium – FOSS Alternative to Teleport, Cloudflare, Tailscale, Ngrok

#80

Post by jvink »

wkat4242 wrote: post #65

There are so so many of these already... - Tinc (the OG of P2P VPN) - Hamachi (not open though) - ZeroTier - Nebula (from Slack) - Tailscale - Netbird I wonder why people keep building more. I know each has its own quirks and things they're better at, but the difference is really quite minimal. One of the things I really would like is zero-trust 'lighthouses'. With current Zerotier and Tailscale, you really have to t…

Look into sanctum [1] it's cathedral mode. You can self-host those entirely and they're only discovery nodes. Once the tunnel is up the cathedral isn't involved unless for black key distribution or if your peers are behind restrictive NAT.

There's reliquary [2] which I host and run for me and my hacker friends based on sanctum.

[1] https://github.com/jorisvink/sanctum

[2] https://reliquary.se

Post reply on HN