Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Netrinos – A keep it simple Mesh VPN for small teams

netrinos.com

Post reply on HN
Print view View original

61–70 of 75 posts

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#61

Post by panarky »

hugo1789 wrote: post #38
panarky wrote: post #26

Earlier quoted context omitted.

And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has…

What’s the alternative—locking down all legitimate users and still losing the data anyway? Network controls alone don’t stop exfiltration. HDMI/DP can move data faster than most consumer NICs. Does the system account for that scenario?

> Network controls alone don’t stop exfiltration.

Stop signs alone don't stop all traffic accidents.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#63

Post by sh3rl0ck »

observationist wrote: post #15
bongodongobob wrote: post #10

Earlier quoted context omitted.

Not allowing random VPN connections on a LAN is pretty standard. I've been surprised at how many people here are able to use tailscale and the like. Guessing it's just because there are likely smaller teams here that don't have any kind of managed network.

Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public int…

Exactly.

I'm from a cybersec and devops background, and the IT admin here is just an ancient family-appointed person with no idea of how stuff works and with a lot to gain from under the table corporate dealings.

This is a man who believes that 15 megabit is sufficient bandwidth for CompSci students in their hostels (not the college, mind you, the hostel specifically) and decided that banning games was a "hero move".

Vendor locked into Sophos and a custom third party provider, these people have zero idea about what they're doing. I've met them various times and had various discussions up and down the org chart - this is a man who thinks he should have full access to every student's browsing history in their own time and that all VPNs are the same (he doesn't know how VPNs work btw) and allow for evasion from their network policies.

It's all a bit cursed because he fear-mongers the upper echelons of the college administration by showing them made up logs saying "students are hacking the network" to justify this.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#64

Post by sh3rl0ck »

panarky wrote: post #26
observationist wrote: post #15

Earlier quoted context omitted.

Someone is making your IT team do extra work without a good understanding of their systems if they're banning tailscale or granting special network level access thinking that ip or mac address based profiling is secure. Your network should be zero trust. That means you want to treat every host that connects as if it's on the public internet; the corollary to that is you should give your hosts access to the public int…

And then a few of those users who you treated like adults who don't need surveillance make a private network among themselves and other nodes in Russia and China to exfiltrate the corporation's most sensitive intellectual property, serve as a bridge for state-sponsored bad actors to bypass your firewall, and tunnel command-and-control traffic through your "unrestricted" egress, and now your zero-trust philosophy has…

You know, that makes sense for a corporate network. They have an extremely aggressive firewall on the academic campus, which is how it should be.

However, they have failed to provide isolated networks for the research labs which just need it for even downloading LLMs (they have banned huggingface!).

Moreover, a hostel is residential. They should provide either the option of getting an external connection (which I would happily do!) or provide a means of non-stupid internet which they aren't.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#65

Post by dewey »

atmosx wrote: post #39
windexh8er wrote: post #34

Well, I wish you the best with this - but I really don't understand the target market. The obvious competitor here is Tailscale. But let's say, reasons, and Tailscale isn't an option. Then you go down the path... TwinGate, Teleport, Netbird, Pomerium, Netmaker, ZeroTier, etc... Even the initial pricing and free tier are you're up against are going to mostly be a deal breaker compared to what's out there. Trusting a V…

Isn’t that true for any new service out there? What’s the market for a search engine? And yet kagi.com is a thing.

That's a very weird comparison...as the market for a search engine is basically every internet user. A networking overlay for technical users is a much smaller market.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#66

Post by drcongo »

pcarroll wrote: post #51
drcongo wrote: post #48

I only use Tailscale for two features - one is having every machine on the network use a logical name of the pattern {projectname}-{environment} ie: `ssh me@hn-prd` and the other is exit nodes. I couldn't work out from your site if either of these two things is doable here.

Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account. Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short domain these days). So yes, you can... $ ssh user@server.myaccount.2ho.ca C:\ net use S: \\server.myaccount.2ho.ca\Home etc.

Ah, that's a shame - my OCD loves the short, domainless names we get on Tailscale.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#67

Post by atmosx »

dewey wrote: post #65
atmosx wrote: post #39

Earlier quoted context omitted.

Isn’t that true for any new service out there? What’s the market for a search engine? And yet kagi.com is a thing.

That's a very weird comparison...as the market for a search engine is basically every internet user. A networking overlay for technical users is a much smaller market.

You mean that going against Google is easier than going against a small company like Tailscale? I doubt it.

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#68

Post by pcarroll »

drcongo wrote: post #66
pcarroll wrote: post #51

Earlier quoted context omitted.

Each device on your account gets a private static IP address in the network 100.x.x.x. The name is static as long as the device lives on your account. Each also gets a friendly DNS name in the form device.account.2ho.ca (try finding a short domain these days). So yes, you can... $ ssh user@server.myaccount.2ho.ca C:\ net use S: \\server.myaccount.2ho.ca\Home etc.

Ah, that's a shame - my OCD loves the short, domainless names we get on Tailscale.

Maybe I should look into that... there are a few different ways to do it, and none of them are all that hard.

- i just put it in the roadmap

Re: Show HN: Netrinos – A keep it simple Mesh VPN for small teams

#70

Post by drcongo »

pcarroll wrote: post #68
drcongo wrote: post #66

Earlier quoted context omitted.

Ah, that's a shame - my OCD loves the short, domainless names we get on Tailscale.

Maybe I should look into that... there are a few different ways to do it, and none of them are all that hard. - i just put it in the roadmap

Amazing. Is there somewhere we can view / follow the roadmap?
Post reply on HN