Live data from Hacker News

Rayfish, Peer-to-peer mesh VPN with no server to trust

rayfish.xyz

21–30 of 116 posts

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#21

Having an install script that you paste into the terminal and all it does is download a binary and stick it in a folder is wild. If your users are savvy enough to be running random scripts they shouldn't need a script to do this and if they're not savvy enough to understand how to do that then the last thing they should be doing on earth is running a random terminal command off a website.

I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.

It's because people are too obsessed with providing complete instructions to incorporate any package manager into their instructions.

What we are really missing is an explicit progression from new software to maintained packages across distribution. As it is, each distro expects each package to have a maintainer, and very few people actually want to do that across several distros just to release their software. Generally, the expectation is to instead just wait around for people to make and maintain those packages by virtue of their own interest in your software, but it takes a while, and discoverability isn't automatic.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#24

Earlier quoted context omitted.

Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?

Because it normalizes a practice that, while acceptable in context of a well known project with numerous dedicated eyeballs such as Rust language, is not a generally acceptable method of installing software.

Exactly this.

The correct way is to have M of N signatures on specific package manager pinned versions. And you trust the auditors to look at each new version, of a well-known package.

We should start a project and get it funded, to do just that. The money can go to LLM tokens for audits, at least, and hosting the multisigs and the package managers.

Anyone want to partner on this? See my profile on HN and email me.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#26

Earlier quoted context omitted.

I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.

Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?

The issue does not have to do with whether the download is a binary or source code. It has to deal with verifying the integrity of the download before installation.

Curl piped into a shell command provides no means to verify that the download is uncorrupted and unmodified before running it. For example, whenever I download software manually I check the downloaded file against the verified checksums to ensure that I have an unmodified version. Ideally I check this with gpg --verify on the signed checksum file (against the source's public key). This is a standard procedure for many organizations [1]. If you just download something and immediately run it without this step, you could potentially run a hacked version of the installation script.

[1] https://www.debian.org/CD/verify

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#27

Hi HN, we built Rayfish, a peer-to-peer mesh VPN written in Rust on top of iroh. The core idea: every node has a keypair, and its identity on the network is that public key. From the key we derive a stable IPv4 in 100.64.0.0/10 and a stable IPv6 in 200::/7, similar in spirit to yggdrasil. Those addresses are yours for as long as you hold the key, and they don't change when you move networks or your physical IP change…

could a MITM/poison-well attacks work here or susceptible ?

im also afraid of exploits disseminating from a mesh network it would be impossible to stop

great work

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#28

> and membership is a signed record they each carry, not a question they ask a server. Sigh.. I like the project though. It looks very similar to something I vibed up recently, must be in the air

What’s the sigh to, out of curiosity, just because this makes revocation hard?

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#29

Earlier quoted context omitted.

Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?

The issue does not have to do with whether the download is a binary or source code. It has to deal with verifying the integrity of the download before installation. Curl piped into a shell command provides no means to verify that the download is uncorrupted and unmodified before running it. For example, whenever I download software manually I check the downloaded file against the verified checksums to ensure that I h…

Doesn't curl still validate ssl certificates? So long as I'm curling an https url from a trusted domain, don't I still have a chain of trust?

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#30

> and membership is a signed record they each carry, not a question they ask a server. Sigh.. I like the project though. It looks very similar to something I vibed up recently, must be in the air

What’s the sigh to, out of curiosity, just because this makes revocation hard?

The grandparent comment is correctly pointing out the sentence is an LLM tell.

"Membership is a question they ask a server" is a bogus sentence. "membership" is not a "question". It's syntactically valid semantic nonsense.

"Membership is dictated by a server" is one of several human sentences saying what that one is trying to.

Post reply on HN