Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rayfish, Peer-to-peer mesh VPN with no server to trust

rayfish.xyz

Post reply on HN
Print view View original

31–40 of 116 posts

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#31

Post by utilize1808 »

Fabricio20 wrote: post #10

One thing I seem to struggle to understand is, a simple invite code system is showcased, but how does host Alice in one country know how to contact host Bob in another country with just the invite code? This seems to require a coordination server at least right, or does the invite embed some sort of information that'd allow Bob to directly reach Alice with just the invite code?

I think for this kind of system to work, there has to be SOME kind of public/shared server to do the coordination. If the inviting node is behind a firewall then no amount of information can enable a guest node to connect to it without a node reachable by both.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#32

Post by Avicebron »

winterqt wrote: post #28
Avicebron wrote: post #22

> and membership is a signed record they each carry, not a question they ask a server. Sigh.. I like the project though. It looks very similar to something I vibed up recently, must be in the air

What’s the sigh to, out of curiosity, just because this makes revocation hard?

Partly. Partly because using EUF-CMA pins the record to the CA which makes membership deniability non-trivial which I don't love. It's not dumb, it's what Signal uses AFAIK and in transit message deniability is different than the signer. But still..

Also that sentence structure is very claudelike.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#33

Post by mintplant »

Borealid wrote: post #30
winterqt wrote: post #28

Earlier quoted context omitted.

What’s the sigh to, out of curiosity, just because this makes revocation hard?

The grandparent comment is correctly pointing out the sentence is an LLM tell. "Membership is a question they ask a server" is a bogus sentence. "membership" is not a "question". It's syntactically valid semantic nonsense. "Membership is dictated by a server" is one of several human sentences saying what that one is trying to.

Going from starting the project two weeks ago to already having a flashy marketing site is another tell, unfortunately. As much as I would love to see a trustworthy version of this idea.

https://github.com/rayfish/rayfish/commit/c49816e6dfba19e91a...

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#36

Post by rsyring »

Interesting project but can't find anything useful about the author's background on GitHub.

Commit history shows the project is a couple weeks old and the commit velocity only seems possible with heavy LLM involvement. Not unexpected but worth noting.

The repo's CLAUDE.md is huge which conflicts with published best practices around agent instructions and makes me wonder how much experience the author has using LLMs.

All that said, I'd like to use something like this for my personal devices since my personal and work Tailscale networks still can't run at the same time. But there aren't enough trust signals for me for this project yet.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#37

Post by atrettel »

NAR8789 wrote: post #29
atrettel wrote: post #26

Earlier quoted context omitted.

The issue does not have to do with whether the download is a binary or source code. It has to deal with verifying the integrity of the download before installation. Curl piped into a shell command provides no means to verify that the download is uncorrupted and unmodified before running it. For example, whenever I download software manually I check the downloaded file against the verified checksums to ensure that I h…

Doesn't curl still validate ssl certificates? So long as I'm curling an https url from a trusted domain, don't I still have a chain of trust?

Curl does verify certificates [1]. That does confirm that your connection is to the right server, but it does not confirm that the files were unmodified.

SSL/TLS/HTTPS is more about encrypting the traffic and ensuring that there was no tampering with the file between you and the server. The steps that I describe are more about ensuring that there was no tampering between you and the original source. Those are two separate problems. If you just rely on HTTPS, somebody can replace the file on the server with a modified version, and you would not know.

[1] https://curl.se/docs/sslcerts.html

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#38

Post by jasonjayr »

tinc (https://tinc-vpn.org/), a OSS mesh vpn that has existed for a long, long time, is another great solution with no central server. You can manage the public key distribution yourself, or just keep them checked into a git repo (my preferred solution), and it's been solid for years.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#39

Post by petcat »

atrettel wrote: post #12
whywhywhywhy wrote: post #7

Having an install script that you paste into the terminal and all it does is download a binary and stick it in a folder is wild. If your users are savvy enough to be running random scripts they shouldn't need a script to do this and if they're not savvy enough to understand how to do that then the last thing they should be doing on earth is running a random terminal command off a website.

I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.

Every package manager does the same thing: run a script.

Would you feel safer if they offered a .deb? Do you unpack and inspect every .deb you install?

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#40

Post by drdexebtjl »

atrettel wrote: post #26
barnabee wrote: post #13

Earlier quoted context omitted.

Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?

The issue does not have to do with whether the download is a binary or source code. It has to deal with verifying the integrity of the download before installation. Curl piped into a shell command provides no means to verify that the download is uncorrupted and unmodified before running it. For example, whenever I download software manually I check the downloaded file against the verified checksums to ensure that I h…

For a Debian image, yeah, that is the threat.

But this is new software from someone no one trusts yet. Verifying the binary was not maliciously replaced by someone else doesn’t matter.

What we need here is a reproducible build made and published by an independent third-party.

Post reply on HN