Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rayfish, Peer-to-peer mesh VPN with no server to trust

rayfish.xyz

Post reply on HN
Print view View original

61–70 of 116 posts

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#61

Post by Arqu »

Groxx wrote: post #59
polycancel wrote: post #55

Earlier quoted context omitted.

Seems like nothing can really get around this without a server/relay/TUN/STUN server. Peer to Peer messaging just doesn't work otherwise. Saw Iroh post on HN. Just wonder how it differ from Nostr, Scuttlebutt or Yggdrasil or DHT etc? Many from Nostr claim that they are successor of scuttlebutt, but many devs from Scuttlebutt highly dispute that. Be good to get a comparison between these protocols for devs who want to…

Stable IP addresses solve it as well, but these kinds of things are not generally aimed at contexts where those are an option. Even IPv6 isn't generally stable - the prefix is ISP-defined and tends to vary similarly to IPv4 with CGNAT. There's also "dynamic DNS", which is basically just caching one side of that server/relay/TUN/STUN handshake, and relying on DNS for global discovery. For Iroh vs Scuttlebutt / DHT, I'…

One of the n0/iroh devs here.

Iroh doesn't use DHT as its main discovery mechanism. It uses DNS/pkarr and relays as the primary method. DHT is a separate feature if folks like to do that, we don't have it on by default and don't have it on the public relays.

The whole idea is p2p but trying to be realistic about what network environments actually look like.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#62

Post by Arqu »

captain_dfx wrote: post #2

Hi HN, we built Rayfish, a peer-to-peer mesh VPN written in Rust on top of iroh. The core idea: every node has a keypair, and its identity on the network is that public key. From the key we derive a stable IPv4 in 100.64.0.0/10 and a stable IPv6 in 200::/7, similar in spirit to yggdrasil. Those addresses are yours for as long as you hold the key, and they don't change when you move networks or your physical IP change…

Part of the n0/iroh team, cool to see this here, looking forward to play with it :)

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#63

Post by atrettel »

nazcan wrote: post #54
atrettel wrote: post #37

Earlier quoted context omitted.

Curl does verify certificates [1]. That does confirm that your connection is to the right server, but it does not confirm that the files were unmodified. SSL/TLS/HTTPS is more about encrypting the traffic and ensuring that there was no tampering with the file between you and the server. The steps that I describe are more about ensuring that there was no tampering between you and the original source. Those are two sep…

But where do you get the checksum from? I realize in some cases you are downloading from a mirror (thus as long as you trust the source of the checksum, that is quite useful) - but if it is from the same host - then you are just comparing against the same webserver.

You raise a good point. This is why people sign the checksums. The signature confirms that authenticity of the checksums. That somewhat moves the goalpost, though, since it then depends on where you got the source's public key, but it is still a more secure practice overall. The advantage of having the public key is that you only need to get it once and you can check many downloads later.

It is also possible to have a signed file that you can use to check the authenticity of a downloaded file directly without having to use checksums. Rust [1] does it that way for its other installation methods.

[1] https://forge.rust-lang.org/infra/other-installation-methods...

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#64

Post by Groxx »

Arqu wrote: post #61
Groxx wrote: post #59

Earlier quoted context omitted.

Stable IP addresses solve it as well, but these kinds of things are not generally aimed at contexts where those are an option. Even IPv6 isn't generally stable - the prefix is ISP-defined and tends to vary similarly to IPv4 with CGNAT. There's also "dynamic DNS", which is basically just caching one side of that server/relay/TUN/STUN handshake, and relying on DNS for global discovery. For Iroh vs Scuttlebutt / DHT, I'…

One of the n0/iroh devs here. Iroh doesn't use DHT as its main discovery mechanism. It uses DNS/pkarr and relays as the primary method. DHT is a separate feature if folks like to do that, we don't have it on by default and don't have it on the public relays. The whole idea is p2p but trying to be realistic about what network environments actually look like.

There has definitely been a lot of blind-idealism in a lot of P2P systems, yea. Though sometimes that's because it was/is just a PoC to see if it works at all, and then it grows too large to change / needs to be forked.

Iroh is definitely near the top of my "play with it some time" list, that pragmatism is very important for building normal things that normal people will be using :)

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#65

Post by atrettel »

petcat wrote: post #39
atrettel wrote: post #12

Earlier quoted context omitted.

I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.

Every package manager does the same thing: run a script. Would you feel safer if they offered a .deb? Do you unpack and inspect every .deb you install?

I get what you are saying, but my issue is not that it runs a script. My issue is that curl piped into a shell does not verify that the download is from the original source before running the script.

A .deb file has many advantages over curl piped into a shell. You can check the contents before installation, you can potentially verify the authenticity of the .deb file, and dpkg makes it possible to uninstall the package later since it keeps track of what it installed in an organized manner.

I won't say that I would feel safer with a .deb file. That depends on the source, what the package does, and other factors. Security is about tradeoffs. I personally find the tradeoffs associated with a .deb file better than the tradeoffs of curl piped into a shell, but I myself do not install .deb files in the first place since I get almost everything that I need from package repositories.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#66

Post by brookst »

anon7000 wrote: post #51
whywhywhywhy wrote: post #7

Having an install script that you paste into the terminal and all it does is download a binary and stick it in a folder is wild. If your users are savvy enough to be running random scripts they shouldn't need a script to do this and if they're not savvy enough to understand how to do that then the last thing they should be doing on earth is running a random terminal command off a website.

Yeah, if the script only downloads something from GH releases and doesn’t even put it in a bin dir… why not just make it a normal download from the website

Because the script can do branching logic and checks that you otherwise have to explain to the user.

Not defending the practice, I don’t like it. But the intent is to make it easier.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#67

Post by aftbit »

skulk wrote: post #53
ChocolateGod wrote: post #25

So it's effectively a clone of Nebula minus the need for a lighthouse.

Not really. Nebula creates a layer-3 network[1]. Rayfish is built upon Iroh which is a layer-7 network. [1]: https://nebula.defined.net/docs/#technical-details

But ... Rayfish creates a layer 3 network too. It assigns IP addresses to each node. I don't really see why it matters from this point of view whether it uses Iroh or something else to provide its backhaul. That's like saying Wireguard works at layer 4 because it uses UDP. The whole point of VPNs is to offer some kind of tunneling over higher level protocols.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#68

Post by Retr0id »

aftbit wrote: post #18
applfanboysbgon wrote: post #9

Earlier quoted context omitted.

> Honest [...] > Happy to get into the addressing scheme I truly loathe how all of the HN spambots promoting shovelware include a stupid call-to-action for feedback/discussion.

> Happy to get into ... No reply to various questions an hour later. I guess they're not really watching.

I'm sure any moment now the next openclaw heartbeat will fire.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#70

Post by throwawaypath »

keepupnow wrote: post #41

It is wrong to describe these P2P products as server-less. In order to connect two peers over WAN it needs a form of coordination server. Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes.

>Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes.

But that would take understanding network fundamentals, architecture, etc. Who needs any of that cruft any longer?

Post reply on HN