Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rayfish, Peer-to-peer mesh VPN with no server to trust

rayfish.xyz

Post reply on HN
Print view View original

71–80 of 116 posts

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#71

Post by blourvim »

barnabee wrote: post #13
atrettel wrote: post #12

Earlier quoted context omitted.

I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.

Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?

The web server is able to detect and change the response of a curl | sh thus a malicious actor could avoid some detection.

Having a binary also allows for antivirus software to be ran on it before deciding to run the binary itself or not.

I am not sure if curl | sh bypass sandboxing by default, but definitely is the case when compared to flatpak or just regular packaging

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#72

Post by [deleted] »

throwawaypath wrote: post #70
keepupnow wrote: post #41

It is wrong to describe these P2P products as server-less. In order to connect two peers over WAN it needs a form of coordination server. Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes.

>Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes. But that would take understanding network fundamentals, architecture, etc. Who needs any of that cruft any longer?

[deleted]

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#73

Post by Fabricio20 »

tom1337890 wrote: post #44
Fabricio20 wrote: post #10

One thing I seem to struggle to understand is, a simple invite code system is showcased, but how does host Alice in one country know how to contact host Bob in another country with just the invite code? This seems to require a coordination server at least right, or does the invite embed some sort of information that'd allow Bob to directly reach Alice with just the invite code?

Iroh or n0 seems to solve that. It's they're underlying network protocol. When you're behind some cgnat, iroh falls back to public iroh relays hosted by n0: https://docs.iroh.computer/concepts/relays#public-relays However you could self host one of these on a public server you own. Then you're independent.

I see, so a coordination server is necessary which kinda somewhat defeats the "mesh" claim, though I do wonder if achieving this in a manner similar to DHT could eliminate the centralized entity controlling the servers at least, allowing the "peer-to-peer mesh" claim to be there in spirit.

Not that I have anything against the software or company to be clear, just that I wish one of these p2p vpns would be _totally_ actually independent of any coordination server or central entity!

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#74

Post by keepupnow »

throwawaypath wrote: post #70
keepupnow wrote: post #41

It is wrong to describe these P2P products as server-less. In order to connect two peers over WAN it needs a form of coordination server. Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes.

>Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes. But that would take understanding network fundamentals, architecture, etc. Who needs any of that cruft any longer?

Lol thats right who needs this now we have gpt duh

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#75

Post by BobbyTables2 »

barnabee wrote: post #13
atrettel wrote: post #12

Earlier quoted context omitted.

I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.

Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?

A webserver could alter the payload based on the client.

An evil person could present a normal install script for other browsers and randomly present a malicious one for curl clients.

At least with the downloaded file, that is the thing you get.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#76

Post by drdexebtjl »

Fabricio20 wrote: post #73
tom1337890 wrote: post #44

Earlier quoted context omitted.

Iroh or n0 seems to solve that. It's they're underlying network protocol. When you're behind some cgnat, iroh falls back to public iroh relays hosted by n0: https://docs.iroh.computer/concepts/relays#public-relays However you could self host one of these on a public server you own. Then you're independent.

I see, so a coordination server is necessary which kinda somewhat defeats the "mesh" claim, though I do wonder if achieving this in a manner similar to DHT could eliminate the centralized entity controlling the servers at least, allowing the "peer-to-peer mesh" claim to be there in spirit. Not that I have anything against the software or company to be clear, just that I wish one of these p2p vpns would be _totally_ a…

It’s not a coordinator server, it’s a relay, a dumb pipe, for when the peers can’t talk to each other directly because of a CGNAT.

Presumably you could disable it and the VPN would continue to work, just not on CGNATs.

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#77

Post by jarym »

keepupnow wrote: post #41

It is wrong to describe these P2P products as server-less. In order to connect two peers over WAN it needs a form of coordination server. Since Rayfish appears to be a Claude coded wrapper over Iroh it should at-least give credit to use of Iroh's discovery and relay nodes.

Iroh can use multiple discovery methods, one of them is DNS. When a node comes online it publishes its addresses[1]. Another node can resolve from the node id those addresses and attempt a direct or hole-punched connection. If that works, relays aren't needed.

So agree not serverless, but also does not NEED a coordination server (unless you class DNS as a coordination server which is debatable).

[1] https://docs.iroh.computer/concepts/address-lookup#endpoint-...

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#78

Post by preisschild »

ElectricalUnion wrote: post #56
preisschild wrote: post #49

Nowadays I question the necessity of vpn overlay networks. Why not just serve QUIC/HTTP3/Iroh over the internet directly in your application? And use oidc/client cert for authn/authz

I believe the main usecases for this is not requiring changing code, not requiring adding a reverse proxy in front of code I can't change, and "OSI"ish protocols (as in, not really TCP protocols - Remote Database Access, Oracle Net Services/Java Message Queues/X.500, LDAP/smb/ncacn_np). Those days, rather that actual "vpn overlay", I use Tailscale myself mostly for the Tailscale Funnel - a somewhat stable, yet free a…

> Remote Database Access

Postgres also has TLS + oauth2 support

> rather that actual "vpn overlay", I use Tailscale myself

I actually already had tailscale in mind when talking about "vpn overlays" :D

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#79

Post by inigyou »

polycancel wrote: post #55
tom1337890 wrote: post #44

Earlier quoted context omitted.

Iroh or n0 seems to solve that. It's they're underlying network protocol. When you're behind some cgnat, iroh falls back to public iroh relays hosted by n0: https://docs.iroh.computer/concepts/relays#public-relays However you could self host one of these on a public server you own. Then you're independent.

Seems like nothing can really get around this without a server/relay/TUN/STUN server. Peer to Peer messaging just doesn't work otherwise. Saw Iroh post on HN. Just wonder how it differ from Nostr, Scuttlebutt or Yggdrasil or DHT etc? Many from Nostr claim that they are successor of scuttlebutt, but many devs from Scuttlebutt highly dispute that. Be good to get a comparison between these protocols for devs who want to…

IPv6 gets around it!

Re: Rayfish, Peer-to-peer mesh VPN with no server to trust

#80

Post by whywhywhywhy »

jayd16 wrote: post #15
whywhywhywhy wrote: post #7

Having an install script that you paste into the terminal and all it does is download a binary and stick it in a folder is wild. If your users are savvy enough to be running random scripts they shouldn't need a script to do this and if they're not savvy enough to understand how to do that then the last thing they should be doing on earth is running a random terminal command off a website.

What would be your preferred solution?

Said in the post, if they're savvy enough to inspect an install script they can click and download a binary for their OS, chmod +x and move to whatever bin they want.

Although really something like this you unproven you should compile it.

Post reply on HN