Congrats on the launch! Will definitely have to check it out. I see you’re using Phoenix/Liveview for the control plane. :-) How has that been working for you?
Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
31–40 of 90 posts
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#32Congrats on the launch! Will definitely have to check it out. I see you’re using Phoenix/Liveview for the control plane. :-) How has that been working for you?
Thanks!
Erlang/OTP has so far been an excellent platform to build on for a product like Firezone. We chose it specifically for its reputation for powering soft realtime systems. Phoenix Channels are an added bonus that allow us to push all updates where they need to go, in just a few hundred lines of code.
We couldn't be happier with the stack choice.
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#33How does this compare with e.g. Tailscale?
There's a chart on the homepage comparing to Tailscale and Twingate. One difference not listed is MDM support. https://www.firezone.dev/kb/deploy/clients#provision-with-md... just tells you where to find the app but there's no parameters for configuring Firezone via zero-touch. It's also not clear if Gateways can serve as Exit Nodes for egress clients (like a traditional VPN). Lastly, Firezone Clients support only DN…
We don't support full-tunnel yet, but it's just around the corner. Track this issue if you're interested in its progress: https://github.com/firezone/firezone/issues/2667
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#34Hey! I worked on WARP at Cloudflare. I believe Cisco has anyconnect and then there's zscaler. I'm curious how you guys are competing with the other folks in the space. WARP was/is a really tough product to maintain (crossplatform networking is very difficult). CF was doing well with WARP mostly due to the distribution advantage. I imagine it's harder for startups to break into the space.
Oh man, I tried to use WARP for a project and it was the most confused, hard to understand product I've seen for a while. After a couple of hours of reading unhelpful support pages and trying increasingly random settings I simply gave up and used tailscale instead, which worked instantly.
I'm sure it wasn't the part of the product you worked on but the onboarding experience, wow, just terrible.
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#35It's really exciting to see this space bloom! Congrats on the launch!
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#36I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.
Second that.
I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pitfalls / troubleshooting stuff which actually consumed a lot of time and effort.
Is there an open source option with Firezone where I could try it out to have a head to head comparison (or if a comparison that already exists) or a guide that could be used for setting up one's own server and client apps for a self-hosted and self-managed solution using Firezone?
Please recommend / respond with the opinion of whether the thought process is worth it? Thanks.
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#37I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.
Do you think purchasers within enterprises especially care if it's a proprietary or commercially-supported FOSS offering?
Yes. A shitload of legal nuance depending on what you choose here. (Software supply chain issues are increasingly important nowadays, and executives usually care about this stuff more, because it can carry huge risks.)
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#38The concern I have with these types of solutions (meaning Tailscale, Firezone, etc.), is that I need to trust the provider not to mess up or maliciously exchange keys with rouge devices. Is this the case with Firezone as well?
I see that tailscale addresses this now somewhat: https://tailscale.com/kb/1226/tailnet-lock
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#39Hey! I worked on WARP at Cloudflare. I believe Cisco has anyconnect and then there's zscaler. I'm curious how you guys are competing with the other folks in the space. WARP was/is a really tough product to maintain (crossplatform networking is very difficult). CF was doing well with WARP mostly due to the distribution advantage. I imagine it's harder for startups to break into the space.
Through OpenZiti into the mix too - https://openziti.io/. Its open source and was designed from the ground up with zero trust, SDN, and deny-by-default principles. It also includes SDKs to allow developers to embed ZTN as part of the SDLC. We also built zrok (https://zrok.io/) on top of it, as a demonstration of a 'ziti-native' app, and being a better Ngrok.
Re: Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard
#40I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.
Do you think purchasers within enterprises especially care if it's a proprietary or commercially-supported FOSS offering?
They do if they are building it into their product/commercial offering. Less so if its a direct and internal usage.