yggdrasil-go

One option to resolve current worrying trends is to invest in development of alternative network protocols/structure, Yggdrasil[1][2], for example. [1] https://yggdrasil-network.github.io/ [2] https://github.com/yggdrasil-network/yggdrasil-go

I confused it with this for a min, which I have played with: https://github.com/yggdrasil-network/yggdrasil-go

Not sure how recent you are framing in your question, but the go implementation also runs on OpenWRT, in case you want to try it out. [1] https://github.com/yggdrasil-network/yggdrasil-go

- https://github.com/yggdrasil-network/yggdrasil-go

> The next version will make it much simpler to deploy isolated networks by using TLS roots to prevent accidental peerings. Is that PR #1038 [1]? Any info on how to use that feature and whether it works over multicast as well? I noticed this PR uses SHA-1 for matching fingerprints. SHA-1 has been broken for 18 years now. Is it possible to use something more secure? > It's also worth noting that Yggdrasil doesn't have the equivalent of "peer exchange" — only directly connected peers would ever find out your public IP address. Yggdrasil will not form new peerings automatically, with the single exception being multicast-discovered nodes on the same LAN. Right, my worry is that by having a server with a public IPv4 address and Yggdrasil running on an open port (so that my other nodes can connect to it) will allow someone else to connect to it

Hopefully the network segregation[1] feature makes it in at some point: > A shared network key, included in the tree announcements, will ensure that two nodes that peer with what should be segregated networks will ignore each other. This should make it much easier to operate private Yggdrasil meshes and not worry that they will end up accidentally peered to the public network. [1]: https://github.com/yggdrasil-network/yggdrasil-go/discussion...

From a purely networking perspective, there are far better solutions than tailscale. Have a look at full mesh VPNs like: https://github.com/cjdelisle/cjdns https://github.com/yggdrasil-network/yggdrasil-go https://github.com/gsliepen/tinc https://github.com/costela/wesher These build actual mesh networks where every node is equal and can serve as a router for other nodes to resolve difficult network topologies (where some nodes might not be connected to the internet, but do have connections to other nodes with an internet connection — I work with networks like that every day). Sending data through multiple routers is also possible. They also deal with nodes disappearing and change routes accordingly. tailscale (and similar solutions like netbird) still use a bunch of "proxy servers" for that. You can set them up on intermediate nodes, but

The only real solution long-term is completely peer-to-peer ad-hoc networking that doesn't depend on BGP. A few projects are in similar territory but none I've seen are working at the layer of bypassing BGP. Many are just acting as an overlay; which works to an extent. https://github.com/yggdrasil-network/yggdrasil-go It's probably begging for a different model of the "internet" and where data lives. My requirements: 1. Offline-first applications that sync via a pub/sub DHT of trusted peers. More details here but basically allows bypassing BGP. 2. Trusted peers are routable via a determinstic pathing algoritm without exposing the recipient. (content addressable everything). 3. Automatically distribute storage and compute on all local devices a user has and or needs (it's so dumb and wasteful that I only use one computer at a time when I h

> I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. Might want to check out Yggdrasil. It lets you can create a real mesh routed, E2E encrypted network. You can keep your network private, or connect it to the greater network and route others. There's no ring-of-trust (I can't imagine that as a viable solution at scale). But the config file has an AllowedPublicKeys section if you want to specify who can route through your node. https://github.com/yggdrasil-network/yggdrasil-go

https://github.com/yggdrasil-network/yggdrasil-go/blob/983df... I've never seen anyone need to check the top byte of a nonce before. This looks very odd to me.

There is an overview in the whitepaper: https://github.com/yggdrasil-network/yggdrasil-go/blob/maste... It fits the "private VPN" use-case quite well in my experience. You can connect to the wider network over the Internet, or just set your nodes up. If yggdrasil is installed on every router, it automatically creates a nice network topology, since it finds peers on the local subnet. Router advertising is also a possibility. Though there's no real drawback to connecting to the wider network since it's end-to-end encrypted, you have to be aware that specifying more than one peer will make it possible for traffic to be routed trough you, so the whole network performance can be sensitive to the choices that are made when peering over the Internet, as I think hop count is the only metric for now. For private meshes, I don't think you can speci

If you haven't already, you should give Yggdrasil (https://github.com/yggdrasil-network/yggdrasil-go/blob/maste...) a read. > IP addresses are derived from cryptographic keys, to reduce the need for public key infrastructure

Yggdrasil[1] is a similar project that seems to be a bit more active, if you're interested. [1] https://github.com/yggdrasil-network/yggdrasil-go