PLG88

7 ms·

1.
by PLG88 3mo ago
I dont disagree with any of that. I am thus thinking, I think the cleanest distinction is probably not “embedded vs not embedded”, or even “relay vs no relay”. It is: who is supposed to control admission to the service? Iroh seems great whe
2.
by PLG88 3mo ago
I’d separate “app-embedded” from “no external coordination.” OpenZiti SDKs are app-embedded: the app can directly dial/bind Ziti services without a local tunnel daemon. Ziti also supports tunnelers and non-embedded options where app mo
3.
by PLG88 3mo ago
fwiw, Tailscale happens to be mostly open source, not completely. Yes, I know Headscale exists, it does not implement all the Tailscale functions (not non-functional production type capabilities)
4.
by PLG88 6mo ago
Glad it helped (I work on the project). Reading up on Iroh, OpenZiti approaches this less as ‘how do I reach that host across any path’ and more as ‘which identity is allowed to access which service across paths’,’ which feels like a better
5.
by PLG88 6mo ago
Good pointer. OpenZiti does fit that model well — app-embedded rather than network-wide relay/VPN first (though OpenZiti also supports non-embedded options). The main difference is it’s not just connectivity in the app, but identity- a
6.
by PLG88 7mo ago
Embedding is an option, but tunnelers - https://netfoundry.io/docs/openziti/reference/tunnelers/ - and edge routers (which can front legacy services without modifying them) also exist. The difference is
7.
by PLG88 8mo ago
That’s a fair framing, with one important distinction. Overlay ACLs give you network-scoped microsegmentation, not service-scoped Zero Trust (as intended in NIST 800-207). You’re limiting which IPs/ports can talk after a node is attach
8.
by PLG88 8mo ago
Right, but if certificates are a fundamental part of your design, you should include the functional mechanisms to manage them imho (i.e., key distribution, auth/login). The developers created it, but they keep it in the commercial prod
9.
by PLG88 8mo ago
nah, I dont buy that. A network is not a functional requirement of SSH etc in your use case.
10.
by PLG88 8mo ago
Fair, I was being loose with my language. What I should have said is that it does not come fully featured open source, that you need to do a certain amount of rolling your own.
11.
by PLG88 8mo ago
Referring to the previous person's comment, that you need to manage a PKI and have to distribute the keys yourself, no auth/login etc.
12.
by PLG88 8mo ago
Yeah, definitely more on the commercial side of the product. And agreed, I like NetBird/Tailscale/Wireguard, but they are better VPNs, not identity-first, zero trust overlays as OpenZiti/NetFoundry is. That's why compani
13.
by PLG88 8mo ago
Ahh, I see, thanks for clarifying. That was correct, now any OIDC-compatible identity provider (Auth0, Okta, Azure/Microsoft Entra, Google, Keycloak, etc.) is supported on all the tunnelers to my knowledge. Lots of work continues to go
14.
by PLG88 8mo ago
How are the mobile and desktop clients incomplete?? Tunnelers exist for Windows, Android, iOS, Linux, MacOS, and more - https://netfoundry.io/docs/openziti/reference/tunnelers/ ....
15.
by PLG88 8mo ago
Short answer: no, authenticating to start a VPN doesn’t make it Zero Trust. Once you authenticate to a VPN, you’re granted network attachment. From that point on, the network is effectively saying “I trust you enough to route packets,” and
16.
by PLG88 8mo ago
You could use a solution that allows you to have E2E with private sovereign keys on the endpoint, as well as bring your own IdP/PKI, so the provider does not have your keys. Would that be good enough?
17.
by PLG88 8mo ago
Out of curiosity, why? Because you dont want to run software on users devices?
18.
by PLG88 8mo ago
Its more a sharing (outbound proxy) solution than a VPN like Netbird is.
19.
by PLG88 8mo ago
Check out OpenZiti. Its open source, runs at prodution scale, and recently someone who used to work at Twingate said OpenZiti is many times more powerful than TG.
20.
by PLG88 8mo ago
This problem has been brought up in the OpenZiti community many times. I like Nebula, but it's not 'truly open source'.
21.
by PLG88 8mo ago
I like Netbird, its a better VPN, but its not zero trust networking. Zero Trust requires identity to create connectivity itself—per service, per session—rather than granting network reachability and constraining it with routes and rules. I
22.
by PLG88 8mo ago
Why do you think thats against the principles of zero trust? Wireguard is a wire transport, it has no control plane... I think what you are alluding to is the centralised control plane which makes it possible to operate at scale (and much m
23.
by PLG88 8mo ago
You have more or less described OpenZiti. Just mint a new identity/JWT for the user, create a service, and viola, only that user has access to your machine. Fully open source and self-hostable.
24.
by PLG88 9mo ago
fwiw, ngrok started as open source
25.
by PLG88 1y ago
Thats why I think there will be an open source standard that other companies build their ZTNA on (i.e., similar to flavours of Linux), which supports federation, so that companies A, B, and C each have their own ZTNA, but can interoperate b
26.
by PLG88 1y ago
Ahh, interesting, thanks for making it clear to me. You should check out OpenZiti too, that's what zrok is built on.
27.
by PLG88 1y ago
I would say zrok.io is more privacy-focused, particularly with its frontdoor and private sharing features.
28.
by PLG88 1y ago
Sounds like what zrok.io does ... do you also support completely E2E private shares like it does - https://docs.zrok.io/docs/concepts/sharing-private/ . This means the resource does not have a public IP at all
29.
by PLG88 1y ago
Do they? What does it do that nothing else does?
30.
by PLG88 1y ago
Their is tons of competition depending on how you want to attack the problem. Tailscale's problem imho is that their product does not scale well as required by large enterprises. One could argue nor do traditional VPNs, but they are al

More ›