geoctl

5 ms·

1.
Show HN: FOSS sandbox platform for zero trust remote access without secrets(github.com)
1 points by geoctl 2mo ago|0 comments
2.
by geoctl 2mo ago
I don't think the point here is to fully replace deterministic with non-deterministic-based access control. The point is to combine the traditional manual/coarse-grained deterministic access control with an additional layer of dyn
3.
by geoctl 2mo ago
Actually zero trust can be seen as an optimization problem, you almost certainly want to globally deny every single request, even for authenticated users under all circumstances to all resources, unless when "necessary", "nec
4.
by geoctl 2mo ago
I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already been in use for years when it
5.
Show HN: FOSS sandbox platform that hides infra secrets from devs and AI agents(github.com)
2 points by geoctl 3mo ago|0 comments
6.
by geoctl 3mo ago
I discovered this bash trick by chance when I was once trying to healthCheck the Envoy's official OCI image container which didn't include curl or wget while forcing the envoy admin interface to listen on localhost which breaks th
7.
by geoctl 3mo ago
Honestly I am happy that more remote access products are using QUIC, not WireGuard, for tunneling and realizing its technical benefits (e.g. AES hardware acceleration, dynamic endpoints, custom auth with JWT or mTLS, FIPS compliance, traffi
8.
Show HN: Cordium – FOSS identity-based sandbox platform with zero-trust access(github.com)
2 points by geoctl 3mo ago|0 comments
9.
Show HN: Cordium – FOSS self-hosted sandbox platform alt. Codespaces/E2B/Daytona(github.com)
2 points by geoctl 3mo ago|0 comments
10.
Show HN: Cordium: FOSS sandbox platform that eliminates credential injection(github.com)
3 points by geoctl 4mo ago|0 comments
11.
Show HN: Cordium – FOSS sandbox platform with secretless infrastructure access(github.com)
2 points by geoctl 4mo ago|0 comments
12.
by geoctl 8mo ago
Yes, every resource that needs to be protected is represented by a "Service" that's implemented as a L7-aware identity-aware proxy in the Octelium Cluster, which is a distributed system that's running on top of a k8s clu
13.
by geoctl 8mo ago
Thank you, I haven't accepted any contributions so far primarily because of this reason but things might change in the future. As mentioned in the README and docs, Octelium is designed specifically for self-hosting so the commercial si
14.
by geoctl 8mo ago
Well, yes, Octelium is technically a VPN from a layer-3 perspective since it uses WireGuard/QUIC tunneling, but the tunnel doesn't directly terminate to the destination like in VPNs but instead to an identity-aware proxy that does
15.
by geoctl 8mo ago
(Shamless plug) I am also working on a similar FOSS, self-hosted project called Octelium https://github.com/octelium/octelium that you might find interesting if you are interested in this space. Octelium is, however, m
16.
by geoctl 8mo ago
I wonder whether the current huge funding in AI will ever lead to a revolution in computer architecture. Modern PCIe/CXL is already starting to blur the difference between memory and I/O. Maybe the future is going to be that CPUs,
17.
by geoctl 8mo ago
With modern CXL/PCIe, I guess it's not going to be that stupid to claim that RAM/memory controller is slowly becoming I/O on its own.
18.
by geoctl 11mo ago
Is it? I honestly kinda believe that etcd is probably the weakest point in vanilla k8s. It is simply unsuitable for heavy write environments and causes lots of consistency problems under heavy write loads, it's generally slow, it has v
19.
by geoctl 11mo ago
TCP over WireGuard is unavoidable because that's the whole point of tunneling. But TCP over WireGuard over QUIC just doesn't make any sense, neither from performance nor from security perspective. Not to mention that with every ad
20.
by geoctl 11mo ago
There is actually. A way more interesting re-implementation of a popular L7 is SSH over QUIC. SSH has to implement its own mutual authentication and transport embedded in the protocol implementation since it operates on top of plaintext TCP
21.
by geoctl 11mo ago
You can just do that by using QUIC-based tunneling directly instead of using WireGuard-over-QUIC and basically stacking 2 state machines on top of one another.
22.
by geoctl 11mo ago
QUIC isn't really about the web, it's more of a TCP+TLS replacement on top of UDP. You can build your own custom L7 on top of QUIC.
23.
by geoctl 11mo ago
WireGuard-over-QUIC does not make any sense to me, this lowers performance and possibly the inner WireGuard MTUs. You can just replace WireGuard with QUIC altogether if you just want obfuscation.
24.
by geoctl 11mo ago
While WireGuard makes every sense for an FPGA due to its minimal design, I wonder why there isn't much interest in using QUIC as a modern tunneling protocol, especially for corporate use cases. QUIC already provides an almost complete
25.
by geoctl 1y ago
I am working on Octelium https://github.com/octelium/octelium a FOSS unified zero trust secure access platform that is flexible enough to operate as a modern zero-config remote access VPN, a Zero Trust Network Access
26.
by geoctl 1y ago
As for (1) zero trust architectures don't really expose complete subnets to users, they only expose individual resources and enforce access control at each of these resources individually. As for (2) As I said above, this can actually
27.
by geoctl 1y ago
Thank you again. I meant by "negative" that they are critical as opposed to insulting. As I mentioned before in this thread, I usually don't find negative/critical comments offensive at all. Believe me, the last thing th
28.
by geoctl 1y ago
Thank you really for your detailed comment. I will try to answer your questions and please don't hesitate to ask in the Slack/Discord channels or contact emails later if the answers here weren't clear enough to you. 1. Octeli
29.
by geoctl 1y ago
Thank you really for your kind comment. Most of the links regarding how Octelium works, the quick management and installation guides, the examples (e.g. API/AI/MCP gateways, etc...) were actually included in the README itself. How
30.
by geoctl 1y ago
If anything I am actually thankful to HN for the opportunity letting me show my work here. Negative comments are not really that big of an issue for me. I just wish they were generally clearer and more specific so that I can easily fix what

More ›