jvink

6 ms·

1.
by jvink 1mo ago
Working on the ability to create mixnets with sanctum [0] and its cathedrals. Sanctum already has very capable traffic analysis protections in place in the form of shroud, but being able to build mixnets will make it even more valuable. But
2.
by jvink 6mo ago
Picked up hacking on sanctum again after a break - https://sanctorum.se/
3.
by jvink 8mo ago
I've just released sanctum 1.0.0 and am taking 2-3 weeks off from hacking on it while I work on a little dumb game to be creative in a different way.
4.
Sanctum 1.0.0 Released(chants.conclave.se)
10 points by jvink 8mo ago|1 comments
5.
by jvink 9mo ago
Mostly been working on tier6 [0], which is "like" zerotier but over the sanctum protocol and fully open source (ISC licensed). Getting ready to release a 1.0.0 of sanctum [1], after almost a year of internal testing, dogfooding an
6.
Tier6 - Build global Ethernet networks using the sanctum protocol(github.com)
2 points by jvink 9mo ago|0 comments
7.
by jvink 10mo ago
Working on cross-flock discovery in sanctum [1] so I can cut a 1.0 release hopefully before Christmas. I am always looking for more people to test and play with it or even review the code. We've got a nice little user community going.
8.
by jvink 1y ago
Working on sanctum [0] and reliquary [1]. Soon approaching a 1.0 release for sanctum once I get my brain out of vacation mode and into hacking mode again. A lot has happened this year and I am excited. I will be talking about how sanctum an
9.
by jvink 1y ago
Look into sanctum [1] it's cathedral mode. You can self-host those entirely and they're only discovery nodes. Once the tunnel is up the cathedral isn't involved unless for black key distribution or if your peers are behind re
10.
Sanctum || A pq-safe and sandboxed VPN daemon(github.com)
28 points by jvink 1y ago|4 comments
11.
by jvink 1y ago
I am continuing work on https://reliquary.se - a VPN for the hackers - based on my fully privilege separated and sandboxed VPN sanctum ( https://sanctum.se ). It is shaping up nicely towards an actual 1.0 release in th
12.
Show HN: End-to-end encrypted, peer-to-peer VPN tunnels for hackers(reliquary.se)
3 points by jvink 2y ago|0 comments
13.
Show HN: Sanctum – a privilege separated VPN daemon(sanctorum.se)
3 points by jvink 2y ago|0 comments
14.
by jvink 7y ago
> (also working on OpenCVS) Not actively. It has been in hybernation for a long time. Not counting the recently-ish fixes I committed not much is happening with it.
15.
by jvink 10y ago
I understand. You're not forced to use the CLI create/build/run commands for anything. They just make it easier, but you are in no way tied to this. Building the module itself can be done on your own for example, as it is jus
16.
by jvink 10y ago
Author of Kore here. What fears? Care to elaborate? I'd love to hear!
17.
by jvink 11y ago
For sanity sake, this build option is now NOTLS.
18.
by jvink 11y ago
That's fair. Parenthesising return is a matter of readability and flavour to me. It tickles my spidey sense if it is missing. I strongly dislike declaring variables anywhere else but the function root, but I agree with you on the examp
19.
by jvink 11y ago
Author here. I see you picked out the few things that I consistently hear on the coding style I adopted which is based on my time hacking on openbsd. I have no real points to argue against those as it is based on preference in my opinion. I
20.
by jvink 11y ago
Thanks. I agree the BENCHMARK build option is a bit confusing. I might end up renaming it altogether.
21.
by jvink 11y ago
That is great, thanks for sharing.
22.
by jvink 11y ago
Correct. The accepting socket is shared between multiple workers which each have its own fd for epoll or kqueue. Because of this a form of serialising the accepts between said workers is needed to avoid unnecessary wakeups.
23.
by jvink 11y ago
Except you are basing yourself on the fact it creates a single worker process per connection. It does not. Workers are spawned when the server is started. Each of them deals with tens of thousands of connections on its own via the listening
24.
by jvink 11y ago
Kore does not fork per connection. It uses per cpu worker processes which multiplex I/O over either epoll or kqueue.
25.
by jvink 11y ago
It is not a forking web server. It is evented I/O with multiple worker processes. It is literally in the documentation and easily spottable in the code.
26.
by jvink 11y ago
You can turn off TLS on Kore. $ make BENCHMARK=1 It is not a run time option by design, but it is there. I want Kore to have sane defaults for getting up and running. That means TLS (1.2 default by only), no RSA based key exchanges, AEAD ci
27.
by jvink 11y ago
It is. For example being strict on the network input path and doing proper validation of incoming data is a strong part of the design. Or was the question more related to, it is C therefor security cannot be part of the process?
28.
by jvink 11y ago
Perhaps you can check out the websocket and SSE examples. https://github.com/jorisvink/kore/tree/master/examples/sse https://github.com/jorisvink/kore/tree/master&#x2F
29.
by jvink 11y ago
Kore does not fork per connection. It uses an event driven architecture with per CPU worker processes. The number of workers you have can be controlled by the config.