Hacker News Reader

Comment by KaiserPro | Hacker News Reader

Not entirely as it only really allows stuff thats running in that service mesh's world to connect to the network.

But they want a global VPN for _everything_ including laptops. This means some level of access control.

What I like here is the use of lighhouses, to allow external nodes to punch in and discover the rest of the network. Something which is very difficult to do if you are relying on a service mesh in an unknown and unconnectable network.

View on HN

With Consul intentions and edge gateways you may be able to have the same functionality, but those are quite recent and was not present 2 years ago.

How does this differ from cjdns?

I suspect that the goals are slightly different.

The thing that immediately stands out is the routing. It looks like cjdns is a traditional-ish multi-hop network. The DHT routing table allows you to map out a route to peer A via peer B, R, & D.

What wireguard and nebula allow is for the underlying network to figure out most of the routing, and effectively create a massive point to-point network. whilst you can have concentrators/gateways, the idea is that most of the traffic goes direct from peer to peer. This can reduce load considerably.

I think cjdns allows arbitrary peering, so you can certainly set up a full mesh if you want point-to-point traffic, with multiple hops only for cases where the underlying network topology requires it.

Right, cjdns and Yggdrasil will both forward on behalf of other nodes where no direct paths are available.

Reply on news.ycombinator.com