[HN Gopher] Show HN: OpenZiti Python SDK
___________________________________________________________________
Show HN: OpenZiti Python SDK
Author : ekoby
Score : 37 points
Date : 2022-09-21 12:08 UTC (10 hours ago)
(HTM) web link (openziti.io)
(TXT) w3m dump (openziti.io)
| linsomniac wrote:
| This is very cool, Python is my primary programming language and
| OpenZiti is something that looks promising for communication
| between public endpoints (like a Lambda receiver for Slack
| messages) and private infrastructure (like triggering a cron job
| to run).
| ekoby wrote:
| funny you should mention this, here is another post covering
| exactly that: https://news.ycombinator.com/item?id=32924212
| linsomniac wrote:
| Thanks for that pointer, didn't see that.
| ekoby wrote:
| I am happy to introduce OpenZiti Python SDK.
|
| It allows you to:
|
| * embed zero trust secure networking right into your Python
| application
|
| * run your Python services without any open network ports.
|
| Powered by: https://github.com/openziti/ziti
| manfre wrote:
| How does Ziti compare to something like nats (https://nats.io)?
| ekoby wrote:
| I am not deeply familiar with nats.io, so I could be wrong in
| my comparisons.
|
| OpenZiti is a connection-oriented overlay network vs NATS a
| messaging system.
|
| OpenZiti SDKs are more easily embeddable in existing
| applications as it does not require changes in networking
| semantics.
| PLG88 wrote:
| FWI, the OpenZiti project 'integrated' their Go SDK into
| NATS last year - https://www.youtube.com/watch?v=8V_HlDZy6M
| 8&ab_channel=OpenZ....
|
| I say 'integrated' as it was a quick and dirty integration
| rather than anywhere near production ready.
| voidfunc wrote:
| Congrats on the release!
|
| - Your former Orion pal, P :)
| dec0dedab0de wrote:
| Am I the only one who is having trouble understanding what this
| is doing, and why I would want to use it? Maybe I should have had
| that cup of coffee earlier.
| ekoby wrote:
| In the simplest terms, it's an application embedded VPN (on
| both client and server)
|
| The SDK allows you to integrate OpenZiti directly into your
| applications so that it can access network resources securely
| from anywhere in the world. This is based on strong identity so
| that the overlay cannot be access by untrusted endpoints. This
| is ensuring your application has zero trust in the network,
| WAN, LAN and even host OS - in fact, your app does not even
| need to know the IP and port to communicate with on the
| underlying host.
|
| Comparing to traditional VPNs this solution is a lot more
| secure -- instead giving you access to internal network,
| OpenZiti gives you access to specific service endpoints.
| e12e wrote:
| Thank you. It was entirely opaque for me from the "about"
| page what it allowed me to have "zero trust" in.
|
| Also what the threat model is, and how ziti solves it.
|
| I assume it does little to thwart traffic analysis?
|
| Does it suffer from tcp-over-tcp problems?
|
| Would be fair to say it's similar to a private Tor network
| with hidden services - but without anonymity and (probably
| much) higher throughput?
| ekoby wrote:
| > Also what the threat model is, and how ziti solves it.
|
| Your service (anything that accepts incoming connections)
| is never exposed to open internet. any incoming connections
| are guaranteed to be from authenticated and authorized
| clients.
|
| > I assume it does little to thwart traffic analysis?
|
| It does -- the traffic is routed throw OpenZiti fabric.
|
| > Does it suffer from tcp-over-tcp problems?
|
| OpenZiti is not a VPN and it does not forward network
| packets. In application embedded cases payload is end-to-
| end encrypted and forwarded on overlay network.
|
| > Would be fair to say it's similar to a private Tor
| network with hidden services - but without anonymity and
| (probably much) higher throughput?
|
| I believe that is a fair comparison, except anonymity is
| replaced with strong identity support to allow
| configuration of authorization policies.
| e12e wrote:
| Thank you!
|
| > OpenZiti is not a VPN and it does not forward network
| packets. In application embedded cases payload is end-to-
| end encrypted and forwarded on overlay network.
|
| Ok, but messages/RPC calls go over the network - can i
| return a 1gb video file/stream/fragment - or send real-
| time audio - or is it limited to more of a "secure RPC"?
| ekoby wrote:
| Absolutely, from your application's view it is just a
| socket that can live and be used to send/receive data
| indefinitely
| [deleted]
| e12e wrote:
| I more meant: what is the network transport like - does
| it offer tcp-like guarantees and re-submissions, along
| with poor suitability for real-time streams? How does it
| cross firewalls (that increasingly filter by protocol)?
| ekoby wrote:
| at this time OpenZiti connection are guaranteed-delivery
| (like TCP). We are evaluating offering lossy connections
| in the future.
|
| At the edges connection are always outbound and are seen
| as mTLS to the firewalls. the application payloads are
| end-to-end encrypted (using libsodium) an d transferred
| inside mTLS channels
| resoluteteeth wrote:
| It looks like it's like tailscale/zerotier but at the
| individual app level rather than the device level.
| billconan wrote:
| is it app embedded VPN?
| __MatrixMan__ wrote:
| How does this compare with libp2p? Every time I try to use it I
| get the feeling that the python support was abandoned half-way,
| maybe OpenZiti would be better.
| ekoby wrote:
| there are significant differences from libp2p:
|
| * strong identity support: authenticate before connect
|
| * it is service oriented vs point-to-point
|
| We would love for you to try OpenZiti it give us feedback :)
___________________________________________________________________
(page generated 2022-09-21 23:02 UTC)