Ockam
webpki
Our great sponsors
Ockam | webpki | |
---|---|---|
76 | 6 | |
4,323 | 450 | |
1.5% | - | |
10.0 | 8.0 | |
4 days ago | about 1 month ago | |
Rust | Rust | |
Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Ockam
-
Tunnelmole, an ngrok alternative (open source)
disclosure: I work at Ockam.
The Portals for Mac app is an example of the type of thing you could build using the open source stack of protocols. The README (linked by parent) links out to all of the relevant parts of the protocol documentation to explain how these work together. The NAT Traversal (https://github.com/build-trust/ockam/blob/develop/examples/a...) part of the README is probably the best explanation of why the free relay you get via Ockam Orchestrator is a useful part of this demo.
As for why would anyone trust this: The protocols are designed so you absolutely don't have to trust the relay. Trust is pushed out to the edges that you control and so you're not susceptible to a MITM attack if something like a relay is compromised. The protocol design for all of this is open and documented, and was independently audited by (IMO) some of the best in the business, Trail of Bits: https://docs.ockam.io/reference/protocols.
-
Tunnel via Cloudflare to Any TCP Service
We’ve been working on something (https://github.com/build-trust/ockam) that enables exactly this, among a whole host of other use cases. If you check out some of the code examples in the docs you’ll see how to setup a tunnel using the CLI.
For other use cases there’s also the programming libraries (only Rust atm, though I was spiking a TypeScript/Node PoC this week) which might provide more flexibility. Personally I’m excited by the idea of being able to move this kind of secure by design connectivity all the way into the application layer though.
-
Contribute to open source without knowing how to code
Hacktoberfest - No Code - Try Ockam Command (CLI) and give user experience feedback #3631
-
Rust and Elixir libraries for end-to-end encrypted secure communication
https://github.com/build-trust/ockam/blob/develop/documentat...
Give it a try. Would love to know if that fits what you're going for.
UDP hole puncturing is in development right now. However there is extensive research that shows it in only successful in making connections in 60 to 80% of real world networks. This is why Signal does relays for example. Relays provide a highly reliable strategy. So we knew we'll want to support both and give devs and option to choose what is right for their application. Or failover from one to the other.
In addition, relays also allow store and forward and integration to other enterprise systems like Kafka. This is how we're able to to move end-to-end encrypted data through Kafka https://github.com/build-trust/ockam/tree/develop/documentat...
Store and forward as a first class feature is in development.
Scatter/Gather is a much harder problem since it involves group key agreement and challenges that come with doing that safely. This is in our long term roadmap, but we've not done any development for this yet.
-
Official /r/rust "Who's Hiring" thread for job-seekers and job-offerers [Rust 1.58]
Ockam crates implement a collection of messaging and cryptographic protocols that provide end-to-end application layer trust in data. We believe that, in order to have a realistically manageable vulnerability surface, all modern applications need end-to-end guarantees of data integrity and authenticity. The only way to build secure and private applications is to remove unnecessary implicit trust in network boundaries, intermediaries and infrastructure.
- Ask HN: Do you donate money to open source?
- What are you using Rust for?
webpki
-
Struggling with the OpenSSL Crate
Beyond that, various things like the ScyllaDB driver are using OpenSSL because WebPKI doesn't support validating connections to IP addresses (as opposed to DNS names) and RusTLS currently delegates to WebPKI.
-
What Is Rust's Hole Purpose?
There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime
There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/
There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).
-
I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
An issue was raised with webpki to support the IP addressees 5 years ago, and yet it's still not there. What do people use to overcome the fact that rustls can't do IP-based client connections because of it? My guess would be, they are switching to native-tls or openssl-tls.
-
Why is SSL such a pain?
Yes, rustls currently doesn't support certificates without hostnames (only an IP); this is actually an issue with the webpki crate, and work to solve it is ongoing (will hopefully land in a release in a few months or so).
-
Preparing Rustls for Wider Adoption
> Bundling this set with Firefox
I love that they did that; it was actually my idea (https://bugzilla.mozilla.org/show_bug.cgi?id=657228). I believe the list is pretty large and changes frequently and so they download it dynamically.
> short cut to a "Yes"
Do they really do that? That's awesome if so. Then they don't even need to ship the roots.
> I specifically don't like [...] saying "unknown issuer"
https://github.com/briansmith/webpki/issues/221
> If std::fs::File::open() gives me Result with an io:Error that claims "File not found" but the underlying OS file open actually failed due to a permission error, you can see why that's a problem right? Even if this hypothetical OS doesn't expose any specific errors, "File not found" is misleading.
A more accurate analogy: You ask to open "example.txt" without supplying the path, and there is no "example.txt" in the current working directory. You will get "file not found."
Regardless, I agree we could have a better name than UnknownIssuer for this error.
> he situation described above just generated an "Invalid certificate" message. More use of anyhow::Context would be helpful. I don't disagree with Rustls disallowing decade-obsolete crypto. It's the "silently ignores" part that's a problem.
Because of how X.509 certificate validation works, in general it's not possible to tell you why an issuer couldn't be found, because there are many possible reasons.
Regardless https://github.com/briansmith/webpki/issues/206 tracks improving the situation.
What are some alternatives?
rust-native-tls
rustls - A modern TLS library in Rust
ejabberd - Robust, Ubiquitous and Massively Scalable Messaging Platform (XMPP, MQTT, SIP Server)
sshkit - An Elixir toolkit for performing tasks on one or more servers, built on top of Erlang’s SSH application.
socket - Socket wrapping for Elixir.
rust-crypto - A (mostly) pure-Rust implementation of various cryptographic algorithms.
ring - Safe, fast, small crypto using Rust
rust-openssl - OpenSSL bindings for Rust
schannel-rs - Schannel API-bindings for rust (provides an interface for native SSL/TLS using windows APIs)