Squid VS envoy

> But I’m working on setting up a VPN at my house to tunnel all Netflix traffic through ...

On a technical point, you might be able to get away with just using Squid for the proxy, with pretty much default settings.

http://www.squid-cache.org

I used to use that years ago (not with Netflix though) running from a data centre, using an ssh (autossh) tunnel to reach it securely.

Worked pretty well, aside from the extra latency due to the packets having to go an extra half way around the world. ;)

I recommend trying a transparent proxy like Squid. There are many analytics tools for Squid logs. Squid can generate TLS certificates on the fly to inspect secure websites but you'll have to generate and install a CA certificate and key into Squid. You'll also have to import the CA certificate on any machine accessing the internet through the Squid proxy. Squid has the added bonus of caching content to speed up web browsing and reduce data usage.

I “invented” IPFS when I though “wouldn’t it be nice if we could combine Squid-Cache with BackupPC

A couple of dedicated server-side resource caching solutions have emerged over the years: Memcached, Varnish, Squid, etc. Other solutions are less focused on web resource caching and more generic, e.g., Redis or Hazelcast.

Web caching (more techical, probably not useful) there squid-cache

Also, the fact it is distributed by HTTP allow companies (and ISPs) to cache content in Squid servers (http://www.squid-cache.org/). And this is quite a feature!

If your router is compatible with custom firmware (Tomato or DD-WRT) you can flash it and use the logging features of those platforms. Otherwise no there isn't really an "app or software" that can do this, you need a piece of hardware that sits between the LAN devices and the internet connection. That can be a full-fledged computer, if you're willing to use it as firewall or router (pfSense), DNS server (PowerDNS) or proxy server (Squid).

A Proxy will be installed next to your ECS Task. Under the hood, it's built on Envoy

The open source projects Fastly uses and the foundations we partner with are vital to Fastly’s mission and success. Here's an unscientific list of projects and organizations supported by the Linux Foundation that we use and love include: The Linux Kernel, Kubernetes, containerd, eBPF, Falco, OpenAPI Initiative, ESLint, Express, Fastify, Lodash, Mocha, Node.js, Prometheus, Jenkins, OpenTelemetry, Envoy, etcd, Helm, osquery, Harbor, sigstore, cert-manager, Cilium, Fluentd, Keycloak, Open Policy Agent, Coalition for Content Provenance and Authority (C2PA), Flux, gRPC, Strimzi, Thanos, Linkerd, Let’s Encrypt, WebAssembly. And the list goes on!

The issue in Envoy was reported to the maintainers, and they decided to implement hardening to help mitigate this issue. The vulnerability was tracked as GHSA-vcf8-7238-v74c/CVE-2024-23326 and is patched in versions 1.30.2, 1.29.5, 1.28.4, and 1.27.6. The patch ensures that the correct response code (101) is received before assuming a successful protocol switch.

Istio offers application-aware networking that understands your app's requirements. It uses the Envoy proxy to abstract the underlying networking environment and facilitate universal traffic management.

Both Ambient and eBPF solutions, which are closely related, are reactions to this sentiment of not wanting to deal with sidecars directly. The aim is to make sidecars disappear. Take Istio and most service meshes built on Envoy, for instance. Envoy is complex and memory-intensive and requires constant attention and tuning based on traffic specifics.

Apple also contributed[1] MPTCP support to Envoy Proxy.

[1]https://github.com/envoyproxy/envoy/pull/18780

After it finishes (it can take a few minutes), Docker-Compose automatically starts a cluster with two containers. One is an Envoy proxy (running on port 3000) that relays requests from outside the cluster to the other container (running on port 4000), which is our AR.IO gateway that will handle the requests.

Hi HN!

For the past few weeks we've been working on Proximal - a workflow engine that lets you quickly iterate on WebAssembly extensions for Envoy Proxy[0] (or other proxies) right on your local machine: https://github.com/apoxy-dev/proximal

This work is based on Proxy-WASM[1] extension ABI for Envoy (and other proxies like APISIX and Mosn[2]) which allows you to execute WebAssembly code on every API request a la Cloudflare Workers. As part of our wider effort at https://apoxy.dev to improve API glue code we built an experimentation / development platform and hope you will find it useful!

On the technical side this project packs Envoy itself, Envoy controller, REST API (for controlling the controller =)), React SPA, and Temporal server/worker (for orchestration) - all baked into a single Go binary. You can find more on architecture and limitations in the repository README[4].

This project is pretty early stage and we would appreciate community feedback!

Previous HN discussions on this topic:

* https://news.ycombinator.com/item?id=36113542

* https://news.ycombinator.com/item?id=22582276

---

[0] https://www.envoyproxy.io/

[1] https://github.com/proxy-wasm/spec/blob/master/docs/WebAssem...

[2] https://apisix.apache.org/ https://mosn.io/

[3] https://github.com/apoxy-dev/proximal/blob/main/README.md#ar...