315 private links
A mix of traceroute and ping. I am happy with it.
another protocol to send data packets over multiple physical layers such as LoRa, IP, Bluetooth or Serial
How can QUIC be viable, then? The attentive reader might already have spotted the answer: the problem isn’t QUIC, but its default configuration, which was designed with terrestrial internet in mind. What we need is a custom configuration, this time targeting deep space, with guidelines to tweak things further if a space mission deems it necessary.
See https://datatracker.ietf.org/doc/draft-many-tiptop-quic-profile/01/
To run the experiments in real time instead of time delays in space:
- the clock can advance way faster than normal and elapse whenever the process got blocked due to a timer
- get rid of packet IO and use one process simulating the whole thing.
With full control over the network, it became possible to make the workbench fully deterministic
Debuggability received some love too. As packets travel through the in-process network, each peer records them in a synthetic .pcap file for later inspection.
More details in the post to make it work.
The TL;DR is that iroh is a library and an architectural pattern to establish peer-to-peer QUIC connections between machines, even if they are behind routers (NAT gateways). It's not a replacement for WireGuard, HTTPS or BitTorrent, instead, it's a building block that you can use to build applications on top of it, but you need to bring your own application protocol and business logic. It's just a very dumb, very reliable pipe between 2 machines anywhere in the world.
Instead of building over UDP, the project builds over QUIC (that is over UDP).
Concepts:
- Endpoint: base unit of iroh. Two endpoints can establish a connection.
- Address: instead of IP addresses, endpoints have addresses that are Ed25519 signing keys.
- Connection: a QUIC connection between 2 endpoints. The connection use QUIC multipath extension, so the connection can flow through multiple pyssical paths.
- Relays: help endpoints punch holes through NATs and relay traffic when it's not possible. They allow to be internet-reachable. The default is the public relays provided by the N0 company, but a relay can be hosted and use privately.
- Discovery / Lookup: through DNS and pkarr signed packets to map an Ed25519 key to IP addresses.
- Transport: over UDP and QUIC handles the reliability and encryption. The transport can be carried over Bluetooth, Tor, radio or serial.
- protocol: application level communication (advertised in TLS' ALPN field of QUIC). A few are provided by iroh's team such as Blobs, RPC, HTTP/3
A perfect timing because:
- there is a growing sentiment against big tech and the US era of cooperation's end. Thus some are turning to build open and decentralized solutions.
- the invasion of Ukraine and industrial advances in China have revealed to the world the incredible leverage offered by cheap drones and robots. There is an area of semi-autonomous machines that need to communicate over heterogenous physical networks (radio, satellite, Wifi, ...) which is completely different that the traditional everything-over-internet (IP) model.
Current limitations of Iroh:
- rebrand to "P2P made easy" instead of "IP addresses break, dial keys instead"
- less bloated public API
- easier integration with application-layer protocols (plug-and-play HTTP/3)
- advanced routing and relay-to-relay communication.
We could have machines sending raw QUIC packets directly over the physical link or with minimal encapsulation + metadata for routing, in some case bypassing the need for a networking stack (i.e. directly talking to the optic fiber driver).
The source code is now available at https://github.com/ARCEP-dev/Mon-Reseau-Mobile-v2
« Mon réseau mobile » permet de comparer les performances des opérateurs mobiles en matière de couverture (services : "Appels et SMS" et "Internet mobile") et de qualité de service dans son lieu de vie comme dans les transports, en France métropolitaine et en Outre-mer.
Construire un réseau résilien de communication. Meshtastic n'est pas WhatsApp. LoRa (Long Range) sacrifie le débit pour la portée, chaque message est limité à 228 caractères, et le canal tourne à 3–5 messages par minute avec le preset par défaut. En France, la bande 868 MHz impose en plus un duty cycle légal de 10% : votre nœud ne peut émettre que 6 minutes par heure maximum.
Un Flipper Zero peut aussi s'y connecter via un addon.
La référence du réseau en France est Gaulix: https://gaulix.fr/
https://meshnetwork.fr rend le réseau lisible via une carte. Il y a aussi https://meshmap.net/ pour l'international.
L'article de Yohann Ciurlik qui décrit son implantation dans l'Eure https://medium.com/@spawnrider/d%C3%A9couvrir-meshtastic-simplement-et-pourquoi-jai-cr%C3%A9%C3%A9-meshnetwork-fr-d24371d9e541
LittleSnitch est donc maintenant disponible sur GNU/Linux.
An alternative to SpeedTest, sold to Accenture.
Bloquer les IPs lisant des wordpress douteux, des .php sur un site statique, etc...
An IPv6 can de divided into 3 pieces:
- 48 or more bits of network identifier (also known as the subscriber prefix)
- 16 or fewer bits of subnet identifier
- 64 bits of interface identifier
The RFC mentioned can be obsolete, but are kept up to date at
Using MAC adresses was flawed, and location data was too. The randomization defined in RFC 30411 was then refined in RFC 7217. Here comes the SLAAC protocol.
Steps:
- Calculating a link-local address
- Link-local Duplicate Address Detection (DAD)
- Locating a router (by sending a Router Advertisement (RA) message)
- Calculating a routable address
DHCPv6 (RFC 3315) solves also the domain name association with IPv6 while distributing additional information.
There is an address renegotiation to preserve privacy.
Slaac is vulnerable to RA spoofing, and DNS spoofing. The proposed solution is to use IPsec, but it's complicated to deploy. SEcure Neighbor Discovery introduced a dedicated cryptographic authentication protocol for network discovery.
Another potential issue is that a network device can respond with Neighbor Advertisement packets for every Neighbor Discovery it sees. This will effectively block any device from completing Duplicate Address Detection, hence blocking SLAAC from completing. Preventing this attack is a current research topic 1, 2, 3
Le déploiement de la fibre aussi va bon train puisqu’elle couvre désormais 93,5 % des locaux.
« Fin septembre 2025, la France compte 26,3 millions d’abonnements à la fibre optique, soit 80 % du nombre total d’abonnements internet à usage fixe », soit 610 000 de plus en trois mois.
220 000 dans les Réseaux d'Initiative Publique, reste 1 410 000.
30 000 dans les AMEL (appels à manifestation d'engagements locaux), reste 75 000.
20 000 dans les zones très denses, reste 470 000.
Source de l'ARCEP: https://www.arcep.fr/actualites/actualites-et-communiques/detail/n/marche-du-haut-et-du-tres-haut-debit-fixe-091225.html
Ainsi que la carte du déploiement de la fibre à jour: https://cartefibre.arcep.fr/
What is Yggdrasil? I didn't know it.
Ok, so Tyr avoid email and the email adress is derived from the public key: <64-hex-characters>@yggmail
Documentation: https://pingoo.io/
Developed by Silvain Kerkour: https://kerkour.com/
At the height of the incident, all prefixes from AS25135 disappeared from global routing tables, effectively making large segments of Vodafone’s infrastructure unreachable.
ça apprendra à faire des gaines écologiques 🤣