[00:00.640 --> 00:02.540]  How is... how's everybody doing?
[00:05.320 --> 00:05.820]  Yeah?
[00:06.480 --> 00:07.060]  It's late.
[00:07.260 --> 00:08.380]  I'm surprised so many people are here.
[00:10.340 --> 00:12.000]  Who traveled to get here today?
[00:13.680 --> 00:16.780]  Wow, that's... who traveled the furthest?
[00:18.340 --> 00:19.640]  All right, we got some candidates.
[00:19.960 --> 00:20.240]  Let's see.
[00:20.460 --> 00:20.780]  Let's see.
[00:20.960 --> 00:21.420]  Shout it out.
[00:23.540 --> 00:24.620]  Oregon, Colorado.
[00:25.640 --> 00:26.140]  Poland.
[00:26.460 --> 00:29.100]  Can anybody beat... can anybody beat Poland?
[00:30.200 --> 00:31.380]  All right, Poland it is.
[00:36.620 --> 00:38.340]  No, no, I'm next, yeah.
[00:39.560 --> 00:41.520]  That's me, yeah.
[00:44.180 --> 00:45.440]  Oh, am I in the wrong room?
[00:47.680 --> 00:50.160]  If I was in the wrong room, you'd think somebody would be telling me to leave by now.
[00:52.260 --> 00:52.860]  That's good, yeah.
[00:54.200 --> 00:55.280]  No, no, you're doing great.
[00:55.500 --> 00:56.900]  Okay, I'll just go.
[00:57.140 --> 00:57.600]  You want to introduce?
[00:57.980 --> 01:00.880]  Well, it's already recorded, so it's like one minute until.
[01:01.120 --> 01:01.600]  Okay, yeah.
[01:04.180 --> 01:05.320]  I'm not going to see you there.
[01:06.260 --> 01:07.240]  My name is Spencer Cromwell.
[01:07.360 --> 01:07.700]  I work at...
[01:07.700 --> 01:08.780]  Yeah, that's awesome.
[01:10.140 --> 01:10.600]  Yeah, yeah.
[01:11.260 --> 01:12.480]  So, well, yeah, thank you.
[01:13.020 --> 01:17.940]  So, I, obviously, I'm confused and I'm late, even though it's supposed to be your MCs.
[01:18.040 --> 01:21.240]  I think we should just cut the shifts and you can talk.
[01:21.240 --> 01:26.300]  But the one reminder is, I'll try to get back here and remind you, in 50 minutes, is and on time.
[01:26.520 --> 01:27.320]  And at 9:50?
[01:27.560 --> 01:29.980]  Uh, 9:55, including Q&A.
[01:30.600 --> 01:31.000]  Okay.
[01:31.440 --> 01:32.280]  So, five minutes and four.
[01:32.420 --> 01:33.360]  Sure, yeah, easy.
[01:34.700 --> 01:35.400]  Yeah, I doubt.
[01:35.600 --> 01:37.540]  I usually get this in 45 or 30 minutes.
[01:37.800 --> 01:39.160]  Well, I can take that into a question.
[01:39.400 --> 01:39.700]  Yeah, yeah, yeah.
[01:57.520 --> 01:58.400]  Okay, everybody.
[01:58.620 --> 02:00.160]  I think we're going to, we're going to get it started.
[02:03.880 --> 02:06.180]  Um, my name is, uh, Spencer Cromwell.
[02:07.040 --> 02:12.040]  I work at IBM, uh, and this is a talk on, uh, uh, secure peer networking with Tinc.
[02:12.800 --> 02:14.960]  Um, don't, don't think too hard about the secure part.
[02:15.480 --> 02:16.660]  Um, so, who am I?
[02:16.760 --> 02:18.520]  So, I'm, like, a system administrator by trade.
[02:18.660 --> 02:19.280]  That's, like, what I do.
[02:19.880 --> 02:23.120]  Uh, I've been sys-opping Linux for five or six years now.
[02:23.620 --> 02:24.840]  Um, this is my second hope.
[02:24.980 --> 02:26.180]  This is the first time I've been a speaker.
[02:26.980 --> 02:32.680]  Um, and this is kind of a talk mostly about what me and my friends do in our, like, hacker free time.
[02:32.940 --> 02:36.480]  More so than it's a talk about something that, like, work is related to.
[02:36.980 --> 02:45.880]  Um, and, uh, there, there's a, there's a link right there to the slides in HTML form if anybody has a screen reader or just wants to follow along because the, they can't see the projector or whatever.
[02:45.880 --> 02:47.280]  Um, yeah.
[02:47.640 --> 02:49.800]  And then I'm nibalizer on most of the IRC stuff.
[02:50.160 --> 02:53.220]  And then, um, there's a GitHub nibalizer if you want to get the source code or anything.
[02:53.880 --> 02:55.200]  I traveled from Portland.
[02:55.480 --> 02:58.720]  Uh, we found out earlier the, the furthest anyone traveled in the room was Poland.
[02:58.920 --> 03:00.360]  So, hats off to that guy.
[03:01.040 --> 03:03.140]  Hope, hope, hope your butt is not feeling too sore.
[03:04.040 --> 03:05.940]  Um, Portland is in Oregon.
[03:06.220 --> 03:07.020]  It's beautiful there.
[03:07.200 --> 03:08.120]  We have this awesome mountain.
[03:08.420 --> 03:11.760]  Um, we have, we have, yeah, um, we have trees.
[03:12.160 --> 03:14.120]  Um, anybody from New York would be like, what?
[03:14.200 --> 03:14.700]  What are you doing there?
[03:14.800 --> 03:16.240]  It's also very expensive and terrible.
[03:16.400 --> 03:17.460]  Don't try to move out here.
[03:19.500 --> 03:20.440]  Portland is full.
[03:21.860 --> 03:25.060]  Uh, the software we're going to talk about is called Tinc.
[03:25.220 --> 03:28.060]  And there's another software we might talk about called Console a little bit.
[03:28.060 --> 03:34.280]  And, uh, I, I, I show up the, uh, the two logos because the two logos kind of demonstrate the difference.
[03:34.500 --> 03:37.280]  Like, Tinc is from the 90s and Console is from, like, three years ago.
[03:37.600 --> 03:39.980]  Um, and you can see that just in the logos, right?
[03:40.980 --> 03:46.300]  Some weird helicopter thing and then some, some trendy SVG pulsating, you know, whatever.
[03:46.500 --> 03:48.500]  It doesn't animate in my slides because, you know, why not?
[03:49.520 --> 03:51.420]  All right, so Tinc is fundamentally a VPN.
[03:51.720 --> 03:56.960]  This is your standard 90s VPN picture with all the, the whistles and the bells.
[03:57.460 --> 04:01.960]  Um, notice we have the red brick, uh, on fire for the firewall.
[04:02.920 --> 04:09.340]  Um, we also have this strange, you know, film reel or something connecting them or whatever.
[04:09.960 --> 04:12.540]  But this also isn't really what a VPN looks like anymore.
[04:12.780 --> 04:14.480]  Like, I think that's what a VPN used to look like.
[04:14.540 --> 04:18.780]  And what it was, was there was a site A and a site B, a site in Columbus and a site in New York.
[04:18.780 --> 04:27.420]  And they would both have workers there and there'd be evidently mainframes and some strange, terrible-looking, uh, PCs on each side.
[04:28.280 --> 04:31.000]  But modern times when you think about a VPN, you don't think about this.
[04:31.080 --> 04:33.360]  You think of all of the left side as being a VPN.
[04:33.720 --> 04:36.840]  And then on the right side, there's somebody's laptop or their iPad or whatever.
[04:37.740 --> 04:53.860]  Um, and Tinc, Tinc enables us, you know, me and my friends, and we'll talk about this in a minute, to do this kind of, to kind of bring this back, this idea of we're just going to link sites together and make flat IP spaces, IP networks that allow us to communicate against each other and set up services and stuff like that,
[04:54.220 --> 04:55.000]  which is pretty cool.
[04:56.280 --> 04:59.920]  Um, so just some facts, facts, you know, the software we're going to talk about is called Tinc.
[05:00.140 --> 05:02.440]  Um, it's from the same year as this cell phone.
[05:03.000 --> 05:07.620]  So, if anybody remembers this cell phone, there aren't as many skins for Tinc, though.
[05:07.760 --> 05:09.040]  That's, that's not, that's certainly true.
[05:09.600 --> 05:11.040]  Uh, it's written in C.
[05:11.200 --> 05:12.020]  It started in 1998.
[05:12.500 --> 05:14.800]  Um, it was finally put in Git in, like, 2007.
[05:15.160 --> 05:16.540]  Before that, it was in something else.
[05:17.140 --> 05:18.480]  Uh, it's portable-ish.
[05:18.680 --> 05:21.360]  Like, there's Nix builds for any Nix-ish operating system.
[05:21.480 --> 05:21.960]  There's Windows builds.
[05:22.040 --> 05:22.540]  There's Mac builds.
[05:23.020 --> 05:25.460]  Um, it's, it runs as a user space daemon.
[05:25.840 --> 05:27.680]  Like, it's a VPN that runs as a user space daemon.
[05:28.120 --> 05:29.220]  Um, that's what Tinc does.
[05:29.680 --> 05:33.260]  Uh, and so, like, you can look at it in user space.
[05:33.380 --> 05:35.260]  It uses the Tuntap driver, um, in the kernel.
[05:35.660 --> 05:38.240]  Uh, so 99% of the code's written by just a couple developers.
[05:38.620 --> 05:41.440]  Um, I personally am not one of those developers, right?
[05:41.580 --> 05:43.640]  I'm just somebody who's a user and likes to talk about it.
[05:44.220 --> 05:47.440]  Um, there's a free node channel if you want to hang out with the Tinc, Tinc nerds.
[05:47.540 --> 05:54.420]  There's a, there's a mailing list that's reasonably, and, uh, you know, the main website is still hosted by some university in Europe because open source.
[05:54.980 --> 06:01.120]  Um, you know, uh, there's, you get some slowdowns when you run anything over a, a VPN, of course.
[06:01.420 --> 06:05.340]  Um, one of my buddies at HP when I worked there ran it, uh, ran some tests.
[06:05.440 --> 06:06.420]  He was a, he was a network guy.
[06:06.600 --> 06:07.580]  And he ran some tests.
[06:07.680 --> 06:10.060]  So, what, what you actually saw in terms of network degradation.
[06:10.060 --> 06:13.520]  And he said he lost about 15% of the link speed, which is kind of significant.
[06:14.100 --> 06:16.160]  Um, you ran a similar test against, like, something like open VPN.
[06:16.300 --> 06:17.360]  You only lose about two or three percent.
[06:17.360 --> 06:19.980]  So, you know, it's just something to think about as we're going forward.
[06:20.540 --> 06:21.360]  Um, Tinc is old.
[06:21.480 --> 06:23.080]  Tinc is older, like this phone.
[06:23.240 --> 06:27.100]  And it's so old that it has its own number in /etc/services, which is kind of cool.
[06:27.320 --> 06:30.580]  So, it's port 655 in /etc/services on your, on your systems.
[06:31.200 --> 06:31.820]  Which is cool.
[06:32.300 --> 06:36.080]  Um, you know, since we're at a security conference, you know, I don't really know how the, to the crypto works.
[06:36.360 --> 06:41.280]  But if you run which Tinc DD, if you run LDD on it, you see it links against, you know, lib crypto.
[06:42.580 --> 06:43.560]  So, that's a thing.
[06:47.660 --> 06:52.480]  I don't, I'm not saying, like, I know, I'm just saying, you know, whatever.
[06:53.400 --> 06:54.960]  All right, who remembers this, huh?
[06:56.600 --> 06:58.440]  The network is the computer.
[06:59.080 --> 07:02.620]  Right, so this is really a, yeah, no, look at, like, take it all in.
[07:05.160 --> 07:07.020]  Just, that's not even a mouse pad.
[07:07.160 --> 07:14.320]  That's like, that's like a, like a gardening pad for your knees, for your, your mom or something to, like, plant geraniums with.
[07:14.420 --> 07:15.860]  Anyway, I'm not just going to make jokes.
[07:16.020 --> 07:17.540]  There's actually content in this, in this talk.
[07:18.840 --> 07:23.900]  So, if you're, if you're old enough to remember this, like, Sun had big ideas when, when they said that the network is the computer.
[07:24.180 --> 07:33.580]  And, like, I had the fortunate ability to grow up, like, I didn't grow up in the time when Sun had those ideas, but I grew up and, like, I came into a university environment that never gave them up.
[07:33.580 --> 07:37.820]  And so, when I was in undergrad, we had this kind of network is the computer architecture.
[07:37.980 --> 07:42.100]  So, we had Solaris file servers, we had Linux desktops for all the, the engineering students to use.
[07:42.100 --> 07:49.140]  And, like, the, in those times, and the times I got a little glimpse of, it, like, it was just more fun to hack on, on Unix.
[07:49.140 --> 07:54.680]  Because the, the, the, the line between a workstation and a server was much more blurry.
[07:55.120 --> 08:02.460]  And there were 65,000 ports that you could use, speaking as many services as you want, to get these complicated, interesting behaviors out.
[08:02.460 --> 08:04.160]  And so, LAN parties just sprung up.
[08:04.340 --> 08:10.640]  If you wanted to send files to a, a buddy, you didn't use Dropbox, you just, like, net catted it over to your buddy, or something like that.
[08:10.900 --> 08:14.440]  Um, you could set up whatever service and whatever port you ran, as long as you were root.
[08:14.960 --> 08:18.680]  And this was an exciting and kind of freeing time, and it, it was fun.
[08:18.840 --> 08:22.120]  And my friends and I were like, that was fun, I want that back.
[08:22.300 --> 08:31.660]  And so, what we did, is we took kind of all of our laptops, and all of our weird little colo boxes, and all of our servers that we hid in various data centers, you know what I'm talking about.
[08:33.520 --> 08:40.320]  And, like, you know, random, like, stuff you have behind your, your Linksys work 54G at home, and mom's house, and all that stuff.
[08:40.620 --> 08:45.780]  And we put them into one Tinc VPN, and Tinc is a mesh VPN.
[08:46.200 --> 08:54.860]  And what it enables you to do, is to take all these machines with all these different IP addresses, and all these different network configurations, and put them onto one local area network.
[08:55.300 --> 08:59.780]  And it's secure enough, that you can get away with running services that had been put aside.
[08:59.780 --> 09:03.700]  Because in the modern world, there's really only two services, like HTTP and HTTPS.
[09:03.940 --> 09:05.700]  And people get mad at you, if you use the first one.
[09:07.020 --> 09:14.280]  So, the idea, when the sun says the network is a computer, is it's, it's the interactions between two different machines, and all the different varieties that can have.
[09:14.620 --> 09:19.580]  And I think the, the point of this talk, is to show you how we kind of crack the skulls, crack that open a little bit.
[09:19.720 --> 09:20.620]  And said, hey, that was fun.
[09:20.800 --> 09:22.420]  I don't want to tunnel everything through HTTP.
[09:22.780 --> 09:23.440]  What can I do?
[09:23.920 --> 09:26.380]  And boy, just look at that globe coffee pot, right?
[09:26.560 --> 09:27.760]  Like, what is that doing?
[09:29.020 --> 09:29.380]  Jeez.
[09:30.820 --> 09:31.760]  It's running Java.
[09:31.980 --> 09:32.360]  That's right.
[09:36.680 --> 09:37.240]  All right.
[09:37.880 --> 09:38.600]  Look at that guy.
[09:38.700 --> 09:39.420]  He had some Java.
[09:40.540 --> 09:41.000]  All right.
[09:41.120 --> 09:46.300]  To understand what a tink network is, you know, I'm going to take you through looking at it in four different layers.
[09:46.300 --> 09:49.900]  And these layers don't exactly map to like the IP stack.
[09:50.240 --> 09:51.840]  So don't, don't try to think about it too hard like that.
[09:52.260 --> 09:57.060]  But just to show you the picture at the first date, we have nine machines, right?
[09:57.220 --> 09:59.560]  And these machines come in different, different places.
[09:59.760 --> 10:01.900]  Like, so at least one of the machines is a laptop.
[10:02.300 --> 10:04.680]  One of these machines is like a co-load server somewhere.
[10:05.060 --> 10:07.340]  One of these machines is somebody's, like, home router.
[10:07.760 --> 10:11.620]  One of these machines, you know, all the different kinds of machines that like random nerds have.
[10:12.480 --> 10:12.800]  Right?
[10:13.300 --> 10:16.580]  And then, okay, so you have this Tinc software, and Tinc is a mesh VPN.
[10:16.700 --> 10:18.220]  We'll talk more about that, what that means in a minute.
[10:18.480 --> 10:23.720]  But what that means is that you need to make, you know, users port 655, TCP, and UDP, because, you know, why not both?
[10:24.960 --> 10:28.600]  And so, a connection needs to be initiated from kind of a client to a server.
[10:28.840 --> 10:32.520]  Like, even though everybody's equal, like, somebody needs to start the conversation, right?
[10:32.600 --> 10:34.000]  And so that ends up looking like this.
[10:34.740 --> 10:35.060]  Okay?
[10:35.260 --> 10:39.620]  And so you kind of see that there's... Now you can see what's in a colo and what isn't, right?
[10:39.700 --> 10:41.600]  Because what's four and five and six...
[10:41.600 --> 10:47.500]  six and seven, those are things that are receiving incoming connections, because they have well-known IP addresses, right?
[10:47.640 --> 10:48.860]  And those IP addresses don't change.
[10:48.960 --> 10:52.760]  Whether you're using DynDNS or you have, you know, it's racked somewhere where you know what it is.
[10:53.080 --> 11:00.240]  And then the outside hosts, you know, your twos, your threes, your eights and nines, those are laptops that might change IP addresses every day.
[11:00.600 --> 11:01.460]  Those are phones.
[11:01.640 --> 11:08.020]  Those are, you know, might even be somebody behind Comcast Internet, or I guess we're on the East Coast, so Cox or Charter or something.
[11:08.720 --> 11:09.800]  Comcast owns the West Coast.
[11:10.540 --> 11:13.240]  And then, you know, so the IP address might be changing.
[11:13.360 --> 11:15.220]  So it doesn't make sense for people to call into that.
[11:16.120 --> 11:24.220]  So somebody, each of these nodes running the tink daemon has a configuration of which servers it allows connections to, and which servers it makes connections to.
[11:24.480 --> 11:27.460]  And the difference, basically, is whether or not it has a well-known public IP address.
[11:27.680 --> 11:29.680]  And it works over IPv6 and IPv4.
[11:30.660 --> 11:33.620]  And then the connection is authenticated using RSA.
[11:33.820 --> 11:35.240]  So there's a private key and a public key.
[11:35.300 --> 11:38.200]  And basically, it's not like there's a CA implemented or anything like that.
[11:38.200 --> 11:46.140]  You just sort of, like, number five is going to have the public key for number three, and just a list of things that it allows connections from.
[11:46.520 --> 11:46.800]  All right.
[11:46.920 --> 11:49.360]  So this is the initial connection, right?
[11:49.620 --> 11:54.540]  Once the connection is formed and you've joined the tink cluster, the traffic ends up looking like this.
[11:54.640 --> 11:56.080]  Like, everything is bi-directional.
[11:56.360 --> 12:01.840]  So a packet that is leaving seven and headed to two can go through five through four through two.
[12:02.000 --> 12:05.660]  Whether, like, after the connection is initiated, it's all completely fluid.
[12:06.020 --> 12:08.680]  And it's actually very, very difficult to firewall...
[12:08.680 --> 12:13.240]  It's basically impossible for six to say, like, I don't want traffic from seven or I don't want traffic from three.
[12:13.460 --> 12:15.060]  You don't really have that ability to do it.
[12:15.700 --> 12:17.800]  And we can talk about more about that, like, in just a little bit.
[12:18.160 --> 12:19.760]  It also has the ability to...
[12:19.760 --> 12:23.540]  As you can see, that there's, like, ways to loop and there's multiple paths through this.
[12:23.680 --> 12:27.860]  Like, if nine wanted to send a packet to three, there's a couple different ways that might happen.
[12:27.860 --> 12:30.820]  And tink keeps the connections open between everything.
[12:31.160 --> 12:32.520]  And it is constantly probing.
[12:32.860 --> 12:37.100]  It's probing for MTU, like the optimal MTU, because it knows it's probably being tunneled over something, too.
[12:37.540 --> 12:39.580]  It's probing for which is the most optimal path.
[12:39.920 --> 12:45.680]  And it's using all those routing algorithms that I learned about in CS class and then forgot to identify.
[12:45.860 --> 12:49.960]  And if we lose a node, like if we lost the number five node, we would lose three.
[12:50.100 --> 12:51.860]  Three would no longer be on the network either.
[12:51.860 --> 12:53.840]  But everything else would just route around five.
[12:54.100 --> 12:58.680]  And so as long as you have some path, it will persist the connectivity.
[12:59.340 --> 13:00.140]  So then if you...
[13:00.140 --> 13:04.260]  That's, like, where the traffic is flowing, you know, like if you're looking at links and stuff.
[13:04.420 --> 13:14.440]  And then if you're just on one of these nodes and you want to look at what the network looks like, it looks completely flat, where one is just one hop over to two, one hop over to four, one hop over to eight.
[13:14.520 --> 13:15.560]  It's just directly connected.
[13:15.720 --> 13:21.260]  And the way we've actually configured it with my friends and I is that each node has an IP address on a flat slash 16.
[13:21.860 --> 13:23.060]  And everyone can just ping each other.
[13:23.340 --> 13:29.120]  And if you try to look at a trace route or something, it doesn't hit a router because it's going into a virtual interface and emitting out another virtual interface.
[13:29.240 --> 13:30.980]  There's no virtual routers in place.
[13:33.420 --> 13:42.860]  So one of the cool things about Tinc is that it'll actually emit the graph of the current state in dot format every minute, which is kind of slick.
[13:43.200 --> 13:45.240]  So you can run this to see...
[13:45.240 --> 13:46.500]  This is actually much more real.
[13:46.600 --> 13:49.660]  The other one was kind of me farting around in Inkscape, which I'm not very good at.
[13:50.620 --> 13:54.720]  So this is like a live network that we had, you know, a couple months ago when I made these slides.
[13:55.100 --> 13:59.060]  And so what you'll see is there's a couple peers that have a lot of connectivity.
[13:59.260 --> 14:01.020]  There's a couple peers that only have one connection.
[14:01.900 --> 14:08.740]  Because this is a look at who, you know, who is connected to who, you don't have any information about who initiated the conversation.
[14:09.280 --> 14:14.580]  But you can bet that one dialed into nine because why would it have no other connections if it was doing that?
[14:15.280 --> 14:17.080]  Four and eight are nodes that left.
[14:17.500 --> 14:24.780]  So that's probably somebody's laptop that it still knows, still knows about, was on the network recently, but right now it doesn't have any connection to.
[14:25.020 --> 14:27.600]  And so maybe the laptop's closed or something like that.
[14:27.980 --> 14:30.080]  It keeps them around for a little while and eventually flush them out.
[14:33.950 --> 14:40.610]  So one of the cool things about Dink as like a daemon is what it can do is like the way you like look at it.
[14:40.690 --> 14:51.870]  So by default, it, it dumps its stuff into syslog and rather than, you know, something else, what it does is you just hit it with a user to signal and it will dump connection information into syslog.
[14:51.870 --> 15:00.310]  And so you can get this information about the edges in text form, like Spencer is connected to Biccaro, all the hosts have names, Spencer and Biccaro, two of the names, and it has weight.
[15:00.590 --> 15:13.350]  So this is a very contrived example that I used to get it out because I don't want to show you my p-dresses, but you can see a link of all the, you can see all the, the edges is kind of all the connections between each other and they all have different weights.
[15:13.350 --> 15:22.550]  So, um, if traffic is, you know, if there's an optimal way to send traffic, it's going to use the weights to determine that and then it'll show you like Tinc can be run in two modes.
[15:22.670 --> 15:24.310]  It can be run in layer two mode or layer three mode.
[15:24.530 --> 15:25.810]  Um, and this was layer three mode.
[15:26.030 --> 15:32.590]  And so when you do that, basically every node that joins the IP, the, the Tinc cluster answers for a subnet.
[15:32.730 --> 15:34.090]  So some kind of a cider range.
[15:34.430 --> 15:42.950]  And typically what you'll do, what we do is basically put one address of that cider range on the, on the node and call it good and waste the other IP space because IP space is cheap.
[15:42.950 --> 15:54.690]  in 1918 space, but you know, what you can do, what we have done in the past is basically just Nat behind that or just route behind that and put, um, you know, basically run a Tinc node as a router in front of like a physical subnet.
[15:54.830 --> 16:02.030]  So for a while, my printer was on the network and then my friends were dicks and now the printer's not on the network.
[16:02.870 --> 16:11.330]  So that's how that works, but that also gets into the idea of what we're really trying to build here, which is like my friends and I kind of decided just to run a land together.
[16:11.710 --> 16:13.750]  And there's, there's some hostility there.
[16:13.890 --> 16:14.930]  There's some niceness there.
[16:15.070 --> 16:19.990]  And it's, it's like, it's not a super hostile network, but it's also like people are going to jab each other.
[16:20.110 --> 16:20.550]  You know how it is.
[16:21.010 --> 16:21.830]  Um, so that's fun.
[16:22.210 --> 16:24.950]  So like you can send a lot of different signals to Tinc.
[16:25.050 --> 16:32.870]  I actually kind of hated this at first that you would send signals to it in order to control it because you hit it with a user one or user two and it'll dump interesting data about what's going on.
[16:32.870 --> 16:37.990]  And that's useful, although it can be frustrating because I'm used to doing some, I'm used to managing my daemons in other ways.
[16:38.250 --> 16:43.670]  But one of the cool things you can do is you hit it with a SIG term and it will increase its logging verbosity to five.
[16:43.970 --> 16:47.450]  And then if you hit it with another SIG term, it'll decrease the verbosity to five.
[16:47.630 --> 16:55.670]  So if you're like trying to add a new node and you need debugging information for why it's not working, you just hit it with a signal and it starts giving you all the debugging information.
[16:57.890 --> 17:03.710]  So you can, you can basically debug it while it's hot and not have to like restart the daemon with more logging enabled.
[17:03.930 --> 17:04.530]  That's great.
[17:04.730 --> 17:05.730]  That's actually really useful.
[17:05.950 --> 17:06.930]  More things should do that.
[17:07.270 --> 17:13.230]  However, if you're like just getting started, you might have this idea that you're going to run Tinc in the foreground, right?
[17:13.370 --> 17:23.030]  So you're just running Tinc and it's time to, it's time to, to close it because you're done with that and you hit control C and rather than stopping, it just vomits text at you because you've increased the verbosity of the logging.
[17:23.030 --> 17:24.770]  It's just pretty frustrating.
[17:26.090 --> 17:27.930]  So there's some good and some bad.
[17:29.270 --> 17:34.610]  This also this like whole getting it out of syslog is great from like a, I want to manage my pets, right?
[17:34.770 --> 17:39.070]  But if you have cattle or you want to, you know, DevOps it or whatever, it's not super.
[17:39.310 --> 17:41.810]  So I ended up writing go because, you know, DevOps.
[17:43.090 --> 17:48.230]  And so Tinc stat is basically a little application that you hit, hit it with, you know, it's just a little go daemon.
[17:48.230 --> 17:53.470]  It listens on an HTTP and you hit it with a curl on Tinc stat and it'll go ahead and hit it.
[17:53.570 --> 17:59.970]  It'll hit Tinc itself with the right signals, grab the logs, parse them up, put them into a JSON blob and return that to you.
[18:00.110 --> 18:04.330]  So that then you can start really programming against this, figure out what you want to do, all that kind of stuff.
[18:05.090 --> 18:10.090]  For anyone who's familiar with HAProxy, HAProxy has something like this, but like a little bit, a little bit different.
[18:10.090 --> 18:11.790]  So HAProxy has a control socket.
[18:12.310 --> 18:19.250]  And you can netcat or socat to that control socket and get information and statistics about and control the HAProxy.
[18:19.450 --> 18:24.070]  And so Tinc is currently at 1.0 with a whole bot of release candidates for 1.1.
[18:24.250 --> 18:25.810]  And eventually there will be a 1.1.
[18:25.910 --> 18:30.470]  And when 1.1 comes out finally, it will have this control socket that you can interact with.
[18:30.610 --> 18:31.170]  And that's pretty cool.
[18:33.450 --> 18:33.930]  Okay.
[18:33.930 --> 18:41.430]  So you basically have this network with a bunch of nerds on the network, a bunch of machines on the network.
[18:41.690 --> 18:44.630]  You know, if you go back to this one, you can kind of see...
[18:45.330 --> 18:50.390]  If you go back to this diagram, you can kind of see that there's probably one human that's responsible for 1, 2, and 4.
[18:50.850 --> 18:53.730]  And then like another human that's responsible for 3 and 5.
[18:54.230 --> 18:56.870]  And then like maybe another human for like 6, 8, 9.
[18:57.370 --> 18:59.790]  Because I kind of see how that probably worked out.
[19:00.650 --> 19:02.450]  That's probably how that worked out, roughly.
[19:03.530 --> 19:11.050]  So you got all these people and all these nerds, and they're like, well, we definitely made something, now what do we do with it?
[19:12.470 --> 19:12.750]  Right?
[19:12.950 --> 19:18.990]  And so, you know, your scientists were so preoccupied with whether or not they could, they stopped to think what they were going to do with it when they made it.
[19:19.490 --> 19:22.590]  And so there's, like, some services, you know, in the UNIX-y sense that you get.
[19:22.730 --> 19:24.810]  Like, you just turn on Apache, and Apache just works.
[19:24.890 --> 19:25.930]  It'll serve files to each other.
[19:25.990 --> 19:28.950]  But, of course, we could do that over HTTP before, so I don't know why that was exciting.
[19:29.490 --> 19:37.290]  If you have, like, a propensity for using UPnP or a PlayStation 3 or something like that, you know, you can just share files out with, like, MediaTune or something like that, and that just works.
[19:37.630 --> 19:41.270]  If you want to do some weird VLC streaming type stuff, that just works.
[19:42.250 --> 19:43.670]  StarCraft does not just work.
[19:46.370 --> 19:48.750]  Yeah, I thought StarCraft would just work.
[19:49.190 --> 19:56.610]  And then StarCraft, you know, StarCraft inside, StarCraft would work, but wine plus StarCraft makes the whole thing very hard to get working.
[19:57.190 --> 20:00.310]  You know, come watch me give this talk to some other conference, and maybe we'll have StarCraft working.
[20:00.450 --> 20:01.070]  It's a work in progress.
[20:01.610 --> 20:03.510]  All right, so everybody sets up their services.
[20:03.730 --> 20:04.370]  They're really excited.
[20:04.610 --> 20:07.130]  And then a problem shows up, right?
[20:07.230 --> 20:10.670]  And the problem is, like, DNS, probably.
[20:12.470 --> 20:14.030]  So, no, but, like, that's the real question.
[20:14.170 --> 20:18.310]  It's like, hey, where are you running that file server that you set up, or the HTTP server that you set up?
[20:18.350 --> 20:19.110]  Where is that coming from?
[20:19.110 --> 20:20.230]  And you write an IP address.
[20:20.510 --> 20:25.970]  And we solved DNS in the way of the early Internet with this giant host file that just got copied around.
[20:26.310 --> 20:29.770]  And when some new person joined the cluster, you gave them a copy of the host file.
[20:30.250 --> 20:31.310]  And that was great.
[20:31.330 --> 20:32.310]  And everything was good.
[20:33.010 --> 20:35.750]  Until... and that just adds nicely, right?
[20:35.830 --> 20:37.590]  Because you just keep adding entries to it.
[20:37.690 --> 20:38.590]  And that just keeps growing.
[20:38.790 --> 20:44.050]  But if you go further, then people start reusing IP addresses.
[20:44.270 --> 20:45.610]  And that's where it gets really bad.
[20:45.610 --> 20:47.390]  And that's where the whole system starts to break down.
[20:48.350 --> 20:51.910]  And so, as a solution to that problem, you know...
[20:51.910 --> 20:53.210]  Well, we're like, we're sysadmins.
[20:53.350 --> 20:54.070]  We can set up bind.
[20:54.230 --> 20:54.890]  I know how to do that.
[20:55.650 --> 20:58.390]  And so, like, three or four different bind servers showed up.
[20:58.490 --> 21:00.190]  And that created a different problem.
[21:00.370 --> 21:00.710]  Because...
[21:01.810 --> 21:03.890]  Now you need to know where the bind servers are.
[21:04.010 --> 21:06.290]  And, of course, you can't modify someone else's bind server.
[21:06.430 --> 21:09.890]  Because, remember, this is like a... it's sort of collaborative, but it's sort of not.
[21:10.710 --> 21:12.050]  It's a little vague.
[21:12.050 --> 21:16.930]  Like, certainly I'm not giving SSH access to my friends to, like, log in and set up a DNS.
[21:17.150 --> 21:19.730]  And, like, there's no shared host on this or something like that.
[21:19.850 --> 21:21.750]  No one felt like paying for Linode or something like that.
[21:22.050 --> 21:24.090]  So, anyways, you think it's DNS.
[21:24.290 --> 21:25.050]  And it is DNS.
[21:25.250 --> 21:30.130]  But, like, solving DNS the way you should DNS isn't... like, didn't actually work.
[21:30.550 --> 21:32.510]  So, we're like, well, we need something...
[21:33.450 --> 21:36.430]  We need something that's, like, mutable, like, by the group.
[21:36.590 --> 21:37.830]  Like, everybody can modify it.
[21:37.910 --> 21:39.390]  But that's, like, highly available.
[21:40.610 --> 21:42.420]  And the reason you need high availability is...
[21:42.950 --> 21:46.310]  Remember, there's, like, four humans that are all pretty interested in ops.
[21:46.450 --> 21:49.590]  And what that means, really, is that they set up services and forget them.
[21:49.750 --> 21:53.510]  And it's the whole cobbler's... kids have no shoes problem, right?
[21:53.750 --> 21:55.850]  Like, these people run systems all day.
[21:55.990 --> 22:00.030]  And so, their stuff they have at home in their spare time projects is, like, very poorly maintained.
[22:00.250 --> 22:02.070]  And that's entirely by design, right?
[22:02.190 --> 22:04.210]  So, like, random DNS servers will die or whatever...
[22:04.210 --> 22:06.520]  Whatever we set up has to survive a certain amount of failure.
[22:07.260 --> 22:09.700]  Because people are just gonna turn it off and forget to turn it back on.
[22:10.440 --> 22:12.600]  And so, we're like, well, you know, there's this...
[22:12.600 --> 22:15.640]  If you just have those requirements and you say data store in front of it.
[22:15.800 --> 22:18.840]  Like, there's definitely some things that you can do in today's world.
[22:19.200 --> 22:19.560]  Right?
[22:19.920 --> 22:21.400]  And so, like, etcd...
[22:21.400 --> 22:22.540]  How many people have heard of etcd?
[22:24.080 --> 22:24.440]  Okay.
[22:24.620 --> 22:25.440]  So, not very many of you.
[22:26.020 --> 22:30.040]  So, etcd is, like, written by people from San Francisco with very tight pants.
[22:32.560 --> 22:33.580]  It's written in Go.
[22:35.100 --> 22:39.640]  It's basically an implementation of, I believe, Raft is the consensus protocol.
[22:39.900 --> 22:41.600]  We're getting way out on the edge of what I know.
[22:41.780 --> 22:45.300]  But it's basically, like, if you use Zookeeper, it's basically the same thing as that, except it's not Java.
[22:45.560 --> 22:50.720]  And it has this property that you can have three of them or five of them or seven of them or nine of them.
[22:50.720 --> 22:54.640]  And when you make a write to it, like, it has very short...
[22:54.640 --> 22:55.540]  It has keys.
[22:55.760 --> 22:58.000]  And you can write to the keys and read from the keys.
[22:58.200 --> 23:01.140]  And you have very strong consistency guarantees about the state of those keys.
[23:01.280 --> 23:04.640]  Like, if you write and the write isn't accepted by the cluster, you get, like, a nice message.
[23:04.740 --> 23:05.840]  It's like, no, you have to try again.
[23:06.180 --> 23:07.600]  You can grab locks with it.
[23:08.900 --> 23:10.480]  You can do all these really cool things with it.
[23:10.540 --> 23:11.840]  You can't write to it very fast.
[23:11.900 --> 23:13.180]  You can't read from it super fast.
[23:13.340 --> 23:14.540]  And you can't store very much in it.
[23:14.580 --> 23:18.760]  But if you have just a little bit of metadata that you're using for control, it's very, very good.
[23:18.760 --> 23:27.640]  And so this is etcd and Zookeeper being used all over the industry, or the DevOps industry, anyways, to make programming distributed system things easier.
[23:27.800 --> 23:31.900]  And so we're like, you know, we only have about 30 host names, so we're definitely going to set up an etcd cluster.
[23:32.020 --> 23:33.120]  That's obviously the right solution.
[23:33.820 --> 23:34.300]  It's not.
[23:35.500 --> 23:37.220]  And so we're like, all right, let's set up etcd.
[23:37.300 --> 23:41.580]  So etcd, of course, you know, being from San Francisco, it's made by Core West, and it's very good software.
[23:41.700 --> 23:42.660]  Don't think I'm knocking on it.
[23:42.740 --> 23:43.160]  It's awesome.
[23:45.900 --> 23:49.600]  So it has like a resting point, or you just kind of hit it with curl or something like that.
[23:49.720 --> 23:50.320]  And like, that's great.
[23:50.460 --> 23:54.220]  But that doesn't end up like actually meaning DNS.
[23:54.540 --> 24:03.740]  Like if you can write a little script that you say, get me the name, the IP address of, you know, Spencer's web server, and it will go hit etcd and get it back to you.
[24:03.940 --> 24:06.300]  And you have an IP address, and then you can paste that in your command.
[24:06.620 --> 24:08.120]  But that's not really what you want.
[24:08.480 --> 24:11.500]  So we started doing stuff that's kind of stupid.
[24:14.400 --> 24:16.680]  This is, this is a pretty good photograph, actually.
[24:18.500 --> 24:21.040]  So like, they've obviously been at it for a while.
[24:21.860 --> 24:27.000]  Like, those two guys sat down, they're like, this is going, this is taking a lot, it's funny, but it's important.
[24:27.500 --> 24:27.680]  Right?
[24:28.060 --> 24:32.360]  And like, what they're moving up there at the very top is not just, it's not just boxes.
[24:32.360 --> 24:38.100]  That's like some pressurized cylinder with some valve, like there's a dial that's showing you how much pressure is in the cylinder.
[24:38.100 --> 24:41.520]  Like, how much lead do I have on this?
[24:41.560 --> 24:42.380]  I have some lead.
[24:42.660 --> 24:45.080]  Alright, so the guy driving is like, Jesus Christ.
[24:45.880 --> 24:48.420]  Why is the dude standing between the two forklifts?
[24:48.560 --> 24:52.380]  Like, what is he, what is the guy standing on the very far edge?
[24:54.020 --> 24:58.420]  Okay, well the guy on the very far edge is putting just all the weight in the wrong place.
[24:58.420 --> 25:02.300]  Because, alright, this, this, this guy is about to die.
[25:03.820 --> 25:06.840]  And then, the best part of the photo is the bottom right tire.
[25:07.560 --> 25:09.680]  You can kind of look, and it's cut off.
[25:09.940 --> 25:11.600]  But you can kind of see where the ground is.
[25:12.080 --> 25:13.660]  You see where the bottom of the tire is.
[25:13.740 --> 25:17.280]  And you can look at the left, and you can kind of see the left tire.
[25:17.400 --> 25:19.460]  And you can kind of see where the, where the ground is.
[25:19.660 --> 25:20.740]  And the bottom of the tire is.
[25:20.820 --> 25:22.540]  And you realize that this is in the process of tipping.
[25:22.820 --> 25:25.000]  It isn't even gonna tip in a few minutes.
[25:25.120 --> 25:25.800]  It's, it's gone.
[25:25.800 --> 25:25.900]  Come on.
[25:26.060 --> 25:31.220]  I want to see this in 30 seconds after this photo was taken, because it's just blood everywhere.
[25:31.380 --> 25:37.440]  Anyways, so what we did... how many people are familiar with Lib NSS, or the name service switcher?
[25:38.520 --> 25:39.880]  /etc/NSSwitch.com?
[25:40.060 --> 25:40.420]  Yeah, yeah.
[25:40.920 --> 25:41.900]  Unix Greybeards, man.
[25:42.340 --> 25:44.200]  The network is the computer.
[25:44.580 --> 25:51.240]  Alright, so, like, for instance, if you have a file on a Unix file system, and it's owned by your username, my username is usually NIBS.
[25:51.840 --> 25:55.020]  You know, when you LS-L it, you get, you know, owner NIBS.
[25:55.240 --> 25:57.400]  But, like, the Unix file system doesn't actually know that.
[25:57.600 --> 25:59.200]  The Unix file system writes that down as a number.
[25:59.560 --> 26:00.340]  Your user ID.
[26:00.700 --> 26:01.060]  Okay?
[26:01.440 --> 26:11.180]  And then what it does is it goes through the name service system, which is controlled by the name service switcher, to say, hey, if I had a user named 1860... with the number 1861, what would the name be?
[26:11.360 --> 26:15.380]  And the name service goes, and it looks up /etc/password, and it gives you the name...
[26:15.380 --> 26:18.820]  It gets the name, and it gives it back, and so the number shows up in LS-L.
[26:18.820 --> 26:26.880]  And if you need to use the NS switcher, you need to use that for something that says, hey, I want you to look in /etc/password and in some LDAP server or something.
[26:27.100 --> 26:28.780]  Same principle basically applies for DNS.
[26:28.980 --> 26:34.100]  You say, hey, a name service switcher, I want you to look in the host file, and I want you to look in DNS.
[26:34.320 --> 26:35.600]  And we just were like, you know, whatever.
[26:35.920 --> 26:38.820]  One of our friends is pretty good at C, you know, or okay at C.
[26:38.820 --> 26:41.120]  And he just wrote LibNSS, etcd...
[26:41.460 --> 26:48.800]  And so, all our name service switchers just said, you know, for DNS, it was host file, etcd..., DNS.
[26:49.460 --> 26:50.520]  Just, why not?
[26:50.660 --> 26:56.560]  We'll just shell out to the weird etcd CTL command from C in the middle of every DNS request to the computer.
[26:56.680 --> 26:56.960]  Why not?
[26:57.040 --> 26:57.560]  That'll be great.
[26:59.280 --> 27:00.360]  And it was...
[27:00.360 --> 27:01.880]  You know, it worked surprisingly well.
[27:03.340 --> 27:09.140]  With the shelling out form, then someone rewrote it to, like, use actual lib curl, and it got three times longer, and it got a memory leak.
[27:09.300 --> 27:09.940]  It was bad.
[27:10.160 --> 27:10.440]  All right.
[27:11.120 --> 27:12.120]  So, it was great.
[27:12.320 --> 27:13.320]  Like, there were some good things.
[27:13.440 --> 27:14.100]  There were some bad things.
[27:14.200 --> 27:17.580]  We ended up retiring it because it was, you know, just totally not going to work at all.
[27:18.480 --> 27:23.740]  But for a minute there, for a few minutes, you know, like a couple weeks, we actually had functional DNS, sort of.
[27:24.100 --> 27:24.820]  One of the night...
[27:24.820 --> 27:28.820]  So, then we're like, we're looking around, and like, you know, I kind of, you know, DevOps, whatever.
[27:28.820 --> 27:42.120]  So, the other people in San Francisco wrote this, which is called console, which also uses a raft consensus protocol, and also has a key value lookup pair, and also has, like, an HTTP rest based, you know, getter setter format.
[27:42.620 --> 27:48.260]  But, they wrote console specifically for service discovery in large applications.
[27:48.440 --> 27:49.560]  This is a HashiCorp project.
[27:49.880 --> 27:50.880]  Big shout out to them.
[27:50.960 --> 27:51.220]  They're great.
[27:52.180 --> 27:55.240]  They wrote it specifically for service discovery in large applications.
[27:55.440 --> 27:57.160]  And so, it speaks DNS natively.
[27:57.160 --> 28:01.380]  You can just dig at your console server and get a name back.
[28:02.000 --> 28:03.160]  And it just works.
[28:03.300 --> 28:05.000]  And we're like, well, obviously we're going to use that.
[28:05.220 --> 28:06.560]  So, we set that up for a little while.
[28:06.920 --> 28:07.840]  And everything is good.
[28:07.940 --> 28:08.900]  The DNS names are flowing.
[28:09.260 --> 28:12.440]  And then we realized that we still haven't actually solved the problem.
[28:12.620 --> 28:15.840]  Which was, hey buddy, where did you put your web server?
[28:16.020 --> 28:16.500]  Or whatever.
[28:16.760 --> 28:21.780]  Because even if I know the name of it, like, we've solved the problem where if I know the name, I can get the name.
[28:22.100 --> 28:24.200]  Or I can get the IP address and my computer can talk to it.
[28:24.200 --> 28:25.960]  But I still don't know what you set up.
[28:26.260 --> 28:28.840]  Or, remember, these are sysavins that let their services die all the time.
[28:28.980 --> 28:30.100]  What's currently running?
[28:30.620 --> 28:31.020]  Right?
[28:31.120 --> 28:33.140]  The problem ultimately is still service discovery.
[28:34.160 --> 28:35.260]  How do you solve that?
[28:35.380 --> 28:41.000]  And so, as is a theme in this talk, we looked into the past.
[28:41.000 --> 28:43.560]  So, I'm going to show you a picture.
[28:43.860 --> 28:46.560]  And this is, like, this can be scary.
[28:46.760 --> 28:49.360]  I've gotten some feedback that this was a terrifying part of the talk.
[28:49.520 --> 28:51.020]  So, nobody, like, freak out.
[28:51.300 --> 28:53.480]  Like, who knows what this logo is?
[28:54.420 --> 28:55.820]  This terrifying monkey.
[28:56.940 --> 28:57.720]  Shout it out.
[28:59.620 --> 29:00.100]  Gopher.
[29:00.380 --> 29:00.860]  No.
[29:01.200 --> 29:02.100]  It's not Gopher.
[29:03.400 --> 29:04.340]  It's not that old.
[29:05.820 --> 29:06.940]  It's not ZDONG.
[29:08.580 --> 29:10.080]  It runs on Macs.
[29:10.940 --> 29:12.840]  They call it Bonjour on Macs.
[29:15.660 --> 29:16.360]  What is it?
[29:16.520 --> 29:16.960]  What is it?
[29:17.180 --> 29:18.100]  It's called a VAHI.
[29:18.540 --> 29:20.500]  So, this is the original zero conf.
[29:20.860 --> 29:23.040]  And so, remember I told you that you can run...
[29:23.040 --> 29:23.520]  Yeah.
[29:23.740 --> 29:24.140]  This guy.
[29:24.780 --> 29:25.480]  Big sigh.
[29:27.820 --> 29:33.460]  So, remember I told you that you could run Tinc as, like, a layer 3 or a layer 2.
[29:33.460 --> 29:38.400]  So, if you run it in layer 3 mode, all your nodes have IP addresses on the network.
[29:38.820 --> 29:40.820]  And they can all just ping each other or TCP to each other.
[29:41.200 --> 29:42.400]  Like, it's a layer 3 on up.
[29:42.560 --> 29:45.020]  Like, an actual OSI layer 3 on up.
[29:45.580 --> 29:47.060]  But you can also run it in layer 2 mode.
[29:47.180 --> 29:49.900]  And when you run it in layer 2 mode, you can use services like...
[29:50.440 --> 29:52.720]  It's very much just MAC addresses speaking at each other.
[29:52.820 --> 29:54.480]  And so, you can do things like run THP servers.
[29:54.680 --> 29:56.380]  Or you can run a VAI, which is zero conf.
[29:56.500 --> 30:03.960]  So, if anybody didn't know, this is, like, this is where those 169 addresses show up on your computer when, like, the Wi-Fi isn't working, that's this guy helping you out.
[30:05.060 --> 30:05.840]  To do nothing.
[30:07.540 --> 30:11.500]  And so, there's, like, Avahi Auto IPD, which provides IP addressing.
[30:11.940 --> 30:17.260]  And once you set up Avahi, you can actually run commands like Avahi-browse-all.
[30:17.500 --> 30:22.540]  And what it will do is it will kind of poll everybody and send broadcast packets and be like, hey, who's got services?
[30:22.880 --> 30:23.700]  And you'll get this nice...
[30:23.700 --> 30:25.900]  And I hope if the Internet and the demo work...
[30:25.900 --> 30:27.180]  I might even demo it for you.
[30:27.180 --> 30:30.960]  But, like, basically, you just get this list of, like, this server is running this services.
[30:31.140 --> 30:32.520]  This server is running this services.
[30:32.740 --> 30:34.260]  And that was even better than DNS.
[30:34.260 --> 30:39.560]  Because even if you know the IP address or the name of a service, you still don't know what port to connect it on.
[30:39.680 --> 30:44.880]  Because remember, the whole point is to bring these ports that we haven't used in a long time back into popularity.
[30:46.240 --> 30:47.260]  So, let's see.
[30:48.060 --> 30:49.460]  Let's see how this goes.
[30:51.680 --> 30:53.140]  Does anybody have any questions so far?
[30:57.030 --> 30:57.430]  Perfect.
[30:58.450 --> 30:58.850]  Hello?
[30:59.730 --> 31:00.510]  Can you hear me?
[31:02.430 --> 31:02.830]  Yeah?
[31:04.510 --> 31:09.650]  While looking at all these DevOps solutions, did you look at SkyDNS, which does service discovery on its ED?
[31:10.170 --> 31:11.270]  I did not look...
[31:11.270 --> 31:12.970]  The question was, have we seen SkyDNS?
[31:13.250 --> 31:15.350]  And I want to say people brought it up in chat.
[31:15.590 --> 31:19.110]  But nobody, like, took it up on themselves to set up a little instance.
[31:19.630 --> 31:21.770]  But, yeah, I think we thought about it for a few minutes.
[31:25.990 --> 31:27.150]  Is that, is that good?
[31:27.330 --> 31:27.750]  In size?
[31:27.990 --> 31:28.290]  Yeah.
[31:44.200 --> 31:44.740]  Okay.
[31:45.020 --> 31:45.680]  It's getting mirrored.
[31:46.400 --> 31:48.340]  2016, you're the latest desktop.
[31:48.600 --> 31:48.880]  Yeah.
[31:55.630 --> 31:57.610]  What is, what does XFinder-X do?
[31:58.290 --> 31:58.830]  Oh.
[31:59.210 --> 31:59.510]  Oh.
[32:00.710 --> 32:01.250]  Oh.
[32:02.470 --> 32:04.430]  Why did I think that was a good idea?
[32:04.430 --> 32:04.470]  Yeah.
[32:05.190 --> 32:05.950]  Dash XY.
[32:06.250 --> 32:06.270]  No.
[32:08.250 --> 32:08.630]  Um...
[32:08.630 --> 32:10.650]  You have to read the man page to figure out how to do it.
[32:12.950 --> 32:16.110]  So, I'm just trying to figure out, like, how we...
[32:18.150 --> 32:19.310]  So, it's like...
[32:19.890 --> 32:23.130]  It says it's in 10, 20 byte, but it's not.
[32:25.010 --> 32:26.830]  That's because projectors hate your freedom.
[32:26.890 --> 32:27.110]  Yeah.
[32:27.330 --> 32:27.550]  All right.
[32:27.890 --> 32:28.550]  Software freedom.
[32:28.730 --> 32:29.670]  We're gonna roll with this.
[32:29.770 --> 32:30.430]  This is fine.
[32:30.690 --> 32:30.970]  All right.
[32:31.650 --> 32:32.050]  So...
[32:33.050 --> 32:34.130]  Everything is fine here.
[32:34.610 --> 32:37.690]  So, remember I told you that Tinc runs in user space, sort of.
[32:38.130 --> 32:40.070]  So, you can just see that we're running two Tincs.
[32:40.230 --> 32:41.890]  We're running an ExampleNet and a BoffNet, too.
[32:43.170 --> 32:45.790]  And evidently an Inkscape file from when I was building you slides.
[32:45.790 --> 32:45.950]  But...
[32:47.350 --> 32:48.750]  And so, these two...
[32:48.750 --> 32:50.590]  So, Tinc actually has, like, some kind of...
[32:50.590 --> 32:51.930]  I wouldn't call it multi-tenancy.
[32:52.090 --> 32:54.890]  But you can run multiple Tinc networks with one Tinc daemon.
[32:54.990 --> 32:58.230]  And it basically just spawns these two versions, these two instances of TincD.
[32:58.550 --> 33:00.970]  And basically, there's this file in /etc/tinc... tinc.conf...
[33:03.990 --> 33:04.830]  Oh, wait.
[33:04.890 --> 33:05.510]  Nets.boot.
[33:05.710 --> 33:09.370]  That basically, you just list networks here and it will run those networks.
[33:09.550 --> 33:11.290]  And then, if you look at...
[33:11.290 --> 33:12.630]  I don't want to show you my...
[33:12.630 --> 33:13.590]  I can show you most of this.
[33:13.590 --> 33:16.470]  If you link at the...
[33:16.470 --> 33:17.150]  There's a...
[33:17.150 --> 33:20.930]  Each directory here basically has its own configurations for that network.
[33:22.190 --> 33:28.670]  And so, there's the private key, the public key, a Tinc configuration file, a list of hosts.
[33:28.730 --> 33:32.950]  So, that's all the hosts mapping of subnets and RSA public keys.
[33:33.270 --> 33:34.090]  And then, a Tinc up.
[33:34.230 --> 33:36.450]  And the Tinc up is an executable that Tinc fires.
[33:36.450 --> 33:37.750]  It's just a shell script or...
[33:37.750 --> 33:38.810]  It's usually a shell script.
[33:38.910 --> 33:39.330]  It doesn't have to be.
[33:39.450 --> 33:42.830]  But it basically just will execute that as soon as Tinc has actually initialized everything.
[33:42.830 --> 33:47.970]  So, like, the classic thing to put in Tinc up is, like, please put my IP address on that machine.
[33:48.090 --> 33:55.310]  So, what we can see here is if we run ifconfig.example.net, I have a little 10 address here.
[33:55.790 --> 34:00.370]  And so, if we cat /etc/hosts, we can look at a really...
[34:01.970 --> 34:04.970]  We can see that I have, you know, just stuff in /etc/hosts kind of from the beginning.
[34:05.230 --> 34:08.810]  And so, we can just ping example telescope and we get pings back from it.
[34:08.870 --> 34:09.610]  And that's all layer two.
[34:09.770 --> 34:10.890]  Or that's all just layer three.
[34:11.010 --> 34:12.430]  And it's all this, like, virtual...
[34:12.430 --> 34:13.470]  It just shows up.
[34:14.070 --> 34:14.430]  Don't...
[34:14.430 --> 34:15.730]  Like, we can...
[34:16.190 --> 34:17.430]  We can trace route it.
[34:17.690 --> 34:18.690]  Oh, I don't want to...
[34:18.690 --> 34:19.150]  I don't...
[34:19.150 --> 34:19.310]  No.
[34:19.310 --> 34:19.990]  Just...
[34:20.770 --> 34:21.170]  Just...
[34:21.170 --> 34:22.010]  Oh, my God.
[34:22.290 --> 34:22.430]  What?
[34:24.350 --> 34:24.790]  All right.
[34:24.930 --> 34:26.710]  So, if we use MTR...
[34:29.470 --> 34:31.690]  How do I have trace route six and not trace route?
[34:31.790 --> 34:32.330]  What is that?
[34:32.690 --> 34:33.990]  Where's the Ubuntu dev in the room?
[34:34.570 --> 34:34.970]  Anyway.
[34:35.370 --> 34:36.750]  So, you can see that it just shows...
[34:36.750 --> 34:38.150]  It's just there.
[34:38.470 --> 34:39.770]  It just shows up.
[34:39.970 --> 34:41.930]  There's nothing to see here, folks.
[34:42.070 --> 34:42.990]  It just happens.
[34:44.270 --> 34:48.370]  What we can also see is that there's, like, services.
[34:48.370 --> 34:49.370]  So, does anyone...
[34:49.990 --> 34:52.150]  So, like, just to show off a little bit.
[34:52.770 --> 34:54.030]  If we just run...
[34:54.470 --> 35:01.490]  If we go here, and we just go to example telescope, we can see, you know, just, like, some files that are being served.
[35:01.670 --> 35:05.430]  So, it turns out tree will actually make you a nice little index if you didn't know that.
[35:05.910 --> 35:07.990]  And we can, you know, we can click on big buck bunny or whatever.
[35:08.130 --> 35:08.570]  We can watch...
[35:08.570 --> 35:09.890]  You can see the little script I made.
[35:09.950 --> 35:10.850]  We can open it and g edit.
[35:12.090 --> 35:12.410]  Or...
[35:12.410 --> 35:12.610]  Yeah.
[35:13.010 --> 35:13.330]  Yeah.
[35:13.470 --> 35:16.050]  And so, you can just see, like, tree dump thing, you know?
[35:16.150 --> 35:17.550]  And so, you just build yourself a little index.
[35:17.550 --> 35:20.590]  But the point is that this is an attendance base.
[35:20.890 --> 35:25.510]  And all this connectivity is going out my laptop through the Tinc network.
[35:25.950 --> 35:31.770]  Or, well, it's going inside my laptop into the Tinc network, out the Tinc network on the remote host, and then back through.
[35:31.910 --> 35:32.330]  So, it's all...
[35:32.330 --> 35:33.070]  It's just a VPN.
[35:33.270 --> 35:34.310]  It's a point-to-point VPN.
[35:34.450 --> 35:35.510]  It's not that complicated.
[35:37.370 --> 35:38.250]  And then...
[35:39.830 --> 35:41.710]  But we can run other commands.
[35:41.950 --> 35:45.210]  Like, does anyone know what this one does?
[35:47.090 --> 35:48.370]  Off the top of your heads.
[35:49.310 --> 35:51.230]  This is the NFS mounts.
[35:52.130 --> 35:54.890]  And so, what we can see is we can just, like...
[35:55.470 --> 35:56.430]  We can mount...
[35:56.430 --> 35:57.670]  NFS is back, y'all.
[35:58.730 --> 36:00.690]  The dream of the 90s is alive in Portland.
[36:12.020 --> 36:14.860]  How many people worked at, like...
[36:14.860 --> 36:18.100]  Or went to university at a place where there was a big NFS installation of some kind?
[36:19.800 --> 36:20.640]  Some of you?
[36:20.800 --> 36:21.040]  Yeah.
[36:21.360 --> 36:22.380]  You remember what I'm talking about.
[36:23.620 --> 36:24.460]  Oh, no!
[36:29.170 --> 36:29.730]  What?
[36:30.990 --> 36:31.550]  Oh.
[36:33.010 --> 36:33.990]  Is it that?
[36:34.590 --> 36:34.870]  No.
[36:36.130 --> 36:36.890]  Is it...
[36:36.890 --> 36:37.050]  No.
[36:37.750 --> 36:38.310]  Like...
[36:38.310 --> 36:39.030]  Like that?
[36:41.350 --> 36:41.910]  Oh.
[36:43.150 --> 36:45.450]  Well, there's one way we can fix this.
[36:50.770 --> 36:51.810]  We got this.
[36:53.080 --> 36:54.310]  We came here to party.
[36:54.310 --> 36:54.350]  We came here to party.
[36:57.430 --> 36:57.830]  Oh.
[36:57.890 --> 36:58.290]  Oh.
[36:59.270 --> 37:00.770]  There's not a lot I can do about that.
[37:00.930 --> 37:01.500]  Control L.
[37:01.930 --> 37:02.020]  Yeah.
[37:02.330 --> 37:02.500]  Control L.
[37:02.890 --> 37:03.290]  Yeah.
[37:03.910 --> 37:04.310]  Oh.
[37:10.390 --> 37:11.020]  We're young.
[37:13.160 --> 37:13.460]  Boom.
[37:13.800 --> 37:14.920]  And so, what we did...
[37:14.920 --> 37:15.260]  And my...
[37:15.260 --> 37:18.340]  Let's just note for 10 seconds that my prompt knows that I'm on NFS.
[37:18.460 --> 37:18.840]  Oh, yeah.
[37:20.060 --> 37:22.480]  And so, what we've done here is we've taken...
[37:22.480 --> 37:23.620]  You know, look, I've got...
[37:23.620 --> 37:24.460]  I've got...
[37:24.460 --> 37:25.220]  I've got...
[37:25.220 --> 37:25.600]  I've got one...
[37:25.600 --> 37:33.640]  10.6 terabytes available on this NFS directory that my laptop has that's secure enough that I dared to use it on the Wi-Fi at a hacker conference.
[37:35.580 --> 37:36.180]  RIP me.
[37:36.880 --> 37:38.460]  Anyway, so NFS is pretty cool.
[37:39.260 --> 37:41.000]  We can do whatever we want with NFS.
[37:41.160 --> 37:42.020]  We can touch...
[37:42.020 --> 37:45.480]  We can't actually touch a file because this is an NFS read-only file system.
[37:45.580 --> 37:47.280]  And this is, you know, just a feature of NFS.
[37:47.380 --> 37:52.380]  Like, what you would commonly do when you're an NFS administrator is you take a big blob of storage, like something called SuperMedia.
[37:52.520 --> 37:54.000]  You share it out to everyone, read-only.
[37:54.000 --> 37:58.460]  And you can do that with relative confidence because I just want you to read these files, don't touch these files.
[37:58.820 --> 37:59.260]  It's like...
[37:59.260 --> 38:02.920]  And the beauty of it is we've brought back, you know, those considerations.
[38:04.100 --> 38:05.820]  Instead of just being like, well, use Dropbox.
[38:05.880 --> 38:07.820]  And if Dropbox doesn't support it, well, have fun.
[38:09.140 --> 38:11.400]  We can also do some other kind of cool things.
[38:11.600 --> 38:13.140]  So, we can...
[38:15.300 --> 38:22.160]  We can actually, like, put users that have home directories on remote file systems.
[38:22.160 --> 38:25.080]  And so this is, like, who am I?
[38:25.240 --> 38:27.380]  Like, this is the NFS user.
[38:27.580 --> 38:29.460]  Well, actually, it's...
[38:29.460 --> 38:30.720]  There's a lot of pseudo going on.
[38:30.820 --> 38:32.580]  But this is the NFS user.
[38:34.900 --> 38:35.820]  And it's...
[38:36.460 --> 38:38.540]  It's currently in Ramon HOPE F user.
[38:38.700 --> 38:40.720]  And if you echo dollar home, that's its home directory.
[38:41.100 --> 38:44.000]  But this home directory is on a remote file system.
[38:45.120 --> 38:50.000]  And so this user can just touch file and so on and so forth.
[38:50.100 --> 38:54.720]  And it can finger NFS user to bring back all the services.
[38:55.360 --> 38:55.840]  Plan.
[38:56.040 --> 38:56.760]  Speak at hope.
[38:57.460 --> 38:57.940]  Profit.
[39:00.220 --> 39:00.700]  Cool.
[39:00.940 --> 39:01.720]  It's pretty cool.
[39:01.940 --> 39:02.420]  It's not bad.
[39:03.800 --> 39:04.760]  So we can...
[39:04.760 --> 39:06.000]  We can go back.
[39:06.640 --> 39:08.420]  Did I actually get this to...
[39:12.030 --> 39:12.430]  Okay.
[39:12.990 --> 39:13.910]  So let's talk...
[39:13.910 --> 39:15.270]  So this is all, like, the example net.
[39:15.350 --> 39:18.750]  The example net is basically the layer three network that we put together.
[39:19.010 --> 39:20.730]  So there's also the layer two network.
[39:20.850 --> 39:21.950]  And so you can sing...
[39:21.950 --> 39:27.790]  When you use Avahi, it basically assigns DNS to these dot locals.
[39:27.790 --> 39:29.310]  So my buddy has a server called riddler.
[39:29.510 --> 39:31.650]  And so riddler is available at riddler.local.
[39:32.470 --> 39:33.910]  And it has Toyman.
[39:34.550 --> 39:35.850]  And we can ping Toyman at local.
[39:36.570 --> 39:37.530]  And we can come over here.
[39:37.630 --> 39:38.410]  We can go to...
[39:38.410 --> 39:42.390]  We can just type in riddler.local.
[39:43.710 --> 39:44.690]  And it says, hi, HOPE.
[39:44.850 --> 39:46.370]  He wants you to know we're here.
[39:47.230 --> 39:48.110]  And then you can run...
[39:48.110 --> 39:49.050]  You can run stuff like this.
[39:49.130 --> 39:52.750]  You can run Avahi Browse dash A.
[39:53.990 --> 39:57.670]  And what it'll do is give you this information down here.
[39:57.670 --> 39:58.670]  That's actually...
[39:59.870 --> 40:00.990]  Are the ports on there?
[40:01.650 --> 40:02.310]  What did you say?
[40:02.470 --> 40:03.510]  Are the ports on there?
[40:03.550 --> 40:05.310]  So the question was, are the ports on there?
[40:05.390 --> 40:08.230]  And the answer is probably if I add the right flags, it would take it off.
[40:08.290 --> 40:08.850]  But look over here.
[40:08.870 --> 40:10.390]  You've actually just got nice little messages.
[40:10.610 --> 40:12.170]  Like riddler is running a website.
[40:12.630 --> 40:14.770]  Selina is running SFTP and SSH.
[40:16.230 --> 40:18.450]  And they can identify themselves as workstations.
[40:18.610 --> 40:22.610]  So you can get this nice expressive just list of who's running what services.
[40:22.670 --> 40:23.730]  And then go from there.
[40:24.130 --> 40:25.030]  Which is pretty cool.
[40:25.230 --> 40:27.830]  How did you do that out?
[40:28.350 --> 40:28.830]  How...
[40:28.830 --> 40:30.150]  The question was, how is what...
[40:30.150 --> 40:31.970]  How is this done without root?
[40:32.630 --> 40:33.110]  What...
[40:33.110 --> 40:33.670]  Is...
[40:33.670 --> 40:34.830]  How is what done without root?
[40:35.210 --> 40:37.210]  Layer 2 and 3 networking.
[40:37.530 --> 40:38.010]  So...
[40:38.010 --> 40:38.270]  So...
[40:38.270 --> 40:38.350]  Yeah.
[40:38.550 --> 40:39.030]  So if you...
[40:39.030 --> 40:41.050]  If config example net...
[40:41.050 --> 40:41.310]  So...
[40:41.310 --> 40:42.070]  First off...
[40:42.610 --> 40:43.090]  Tinc...
[40:43.090 --> 40:44.170]  Tinc runs as root.
[40:46.010 --> 40:46.490]  I...
[40:46.490 --> 40:47.410]  I assume that's right there.
[40:49.330 --> 40:50.370]  And then if you...
[40:50.370 --> 40:51.950]  If config example net...
[40:51.950 --> 40:52.590]  You'll see that it's...
[40:52.590 --> 40:52.670]  Yeah.
[40:52.790 --> 40:53.850]  It's a ton tap...
[40:53.850 --> 40:54.770]  In here somewhere.
[40:56.490 --> 40:57.410]  I don't know what it says.
[40:57.590 --> 40:57.950]  But...
[40:57.950 --> 40:58.030]  Yeah.
[40:58.090 --> 40:59.010]  It uses the ton tap driver.
[41:00.670 --> 41:01.050]  Okay.
[41:01.190 --> 41:01.910]  So for the...
[41:01.910 --> 41:03.670]  My final trick...
[41:07.270 --> 41:07.650]  Mount...
[41:07.650 --> 41:08.410]  And if this...
[41:08.410 --> 41:08.970]  Two...
[41:08.970 --> 41:10.130]  We can actually...
[41:10.130 --> 41:11.170]  Go into the big...
[41:11.170 --> 41:12.130]  The BBB...
[41:12.410 --> 41:12.670]  And...
[41:12.670 --> 41:13.630]  And we can actually...
[41:13.630 --> 41:15.050]  We can actually play this.
[41:17.330 --> 41:17.850]  Um...
[41:17.850 --> 41:18.310]  Maybe.
[41:19.970 --> 41:21.030]  With a lot of caching.
[41:23.490 --> 41:25.590]  And you get to see a quarter of a video...
[41:25.590 --> 41:26.130]  Played...
[41:26.650 --> 41:27.170]  Over...
[41:27.170 --> 41:28.570]  Semi-hostile Wi-Fi...
[41:28.570 --> 41:29.570]  On conference network...
[41:29.570 --> 41:30.270]  From a remote host.
[41:30.270 --> 41:30.850]  Woo!
[41:31.610 --> 41:31.670]  Woo!
[41:36.930 --> 41:38.650]  What happens if you did no caching?
[41:39.010 --> 41:40.350]  If you did no caching...
[41:40.350 --> 41:40.750]  It's...
[41:40.750 --> 41:40.990]  It stutters.
[41:42.310 --> 41:42.710]  Um...
[41:42.710 --> 41:42.930]  Maybe.
[41:43.190 --> 41:43.910]  10 gigs?
[41:45.050 --> 41:45.490]  All right.
[41:46.170 --> 41:46.770]  Come on.
[41:46.910 --> 41:47.530]  Use more bandwidth.
[41:49.010 --> 41:49.410]  So...
[41:49.410 --> 41:49.650]  I...
[41:49.650 --> 41:50.770]  This is kind of...
[41:50.770 --> 41:51.570]  We're just gonna do that.
[41:51.710 --> 41:52.070]  It's fine.
[41:53.270 --> 41:53.750]  All right.
[41:53.810 --> 41:54.310]  We demoed?
[41:55.030 --> 41:55.470]  All right.
[41:55.550 --> 41:55.810]  What are the...
[41:55.810 --> 41:56.830]  What are some neat tricks you can do this?
[41:56.950 --> 41:58.830]  Well, so basically laptops...
[41:59.790 --> 42:00.190]  Um...
[42:00.190 --> 42:01.990]  Laptops start looking a lot more like servers.
[42:02.390 --> 42:02.710]  Because...
[42:02.710 --> 42:04.610]  My server has a known IP address.
[42:05.170 --> 42:07.190]  Any time it's talking to any boffnet service...
[42:07.190 --> 42:07.990]  It has a known source...
[42:08.850 --> 42:09.970]  Address of any of those connections.
[42:10.450 --> 42:11.090]  Which is kind of cool.
[42:11.270 --> 42:12.170]  Because it means...
[42:12.170 --> 42:13.090]  That if you're looking at like W...
[42:13.670 --> 42:13.770]  Or...
[42:13.770 --> 42:14.590]  Or anything like that.
[42:14.730 --> 42:15.250]  Or you know...
[42:15.250 --> 42:15.990]  Who's on the box.
[42:16.090 --> 42:16.530]  Or something like that.
[42:16.610 --> 42:18.010]  You have a meaningful source.
[42:18.210 --> 42:19.630]  And you can do DNS lookups on that.
[42:19.750 --> 42:19.910]  Or whatever.
[42:20.330 --> 42:21.370]  It also means that...
[42:21.370 --> 42:22.730]  You have like a known path...
[42:22.730 --> 42:23.310]  To whatever you're doing.
[42:25.010 --> 42:25.330]  Um...
[42:25.330 --> 42:25.810]  Uh...
[42:25.810 --> 42:26.090]  And...
[42:26.090 --> 42:26.390]  And...
[42:26.390 --> 42:26.890]  And stuff like that.
[42:26.990 --> 42:28.570]  We did try to get brood war working over...
[42:28.570 --> 42:29.750]  That Starcraft didn't work.
[42:29.750 --> 42:30.450]  Um...
[42:30.450 --> 42:32.110]  We ran this as a trans-specific thing.
[42:32.270 --> 42:33.890]  So we had somebody running a tink node...
[42:34.270 --> 42:34.630]  Um...
[42:34.630 --> 42:35.170]  In Japan.
[42:35.570 --> 42:37.130]  And that went actually pretty well.
[42:37.390 --> 42:38.070]  We had to increase...
[42:38.070 --> 42:39.510]  When we were running the ETDs and the consoles...
[42:39.510 --> 42:40.790]  We had to increase the timeouts.
[42:41.010 --> 42:41.670]  Because those are...
[42:41.670 --> 42:42.990]  Those are sensitive to network.
[42:43.550 --> 42:43.910]  But...
[42:43.910 --> 42:44.510]  Um...
[42:44.510 --> 42:45.390]  In terms of just tink...
[42:45.390 --> 42:46.990]  Tinc just puts a heck of a lot of weight...
[42:46.990 --> 42:47.290]  On those.
[42:47.430 --> 42:48.330]  And doesn't use those links...
[42:48.330 --> 42:48.970]  If it doesn't have to.
[42:49.170 --> 42:49.990]  Which is pretty slick.
[42:51.030 --> 42:51.390]  Um...
[42:51.390 --> 42:52.450]  As I've kind of shown you...
[42:52.450 --> 42:53.390]  The NFS is pretty cool.
[42:53.550 --> 42:54.550]  We brazed through it.
[42:54.550 --> 42:56.930]  But there was a whole section on AutoFS...
[42:56.930 --> 42:57.490]  That was pretty slick.
[42:57.710 --> 42:57.910]  If you...
[42:57.910 --> 42:59.730]  When you sued the NFS user...
[42:59.730 --> 43:01.510]  It knows exactly how to mount...
[43:01.510 --> 43:03.150]  Because it looks it up in the AutoFS table.
[43:03.390 --> 43:04.050]  Which is another...
[43:04.050 --> 43:05.510]  Name service source...
[43:05.510 --> 43:06.190]  If anybody was curious.
[43:24.130 --> 43:24.530]  Um...
[43:24.530 --> 43:25.490]  That this is like...
[43:25.490 --> 43:26.050]  I call it...
[43:26.050 --> 43:27.030]  Grandpa backup hack.
[43:27.510 --> 43:27.790]  So...
[43:28.530 --> 43:30.490]  When Corbin moved his server...
[43:30.490 --> 43:31.470]  Into the colo...
[43:31.470 --> 43:32.250]  We didn't know...
[43:32.250 --> 43:33.730]  What IP address the colo was gonna give us.
[43:34.210 --> 43:34.970]  And so...
[43:34.970 --> 43:35.430]  What he did...
[43:35.430 --> 43:36.350]  Is he basically set...
[43:36.350 --> 43:38.110]  His computer...
[43:38.110 --> 43:39.470]  To DHCP on all interfaces...
[43:39.470 --> 43:39.990]  And start tink.
[43:40.150 --> 43:41.710]  And then connect to well-known IP addresses.
[43:42.090 --> 43:43.250]  And as a result...
[43:43.250 --> 43:44.510]  He didn't need to know.
[43:45.250 --> 43:45.870]  Because it...
[43:46.450 --> 43:46.910]  DHCPed out...
[43:46.910 --> 43:48.190]  It got a default route...
[43:48.190 --> 43:49.870]  And then it made a connection...
[43:49.870 --> 43:51.030]  And then it had an...
[43:51.030 --> 43:51.790]  Internal IP address on the...
[43:51.790 --> 43:52.650]  On the VPN...
[43:52.650 --> 43:53.570]  That anything could hit.
[43:53.570 --> 43:54.350]  And then...
[43:54.350 --> 43:54.650]  He's in.
[43:55.450 --> 43:55.810]  So...
[43:55.810 --> 43:56.850]  You take that a step further...
[43:56.850 --> 43:57.370]  And what you do is...
[43:57.370 --> 43:57.870]  You buy...
[43:57.870 --> 43:58.410]  You know...
[43:58.410 --> 43:59.630]  Some tiny little tower...
[43:59.630 --> 44:00.810]  You fill it full of drives...
[44:00.810 --> 44:02.030]  You set it to DHCP...
[44:02.030 --> 44:02.910]  And connect to tink...
[44:02.910 --> 44:03.970]  And you ship it to Grandpa...
[44:03.970 --> 44:04.250]  And say...
[44:04.250 --> 44:04.870]  Grandpa...
[44:04.870 --> 44:05.610]  Plug this in...
[44:05.610 --> 44:07.630]  And now you have a remote backup server...
[44:07.630 --> 44:08.050]  Because...
[44:08.870 --> 44:09.230]  Um...
[44:09.230 --> 44:10.170]  It's just on the network.
[44:10.630 --> 44:10.990]  And...
[44:10.990 --> 44:11.710]  And there's no...
[44:11.710 --> 44:13.210]  There's no talking to Grandpa...
[44:13.210 --> 44:14.410]  About port openings...
[44:14.410 --> 44:16.370]  There's no DynDNS talk with Grandpa...
[44:16.370 --> 44:16.750]  It's just...
[44:16.750 --> 44:17.350]  Plug it in.
[44:17.590 --> 44:18.370]  Is the light on?
[44:18.630 --> 44:18.990]  Alright...
[44:18.990 --> 44:19.750]  It's on my network...
[44:19.750 --> 44:20.350]  And I can see it.
[44:23.570 --> 44:24.530]  Whenever I give this talk...
[44:24.530 --> 44:25.590]  And as somebody who works in like...
[44:25.590 --> 44:26.570]  The very corporate world...
[44:27.290 --> 44:27.730]  Uh...
[44:27.730 --> 44:27.950]  Uh...
[44:27.950 --> 44:29.630]  Corporate network engineers hate you.
[44:30.130 --> 44:31.510]  And so they love the idea...
[44:31.510 --> 44:32.750]  Of segregating these networks...
[44:32.750 --> 44:34.710]  And these networks can talk to these networks...
[44:34.710 --> 44:36.030]  Over these ports...
[44:36.030 --> 44:36.390]  When...
[44:36.390 --> 44:37.250]  There's lots of...
[44:37.250 --> 44:38.970]  This network can initiate a connection...
[44:38.970 --> 44:39.690]  To that network...
[44:39.690 --> 44:41.230]  But not the other way around...
[44:41.230 --> 44:42.550]  For reasons...
[44:42.550 --> 44:42.910]  Um...
[44:42.910 --> 44:44.070]  Because that's how security works.
[44:44.590 --> 44:45.030]  Uh...
[44:45.030 --> 44:45.770]  And so like...
[44:45.770 --> 44:46.610]  What Tinc allows you to do...
[44:46.610 --> 44:47.690]  If you have a couple well-known...
[44:47.690 --> 44:48.490]  Kind of ultra peers...
[44:48.490 --> 44:50.310]  You can slam a whole bunch of machines...
[44:50.310 --> 44:51.090]  Onto one network...
[44:51.090 --> 44:52.470]  Where any machine can connect...
[44:52.470 --> 44:53.490]  To any other machine...
[44:53.490 --> 44:54.450]  Which is very useful...
[44:54.450 --> 44:55.330]  And that's an example...
[44:55.330 --> 44:55.870]  Of not using it...
[44:55.870 --> 44:57.330]  To necessarily secure...
[44:57.330 --> 44:58.230]  But to flatten...
[44:58.230 --> 44:59.570]  A network that was otherwise...
[44:59.570 --> 45:00.310]  Very hilly...
[45:00.310 --> 45:00.790]  And strange...
[45:00.790 --> 45:02.110]  And natted...
[45:02.470 --> 45:02.790]  Okay...
[45:02.790 --> 45:03.870]  So those are some really cool stuff...
[45:03.870 --> 45:04.150]  You can do it...
[45:04.150 --> 45:04.990]  What's next...
[45:04.990 --> 45:06.250]  Is a lot of us are running...
[45:06.250 --> 45:07.550]  Kind of file server-y things...
[45:07.550 --> 45:08.290]  That have like...
[45:08.290 --> 45:09.270]  Big lists of files...
[45:09.270 --> 45:09.750]  Or whatever...
[45:09.750 --> 45:10.470]  And so what I want to do...
[45:10.470 --> 45:11.610]  Is get like a Lucene index...
[45:11.610 --> 45:11.990]  Or something...
[45:11.990 --> 45:13.590]  Like Avahi Browse...
[45:13.590 --> 45:14.730]  Hit the websites...
[45:14.730 --> 45:16.050]  Put them into some Lucene index...
[45:16.050 --> 45:17.210]  And make that easily searchable...
[45:17.210 --> 45:18.070]  I thought that'd be really cool...
[45:18.610 --> 45:18.690]  Um...
[45:18.690 --> 45:20.150]  Tinc 1.1 is gonna drop...
[45:20.150 --> 45:21.330]  Any day now...
[45:21.330 --> 45:21.810]  Uh...
[45:21.810 --> 45:22.910]  I've made a point...
[45:22.910 --> 45:23.890]  Out of trying to use...
[45:23.890 --> 45:24.810]  The release candidates...
[45:24.810 --> 45:25.510]  When they show up...
[45:25.510 --> 45:26.290]  So that I...
[45:26.290 --> 45:26.530]  You know...
[45:26.530 --> 45:27.330]  Can provide feedback...
[45:27.330 --> 45:27.470]  Like...
[45:27.470 --> 45:28.050]  Hey it worked...
[45:28.050 --> 45:28.730]  Hey it didn't work...
[45:29.210 --> 45:30.710]  Because I'm not really a coder...
[45:30.710 --> 45:30.930]  Like...
[45:30.930 --> 45:32.310]  At least not in C...
[45:32.310 --> 45:33.910]  Not VPNs in C...
[45:33.910 --> 45:34.470]  Maybe Python...
[45:35.390 --> 45:36.110]  And so...
[45:36.110 --> 45:36.750]  You know...
[45:36.750 --> 45:37.450]  That's my...
[45:37.450 --> 45:38.250]  What I try to contribute...
[45:38.250 --> 45:39.470]  To the project...
[45:40.110 --> 45:40.550]  So yeah...
[45:40.550 --> 45:41.090]  So inclusions...
[45:41.090 --> 45:41.690]  You can build it...
[45:41.690 --> 45:42.210]  You can use it...
[45:42.210 --> 45:43.230]  To build an overlay network...
[45:43.230 --> 45:44.090]  I make no promises...
[45:44.090 --> 45:45.370]  About the crypto...
[45:47.010 --> 45:47.690]  You know...
[45:48.070 --> 45:48.630]  Figuring out...
[45:48.630 --> 45:49.610]  What you're actually gonna do...
[45:49.610 --> 45:49.930]  With this...
[45:49.930 --> 45:50.810]  Is a little harder...
[45:50.810 --> 45:52.030]  Than just setting it up...
[45:52.030 --> 45:53.050]  Console and NetCD...
[45:53.050 --> 45:53.770]  Are really cool...
[45:53.770 --> 45:54.270]  But like...
[45:54.270 --> 45:55.750]  If you don't necessarily know...
[45:55.750 --> 45:56.350]  What you want...
[45:57.470 --> 45:58.310]  To work for you...
[45:58.310 --> 45:59.130]  And then StarCraft...
[45:59.130 --> 45:59.550]  Is a really...
[45:59.550 --> 46:00.990]  Really good game...
[46:01.950 --> 46:03.470]  This is the Tinc website...
[46:04.050 --> 46:04.990]  This is me...
[46:04.990 --> 46:05.810]  Thank you so much...
[46:05.810 --> 46:06.350]  For coming...
[46:06.350 --> 46:07.270]  I know it's late...
[46:16.100 --> 46:16.940]  Are there...
[46:16.940 --> 46:17.420]  Any questions?
[46:18.500 --> 46:18.730]  Yeah?
[46:19.160 --> 46:19.640]  So...
[46:19.640 --> 46:20.840]  You're running NFS...
[46:20.840 --> 46:21.710]  On your laptop...
[46:21.710 --> 46:22.500]  Mounting your remote...
[46:22.500 --> 46:23.180]  File server...
[46:23.180 --> 46:24.560]  If you were to put your laptop...
[46:24.560 --> 46:24.860]  To sleep...
[46:24.860 --> 46:26.360]  And then open it up again...
[46:26.760 --> 46:28.270]  Would the NFS mount...
[46:28.270 --> 46:29.250]  That horrible...
[46:29.250 --> 46:29.730]  Horrible...
[46:29.730 --> 46:30.160]  Death...
[46:30.160 --> 46:30.600]  Or...
[46:30.600 --> 46:31.520]  Okay...
[46:31.520 --> 46:32.860]  So the question was...
[46:32.860 --> 46:34.080]  You're running NFS mounts...
[46:34.080 --> 46:34.960]  On your laptop...
[46:34.960 --> 46:36.210]  You close your laptop...
[46:36.210 --> 46:36.980]  You open your laptop...
[46:36.980 --> 46:37.320]  What happened?
[46:38.040 --> 46:38.460]  Well...
[46:38.460 --> 46:39.100]  The answer is...
[46:39.100 --> 46:40.700]  When you do NFS...
[46:40.700 --> 46:41.560]  You can bind hard...
[46:41.560 --> 46:42.840]  Or you can bind soft...
[46:42.840 --> 46:43.710]  And binding hard...
[46:43.710 --> 46:44.140]  Means that...
[46:44.140 --> 46:45.660]  It has something to do...
[46:45.660 --> 46:46.580]  With the system calls...
[46:46.580 --> 46:47.230]  Like the system calls...
[46:47.230 --> 46:48.440]  Are guaranteed to...
[46:48.440 --> 46:49.750]  Finish in a bind hard...
[46:49.750 --> 46:50.700]  And so it will block...
[46:50.700 --> 46:51.440]  Like a write...
[46:51.440 --> 46:51.900]  Or a read...
[46:51.900 --> 46:53.680]  Until it actually gets an answer...
[46:53.680 --> 46:54.500]  If you soft...
[46:54.500 --> 46:55.060]  It will like...
[46:55.060 --> 46:55.920]  It will...
[46:55.920 --> 46:56.250]  Fail...
[46:56.250 --> 46:56.620]  But like...
[46:56.620 --> 46:57.770]  Then you get really weird behaviors...
[46:57.770 --> 46:58.500]  Of the files...
[46:58.500 --> 46:59.460]  That you're trying to interact with...
[46:59.460 --> 47:00.440]  And so I bound hard...
[47:00.440 --> 47:01.180]  And so the reason...
[47:01.180 --> 47:02.040]  That I couldn't mount...
[47:02.040 --> 47:03.060]  To that first NFS...
[47:03.060 --> 47:03.300]  Like...
[47:03.300 --> 47:03.710]  Slash mount...
[47:03.710 --> 47:04.180]  Slash NFS...
[47:04.180 --> 47:05.340]  Was because I closed my laptop...
[47:05.340 --> 47:06.200]  To use the restroom...
[47:06.200 --> 47:07.580]  Before the talk...
[47:07.580 --> 47:08.160]  So...
[47:08.160 --> 47:08.800]  That's...
[47:08.800 --> 47:14.670]  That's what happens...
[47:14.680 --> 47:15.940]  Deletes don't take any time...
[47:15.940 --> 47:16.340]  But like...
[47:16.340 --> 47:17.000]  If you're like...
[47:17.000 --> 47:18.060]  Actively copying over files...
[47:18.060 --> 47:18.200]  And you...
[47:18.200 --> 47:19.100]  And you close your laptop...
[47:19.100 --> 47:21.800]  It's gonna be pretty sad...
[47:23.120 --> 47:23.800]  Are there any other...
[47:23.800 --> 47:24.260]  Yeah...
[47:24.260 --> 47:25.340]  So can we turn the house lights off...
[47:25.340 --> 47:26.480]  I can't see anything...
[47:26.840 --> 47:27.020]  So...
[47:27.020 --> 47:28.540]  When you were trying to...
[47:28.540 --> 47:29.880]  To get the gaming working...
[47:29.880 --> 47:30.940]  With StarCraft and such...
[47:30.940 --> 47:31.980]  Were you using the...
[47:31.980 --> 47:32.560]  Layer 2...
[47:32.560 --> 47:33.400]  Or Layer 3...
[47:33.860 --> 47:34.040]  So...
[47:34.040 --> 47:34.680]  Yeah...
[47:34.680 --> 47:35.540]  So the question was...
[47:35.540 --> 47:36.580]  To get StarCraft...
[47:37.020 --> 47:38.300]  LAN gaming working...
[47:38.300 --> 47:38.500]  Over...
[47:39.040 --> 47:39.400]  Over...
[47:39.400 --> 47:39.900]  Tinc...
[47:39.900 --> 47:40.580]  What did you try...
[47:40.580 --> 47:41.300]  And what didn't work...
[47:41.300 --> 47:43.020]  Well we tried a lot of things...
[47:43.020 --> 47:44.520]  The problem really is...
[47:44.520 --> 47:45.000]  That...
[47:45.000 --> 47:46.020]  What we need to do...
[47:48.660 --> 47:49.460]  With Wine...
[47:49.460 --> 47:50.220]  With Wine...
[47:50.220 --> 47:50.820]  What we need to do...
[47:50.820 --> 47:51.800]  Is have Wine...
[47:51.800 --> 47:53.060]  Use a specific interface...
[47:53.060 --> 47:53.320]  And like...
[47:53.320 --> 47:54.160]  The best thing would be...
[47:54.160 --> 47:54.700]  If Wine said...
[47:54.700 --> 47:56.020]  This interface is the only network...
[47:56.020 --> 47:56.700]  You get...
[47:56.700 --> 47:58.120]  Windows Emulation Layer...
[47:59.160 --> 47:59.560]  But...
[48:00.240 --> 48:00.640]  It...
[48:00.640 --> 48:01.080]  Like...
[48:01.080 --> 48:02.100]  It's pretty much...
[48:02.100 --> 48:02.620]  Well coded...
[48:02.620 --> 48:02.960]  To say...
[48:02.960 --> 48:04.340]  Use the default interface...
[48:04.340 --> 48:05.320]  And that's the only network...
[48:05.320 --> 48:05.660]  So...
[48:05.660 --> 48:06.780]  There was a lot of hacks...
[48:06.780 --> 48:07.400]  Around trying to get that...
[48:07.400 --> 48:08.960]  To not happen...
[48:10.820 --> 48:11.220]  Yeah...
[48:15.760 --> 48:16.880]  Have you tried that?
[48:17.320 --> 48:17.760]  So...
[48:17.760 --> 48:18.600]  The question was...
[48:18.600 --> 48:19.780]  Have you tried...
[48:19.780 --> 48:20.620]  IPv6 over Tinc?
[48:20.800 --> 48:21.760]  And the answer is...
[48:21.760 --> 48:22.180]  We've tried...
[48:22.180 --> 48:23.740]  IPv6 inside the Tinc...
[48:23.740 --> 48:25.700]  We haven't tried IPv6 outside the Tinc...
[48:26.700 --> 48:27.800]  How was the experience?
[48:28.480 --> 48:29.360]  It was...
[48:29.360 --> 48:30.200]  It was seamless...
[48:30.200 --> 48:30.360]  Like...
[48:30.360 --> 48:30.880]  It was like...
[48:30.880 --> 48:31.740]  Nobody cared...
[48:32.440 --> 48:32.780]  It was...
[48:32.780 --> 48:33.280]  The question was...
[48:33.280 --> 48:33.780]  How did it work?
[48:33.780 --> 48:36.440]  And the answer was, it wasn't the problem that we were facing that day.
[48:37.620 --> 48:42.060]  Not for the service discovery, but the neighbor discovery, all that stuff.
[48:42.220 --> 48:46.720]  Oh, so the question was, did I run Slack, like a seamless auto configuration?
[48:47.180 --> 48:49.340]  Like IPv6 auto configuration?
[48:49.520 --> 48:50.960]  No, no, I did not run that.
[48:51.200 --> 48:53.640]  Or I did not try to use that, let me put it that way.
[48:54.660 --> 49:03.600]  So I gave this talk at scale, and during the Q&A, a bunch of people got really excited about IPv6 and started arguing with each other about how well it worked inside and outside of Tinc.
[49:03.600 --> 49:05.000]  And I was like, cool.
[49:06.240 --> 49:07.680]  So there's probably some bugs.
[49:07.840 --> 49:08.560]  Like there's definitely bugs.
[49:08.760 --> 49:12.680]  But I think that Goose is the main developer.
[49:12.960 --> 49:16.980]  And so if you can make a gnarly IPv6 bug reproducible, he would love to hear about that.
[49:18.000 --> 49:18.400]  Yeah?
[49:18.820 --> 49:20.840]  How do you distribute the keys?
[49:21.200 --> 49:24.900]  So the question was, how do we bootstrap kind of IP addresses, keys, subnets, you know?
[49:25.120 --> 49:27.280]  And so that has been an evolving conversation.
[49:27.760 --> 49:30.960]  And so the Gen 1 was like we PMed it to each other on Freenote.
[49:30.960 --> 49:33.160]  And then like Gen 2 was like there's a Git repo.
[49:33.500 --> 49:36.380]  We kind of bootstrap it off of existing kind of secret Git repos.
[49:36.920 --> 49:39.800]  And then Gen 3, there's like something we're playing with now.
[49:39.920 --> 49:41.900]  I don't forget the name of it, but it's sort of like a...
[49:42.600 --> 49:49.420]  It's not a blockchain, but it allows you and your friends to have like a secure encrypted file that everyone kind of piles crap onto.
[49:49.660 --> 49:50.740]  And I don't remember the name of it.
[49:51.480 --> 49:52.320]  We're gonna check that out.
[49:52.320 --> 49:53.280]  In the back.
[49:53.620 --> 49:55.680]  Tinc 1.1 supports key distribution.
[49:56.240 --> 49:58.940]  So evidently Tinc 1.1 supports key distribution.
[50:00.120 --> 50:00.600]  Yeah?
[50:01.680 --> 50:03.200]  Were you aware of Chaos VPN?
[50:03.600 --> 50:04.920]  Was I aware of Chaos VPN?
[50:05.420 --> 50:06.380]  And the answer was no.
[50:07.340 --> 50:08.760]  You want to plug it for 10 seconds?
[50:08.960 --> 50:17.360]  Well, just four or six years ago, CCC in Germany started doing the same thing with Tinc, creating meshes between all of their hackerspaces and that kind of stuff.
[50:17.360 --> 50:18.060]  Oh, wow.
[50:18.180 --> 50:22.380]  So evidently CCC in Germany set up a big Tinc, which is cool.
[50:22.640 --> 50:30.280]  I've also heard that the FSFE, which is the Free Software Foundation Europe, has a big Tinc and they run OpenStack on it, which I thought was... that sounds like a tall tale.
[50:32.080 --> 50:33.140]  OpenStack doesn't work.
[50:35.320 --> 50:37.060]  I work on OpenStack for IBM.
[50:39.220 --> 50:39.920]  It works.
[50:40.520 --> 50:41.480]  Yeah, in the... yeah.
[50:42.960 --> 50:49.240]  Have you heard of other alternative mesh-based VPNs, like...
[50:49.880 --> 50:55.220]  So the question was, have I heard of other mesh-based VPNs, like... say the names really loud.
[50:56.180 --> 50:58.240]  CJDNS, there's Lantern Project...
[50:58.240 --> 50:59.480]  I guess it's CJ...
[51:00.480 --> 51:02.480]  So CJDNS runs Hyper...
[51:04.460 --> 51:10.360]  No, I... you know, this is kind of like free time stuff, so we didn't do like a full requirements gathering process.
[51:11.600 --> 51:21.480]  But yeah, no, I think one day we're going to throw this away for something that fits our model a little bit better, but for right now it's kind of cool to be able to just like know my laptop has a secure connection back to... to home base and stuff.
[51:21.660 --> 51:23.160]  That's... that's really what it comes down to.
[51:23.300 --> 51:27.620]  It's like as soon as I added this, I no longer dealt with home DNS problems.
[51:27.820 --> 51:33.760]  Like the... the stuff I run off my... my home, you know, with the IP address changing and stuff and trying to punch through like a NAT.
[51:34.140 --> 51:39.420]  It's like, no, they just have IP addresses that I interact with and I don't think about it anymore and that's really nice.
[51:41.420 --> 51:44.460]  Okay, so I think... one more question and then we're going to call it.
[51:45.120 --> 51:45.360]  Yeah?
[51:45.600 --> 51:47.260]  What about Tinc and portable devices?
[51:47.840 --> 51:49.940]  Okay, so the question was Tinc and portable devices.
[51:50.120 --> 51:54.740]  Now, there's some stuff on the website that claims that there's an Android build and...
[51:55.860 --> 51:57.560]  Dude in the back says it works.
[51:59.080 --> 52:00.600]  All right, thank you very much.
[52:01.500 --> 52:01.620]  Thank you very much.