Viewing a single comment thread. View all comments

cylindrical_ t1_iqy297d wrote

Reply to comment by dovholuknf in OpenZiti - *everything* you need to implement your own secure, zero trust overlay network by dovholuknf

I'd love to read it! My first thought when seeing OpenZiti was "hmm, how does this compare to boring proxy?" Then immediately realized that I might not know enough about the difference between a mesh net and a zero trust platform.

1

dovholuknf OP t1_iqy6tka wrote

OpenZiti vs BoringProxy has some similarities for sure. The simplest OpenZiti deployment is similar to a boring proxy deployment. The main differences will be that the listening ports "on the network" are going to be from the OpenZiti edge-router which will authenticate before allowing any connection using a strong x509 identity (not a token) and then after that the same identity can be authorized to access one or more services. That's one killer difference to me. There are lots of other things OpenZiti is doing that boringproxy isn't trying to as well. I filed an issue to do a comparison to that some day https://github.com/openziti/ziti-doc/issues/176 thanks for the idea! :)

Boringproxy doesn't seem to me to purport to be a mesh network. OpenZiti is a mesh network (a zero trust mesh network). That means that all the components use mutual TLS (mTLS) to connect to one another. Each node has its own identity as well. We'll write it up soon, hopefully.

Thanks for the interest, I was terse here but I'd be happy to answer other questions if you have any.

-- EDIT: -- I totally forgot that OpenZiti is very different insofar as it's trying to get those zero trust principles into applications themselves. That means there's a bunch of SDKs you can use to embed into "your own" applications. I can't leave that out of any comparison - even if the comparison is terse!!! :)

2