[RELEASE] Zero-Trust-Lite: Tiny & Secure Zero-Trust Gateway for your VPS

Maki

@Alyx said:

show previous quotes

@Usagi said:

@Maki said:

@Usagi said:

@Maki said:

@Usagi said:

@Alyx said:
If anyone here is in the need of more than "basic auth" as you put it, they are probably in need of more than a "trust me bro, this is definitely not a chinese trojan, and the proprietary stuff I ChatGPT has developed, is secure".

You said you don't need validation. And you obviously also don't take any feedback.

So, all this is, is a post asking people to run your arbitrary binary on their servers.

If you see this as what it is, this gives really shady vibes.

No root required, works in Docker. If you're too paranoid to audit a non-root container, just don't use it. Whatever.

Absolutely moronic Idea

He said: DONT USE OPEN SOURCE SOLUTION ITS USE 500MB OF RAM

Then: USE DOCKER

it mad me laugh

Stop acting like a clown. I said use Docker to isolate and sniff the traffic if you're so paranoid. It’s for testing, not a debate about RAM. **

If you’re too clueless to handle a non-root process, then just don’t use it and stop barking. Move on.

Keep copy paste LLM hallucination and use your brain instead, if you have one obviously

Your reply made me laugh. I told you to isolate it and sniff the traffic if you're paranoid, yet you’re still barking because you can't grasp that simple logic. Hilarious.

If you’re too incompetent to monitor a non-root process, just don't use it. Move on, clown.

This is honestly the first good suggestion here.
Since nobody here can trust the random binary, the only reasonable way to run it is to 24/7 monitor exactly what it is doing.

Since.. well.., you I never know if it randomly starts to turn into a piece of malware. Or, that maybe someone calls the hidden backdoor to access your important services on your $10/yr VPS.

I think it's also funny thst this posts comes from the dude who didn't know what zero trust even means, before he asked LET a week ago. I can totally understand why people have zero trust in you.

On a serious note, all jokes aside.
Asking questions is great. Learning new things is great. If you learn programming and AI actually helps you with that that is great too. But if you share something with the community, be transparent about it, and be open for feedback.

Throwing a random binary out there, promoting it as a great proprietary security thing, while you obviously don't even understand what you talking about, will lead to people laughing about you, as seen in this thread.

Bro he even answer our comment with LLM, obviously he learn something, people at the peak of dunning kruger is always... become enjoyable drama

ralf

@Usagi said: It’s a passive read/lookup, not an active "infection" or "data exfiltration."

OK. I'm going to pause normal operations momentarily and be nice for one single post.

The issue isn't so much even a problem with what your thing does. Even if it's completely safe, innocent, benign and the best implementation of whatever it is in the world, none of that is really important.

You're targeting security-obsessed geeks and asking them to put a random binary on their system, with absolutely no way of auditing it. It's clearly written by a single person who's young and inexperienced in security (everything in the OP screams "don't trust me"), or possibly worse, it's written by a well funded team of hackers, trying to pass it off as the work of a single person who's new to security. That label isn't intended to disparage you, even though it probably reads like that. Sorry, if I sugarcoated it you might miss the point.

And it's even worse that just running a single binary. It's something that is actually designed to sit in between EVERY SINGLE COMMUNICATION and granting or denying access to every single aspect of whatever it's supposed to be protecting. Whether there is a backdoor there or not, asking someone who cares the slightest bit about security to delegate their entire security to something that some kid on the internet has written, that's impossible to audit and literally could be doing anything, is frankly deluded.

Even if your app works superficially in its task, we have no way of knowing if there's a backdoor so that a hidden master secret can always grant access or if there's a way of remoting triggering a lock down to be used for blackmail. Maybe your app doesn't, that doesn't matter, what matters is that there's absolutely no way whatsoever of knowing.

Those concerns are assuming the app is fully locked down as a passive filter between the ports you're forwarding. We've just got to take it on trust that it's never initiating other connections out or allowing connections in after certain trigger conditions. It's just a random black box that you're asking people to trust.

Compared to the alternative of taking any of the existing implementations of a standard, being able to audit it as source code and integrate it into the app, or even outright swap it out and replace it for a different implementation of the same standard, literally nobody will want to do this.

I'm glad for you that you've done this. You've hopefully learned a lot through the process, and if you're actually using it yourself, you have a library that you've written yourself, you know you can trust and all is good for you (assuming there are no critical bugs that you've overlooked). But asking others to use it is just asking others to outright reject your project, particularly when you not only don't seem to understand a single one of our concerns, you don't even seem to want to try to understand then.

If you want to make a career in computer security, you need to understand these concerns and fully adopt them yourself in whatever you do, or it's an almost certainty that your systems will get hacked.

Finally, have a think to how you've framed your solution. "Zero trust". And yet you are requiring everyone who uses your product to trust it fully with literally the most important thing in their security model. And you can't provide any guarantees about it whatsoever. That's literally about as far from "zero trust" as it's possible to get.

ralf

Oh, I just noticed @Alyx basically wrote the same stuff, and more succinctly, while I was writing my post. I guess it doesn't hurt to hear it twice.

Usagi

@ralf said:

show previous quotes

@Usagi said: It’s a passive read/lookup, not an active "infection" or "data exfiltration."

OK. I'm going to pause normal operations momentarily and be nice for one single post.

The issue isn't so much even a problem with what your thing does. Even if it's completely safe, innocent, benign and the best implementation of whatever it is in the world, none of that is really important.

You're targeting security-obsessed geeks and asking them to put a random binary on their system, with absolutely no way of auditing it. It's clearly written by a single person who's young and inexperienced in security (everything in the OP screams "don't trust me"), or possibly worse, it's written by a well funded team of hackers, trying to pass it off as the work of a single person who's new to security. That label isn't intended to disparage you, even though it probably reads like that. Sorry, if I sugarcoated it you might miss the point.

And it's even worse that just running a single binary. It's something that is actually designed to sit in between EVERY SINGLE COMMUNICATION and granting or denying access to every single aspect of whatever it's supposed to be protecting. Whether there is a backdoor there or not, asking someone who cares the slightest bit about security to delegate their entire security to something that some kid on the internet has written, that's impossible to audit and literally could be doing anything, is frankly deluded.

Even if your app works superficially in its task, we have no way of knowing if there's a backdoor so that a hidden master secret can always grant access or if there's a way of remoting triggering a lock down to be used for blackmail. Maybe your app doesn't, that doesn't matter, what matters is that there's absolutely no way whatsoever of knowing.

Those concerns are assuming the app is fully locked down as a passive filter between the ports you're forwarding. We've just got to take it on trust that it's never initiating other connections out or allowing connections in after certain trigger conditions. It's just a random black box that you're asking people to trust.

Compared to the alternative of taking any of the existing implementations of a standard, being able to audit it as source code and integrate it into the app, or even outright swap it out and replace it for a different implementation of the same standard, literally nobody will want to do this.

I'm glad for you that you've done this. You've hopefully learned a lot through the process, and if you're actually using it yourself, you have a library that you've written yourself, you know you can trust and all is good for you (assuming there are no critical bugs that you've overlooked). But asking others to use it is just asking others to outright reject your project, particularly when you not only don't seem to understand a single one of our concerns, you don't even seem to want to try to understand then.

If you want to make a career in computer security, you need to understand these concerns and fully adopt them yourself in whatever you do, or it's an almost certainty that your systems will get hacked.

Finally, have a think to how you've framed your solution. "Zero trust". And yet you are requiring everyone who uses your product to trust it fully with literally the most important thing in their security model. And you can't provide any guarantees about it whatsoever. That's literally about as far from "zero trust" as it's possible to get.

Fair points. I appreciate the detailed feedback and the nice reply. You're right—trusting a random binary is a big ask in the security world, and I probably underestimated how that looks to others.

This started as a personal learning project (Lite version), and I've definitely learned a lot from this discussion, both technically and regarding the security mindset. I’ll keep these principles in mind for future improvements.

Thanks for the advice. Cheers.

Fritz

Looks good. I'll bookmark this for now.

Thanks for sharing mate.

Maki

@ralf said:

show previous quotes

@Usagi said: It’s a passive read/lookup, not an active "infection" or "data exfiltration."

OK. I'm going to pause normal operations momentarily and be nice for one single post.

The issue isn't so much even a problem with what your thing does. Even if it's completely safe, innocent, benign and the best implementation of whatever it is in the world, none of that is really important.

You're targeting security-obsessed geeks and asking them to put a random binary on their system, with absolutely no way of auditing it. It's clearly written by a single person who's young and inexperienced in security (everything in the OP screams "don't trust me"), or possibly worse, it's written by a well funded team of hackers, trying to pass it off as the work of a single person who's new to security. That label isn't intended to disparage you, even though it probably reads like that. Sorry, if I sugarcoated it you might miss the point.

And it's even worse that just running a single binary. It's something that is actually designed to sit in between EVERY SINGLE COMMUNICATION and granting or denying access to every single aspect of whatever it's supposed to be protecting. Whether there is a backdoor there or not, asking someone who cares the slightest bit about security to delegate their entire security to something that some kid on the internet has written, that's impossible to audit and literally could be doing anything, is frankly deluded.

Even if your app works superficially in its task, we have no way of knowing if there's a backdoor so that a hidden master secret can always grant access or if there's a way of remoting triggering a lock down to be used for blackmail. Maybe your app doesn't, that doesn't matter, what matters is that there's absolutely no way whatsoever of knowing.

Those concerns are assuming the app is fully locked down as a passive filter between the ports you're forwarding. We've just got to take it on trust that it's never initiating other connections out or allowing connections in after certain trigger conditions. It's just a random black box that you're asking people to trust.

Compared to the alternative of taking any of the existing implementations of a standard, being able to audit it as source code and integrate it into the app, or even outright swap it out and replace it for a different implementation of the same standard, literally nobody will want to do this.

I'm glad for you that you've done this. You've hopefully learned a lot through the process, and if you're actually using it yourself, you have a library that you've written yourself, you know you can trust and all is good for you (assuming there are no critical bugs that you've overlooked). But asking others to use it is just asking others to outright reject your project, particularly when you not only don't seem to understand a single one of our concerns, you don't even seem to want to try to understand then.

If you want to make a career in computer security, you need to understand these concerns and fully adopt them yourself in whatever you do, or it's an almost certainty that your systems will get hacked.

Finally, have a think to how you've framed your solution. "Zero trust". And yet you are requiring everyone who uses your product to trust it fully with literally the most important thing in their security model. And you can't provide any guarantees about it whatsoever. That's literally about as far from "zero trust" as it's possible to get.

I dont know if he will understand this, all of his reply is translation and/or through chatgpt

Even his last reply is like "I dont care what other views, but you are right ..."

Usagi

@Maki said:

show previous quotes

@ralf said:

@Usagi said: It’s a passive read/lookup, not an active "infection" or "data exfiltration."

OK. I'm going to pause normal operations momentarily and be nice for one single post.

The issue isn't so much even a problem with what your thing does. Even if it's completely safe, innocent, benign and the best implementation of whatever it is in the world, none of that is really important.

You're targeting security-obsessed geeks and asking them to put a random binary on their system, with absolutely no way of auditing it. It's clearly written by a single person who's young and inexperienced in security (everything in the OP screams "don't trust me"), or possibly worse, it's written by a well funded team of hackers, trying to pass it off as the work of a single person who's new to security. That label isn't intended to disparage you, even though it probably reads like that. Sorry, if I sugarcoated it you might miss the point.

And it's even worse that just running a single binary. It's something that is actually designed to sit in between EVERY SINGLE COMMUNICATION and granting or denying access to every single aspect of whatever it's supposed to be protecting. Whether there is a backdoor there or not, asking someone who cares the slightest bit about security to delegate their entire security to something that some kid on the internet has written, that's impossible to audit and literally could be doing anything, is frankly deluded.

Even if your app works superficially in its task, we have no way of knowing if there's a backdoor so that a hidden master secret can always grant access or if there's a way of remoting triggering a lock down to be used for blackmail. Maybe your app doesn't, that doesn't matter, what matters is that there's absolutely no way whatsoever of knowing.

Those concerns are assuming the app is fully locked down as a passive filter between the ports you're forwarding. We've just got to take it on trust that it's never initiating other connections out or allowing connections in after certain trigger conditions. It's just a random black box that you're asking people to trust.

Compared to the alternative of taking any of the existing implementations of a standard, being able to audit it as source code and integrate it into the app, or even outright swap it out and replace it for a different implementation of the same standard, literally nobody will want to do this.

I'm glad for you that you've done this. You've hopefully learned a lot through the process, and if you're actually using it yourself, you have a library that you've written yourself, you know you can trust and all is good for you (assuming there are no critical bugs that you've overlooked). But asking others to use it is just asking others to outright reject your project, particularly when you not only don't seem to understand a single one of our concerns, you don't even seem to want to try to understand then.

If you want to make a career in computer security, you need to understand these concerns and fully adopt them yourself in whatever you do, or it's an almost certainty that your systems will get hacked.

Finally, have a think to how you've framed your solution. "Zero trust". And yet you are requiring everyone who uses your product to trust it fully with literally the most important thing in their security model. And you can't provide any guarantees about it whatsoever. That's literally about as far from "zero trust" as it's possible to get.

I dont know if he will understand this, all of his reply is translation and/or through chatgpt

Even his last reply is like "I dont care what other views, but you are right ..."

Maki, seriously, stop. You’re replying to everyone like a total obsessed stalker. Are you trying to be my No.1 fan or just a "Den-sha Chikan" (train creeper) following me around the internet? It’s getting weird. If you’re so in love with me or my code, just say so.

Maki

@Usagi said:

show previous quotes

@Maki said:

@ralf said:

@Usagi said: It’s a passive read/lookup, not an active "infection" or "data exfiltration."

OK. I'm going to pause normal operations momentarily and be nice for one single post.

The issue isn't so much even a problem with what your thing does. Even if it's completely safe, innocent, benign and the best implementation of whatever it is in the world, none of that is really important.

You're targeting security-obsessed geeks and asking them to put a random binary on their system, with absolutely no way of auditing it. It's clearly written by a single person who's young and inexperienced in security (everything in the OP screams "don't trust me"), or possibly worse, it's written by a well funded team of hackers, trying to pass it off as the work of a single person who's new to security. That label isn't intended to disparage you, even though it probably reads like that. Sorry, if I sugarcoated it you might miss the point.

And it's even worse that just running a single binary. It's something that is actually designed to sit in between EVERY SINGLE COMMUNICATION and granting or denying access to every single aspect of whatever it's supposed to be protecting. Whether there is a backdoor there or not, asking someone who cares the slightest bit about security to delegate their entire security to something that some kid on the internet has written, that's impossible to audit and literally could be doing anything, is frankly deluded.

Even if your app works superficially in its task, we have no way of knowing if there's a backdoor so that a hidden master secret can always grant access or if there's a way of remoting triggering a lock down to be used for blackmail. Maybe your app doesn't, that doesn't matter, what matters is that there's absolutely no way whatsoever of knowing.

Those concerns are assuming the app is fully locked down as a passive filter between the ports you're forwarding. We've just got to take it on trust that it's never initiating other connections out or allowing connections in after certain trigger conditions. It's just a random black box that you're asking people to trust.

Compared to the alternative of taking any of the existing implementations of a standard, being able to audit it as source code and integrate it into the app, or even outright swap it out and replace it for a different implementation of the same standard, literally nobody will want to do this.

I'm glad for you that you've done this. You've hopefully learned a lot through the process, and if you're actually using it yourself, you have a library that you've written yourself, you know you can trust and all is good for you (assuming there are no critical bugs that you've overlooked). But asking others to use it is just asking others to outright reject your project, particularly when you not only don't seem to understand a single one of our concerns, you don't even seem to want to try to understand then.

If you want to make a career in computer security, you need to understand these concerns and fully adopt them yourself in whatever you do, or it's an almost certainty that your systems will get hacked.

Finally, have a think to how you've framed your solution. "Zero trust". And yet you are requiring everyone who uses your product to trust it fully with literally the most important thing in their security model. And you can't provide any guarantees about it whatsoever. That's literally about as far from "zero trust" as it's possible to get.

I dont know if he will understand this, all of his reply is translation and/or through chatgpt

Even his last reply is like "I dont care what other views, but you are right ..."

Maki, seriously, stop. You’re replying to everyone like a total obsessed stalker. Are you trying to be my No.1 fan or just a "Den-sha Chikan" (train creeper) following me around the internet? It’s getting weird. If you’re so in love with me or my code, just say so.

Keep replying using LLM, dont worry, someone will validate you here

Usagi

@Fritz said:
Looks good. I'll bookmark this for now.

Thanks for sharing mate.

Glad you like it, mate! Thanks for the support.

If you run into any bugs or have suggestions, feel free to open an issue on GitHub. Cheers!

spoontie

@Usagi said:

show previous quotes

@Alyx said:
I have zero trust in this

@Maki said:
Just wait until the LLM give next plausible answer

Then don't use it. My tool isn't a charity project seeking validation from everyone on the internet.

Nobody is forcing this on you. If you need a "big name" and source code to feel safe on your $10/year VPS, this isn't the tool for you.

whoever uses it is just a fucking idiot like you so yeah, don't count on anyone using your ai slop

Usagi

@Maki said:

show previous quotes

@Usagi said:

@Maki said:

@ralf said:

@Usagi said: It’s a passive read/lookup, not an active "infection" or "data exfiltration."

OK. I'm going to pause normal operations momentarily and be nice for one single post.

The issue isn't so much even a problem with what your thing does. Even if it's completely safe, innocent, benign and the best implementation of whatever it is in the world, none of that is really important.

You're targeting security-obsessed geeks and asking them to put a random binary on their system, with absolutely no way of auditing it. It's clearly written by a single person who's young and inexperienced in security (everything in the OP screams "don't trust me"), or possibly worse, it's written by a well funded team of hackers, trying to pass it off as the work of a single person who's new to security. That label isn't intended to disparage you, even though it probably reads like that. Sorry, if I sugarcoated it you might miss the point.

And it's even worse that just running a single binary. It's something that is actually designed to sit in between EVERY SINGLE COMMUNICATION and granting or denying access to every single aspect of whatever it's supposed to be protecting. Whether there is a backdoor there or not, asking someone who cares the slightest bit about security to delegate their entire security to something that some kid on the internet has written, that's impossible to audit and literally could be doing anything, is frankly deluded.

Even if your app works superficially in its task, we have no way of knowing if there's a backdoor so that a hidden master secret can always grant access or if there's a way of remoting triggering a lock down to be used for blackmail. Maybe your app doesn't, that doesn't matter, what matters is that there's absolutely no way whatsoever of knowing.

Those concerns are assuming the app is fully locked down as a passive filter between the ports you're forwarding. We've just got to take it on trust that it's never initiating other connections out or allowing connections in after certain trigger conditions. It's just a random black box that you're asking people to trust.

Compared to the alternative of taking any of the existing implementations of a standard, being able to audit it as source code and integrate it into the app, or even outright swap it out and replace it for a different implementation of the same standard, literally nobody will want to do this.

I'm glad for you that you've done this. You've hopefully learned a lot through the process, and if you're actually using it yourself, you have a library that you've written yourself, you know you can trust and all is good for you (assuming there are no critical bugs that you've overlooked). But asking others to use it is just asking others to outright reject your project, particularly when you not only don't seem to understand a single one of our concerns, you don't even seem to want to try to understand then.

If you want to make a career in computer security, you need to understand these concerns and fully adopt them yourself in whatever you do, or it's an almost certainty that your systems will get hacked.

Finally, have a think to how you've framed your solution. "Zero trust". And yet you are requiring everyone who uses your product to trust it fully with literally the most important thing in their security model. And you can't provide any guarantees about it whatsoever. That's literally about as far from "zero trust" as it's possible to get.

I dont know if he will understand this, all of his reply is translation and/or through chatgpt

Even his last reply is like "I dont care what other views, but you are right ..."

Maki, seriously, stop. You’re replying to everyone like a total obsessed stalker. Are you trying to be my No.1 fan or just a "Den-sha Chikan" (train creeper) following me around the internet? It’s getting weird. If you’re so in love with me or my code, just say so.

Keep replying using LLM, dont worry, someone will validate you here

Yeah, English isn't my native language, so I use LLM to translate. So what? Keep dancing for me, my obsessed "Chikan" fan.

Usagi

@spoontie said:

show previous quotes

@Usagi said:

@Alyx said:
I have zero trust in this

@Maki said:
Just wait until the LLM give next plausible answer

Then don't use it. My tool isn't a charity project seeking validation from everyone on the internet.

Nobody is forcing this on you. If you need a "big name" and source code to feel safe on your $10/year VPS, this isn't the tool for you.

whoever uses it is just a fucking idiot like you so yeah, don't count on anyone using your ai slop

@Admins ban this guy. cas f-word.

maws

@Usagi said: It’s getting weird. If you’re so in love with me or my code, just say so.

But you have not posted any code at all？