GM β
It is a thoroughly satisfying feeling seeing the FIPS mesh networking software enable so many different use cases, especially ones I would never have thought of in the first place.
But it's not without a bit of anxiety--real world usage means real world consequences of screwing up. I put a lot of effort into specification, review, adversarial testing, and documentation, but that of course isn't always enough. Your bug reports, feature requests, and code contributions are the kind of "closed loop" feedback needed to keep things on track.
Anyway, thanks to everyone for deploying FIPS and helping make it better.
Fallacies of distributed computing:
The network is reliable.
Latency is zero.
Bandwidth is infinite.
The network is secure.
Topology doesn't change.
There is one administrator.
Transport cost is zero.
The network is homogeneous.
- L. Peter Deutsch, Sun Microsystems, 1994.
fips-initramfs 0.1.0 is out.
Unlock a LUKS-encrypted server over a FIPS mesh, from anywhere. No static IP, no port forwarding, no inbound reachability at all. The machine dials out to its peers during early boot and comes up at the same mesh address every time. You record that address once at install, then unlock with a single ssh command.
Console passphrase entry always still works, so a failure leaves you at the normal prompt instead of stranded.
Tested end to end on Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04: real encrypted machines, booted and unlocked over a live mesh.
MIT licensed, .deb for amd64:
GM β
"Now, here, you see, it takes all the running you can do, to keep in the same place. If you want to get somewhere else, you must run at least twice as fast as that!"
- Unknown maintainer, after his fifth unsolicited LLM security review
GM β
In spite of the somber mood surrounding recent events, I'm pretty excited to be traveling this week to join the second half of @Sovereign Engineering eighth cohort. I have found my tribe again π