Top all-time · #6283
OpenZiti Tech Blog
Company blog · blog.openziti.ioprogrammingsecurity
OpenZiti Tech Blog is the company blog at blog.openziti.io, writing about programming and security. Since 2023, 13 different Hacker News readers have linked it 43 times, most often “Secure Caddy server with OpenZiti”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (7) to say how often HN recommends it.?
Why HN links it
HN commenters link these posts as examples of zero-trust networking built on OpenZiti, covering no-listening-ports designs, browser-based access (BrowZer), and integrations with Nginx and Caddy. The comments do not judge the writing.
Summarised by Claude from a sample of 7 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Discussion of OpenZiti, the open source platform developed by NetFoundry for building secure, zero-trust connectivity into any application or network
Most-linked posts?
- Secure Caddy server with OpenZiti3 people · 3 mentions · first linked 2023-10-24
- Go Is Amazing for Zero Trust2 people · 5 mentions · first linked 2023-12-14
- Show HN: Next generation peer-to-peer networking in Golang (zrok SDK)2 people · 3 mentions · first linked 2023-08-25
- /my-intern-assignment-call-a-dark-webhook-from-aws-lambda2 people · 3 mentions · first linked 2023-02-20
- Deploy OpenZiti in Kubernetes with Ease Using K3d2 people · 2 mentions · first linked 2024-05-17
- /introducing-openziti-browzer2 people · 2 mentions · first linked 2024-05-07
- Minecraft over Zrok2 people · 2 mentions · first linked 2024-01-06
- /no-listening-ports2 people · 2 mentions · first linked 2024-08-01
What Hacker News says?
Do you want to share publicly (via a URL for anyone) or privately (accessible only with an endpoint and identity)? For the former, zrok frontdoor (by https://docs.zrok.io/docs/guides/frontdoor/ ) protected by OAuth could be the solution. Further, if you want to embed directly in your app, use the SDK - https://blog.openziti.io/the-zrok-sdk . Today we only have for Golang; Python and NodeJS/Javascript coming soon. Mo…
Comment linking /the-zrok-sdk
on “An app can be a home-cooked meal (2020)”Submitted OpenZiti 1.0 as a story · 20 points
HN discussionYes, but the risk posture is very different. The question I like to ask is, 'what does it take to exploit a listening port on the overlay to get to a service': - (1) need to bypass the mTLS requirement necessary to connect to the data plane (note, each hope is uses its own mTLS with its own, separate key). - (2) have a strong identity that authorizes them to connect to the remote service in question (or bypass the a…
Comment linking /no-listening-ports
on “Tailscale is pretty useful”Submitted Use OpenZiti to secure your monitoring as a story · 6 points
HN discussionCheck out OpenZiti - https://openziti.io/ . It looks like Tailscale but is open source, takes zero trust principles to its logical conclusion, and includes a whole suite of SDKs (alongside host based tunnelers and VMs) making it super easy to embed private, obsfucated, secure connectivity directly into your apps. Heck, you don't even need listening ports on the host OS network, therefore you app cannot be found or a…
Comment linking /go-is-amazing-for-zero-trust
on “Tailscale is pretty useful”Submitted Golang Aha Moments: OOP as a story · 4 points
HN discussionGreat insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are li…
Comment linking /introducing-openziti-browzer
on “Tailscale is pretty useful”Submitted zssh – Using Golang to implement a zero trust SSH client as a story · 4 points
HN discussionFor Chromium-based browsers, an option is to use BrowZer (built on OpenZiti, Apache 2.0). Enables you to connect into a full mesh private network (mTLS, e2e encrypted, no TLS man in middle inspection). 3 examples below with well known apps. Disclosure, I work on the project. MSFT RDP (video): https://youtu.be/1NMrxRIowog Private network for Grafana (video): https://youtu.be/l5ktiI-j3eg Private network for Plex (blog…
Comment linking /its-a-zitiful-life
on “JIT WireGuard”Submitted Deploy OpenZiti in Kubernetes with Ease Using K3d as a story · 4 points
HN discussionthere are 3rd party foss options (1): 1. ephemeral + zero implicit trust (2) https://blog.openziti.io/my-intern-assignment-call-a-dark-we... 2. zero implicit trust: https://github.com/openziti/ziti-webhook-action (1) disclosure, maintainer (2) zero implicit trust in this case = no open inbound ports on underlay; need to access via app-specific overlay which requires strong identity, authN, authZ
Comment linking /my-intern-assignment-call-a-dark-webhook-from-aws-lambda
on “A supply chain attack on PyTorch”Submitted Minecraft over Zrok as a story · 4 points
HN discussionwe can use the Internet without being used by the Internet. an open source example: https://blog.openziti.io/no-listening-ports
Comment linking /no-listening-ports
on “Just disconnect the internet”Submitted Minecraft over Zrok as a story · 4 points
HN discussionAgreed, thats why for production workloads it should be done with hardening and auth. Ngrok does that, as does Cloudflare. The version my company created does that too - https://blog.openziti.io/zrok-frontdoor
Comment linking /zrok-frontdoor
on “Show HN: Pico: An open-source Ngrok alternative built for production traffic”Submitted How to Run OpenZiti in Kubernetes in Docker as a story · 3 points
HN discussionEncapsulate and encrypt in the app itself, or in the browser. App (via the openziti sdk): https://blog.openziti.io/no-listening-ports Browser (the openziti js sdk loads on the fly): https://blog.openziti.io/introducing-openziti-browzer Disclosure: openziti (apache v2) maintainer
Comment linking /introducing-openziti-browzer
on “Novel attack against virtually all VPN apps neuters their entire purpose”Submitted Show HN: The zrok SDK for NodeJS as a story · 3 points
HN discussionIf mTLS is combined with outbound connections, then IP source whitelisting is irrelevant; the external network cannot connect to your resources. This (and more) is exactly what we (I work on it) built with open source OpenZiti, a zero trust networking platform. Bonus points, it includes SDKs so you can embed ZTN into the serverless function, a colleague demonstrated it with a Python workload on AWS - https://blog.op…
Comment linking /my-intern-assignment-call-a-dark-webhook-from-aws-lambda
on “Static IPs for Serverless Containers”Submitted Show HN: Next generation peer-to-peer networking in Golang (zrok SDK) as a story · 3 points
HN discussionYes, indeed, this blog gives a great view on it - https://blog.openziti.io/go-is-amazing-for-zero-trust - using Golang and HTTP examples. My favourite part: " Now, your server has no listening ports on the underlay network. It's literally unattackable via conventional IP-based tooling. Seriously, stop and consider that for just a moment. By adopting an OpenZiti SDK into the server, all conventional network threats a…
Comment linking /go-is-amazing-for-zero-trust
on “Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard”Submitted Show HN: Zrok: open-source peer to peer sharing as a story · 3 points
HN discussionp.s., app embedded makes network attacks almost impossible as you no longer have a listening port on the underlay network, well described here - https://blog.openziti.io/go-is-amazing-for-zero-trust
Comment linking /go-is-amazing-for-zero-trust
on “Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard”Submitted Go Is Amazing for Zero Trust as a story · 2 points
HN discussion> I get that. Would need to check if we can integrate Ziti into Traefik in the same way we did for Nginx ( https://blog.openziti.io/nginx-zerotrust-api-security ) and Caddy ( https://blog.openziti.io/put-some-ziti-in-your-caddy ), which we did respectively using the C and Golang SDKs. Therefore you wouldn't need to change your ingress, you would just load Ziti as a module in it. Yeah, this is why I was thinking that…
Comment linking /put-some-ziti-in-your-caddy
on “Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard”Submitted Secure Caddy server with OpenZiti as a story · 2 points
HN discussionAhh, thats cool. Note, the app embedded capabilities of OpenZiti becomes very interesting in this scenario, for example, our Python SDK working with Boto3 for AWS S3 - https://blog.openziti.io/extend-access-to-a-private-s3-bucke... . I get that. Would need to check if we can integrate Ziti into Traefik in the same way we did for Nginx ( https://blog.openziti.io/nginx-zerotrust-api-security ) and Caddy ( https://blog…
Comment linking /put-some-ziti-in-your-caddy
on “Launch HN: Firezone (YC W22) – Zero-trust access platform built on WireGuard”Submitted My Pi Day Journey with Go 64-bit alignment as a story · 2 points
HN discussionSounds like ngrok SDKs ( https://ngrok.com/categories/sdks ), but its closed source so I guess falls foul of your 3rd party solution comment. Another option could be zrok ( https://zrok.io/ ), which is an alternative that is open source, and also includes SDKs - https://blog.openziti.io/the-zrok-sdk . I work on its parent project, OpenZiti, which also may fit your idea. Either way, its a programmatic way to embed co…
Comment linking /the-zrok-sdk
on “Ask HN: What's your app idea that you don't have the time or motivation to build”Submitted Show HN: The Zrok Public Beta as a story · 1 points
HN discussion