It is not easy to get IPv6 on every device, that is only a dream at the moment but Holesail is real and it works. It solves the issue of connectivity + firewalls.
If you are talking about the routing and DHT behind Holesail then no, it is very efficient as the underlying tech is based on Kademliya algorithm:
Kademlia contacts only 𝑂 ( log 𝑛 ) nodes during the search out of a total of 𝑛 nodes in the system.
Even then that will posses similar issues to static IPv4 addresses we have at the moment.
People irresponsibly using it to expose private and important stuff online without knowledge that malicious third parties can see it.
P.s: I did some good research on this a while ago and have not posted about that yet, I will cover this ISSUE in depth in a separate post.
Unpopular opinion: Absolutely terrible idea
Nostr-web-services is just ngrok / cloudflared with extra steps and more concerns about safety.
1. The things you expose are public; hackers can find you and see whatever you are hosting.
2. You DO NOT OWN your web service if the name servers are not under your control.
Whoever owns the name server is the prime authority, and they can inject whatever they want into your website.
Imagine out of 10 relays, even one of them injects your website with a code to steal passwords and you happen to use that relay (YOU ARE COMPROMISED!!)
It is as dangerous as port forwarding / dynamic DNS with extra concerns about integrity.
When I say "as dangerous as port forwarding", I think I am explaining it casually, but in reality, this is far more dangerous and concerning.
Just two days ago when I was looking into issues with port forwarding / dynamic DNS / Nostr-web-services, I discovered:
1. THREE THOUSAND (3k!!!!) Tesla with open information about their home coordinates, their kid's school, drop location, their workplace, their exact address, if their Tesla is active or not.
2. 6K + Camera with a full recording of the whole month, installed in people's personal—-BEDROOM--, baby monitor.
There is no excuse for self-hosting irresponsibly; it should be done to increase your privacy and security, not to increase the risk.
Holesail provides a way to achieve this peak self-privacy and security. You expose only what you 🫵 choose, and only the person you want can access it, with no chances of a man-in-the-middle attack from a random relay and their DNS hosting.
I like how enthusiastic people are about Nostr and Nostr-based services, but we should NOT overlook the security and risks some of these ideas might bring!
https://m.primal.net/JWdi.png@TheGuySwannnostr:note12vy8lmphxyfd7np7t503k8fzs3em2h6szfwad0fkgr6prjkjuhxsddyprj
Check out Cloudflare Zaraz; it injects the website with whatever content you like because they have the domain with them. (The NS)
Similarly, Ad and tracking agencies dynamically insert ads into the website without ever touching their main code.
It is https, but the certificate is not yours, and neither the origin server, they can insert whatever they like.
There is a proxy in between, from your example: socks5h://relay.8333.space:8882
That transfers all the control to this proxy alone, they get to choose what and how they want to display 👀
If it is someone with malicious intent, they will do whatever they want.
curl -s -x socks5h://relay.8333.space:8882 https://nprofile1qqs8a8nk09fhrxylcd42haz8ev4cprhnk5egntvs0whafvaaxpk8plgpzemhxue69uhhyetvv9ujuwpnxvejuumsv93k2g6k9kr/v1/info --insecure
This command makes a request to relay.8333.space:8882 with a profile key; it is up to the server to decide if they actually want to serve the real content; they can just swap it out for something they run themselves (pretty much how pi-hole works by swapping DNS of ad agencies to trash), and the certs are self-signed.
You would never know if what you see is actually coming from your own host or has been altered.
Instead of using central servers to expose your self-hosted stuff, you can use Holesail to do the same, and it all connects peer to peer; there is no third party in between.
+ There is no public URL like a domain, so hackers can not find you. Only the person you choose to share the connection with can find you and connect to you.
Unpopular opinion: Absolutely terrible idea
Nostr-web-services is just ngrok / cloudflared with extra steps and more concerns about safety.
1. The things you expose are public; hackers can find you and see whatever you are hosting.
2. You DO NOT OWN your web service if the name servers are not under your control.
Whoever owns the name server is the prime authority, and they can inject whatever they want into your website.
Imagine out of 10 relays, even one of them injects your website with a code to steal passwords and you happen to use that relay (YOU ARE COMPROMISED!!)
It is as dangerous as port forwarding / dynamic DNS with extra concerns about integrity.
When I say "as dangerous as port forwarding", I think I am explaining it casually, but in reality, this is far more dangerous and concerning.
Just two days ago when I was looking into issues with port forwarding / dynamic DNS / Nostr-web-services, I discovered:
1. THREE THOUSAND (3k!!!!) Tesla with open information about their home coordinates, their kid's school, drop location, their workplace, their exact address, if their Tesla is active or not.
2. 6K + Camera with a full recording of the whole month, installed in people's personal—-BEDROOM--, baby monitor.
There is no excuse for self-hosting irresponsibly; it should be done to increase your privacy and security, not to increase the risk.
Holesail provides a way to achieve this peak self-privacy and security. You expose only what you 🫵 choose, and only the person you want can access it, with no chances of a man-in-the-middle attack from a random relay and their DNS hosting.
I like how enthusiastic people are about Nostr and Nostr-based services, but we should NOT overlook the security and risks some of these ideas might bring!
https://m.primal.net/JWdi.png@TheGuySwannnostr:note12vy8lmphxyfd7np7t503k8fzs3em2h6szfwad0fkgr6prjkjuhxsddyprj
In case you don't know, Holesail has a built in extension for Visual studio code, no additional setup required.
Share your running webapps with friends or work in a team, there are no restrictions.
P.s. You can both connect and set ports live right within Visual studio code 👀
Link: marketplace.visualstudio.com/items?itemName=holesail.holesail-liveports
https://m.primal.net/JPTq.png
Did I ever tell you guys that Holesail can set literally set **anything** live that is reachable and not just local ports/hosts.
For example if you connect to the key below and access it on https, you will see official @ZEUS 's donation page, running on their server but live through my connection string:
Connection String: 5ceb350418803c705bc60a678da12656374cec86cdd1dbbc84771f57d3f426ad
Looks like you are confused here, pear is a like a library for building peer to peer apps and http is a protocol.
Talking about holesail here, it supports http as well as ftp.
Holesail Go atm only let's you connect to a server atm and not serve from your Phone.
It is planned in a future version of Holesail.
But you can always do this:
holesail --live <port-of-server> --host <local-if-of-your-phone>
on a different computer that is connect to the same network as your phone.
Holesail version 0.3.0 is now available on the Play Store and iOS store and no longer requires a waiting list 🥳
-- Added support for QR code scanning
-- Now supports both Private and Public connection strings.
-- Added an embedded browser.
Download using the links below:
Play Store: play.google.com/store/apps/details?id=io.holesail.holesail.go
iOS Store: apps.apple.com/app/holesail-go/id6503728841
P.s. if you are not using Google Android then you can use a third party service to download Holesail Go off Android Play store and then use the Apk file.
Happy Sailing 🙂 ⛵️
https://m.primal.net/JMHZ.png
No, there is no trade off 😁, that's the best thing about this P2P tech and your data does not travel through third party relays either.
Btw, thanks for the Zap
Not really, holesail does not need relays or servers. The P2P network running behind Holesail is a closed network that people can not enter unless they know an existing peer.
By default there are three public nodes, Node is a known peer, and anyone can become a node.
Node is a known peer that know a lot of other peers who's IP address we know and who will accept all connections. It is not a Relay and anyone can become a Node.
Check out Kademliya algorithm.
You don't need a VPN or tailscale, check out holesail.io:
npm i holesail -g
Then just do holesail --live PORT --host HOST on the host machine and you will get a connection string and we code to remotely access this system anywhere on android, iOS, mac and terminal.
ChatGPT and Gemini are the worst things that have happened to privacy. You need to self-host LLMs if you care about your privacy and if your system can handle it.
Holesail makes locally running LLM accessible from anywhere on any device!
nostr:note169s0wet48nudvkkcdwscct9pf7fzggwxhkp5yavje2s6g3s756uqtkqgz8
Hello there, everyone,
It is a good day to announce Holesail P2P version 1.6.1, a major release with changes that will affect how you use the application.
Here is a list of everything that is now changed and available in the latest version of Holesail:
-- Connectors and keys are now referred to as private connection strings and public connection strings.
-- Private connection strings are now used by default while establishing a connection.
-- Introducing a new parameter --filemanager, that lets you view and download files remotely within Holesail
-- Added QR code support in Terminal
Overview of the v1.6.1 here: https://www.youtube.com/watch?v=TgKri9R59oA
@oren_z0 That is an interesting use case, I have not used Vercel or serverless so not sure if this is possible but I will surely look into it 🤔 and ping you.
ChatGPT and Gemini are the worst things that have happened to privacy. You need to self-host LLMs if you care about your privacy and if your system can handle it.
Holesail makes locally running LLM accessible from anywhere on any device!
nostr:note169s0wet48nudvkkcdwscct9pf7fzggwxhkp5yavje2s6g3s756uqtkqgz8
Holesail.io can be used as a replacement of DNS, it allows you to use a dynamic IP while keeping the connection string static, while using no DNS system at all.
Disadvantages I can think of: iOS version of holesail pauses as soon as it goes into background so Nostr will work only when the app is open (I am looking for a workaround), there is no web version of Holesail.
But Desktop version of Nostr clients on Windows, Mac, Linux and even Android can utilise Holesail to run and connect to a Nostr node based on a "connection string".
> But maybe you could run a bridge locally that would map connector.holesail.local strings to holesail IPs?
The bridge would then need to be run on a public server and thats what I call a jump server.
Adding holesail support to clients is a good idea, otherwise you can connect with local ip and port that holesail provides.
No, it works for anything TCP and will soon support UDP as well.
If you are concerned about the http part, that is only for when you are running websites + it is being served from your local computer to you, so https does not matter here.
When you do holesail CONNECTOR, it generates a hash that is also your location in the distributed hash table, atm there are two public nodes run by hopepunch team which lets you in on the mesh network of peers.
Anyone can run a public nodes, and it's only used for initially finding first few peers after that other peers tell you where your "peer" is located.
To stop people from taking over, you need to use key, which are automatically generated.
holesail --live 5000
will give you a key
This could be possible (though would require some work), you need to embed bare runtime in your java/kotlin application and run holesail-client and holesail-server on it.
It is a tedious and undocumented process atm, but holepunch team is working on new mobile development kit, hopefully that will resolve this and make development easier
I just pushed an update for holesail.io (1.5.0), now the UI is much easier to understand and contains appropriate notices where necessary.
Make sure you are up to date with npm i holesail -g, and if you haven't tried holesail yet you are missing out on all the fun.
https://m.primal.net/IZlE.png
iOS is available on the App store, Android is in closed beta and available to users who are participating on our beta program.
Expect Android version to go live by the end of this week along with binaries for all platforms.
Oddbean new post about login | logout
Notes by supersu | export