Item — HN Reader

If you're new to Iroh, my mental model is roughly "Tailscale at the application layer instead of the network layer".

If your question is, "why not just use Tailscale?", look at it from an app developer's perspective. If you want to release an app and have instances of your app be able to easily connect to each other, you could theoretically embeded Tailscale functionality into your app, but then the users of your app need Tailscale accounts, and your app is dependent on Tailscale.

Iroh lets you embed this functionality directly, and provides public fallback relays. If your app gets too big for the public relays, using your own relays is the flip of a switch.

17 comments

Its amazing to me how people can make a great a product. And then completely bury the lead because they are so deep into the guts of the system

You explained the value proposition so well. The website just didnt get to the "why?" At all

That amazement is due to one of our largest and least realized critical mistakes as a civilization: no where are people taught how to effectively communicate. We have entire Colleges of Communications at every university, and what do they teach? How to execute mass manipulation, not how to convey understanding, not how to manage disagreements. These are not "mistakes" either, this distinct lack of teaching real communications is how society is maintained manipulative. And the worst part, many of you will read this and not understand, because you've not been taught the communications insights to grasp this message.

I think my college technical writing course covered these things quite well. It's not that they're not taught, it's that communication skills are not rewarded the same way that marketing skills are. Generally speaking there's a lot of blame to be placed on the universities, but in this case it's an HR oversight.

That sounds like the Success Oriented approach, as opposed to the Understanding-Oriented approach.

Check out Jürgen Habermas's Theory of Communicative Action (1981).

Is the LLM-tone of this comment intentional? Or is it just how you normally write? Honest question.

It's primarily an open source library, not a product.

I don't understand why HN seems so concerned about nailing down its "value proposition".

>I don't understand why HN seems so concerned about nailing down its "value proposition".

You're getting sidetracked because of the particular phrase "value proposition" but a lot of people just use it as a stock meme to simply understand something even without any commercial product perspective.

You can read through this entire thread where people are having a hard time wrapping their head around what _it_ _is_ because the blog article doesn't explain it well.

The following various stock phrases use different words but are basically asking the same thing:

- "This is the solution to what problem?"

- "How's this different from Tailscale/Wireguard/QUIC/etc?"

- "What is the raison d'être ?"

- "ELI5?"

- "What's the value proposition?"

- "Why should I care about this?"

- "What's the use case for this?"

- "What's the motivation / rationale for this?"

- "What does this do?"

And then different commenters try different explanations and hopefully one will finally click for readers.

Also, this link is to a version announcement. It makes a poor introduction to iroh because it's not one.

The "what is iroh" quesition is answered well in the docs: https://docs.iroh.computer/what-is-iroh

I mean this kindly, but this is so “engineer brained”

Maybe the game has changed with LLMs, but its been a running joke that engineers will build a startup/product/library/thing only to then realize they can’t get any users and that marketing and sales are hard.

Attention and mind share are more valuable than ever. If you can’t answer “Why should I care about X?” then you are fighting an uphill battle.

Even if it isnt a product, it is still a tool/utility. Those srill have value propositions that need to be communicated for the tool to be used by the people who could utlize it

Imagine if had a nail to drive into a peice of wood, but the onky thing youd ever heard about hammers was either how critical they are in building construction, or about their weight balancing and how much grip the handle has. Youd never know that you could swing the hammer to hit the nail and drive it in

On the other hand, parent commenter's comparison is based on another product. How good it is if people don't know what Tailscale is? There was a time I did not understand Tailscale and its value.

Agreed, I went through the blog post and a few other pages trying to figure out what the benefit of Iroh is since I have never heard of it... was struggling lol.

Why? Because if you need to serve ads that are being blacklisted by DNS, you need something like this.

Oh come on. I guess it can be abused that way but its so cynical. First, i heavily doubt thats the intention here, and secondly, mmost ads are blocked at the rendering stage, rather than DNS. Especially since youtube broke DNS adblocking by serving ads and contect from the same domain

> You explained the value proposition so well.

No, it didn't. It shifted the burden of learning the value proposition to first knowing what Tailscale is exactly. And a response of "Duh, that's obvious", perhaps indicates being too deep in the guts of tailscale systems.

I think you've got this a little backwards.

The target audience of this comment chain is exactly people who are familiar with Tailscale, aren't familiar with Iroh, and read the linked post.

Such a person (like me) reading that post will have an immediate reaction of "this sounds a lot like Tailscale", but the post doesn't provide a clear answer to "what problem does this solve that Tailscale doesn't?"

The people with that reaction are the target audience of this comment chain. The fact it is upvoted to the top of the comment section here is an indication that there are quite a few such people, and if this is your reaction you're presumably not one of them. (and that is perfectly fine!)

Tailscale is a very well established company in the field, and if you didn't hear tailscale before, perhaps this product would not be so interesting for you, so it makes sense here.

Otherwise, everything would end up being a "Thing Explainer"[0].

[0]: https://en.wikipedia.org/wiki/Thing_Explainer

Oh, okay, I get the value prop now. Thank you. They should hire you to write their marketing copy, you did a better job than the landing page.

That explanation still seems overly complicated. Iroh isn't a VPN. Iroh just lets apps connect to each other, just like plain old TCP, but without the shackles of NAT, DNS and dynamic IP addresses that made that impossible. It's restoring simple P2P connectivity to the Internet.

Also, all connections in iroh are end-to-end encrypted.

And bypass all the firewalls if secret key of target machine is known?

I understood more about what iroh does with this post then the video :) thanks for the mental model. Now how does iroh accomplish this. Great idea by the way.

this is how: https://docs.iroh.computer/concepts/relays

This is exactly it. I'm pretty sure I found Iroh after thinking: can we ship Tailscale with our app?

For environments where you want people to access your local instance, I believe Iroh will be a game changer. For us, it's to allow control over our software through phones and other devices easily.

Previously, you might have to make sure they're in the same LAN network. But with Iroh, anything works.

also to follow on the "why not use tailscale" should be because they're a business who seeks to make money and we are fools to keep concentrating distributed technology to a handful of centralized owners (!)

especially when iroh makes it so easy and awesome to do it right.

So instead of paying a subscription fee to Tailscale to support your distributed application, you pay a subscription fee to Iroh to support your distributed application. (https://www.iroh.computer/pricing says $19/month for what most people will want to use it for).

Either one will allow you to stop "concentrating distributed technology to a handful of centralized owners", but the "why not use tailscale" part of what you're trying to say is not at all evident from your comment.

Ok, stupid question, but what applications is something like tailscale/iroh used for? I've never worked with this type of tech so curious where it is valuable.

Say you want to build a Peer to Peer application; chat, file sharing, music sync or whatever, then something needs to be built to communicate between this application running in two different places. While you still need to build the actual protocol yourself ("Users can send messages" etc), how the two instances are connected is handled by Iroh mostly.

Not a stupid question - I was wondering about the same thing, and this gave me easy access to the answer because someone replied to your comment. Thank you for asking :)

With tailscale, you can establish a private LAN over the internet. Iroh embeds this directly into the app itself.

I think it's more similar to the idea of IPFS than Tailscale. It's excellent for example for decentralized networks where there is missing trust; file sharing, bittorrent, blockchain networks etc, where you don't want to manage the complexity of dropping IP addresses at the application layer. I initially found it for parture.org for example.

Still I am not sure why I should use their paid service instead of using publicly available infrastructure. If they go out of business, get sold what's then? DNS and friends are not going to disappear and send me "it was great journey" e-mail. Maybe for some specific applications, like P2P chats, this makes sens, but how many of such applications are needed?

I've looked at the usecases page, obviously there is an AI stunt (which I don't buy at all), for POS applications, well, there are better and less risky (see above) ways to do this, so the only thing that seems to make sense is this real-time sync, if someone is in the restricted environment (but, the point is, that in the restricted environment iroh is going to be blocked anyway by firewalls, z-scaler, etc.).

They host a relay server that is available to everyone, but you are expected/recommended to use your own for most use cases, so you will have only depend on open-source code and your own infra.

How do I add firewalls and proxies and logging to iroh connections? How do I revoke and re-issue iroh keys? Can I host iroh relays/gateways on my intranet?

Until these questions are answered iroh will remain blocked.

You don't have to use it. But here are some answers:

Re-issuing keys is as simple as generating a new Ed25519 keypair.

let secret_key = SecretKey::generate(); // takes less than a millisecond

Iroh as of now has no fleet management. So the concept of revoking a key is something you would have to add yourself.

We have extensive logging for iroh. You can enable trace logging and even enable qlog for detailed connection logs. You can view the logs in any qlog viewer. We have written one, but there are others. It is an open standard for QUIC logs.

https://datatracker.ietf.org/doc/draft-ietf-quic-qlog-main-s... https://github.com/n0-computer/qlog-viewer

The iroh relay library and binary are open source just like everything else in the core. You can of course run a relay in your intranet, but the exact details depend on the use case. Get in touch if you have a demanding use case and want us to help.

https://docs.iroh.computer/

the closest comparison is openziti:

+ iroh and openziti can both be app-embedded

+ so the app developer embedding in their service is a good use case for both

+ openziti is used for services in which scale and security are critical

+ whereas iroh allows participation from parties which don't have any prior relationships - which can be very convenient

> the closest comparison is openziti:

Except without all the ceremony about setting up daemons, servers, controllers, "networks" and what not that openziti seems to have. Iroh is more "define protocol and hook two clients together" with everything in one binary.

Unless I understand https://github.com/openziti/sdk-golang/blob/a6e5f1697a9dc34a... wrong, it seems to require a "controller-url", is that controller embeddable as well?

A much better answer to the question "why not just use Tailscale?" is that critical functionality only is available with cloud hosting, self-hosted headscale just doesn't offer a usable solution.

> If you want to release an app and have instances of your app be able to easily connect to each other, you could theoretically embeded Tailscale functionality into your app, but then the users of your app need Tailscale accounts, and your app is dependent on Tailscale.

Just use Wireguard directly like everyone else.

I found this interesting to learn how Tailscale works: https://tailscale.com/blog/how-tailscale-works

Well, Iroh is more P2P (direct connections) and less VPN (subnet routing).

If anyone really wants to use Tailscale (or I think Headscale should work too) at application layer, you can use tsnet [0]

  0: https://tailscale.com/docs/features/tsnet

They should basically replace any Why Iroh vs Tailscale with this. Thank you

that landing page is confusing, they should delete their text and replace it with yours

why isn't your mental model to use DNS?

How will that help your computer behind your NAT communicate with my computer behind my NAT? (I think you're still stuck on the blog post's very confusing opening, which does indeed make it sound like a terrible alternative to DNS, but it's actually something entirely different, for a very different purpose.)

DNS is piece of the required kit, and not the only hard part of the task.