HN Reader

You can do this with ssh (and socat or mkfifo):

  # receiver
  socat UNIX-RECV:/tmp/foobar - | my-command

  # sender
  my-command | ssh host socat - UNIX-SENDTO:/tmp/foobar

You can relay through any other SSH server if your target is behind a firewall or subject to NAT (for example the public service ssh-j.com). This is end-to-end encrypted (SSH inside SSH):

  # receiver
  ssh top-secret@ssh-j.com -N -R ssh:22:localhost:22
  socat UNIX-RECV:/tmp/foobar - | my command

  # sender
  my-command | ssh -J top-secret@ssh-j.com ssh socat - UNIX-SENDTO:/tmp/foobar

(originally posted on the thread for "beam": https://news.ycombinator.com/item?id=42593135)

I wonder how much reimplementation there is between this and Tailscale, as it seems like there are many needs in common. One would think that there are already low level libraries out there to handle going through NATs, etc. (but maybe this is just the first of said libraries!)

After writing a response about using this for games below, it occurred to me that most tunneling solutions have one or more fatal flaws that prevent them from being "the one true" tunnel. There are enough footguns that maybe we need a checklist similar to the "Why your anti-spam idea won’t work" checklist:

https://trog.qgl.org/20081217/the-why-your-anti-spam-idea-wo...

I'll start:

  Your solution..
  ( ) Can't punch through NAT
  ( ) Isn't fully cross-platform
  ( ) Must be installed at the OS level and can't be used standalone by an executable
  ( ) Only provides reliable or best-effort streams but not both
  ( ) Can't handle when the host or peer IP address changes
  ( ) Doesn't checksum data
  ( ) Doesn't automatically use encryption or default to using it
  ( ) Doesn't allow multiple connections to the same peer for channels or load balancing
  ( ) Doesn't contain window logic to emulate best-effort datagrams over about 1500 bytes
  ( ) Uses a restrictive license like GPL instead of MIT

Please add more and/or list solutions that pass the whole checklist!

https://github.com/anderspitman/awesome-tunneling - for anyone interested in the landscape of tunneling tools like this.

I've always found this path to be more compelling:

https://github.com/samyk/pwnat

It has more edges and doesn't handle all cases, but it also avoids the need for any kind of intermediary.

I've been using this for some years now https://magic-wormhole.readthedocs.io/en/latest/index.html

Just a head's up, I'm getting a 404 on the link to the relay docs (https://www.iroh.computer/docs/layers/connections) when attempting to click through.

This is really good marketing presentation for a command line tool

The surface being http is super nice to have. It's a streams-over-http general utility, quic powered.

I'm struggling to remember what but there's a simple http service called like patchbay or some such that's a store and forward pattern. This idea of very simple very generic http powered services has a high appeal to me.

Looking forward to a future version that can do WebTransport

Every time I see `curl ..| sh` I feel bad. It shouldn't be a norm to run a downloaded script in shell.

Oh they use Iroh notice!

>These dumb pipes use QUIC over a magic socket. It may be dumb, but it still has all the features of a full QUIC connection: UDP-based, stream-multiplexing and encrypted.

How is multiplexing used here? On the surface it looks like a single stream. Is the file broken into chunks and the chunks streamed separately?

Kinda related to this, but is there something that runs a daemon on your local machine, where if a "file request document" is uploaded to mega or Google drive or something similar the (,polling) daemon recognizes the request and pushed the document/file to the file store service?

Wondering about a speed. What transport it uses? Is it establishing a p2p connection? Or transfering all through central server?

> In 2023 it's hard to connect two devices directly

It's not. Use tailscale.

I love the Mr. Dumb Pipe character

You can also do this via "netcat", running the commands below in a terminal.

Receiver (listening to port 31337):

`nc -l -p 31337`

Sender (connecting to receiver IP):

`nc <receiver_ip> 31337`

Want to send a message to the receiver:

`echo "Hello from Kocial" | nc <receiver_ip> 31337`

== if you want to send a file ==

Receiver:

`nc -l -p 31337 > hackernews.pdf`

Sender:

`nc <receiver_ip> 313337 < hackernews.pdf`

thanks everyone for all the love <3

[maintainer of iroh here]

Neato

"Dumb pipe" sounds like they forgot about security.

Every time someone calls a product “dumb,” I get a little excited, because it usually means it’s actually smart. The internet is drowning in “smart” stuff that mostly just spies on you and tries to sell you socks. Sometimes, I just want a pipe that does what it says on the tin; move my bits, shut up, and don’t ask for my mother’s maiden name.

I wonder why it's not standard that you can simply connect two PC's to each other with a USB cable and have them communicate/transfer files. With same protocol in all OSes, of course. Seems like it should have been one of the first features USB could have had since the beginning, imho

I know there's something about USB A to USB A cables not existing in theory, but this would have been a good reason to have it exist, and USB C of course can do this

Also, Android to PC can sort of do it, and is arguably two computers in some form (but this was easier when Android still acted like a mass storage device). But e.g. two laptops can't do it with each other.

Somewhat relevant, I have a list of (mostly browser based + few no-setup cli) tools [1] to send files from A to B. I keep sharing this list here to fish more tools whenever something like this comes up.

[1]: https://gist.github.com/SMUsamaShah/fd6e275e44009b72f64d0570...

If you are in the mood for a slightly less dumb pipe, I’ve been building a tunnel manager CLI built on Iroh. Supports forwarding ports over TCP, UDP, and UNIX sockets. https://gitlab.com/CGamesPlay/qtm

I wonder how much different it is from Wireguard + netcat. Both run encrypted channels over UDP, but somehow differently. What does QUIC offer that Wireguard does not?

iroh is fantastic tech.

I attended Rüdiger's (N0) workshop 2 weeks ago at the web3 summit in Berlin and was left super inspired. The code for building something like this is available here https://github.com/rklaehn/iroh-workshop-web3summit2025 and I highly recommend checking out the slides too :)

Does anyone know if this tech (or Iroh) is suitable for real-time networking for games? Basically, once connection is established, what's the overhead on top of UDP in terms of latency and bandwidth?

Edit: after digging a little, Iroh uses QUIC which looks like a reliable, ordered protocol as opposed to the unreliable, unordered nature of UDP which is what many games need.

Now what I'd love to figure out is if there's a way to use their relay hopping and connection management but send/receive data through a dumb UDP pipe.

At pico.sh we built something similar but using SSH: https://pipe.pico.sh

Does this require a 3rd party host, or is it peer-to-peer?

Good article from Tailscale on how direct connections is established, even when both nodes is behind NAT: https://tailscale.com/blog/how-nat-traversal-works

hamachi anyone?

iroh is awesome, and this is such a good demo of how stupid simple it is to use

Very handy. We've developed an industrialized variant of this in RelayKit designed for fleets of fielded devices at scale with Anycast, mTLS, multiplexing of services through a single tunnel, Bring Your Own PKI and some other fleet management features that together become a somewhat smarter pipe: https://farlight.io

Dumb is the new smart.

Dumb question: can I port forward using this?

The marketing is brilliant. The name of the company (number0) is mad hackerish man, right up my alley in the words of Charlie Murphy. I'm going to try this in my GCE on bare metal "unvirtualizer" today (number0 is what a Linux kernel would call the first tuntap with number as its prefix if you had such a patch).

These are my kind of people!

You mean using "curl | sh" is a dumb pipe? Well, couldn't agree more :)

Who is paying for the relays and why?

Perfect for malware

Question: What is the security level behind this? I guess if it is "dumb" _anyone_ can input your identifier for the pipe and connect to it?? Or even listen on it?

This reminds me a lot of the holepunch.to (previously hypercore-protocol)

What I wonder is this, is there a clever and simple way to share the secret phrase between two devices? The example is pretty long to manually enter "nodeecsxraxjtqtneathgplh6d5nb2rsnxpfulmkec2rvhwv3hh6m4rdgaibamaeqwjaegplgayaycueiom6wmbqcjqaibavg5hiaaaaaaaaaaabaau7wmbq"

10 years ago I made an "encrypted voice channel" by chaining the following 3 commands together (I dont remember exactly how it looked, this is just a sketch):

    arecord - | openssl aes-128-cbc -pass:'secretstring' - | nc <dest ip> <dest port>

on the receiving end

    nc -l <dest port> | openssl aes-128-cbc -pass:'secretstring' | aplay -

I don't remember exactly which audio device I used back then. It worked okay-ish, but there was definitely lag from somewhere. Just kind of neat that you can build something so useful without a bloated app, just chaining a few commands together.

Is there a way I can use this to run remote commands on another host? Something similar to what ssh does?

I remember doing something like this with Skype many years ago (at least 15, I guess).

The old Skype, the one that was a real p2p app and before it got bought by Microsoft, was very good slicing through firewalls and NATs and it offered a plugin api, so it was easy to implement a TCP tunnel with it.

About once or twice a year a solution comes out that does this. Here is a great one for orchestrating connections: https://docs.spacebrew.cc/

> In the iroh world, you dial another node by its NodeId, a 32-byte ed25519 public key. Unlike IP addresses, this ID is globally unique, and instead of being assigned,

ok but my network stack doesn't speak nodeID, it speaks tcp/ip -- so something has to resolve your public keys to a host and port that I can actually connect to.

this is roughly the same use case that DNS solves, except that domain names are generally human-compatible, and DNS servers are maintained by an enormous number of globally-distributed network engineers

it seems like this system rolls its own public key string to actual IP address and port mapping/discovery system, and offers a default implementation based on dns which the authors own and operate, which is fine. but the authors kind of hand-wave that part of the system away, saying hey you don't need to use this infra, you can use your own, or do whatever you want!

but like, for systems like this, discovery is basically the entire ball game and the only difficult problem that needs to be solved! if you ignore the details of node discovery and name mapping/resolution like this, then of course you can build any kind p2p network with content-addressable identifiers or whatever. it's so easy a cave man can do it, just look at ipfs

Reminds me of https://docs.pears.com/tools/hyperbeam

Is there a network topology where two hosts, each behind one or more layers of NAT, can both initiate outbound connections to public internet services (e.g., google.com), but are unable to establish a direct peer-to-peer connection due to NAT traversal limitations? I understand that NAT hole punching can work with a single level of NAT, but does it still function reliably across multiple layers of LAN/NAT hierarchy?

(2023)