On 12/08/2014 13:58, Sandy McArthur Jr wrote:
On Mon, Aug 11, 2014 at 1:27 PM, Etienne Dechamps <[email protected] <mailto:[email protected]>> wrote:I believe we don't have the same perspective on the design philosophy - I prefer when failure modes are purely "black and white" - i.e. communication between two nodes either works or it doesn't. I dislike solutions where the system could "half-fail" in subtle and obscure ways - like a node ending up in the same "hash bucket" as another, flapping node, resulting in random packet loss. My rationale is that it's much easier to diagnose clear-cut issues (two nodes can't talk to each other) as opposed to spending hours trying to find out why some packets seem to get lost on some links at random times. As a VPN user I appreciate and value your caution. But, I selected and value that Tinc makes multiple attempts to work even in an unfavorable environment. eg: if direct UDP doesn't work: TCP fallback or relaying between other peers if necessary.
Yes, and these are fantastic features. However, I draw a clear distinction between features that try to make the VPN as efficient and reliable as possible even in hostile network environments (which tinc has no control over), which are very desirable, and features that try to "half-fix" problems that tinc brought on itself, which are not so clear-cut.
Personally, I would like to see more fallback methods such as listening on multiple ports with protocol encapsulation (HTTP Proxy Connect tunneling) . The more situations Tinc works without me having to think about it post setup, the more value it provides to me.
I wholeheartedly agree. I often use tinc in "road warrior" scenarios where it is very convenient to be able to connect to the VPN even in extremely hostile network environments (the typical airport/hotel crappy Wi-Fi). I believe Skype is the champion in that category, and we should aspire to do the same.
tinc has improved tremendously in that aspect over the years: things like UDP hole punching, TCP fallback, relay fallback, PMTU discovery, tolerance for unknown UDP source addresses... these were very welcome additions, and they work very well in practice (thanks Guus!). These features save me an incredible amount of time, and I use tinc knowing that I can trust it to provide me with the most efficient VPN connection that I could possibly get regardless of the network environment it's running in. Well, not if you're using SPTPS of course, since that's what this whole thread is about :)
-- Etienne Dechamps _______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
