📅 Original date posted:2022-09-01
📝 Original message:
Hi Alex,
This is a super cool project! I've shared some thoughts here in a comment on
the draft PR:
PR:
https://github.com/lightningnetwork/lnd/pull/6843#issuecomment-1234933319
Also I cc'd the lnd mailing list on this reply, perhaps we can move the
discussion over there (or in the issue) since this is more of an lnd
specific thing. In the future, the lnd mailing list is also probably a
better place for lnd architecture specific proposals/discussions.
-- Laolu
On Thu, Sep 1, 2022 at 10:56 AM Alex Akselrod via Lightning-dev <
lightning-dev at lists.linuxfoundation.org> wrote:
> At NYDIG, we're considering ways to harden large LND deployments. Joost
> and I discussed that currently, when external untrusted peers make inbound
> connections, LND must verify the identity of the peer during the noise
> handshake, and it must do this before enforcing any potential key-based
> allow lists. This is done in the same process as the node's other critical
> tasks, such as monitoring the chain.
>
> To reduce the attack area of the main node process, we'd like to propose a
> means to optionally separate the peer communication into a separate
> process: something like CLN's connectd, running separately, and the
> connections would be multiplexed over a single network connection initiated
> from the node to the proxy. The core of our current idea is demonstrated in
> a draft PR: https://github.com/lightningnetwork/lnd/pull/6843
>
> I'd love some early feedback on the general direction of this. If this
> would be interesting, I'll build it out into a fully working feature.
>
> Thanks,
>
> Alex Akselrod
> _______________________________________________
> Lightning-dev mailing list
> Lightning-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20220901/a7c7cf81/attachment.html>;
Olaoluwa Osuntokun [ARCHIVE] /
npub19h…zkvn4
2023-06-09 13:06:45
in reply to nevent1q…hgxf
Author Public Key
npub19helcfnqgk2jrwzjex2aflq6jwfc8zd9uzzkwlgwhve7lykv23mq5zkvn4Published at
2023-06-09 13:06:45Event JSON
{
"id": "c1345705f4fda1ecdae0007f1f5e15154dc210c9bee4f004192434c5e8508ce5",
"pubkey": "2df3fc2660459521b852c995d4fc1a93938389a5e085677d0ebb33ef92cc5476",
"created_at": 1686316005,
"kind": 1,
"tags": [
[
"e",
"59b7bc84c9c4e94ccf7013e737c33bfcb59d36b826043bd33b6232185060d632",
"",
"root"
],
[
"e",
"9b6af06418e61f6ba62954fd406280a589f105da8b281ceb370ba01f066ee972",
"",
"reply"
],
[
"p",
"cc947666eb0f72b86fe97a050651a765544470e6916c78fbea46c00b5b2a178f"
]
],
"content": "📅 Original date posted:2022-09-01\n📝 Original message:\nHi Alex,\n\nThis is a super cool project! I've shared some thoughts here in a comment on\nthe draft PR:\nPR:\nhttps://github.com/lightningnetwork/lnd/pull/6843#issuecomment-1234933319\n\nAlso I cc'd the lnd mailing list on this reply, perhaps we can move the\ndiscussion over there (or in the issue) since this is more of an lnd\nspecific thing. In the future, the lnd mailing list is also probably a\nbetter place for lnd architecture specific proposals/discussions.\n\n-- Laolu\n\n\nOn Thu, Sep 1, 2022 at 10:56 AM Alex Akselrod via Lightning-dev \u003c\nlightning-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e At NYDIG, we're considering ways to harden large LND deployments. Joost\n\u003e and I discussed that currently, when external untrusted peers make inbound\n\u003e connections, LND must verify the identity of the peer during the noise\n\u003e handshake, and it must do this before enforcing any potential key-based\n\u003e allow lists. This is done in the same process as the node's other critical\n\u003e tasks, such as monitoring the chain.\n\u003e\n\u003e To reduce the attack area of the main node process, we'd like to propose a\n\u003e means to optionally separate the peer communication into a separate\n\u003e process: something like CLN's connectd, running separately, and the\n\u003e connections would be multiplexed over a single network connection initiated\n\u003e from the node to the proxy. The core of our current idea is demonstrated in\n\u003e a draft PR: https://github.com/lightningnetwork/lnd/pull/6843\n\u003e\n\u003e I'd love some early feedback on the general direction of this. If this\n\u003e would be interesting, I'll build it out into a fully working feature.\n\u003e\n\u003e Thanks,\n\u003e\n\u003e Alex Akselrod\n\u003e _______________________________________________\n\u003e Lightning-dev mailing list\n\u003e Lightning-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20220901/a7c7cf81/attachment.html\u003e",
"sig": "59a4f1ac159ae3b47ac32b4c6d76ada6efa3990a989bac162b14b14b26619dbe61872fe116f8a44825ffe05050bd897b53ecd71b113e05c774aa2c3b8975e27c"
}