Mycoria is an open-source project developing a secure, open, and decentralized overlay network designed to connect participants with an emphasis on freedom of connectivity, simplicity, and security/privacy by default. Its core technical architecture revolves around IPv6-style router IDs generated from hashed public keys (Ed25519), enabling automatic end-to-end encryption (Chacha20Poly1305) and authentication. Mycoria employs a scalable routing mechanism using geo-marked prefixes and address-distance algorithms, with plans for features like rotating private addresses to enhance user privacy. Currently at an MVP (Minimum Viable Product) stage, the project offers functionalities like .myco DNS resolution, service discovery, and a dashboard. A Hacker News discussion with the author, Daniel Hååvi (formerly of Safing/SPN), delved into his motivations, Mycoria's technical underpinnings (e.g., custom transport, geo-prefix generation), comparisons to existing technologies (like Yggdrasil, Tailscale, VPNs), and community questions regarding privacy implications, commercial viability, and security practices.
Mycoria: An Overview of the Secure Overlay Network and Community Discussion
Mycoria aims to be an open and secure overlay network valuing freedom of connectivity, equality among participants, and mimicking the spirit of the early internet.
Key design goals include keeping it small and simple, ensuring compatibility with existing infrastructure (e.g., DNS), and being secure and private by default.
It promises no "spooking" (everything authenticated), no surveillance (everything encrypted, with private addresses planned), and no barriers to connection.
Section: Introduction - Key Features
Automatic end-to-end encryption: Traffic within Mycoria is encrypted using modern cryptography (Curve25519, Chacha20Poly1305, BLAKE3).
Smart and scalable routing: Utilizes geo-marked prefixes and address-distance routing.
Dashboard: Provides an overview and management interface.
Simple Service Discovery: Facilitates finding services within the network.
Work-In-Progress (WIP) Features: Auto-Optimization/Healing of Network, Rotating private addresses.
Section: Concept - Router IDs & Simplicity
Each Mycoria router has an ID that is a valid IPv6 address, generated by hashing its Ed25519 public key with BLAKE3. This allows the IPv6 address to also serve as the public key's fingerprint.
Section: Concept - Scalable Routing
Employs a two-layered approach:
Geo-marked prefixes: Router IPs are generally within prefixes assigned to specific countries (or US states), aiding global-level routing.
Address-distance routing: Within a country prefix, packets are sent towards the "address-nearest" known router.
Further route exploration can employ source routing for direct paths.
Section: Concept - Network Layers
Switch Layer: Handles source-routed packets ("frames") where the entire path is in the header, reducing router load and enabling future non-routable private addresses.
Routing Layer: Handles packets if the switch layer cannot, performing traditional routing lookups.
Section: Concept - Private Addresses (WIP)
A planned feature using a reserved prefix for non-routable private addresses to enhance user privacy against activity tracking.
Packets using private addresses will require switch labels, obtained via a routed discovery packet mechanism.
Section: Quick Start & Install - Getting Started
Binaries are available for Windows (amd64, arm64) and Linux (amd64, arm64, armv7). WinTun.dll is a required dependency for Windows.
Basic setup involves generating a configuration file (mycoria config generate) and running Mycoria (mycoria run).
Linux requires additional setup for .myco domain resolution (e.g., via systemd-networkd, systemd-resolved, NetworkManager).
Section: Configure - Key Configuration Options
Configuration is managed via a YAML file (config.yaml).
router settings: Define identity (private key within address), universe for siloed networks, iana addresses for public reachability, connect to specific peers, listen ports, autoConnect behavior, bootstrap nodes, and modes like stub (no relaying) or lite (reduced activity).
system settings:tunName, tunMTU, disableTUN (for relay-only), apiListen address.
services: Define services accessible through Mycoria, specifying URL, public/private access, and advertisement. By default, no incoming traffic to the device is allowed.
friends: A list of trusted router IPs/names for simplified access control and DNS resolution (alice.myco).
Section: Examples - Common Use Cases
Connecting to home servers behind NAT/firewalls.
Running Mycoria on low-end devices using stub or lite modes.
Operating a pure relay node by disabling the TUN device.
Hosting public services within Mycoria, with optional advertisement.
Using Mycoria privately by isolating the router and restricting services to friends.
Creating entirely separate Mycoria networks using the universe and universeSecret settings.
Section: About - Project Origins
The name "Mycoria" is derived from "Mycorrhiza," symbolizing a symbiotic relationship with the existing internet.
Daniel Hååvi designed and laid the groundwork, inspired by cjdns and his work on the Safing Privacy Network (SPN). Johannes Schabauer is involved in IoT/embedded aspects.
Author Daniel Hååvi previously co-founded Safing and was CTO, developing the SPN, a privacy network aiming for a niche between VPNs and Tor.
Mycoria was born from a desire to implement a scalable layer-3 mesh network with strong privacy and security, leveraging experience from SPN and inspiration from cjdns/Yggdrasil. It's currently an MVP.
Geo-prefixes: Router IDs are brute-forced to match a country-specific prefix for routing; actual public keys are exchanged separately. This geo-information is less accurate but more stable than typical IP geolocation.
Transport Protocol: Mycoria uses a custom transport layer to support source routing, utilizing the WireGuard library for network interface setup.
Security Analysis: Formal verification tools like VerifPal have been used by the author for other projects but not yet specifically for Mycoria.
DNS: Mycoria DNS is not centralized; each router maintains local mappings. Accessing a .myco service can be done via a URL like http://router.myco/open/service.domain.myco/destination-ip.
Topic: Hacker News - Comparisons to Other Technologies
vs. Yggdrasil: Shares the hashed key -> IP concept. Mycoria enforces geo-prefixes for routing and is secure by default (services are opt-in), whereas Yggdrasil typically requires system-level firewall configuration.
vs. VPNs (WireGuard, Tailscale): Mycoria aims for easy mesh networking among many participants. Unlike WireGuard needing manual peer setup, Mycoria forms an automatic mesh. Compared to Tailscale (P2P with central policies), Mycoria is a decentralized mesh.
vs. Commercial VPN Services: Mycoria primarily focuses on secure connectivity between its participants, not anonymous access to the general internet (though future exit nodes are conceivable).
vs. libp2p: libp2p is a library of P2P modules, while Mycoria is a ready-to-run application.
Security by Default: Mycoria routers do not allow any access to the host device unless services are explicitly defined in the configuration.
Privacy Considerations: While all traffic is encrypted and authenticated, current router IDs with geo-prefixes reveal some location data. The planned "private addresses" feature aims to mitigate this for users needing higher anonymity.
Decentralization & Content: Concerns were raised about decentralized networks potentially facilitating illicit content; the author did not offer specific mitigation strategies for Mycoria beyond its core secure design.
Topic: Hacker News - Project Status & Future
Mycoria is functional on a small scale (MVP) and the author plans further development for use in a new project.
Currently, it's a personal project without immediate commercialization or growth plans, though its technology will evolve.