Join Nostr
2026-10-21 16:39:40 UTC

FIPS v0.5.3 Release

A new FIPS release is out! v0.5.3 is mostly about making your node harder to mess with. If you run FIPS on an OpenWrt router, the router's own services are no longer open to the whole mesh. If you run a gateway, only your LAN can use it. And wherever you run FIPS, someone who can see or inject traffic has far fewer ways to knock over your links or keep you from finding peers. On top of that, you can now pull FIPS into a Rust project straight from crates.io.

Nothing changes on the wire: you can upgrade one node at a time and a mixed mesh keeps working. Every node should upgrade. If you run FIPS on OpenWrt, run the gateway, or run FIPS on Windows, there is something to check before you upgrade; it's called out below.

If you skipped v0.5.1 and v0.5.2: v0.5.1 made the Linux packages start again on Debian 12 and Ubuntu 22.04, and v0.5.2 brought a first round of security fixes and changed defaults. Upgrading to v0.5.3 gets you all of it.

Notable Contributions

  • Johnathan Corgan - @jmcorgan.

    • Johnathan shepherded the release and did the bulk of the security work: the firewall zones, the gateway hardening, the DNS fixes and the handshake and discovery hardening described below.
    • He also fixed link rekeys that stalled when a message was lost, and renamed the Rust package to fips-mesh so it could be published on crates.io.

  • Arjen - @Origami74.

    • Arjen fixed a crossed BLE handshake that closed the shared link (#179), a session that went dark after losing its route (#185) and the 32-bit Android build (#191).
    • He made the OpenWrt services respawn without limit (#188), the systemd units back off between restarts (#190), and fips refuse a config file that configures nothing (#186).
    • He also reported the receive-loop stall on TCP connections (#176) and wrote a how-to on reachability (#189).

  • Martti Malmi - @mmalmi.

    • Martti fixed a socket leak in the Ethernet transport (#171), made TCP try a hostname's remaining addresses after a failed connect (#172), added back-off on UDP receive errors (#174) and made the gateway retry failed firewall rebuilds (#175).

  • Logen - @btcforplebs.

    • Logen found that a Nostr NAT traversal could stall when both peers dialled at the same time and one offer got lost (#181), and fixed it too (#183).

What's in v0.5.3

Your OpenWrt router is no longer open to the mesh

Until now, every FIPS peer could reach your router's LuCI, SSH and DNS, because fips0 sat in the lan zone. After the upgrade, fips0 has its own default-deny fips zone: peers can ping the router and use the gateway's port forwards, and nothing else unless you open it with a src fips rule. Those same rules now let you restrict who can use a port forward.

If you run an 802.11s mesh, its interfaces now sit in a fips_mesh zone that blocks all IP traffic. FIPS peering over the mesh keeps working, since it uses raw Ethernet, not IP.

New in this release: OpenWrt 24.10 and 25.12 routers set up with fips-mesh-setup can now mesh with each other over 802.11s.

What to do: if you manage your router over FIPS, add a src fips rule for SSH (and LuCI, if you use it) before you upgrade, or you'll lock yourself out. If you reach routers over the mesh, upgrade them one at a time, farthest first, and restart fips after the network reload. On 2.4 GHz, OpenWrt 23.05 routers stop peering with upgraded 24.10+ routers unless those keep the old rates. The package README walks through it.

Your gateway serves your LAN, and only your LAN

If you run fips-gateway on a box with more than one network, such as a VPN, containers or VMs, those other networks could use your gateway's .fips mappings and its mesh identity. Now only hosts on gateway.lan_interface are served. A single LAN host can also no longer fill up your mapping table with names it never uses, and after a restart your gateway won't hand an address that clients may still have cached to a different name.

How you're affected: VPN clients, containers and VMs on the gateway host that reached .fips names through it lose that access, and there is no setting to serve a second interface. If your lan_interface is a VLAN on a bridge, read the bridge netfilter note in the release notes before upgrading. A /128 pool now stops the gateway at start, so widen it first.

Someone who could see or inject traffic between you and your peers had a number of ways to disrupt you without ever breaking the cryptography: replaying an old rekey message to stop your key rotation, sending one forged packet to end a dial, tearing down a link with frames that don't decrypt, or steering and starving discovery with forged lookups, PathBroken signals, floods of Nostr adverts or spoofed LAN adverts. Nearby BLE or Ethernet neighbours could also keep you from dialling a peer. All of those are closed. No key material was ever exposed, and handshake keys are now wiped from memory once they're no longer needed.

Your DNS responder also no longer answers forged or non-query traffic, so it can't be abused as an amplifier, and the TLS library behind the Nostr relay connections picks up fixes for four advisories.

How you're affected: nothing to do but upgrade. One thing to know: against a peer still on v0.5.2 or older, recovering from a genuine key mismatch now takes the link-dead timeout (30 seconds by default) instead of twenty failed frames.

When a rekey reply got lost, a link could go up to two minutes without rekeying. Now it completes on the next resend. Link quality no longer freezes after a rekey, so your node keeps choosing good paths and parents, and a session that loses its route looks the destination up again instead of going dark.

Embed FIPS straight from crates.io

You can now add FIPS to a Rust project from crates.io. The package is called fips-mesh, since the name fips was taken, but the library is still fips, so your code doesn't change:

[dependencies]
fips = { package = "fips-mesh", version = "0.5.3" }

If you build from a checkout and name the package in cargo commands, -p fips is now -p fips-mesh. cargo install fips-mesh gives you the binaries, but to run a node, use the packages: they bring the service units, config and DNS setup.

Platform-specific fixes

  • Linux: if fips or the gateway keeps failing to start, systemd now backs off instead of retrying every 5 seconds forever. A tarball upgrade brings fips-dns and fips-gateway back up, and removing the .deb no longer leaves .fips lookups hanging.
  • OpenWrt: a router that hits a run of failures at boot keeps retrying, instead of staying off the mesh until you restart it by hand.
  • macOS: forwarding no longer stops when one of the daemon's sending threads exits.
  • Windows: the installer stops rather than quietly bringing your node up under a new identity. If it stops, move your key as the upgrade notes describe.
  • FreeBSD: .fips names now resolve with pkg dnsmasq. After pkg install, run service fips restart.
  • Android: 32-bit builds (armeabi-v7a and x86) work again.
  • Everywhere: a config file that configures nothing now stops fips at start, instead of quietly starting a node with no transports. And if you run without --config, every node.* setting in the config files on the search path now applies, so check them for values you didn't mean to set.

Community

Unsure what FIPS can actually do? had FIPS on Intelligence Snacks episode 72, "The Internet We Deserve w. FIPS". It covers FIPS, Nostr, local-first agents and the end of API-key hell, plus a spicy detour into whether AI doom is safety... or cartel theatre. A great listen to get familiar with what FIPS makes possible.

Building on FIPS

  • Wingman over FIPS. Pete Winn's OtherStuffAI stack runs over FIPS: a Nostr-based web browser with a built-in signer for Mac, Linux, iPhone and Android; the Wingman Flight Deck, a Human+Agents multiplayer workspace, talking to its backend and self-hosted agent boxes over FIPS; FIPS Drive, for pulling files from a shared folder on another machine, with access whitelisted by npub; and a GitWorkshop fork serving a FIPS-only repo. No tunnels, no DNS, just Nostr IDs.

  • OceanSlim () ran a Minecraft server over FIPS the day v0.5.0 came out, with FIPS doing the NAT traversal over relays, and followed it up with SFTP over FIPS.

  • Logen () is building FIPS into Nostr Vault, so a relay hosted on an Android, macOS or iOS device is reachable directly at its npub, with no lookup and no middleman. He also published sovereign-dns for DNS over FIPS, and made a Curious Pair episode about FIPS.

  • FIPS to Reticulum bridge. fr34aky built a bridge between FIPS and Reticulum, connecting the FIPS mesh to the Reticulum network.

  • fips-initramfs. Johnathan released fips-initramfs, which unlocks a LUKS-encrypted server over the FIPS mesh from anywhere. No static IP, no port forwarding, no inbound reachability at all.

Elsewhere

  • SEC-08 report. The SEC-08 "YOLO++" report from Sovereign Engineering is out. Over six weeks in Madeira, participants explored mesh networking, payments and a multiplayer game in a single HTML file, ran FIPS over sound, and rebuilt Totem, a hardware mesh platform, on FIPS and napplets.

Thank you, testers

A big thank you to everyone in the community who has been running FIPS, testing it in the wild and raising issues. Real-world usage keeps surfacing things no lab test would, and a lot of the fixes in this release started with one of your reports.

Thank you for testing and reporting a batch of rough edges, several of which are fixed in this release: refusing a config file that configures nothing (#186), respawning the OpenWrt services without a retry limit (#188), a how-to for diagnosing reachability between nodes (#189) and backing off between systemd restarts (#190).

Getting v0.5.3

Everything is on the v0.5.3 release page:

  • Linux x86_64 / aarch64 — .deb and tarball
  • Arch Linux — fips from the AUR
  • macOS — .pkg
  • Windows — ZIP
  • FreeBSD (x86_64) — .pkg
  • OpenWrt — .ipk for 24.x and earlier, .apk for 25+
  • Rust crate — fips-mesh on crates.io, new this release
  • From source — cargo build --release from a checkout of the v0.5.3 tag
  • Nix / NixOS — nix build .#fips from a checkout of the v0.5.3 tag

v0.5.3 is wire-compatible with v0.5.x, so nodes can be upgraded in any order. Before upgrading, read the "Before you upgrade" and "Upgrade notes" sections of the release notes, especially on OpenWrt, the gateway and Windows.

Full release notes are on the release page, and the complete per-commit changelog is in CHANGELOG.md.

Where to Find Us

Thank you to everyone who has contributed, tested and built on FIPS. This pace of development wouldn't be possible without your support!

Author Public Key
npub1y0gja7r4re0wyelmvdqa03qmjs62rwvcd8szzt4nf4t2hd43969qj000ly
Seen on
wss://relay.damus.io