Nostr notes by jcorgan

GM ☕ Mood: ...

2026-10-27T13:54:53Z

GM ☕

Mood:

FIPS v0.5.3 released, bug fixes and security hardening ...

2026-10-21T16:52:23Z

FIPS v0.5.3 released, bug fixes and security hardening

quoting
naddr1qv…w8u8

A new FIPS release is out! v0.5.3 is mostly about making your node harder to mess with. If you run FIPS on an OpenWrt router, the router's own services are no longer open to the whole mesh. If you run a gateway, only your LAN can use it. And wherever you run FIPS, someone who can see or inject traffic has far fewer ways to knock over your links or keep you from finding peers. On top of that, you can now pull FIPS into a Rust project straight from crates.io.

Nothing changes on the wire: you can upgrade one node at a time and a mixed mesh keeps working. Every node should upgrade. If you run FIPS on OpenWrt, run the gateway, or run FIPS on Windows, there is something to check before you upgrade; it's called out below.

If you skipped v0.5.1 and v0.5.2: v0.5.1 made the Linux packages start again on Debian 12 and Ubuntu 22.04, and v0.5.2 brought a first round of security fixes and changed defaults. Upgrading to v0.5.3 gets you all of it.

Notable Contributions

Johnathan Corgan - @jmcorgan.

Johnathan shepherded the release and did the bulk of the security work: the firewall zones, the gateway hardening, the DNS fixes and the handshake and discovery hardening described below.

He also fixed link rekeys that stalled when a message was lost, and renamed the Rust package to fips-mesh so it could be published on crates.io.

Arjen - @Origami74.

Arjen fixed a crossed BLE handshake that closed the shared link (#179), a session that went dark after losing its route (#185) and the 32-bit Android build (#191).

He made the OpenWrt services respawn without limit (#188), the systemd units back off between restarts (#190), and fips refuse a config file that configures nothing (#186).

He also reported the receive-loop stall on TCP connections (#176) and wrote a how-to on reachability (#189).

Martti Malmi - @mmalmi.

Martti fixed a socket leak in the Ethernet transport (#171), made TCP try a hostname's remaining addresses after a failed connect (#172), added back-off on UDP receive errors (#174) and made the gateway retry failed firewall rebuilds (#175).

Logen - @btcforplebs.

Logen found that a Nostr NAT traversal could stall when both peers dialled at the same time and one offer got lost (#181), and fixed it too (#183).

What's in v0.5.3

Your OpenWrt router is no longer open to the mesh

Until now, every FIPS peer could reach your router's LuCI, SSH and DNS, because fips0 sat in the lan zone. After the upgrade, fips0 has its own default-deny fips zone: peers can ping the router and use the gateway's port forwards, and nothing else unless you open it with a src fips rule. Those same rules now let you restrict who can use a port forward.

If you run an 802.11s mesh, its interfaces now sit in a fips_mesh zone that blocks all IP traffic. FIPS peering over the mesh keeps working, since it uses raw Ethernet, not IP.

New in this release: OpenWrt 24.10 and 25.12 routers set up with fips-mesh-setup can now mesh with each other over 802.11s.

What to do: if you manage your router over FIPS, add a src fips rule for SSH (and LuCI, if you use it) before you upgrade, or you'll lock yourself out. If you reach routers over the mesh, upgrade them one at a time, farthest first, and restart fips after the network reload. On 2.4 GHz, OpenWrt 23.05 routers stop peering with upgraded 24.10+ routers unless those keep the old rates. The package README walks through it.

Your gateway serves your LAN, and only your LAN

If you run fips-gateway on a box with more than one network, such as a VPN, containers or VMs, those other networks could use your gateway's .fips mappings and its mesh identity. Now only hosts on gateway.lan_interface are served. A single LAN host can also no longer fill up your mapping table with names it never uses, and after a restart your gateway won't hand an address that clients may still have cached to a different name.

How you're affected: VPN clients, containers and VMs on the gateway host that reached .fips names through it lose that access, and there is no setting to serve a second interface. If your lan_interface is a VLAN on a bridge, read the bridge netfilter note in the release notes before upgrading. A /128 pool now stops the gateway at start, so widen it first.

Your links are harder to knock over

Someone who could see or inject traffic between you and your peers had a number of ways to disrupt you without ever breaking the cryptography: replaying an old rekey message to stop your key rotation, sending one forged packet to end a dial, tearing down a link with frames that don't decrypt, or steering and starving discovery with forged lookups, PathBroken signals, floods of Nostr adverts or spoofed LAN adverts. Nearby BLE or Ethernet neighbours could also keep you from dialling a peer. All of those are closed. No key material was ever exposed, and handshake keys are now wiped from memory once they're no longer needed.

Your DNS responder also no longer answers forged or non-query traffic, so it can't be abused as an amplifier, and the TLS library behind the Nostr relay connections picks up fixes for four advisories.

How you're affected: nothing to do but upgrade. One thing to know: against a peer still on v0.5.2 or older, recovering from a genuine key mismatch now takes the link-dead timeout (30 seconds by default) instead of twenty failed frames.

Your links stay healthy through rekeys

When a rekey reply got lost, a link could go up to two minutes without rekeying. Now it completes on the next resend. Link quality no longer freezes after a rekey, so your node keeps choosing good paths and parents, and a session that loses its route looks the destination up again instead of going dark.

Embed FIPS straight from crates.io

You can now add FIPS to a Rust project from crates.io. The package is called fips-mesh, since the name fips was taken, but the library is still fips, so your code doesn't change:
[dependencies]
fips = { package = "fips-mesh", version = "0.5.3" }
If you build from a checkout and name the package in cargo commands, -p fips is now -p fips-mesh. cargo install fips-mesh gives you the binaries, but to run a node, use the packages: they bring the service units, config and DNS setup.

Platform-specific fixes

Linux: if fips or the gateway keeps failing to start, systemd now backs off instead of retrying every 5 seconds forever. A tarball upgrade brings fips-dns and fips-gateway back up, and removing the .deb no longer leaves .fips lookups hanging.

OpenWrt: a router that hits a run of failures at boot keeps retrying, instead of staying off the mesh until you restart it by hand.

macOS: forwarding no longer stops when one of the daemon's sending threads exits.

Windows: the installer stops rather than quietly bringing your node up under a new identity. If it stops, move your key as the upgrade notes describe.

FreeBSD: .fips names now resolve with pkg dnsmasq. After pkg install, run service fips restart.

Android: 32-bit builds (armeabi-v7a and x86) work again.

Everywhere: a config file that configures nothing now stops fips at start, instead of quietly starting a node with no transports. And if you run without --config, every node.* setting in the config files on the search path now applies, so check them for values you didn't mean to set.

Community

Unsure what FIPS can actually do? pw21 (npub1jss…fmzy) had FIPS on Intelligence Snacks episode 72, "The Internet We Deserve w. FIPS". It covers FIPS, Nostr, local-first agents and the end of API-key hell, plus a spicy detour into whether AI doom is safety... or cartel theatre. A great listen to get familiar with what FIPS makes possible.

Building on FIPS

Wingman over FIPS. Pete Winn's OtherStuffAI stack runs over FIPS: a Nostr-based web browser with a built-in signer for Mac, Linux, iPhone and Android; the Wingman Flight Deck, a Human+Agents multiplayer workspace, talking to its backend and self-hosted agent boxes over FIPS; FIPS Drive, for pulling files from a shared folder on another machine, with access whitelisted by npub; and a GitWorkshop fork serving a FIPS-only repo. No tunnels, no DNS, just Nostr IDs.

OceanSlim (OceanSlim (npub1zmc…7f60)) ran a Minecraft server over FIPS the day v0.5.0 came out, with FIPS doing the NAT traversal over relays, and followed it up with SFTP over FIPS.

Logen (npub1vxlhjzeqjjhmqdy4e8sndt8kzklqlnxzew2mtt8mtakvalsckp3qa0gnvx (npub1vxl…gnvx)) is building FIPS into Nostr Vault, so a relay hosted on an Android, macOS or iOS device is reachable directly at its npub, with no lookup and no middleman. He also published sovereign-dns for DNS over FIPS, and made a Curious Pair episode about FIPS.

FIPS to Reticulum bridge. fr34aky built a bridge between FIPS and Reticulum, connecting the FIPS mesh to the Reticulum network.

fips-initramfs. Johnathan released fips-initramfs, which unlocks a LUKS-encrypted server over the FIPS mesh from anywhere. No static IP, no port forwarding, no inbound reachability at all.

Elsewhere

SEC-08 report. The SEC-08 "YOLO++" report from Sovereign Engineering is out. Over six weeks in Madeira, participants explored mesh networking, payments and a multiplayer game in a single HTML file, ran FIPS over sound, and rebuilt Totem, a hardware mesh platform, on FIPS and napplets.

Thank you, testers

A big thank you to everyone in the community who has been running FIPS, testing it in the wild and raising issues. Real-world usage keeps surfacing things no lab test would, and a lot of the fixes in this release started with one of your reports.

Thank you franzap (npub1wf4…dgh9) for testing and reporting a batch of rough edges, several of which are fixed in this release: refusing a config file that configures nothing (#186), respawning the OpenWrt services without a retry limit (#188), a how-to for diagnosing reachability between nodes (#189) and backing off between systemd restarts (#190).

Getting v0.5.3

Everything is on the v0.5.3 release page:

Linux x86_64 / aarch64 — .deb and tarball

Arch Linux — fips from the AUR

macOS — .pkg

Windows — ZIP

FreeBSD (x86_64) — .pkg

OpenWrt — .ipk for 24.x and earlier, .apk for 25+

Rust crate — fips-mesh on crates.io, new this release

From source — cargo build --release from a checkout of the v0.5.3 tag

Nix / NixOS — nix build .#fips from a checkout of the v0.5.3 tag

v0.5.3 is wire-compatible with v0.5.x, so nodes can be upgraded in any order. Before upgrading, read the "Before you upgrade" and "Upgrade notes" sections of the release notes, especially on OpenWrt, the gateway and Windows.

Full release notes are on the release page, and the complete per-commit changelog is in CHANGELOG.md.

Where to Find Us

Website — fips.network, with learn.fips.network, join.fips.network, map.fips.network and awesome.fips.network alongside it

Nostr — follow the FIPS project account for updates and discussion

GitHub — github.com/jmcorgan/fips

gitworkshop — gitworkshop.dev/npub1y0gja7r4re0wyelmvdqa03qmjs62rwvcd8szzt4nf4t2hd43969qj000ly/relay.ngit.dev/fips

Thank you to everyone who has contributed, tested and built on FIPS. This pace of development wouldn't be possible without your support!

Don't forget pounds, horsepower, and acres!

2026-10-04T06:14:47Z

In reply to nevent1q…eywl
_________________________

Don't forget pounds, horsepower, and acres!

If you'd want to contribute a packaging for Slackware, feel ...

2026-10-03T02:46:23Z

In reply to nevent1q…y7ze
_________________________

If you'd want to contribute a packaging for Slackware, feel free to submit a pull request. FIPS has a lot of moving parts though, so there are a lot of subtle parts to the install that might take some iteration.

We've had some long standing problems with the test-us01 ...

2026-10-02T23:29:48Z

In reply to nevent1q…dppg
_________________________

We've had some long standing problems with the test-us01 bootstrap node, but thought we'd gotten past those. test-us03 is generally reliable. Arjen (nprofile…8d6t)

😎

2026-10-01T19:47:22Z

In reply to nevent1q…4m8y
_________________________

😎

GM ☕ I love the smell of freedom packets in the morning!

2026-09-30T14:21:32Z

GM ☕

I love the smell of freedom packets in the morning!

That's not a normal distribution; it is leptokurtic. It has a ...

2026-09-29T13:39:03Z

In reply to nevent1q…8d6d
_________________________

That's not a normal distribution; it is leptokurtic. It has a narrower central portion and fatter tails. "Standard" deviation is a poor measure of likelihood here, as rare events occur much more often than a normal distribution would predict.

There is a whole history of financial disasters in the last few decades from not understanding this.

Nostr event nevent1qqs999djgfhm8t32uv3uepx9x056jm4f0g4r4j3vph8vxnymqzdkpkqzyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7a5k756

2026-09-23T00:54:20Z

In reply to nevent1q…4khr
_________________________

This is a tough one. I've had clients with top-notch ...

2026-09-20T05:33:56Z

In reply to nevent1q…muf5
_________________________

This is a tough one. I've had clients with top-notch professional devs get on the AI coding assistant path and lose a lot of their cohesion and ability to collaborate.

I think we're all discovering how to do this in real time.

GM ☕ A full night's sleep is underrated. But why do I still ...

2026-09-18T13:55:41Z

GM ☕

A full night's sleep is underrated. But why do I still need coffee?

Native integration/network adapter?

2026-09-18T13:45:54Z

In reply to nevent1q…kds5
_________________________

Native integration/network adapter?

GM ☕ The other day I had to send a FAX, play voicemail phone ...

2026-09-17T12:42:07Z

GM ☕

The other day I had to send a FAX, play voicemail phone tag, and deal with correspondence by postal mail.

Ah, to be young again 😏

I've used these in the past (DVD format) without a problem so ...

2026-09-15T23:47:32Z

In reply to nevent1q…qvkc
_________________________

I've used these in the past (DVD format) without a problem so far, but back then you really had to make sure to buy a DVD drive that supported M-Disc writing (for reading any DVD drive will work). Don't know how that's changed more recently. I guess they have Blue-ray format now which is much better in the regard.

One thing to keep in mind is their claims to longevity are based on extrapolating from design and testing in the short term; there's no real way to support their claims without actual experience. So YMMV and take that into account in your planning.

Nostr event nevent1qqsgehak7svpu9adgdrfzyuwt6ljuk83vzpy7kjl98v3muwlm2s72dszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7k5uka2

2026-09-15T20:06:37Z

👀

2026-09-15T14:38:05Z

In reply to nevent1q…5uwe
_________________________

👀

GM ☕ It is a thoroughly satisfying feeling seeing the FIPS mesh ...

2026-09-12T13:59:16Z

GM ☕

It is a thoroughly satisfying feeling seeing the FIPS mesh networking software enable so many different use cases, especially ones I would never have thought of in the first place.

But it's not without a bit of anxiety--real world usage means real world consequences of screwing up. I put a lot of effort into specification, review, adversarial testing, and documentation, but that of course isn't always enough. Your bug reports, feature requests, and code contributions are the kind of "closed loop" feedback needed to keep things on track.

Anyway, thanks to everyone for deploying FIPS and helping make it better.

Nostr event nevent1qqsxvxrvt7wg6trhxcny2eccckje9um0qexww5drsa4hj2g35svxexczyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7fysdkl

2026-09-11T21:51:25Z

https://github.com/jmcorgan/fips-initramfs/releases/tag/v0.1.1

Bug fix release. Thanks hzrd149 (nprofile…tfpf) for the report and testing.

Nostr event nevent1qqsp39877g0jt9cjkcgry3gvcuwzyv7hus7mxfe6nq00mjcra6qrkxszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7f8wxug

2026-09-11T02:29:36Z

I was supposedly retired from open source but something happened.

Sure it is!

2026-09-10T21:03:58Z

In reply to nevent1q…a52s
_________________________

Sure it is!

No, there are two totally independent layers of encryption ...

2026-09-10T21:02:42Z

In reply to nevent1q…c56v
_________________________

No, there are two totally independent layers of encryption involved.

The first is end-to-end. Each FIPS node when talking to any other FIPS node negotiates and end-to-end authenticated encryption session between them that only each other can read.

The second is hop by hop between peers. Each connected peer has a separate encryption session, and passes along the opaque blobs of data from the above unchanged. So no FIPS node can read any traffic passing through it.

Fallacies of distributed computing: The network is reliable. ...

2026-09-10T20:57:11Z

Fallacies of distributed computing:

The network is reliable.
Latency is zero.
Bandwidth is infinite.
The network is secure.
Topology doesn't change.
There is one administrator.
Transport cost is zero.
The network is homogeneous.

- L. Peter Deutsch, Sun Microsystems, 1994.

Nostr event nevent1qqsxr0me948xewet4zmcnfehj6x4kwfcpkjmwzlm2ej6vf8j3tuzpaszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7qflup0

2026-09-10T02:36:38Z

Learning Chinese geography, one distillery at a time.

Nostr event nevent1qqs2u6j9p0h92te3l25t5c0h56ucyspmkttaehdv2vzjfz2ju7ue83czyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7jy3yvd

2026-09-06T23:32:09Z

https://github.com/jmcorgan/fips-initramfs/releases/tag/v0.1.0

fips-initramfs 0.1.0 is out.

Unlock a LUKS-encrypted server over a FIPS mesh, from anywhere. No static IP, no port forwarding, no inbound reachability at all. The machine dials out to its peers during early boot and comes up at the same mesh address every time. You record that address once at install, then unlock with a single ssh command.

Console passphrase entry always still works, so a failure leaves you at the normal prompt instead of stranded.

Tested end to end on Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04: real encrypted machines, booted and unlocked over a live mesh.

MIT licensed, .deb for amd64:
https://github.com/jmcorgan/fips-initramfs/releases/latest

#fips #linux #luks

In short, running FIPS lets your system join a mesh of other FIPS ...

2026-09-04T15:17:12Z

In reply to nevent1q…m065
_________________________

In short, running FIPS lets your system join a mesh of other FIPS nodes, gives you a new IP address, and lets you communicate over the mesh with any other FIPS node. There is no domain, no routing configuration, no firewall or NAT configuration, etc. No permission needed.

Most commonly, people peer with the mesh over the Internet, which makes it an overlay, but FIPS also allows you to construct a local mesh between machines over ethernet, WiFi, or Bluetooth without any TCP/IP configuration at all.

https://github.com/jmcorgan/fips/blob/master/docs/getting-started.md

The experience of Sovereign Engineering is transformative. It ...

2026-09-03T20:56:34Z

The experience of Sovereign Engineering is transformative. It goes way beyond just "hacking on freedom tech". The combination of people, location, philosophy, and shared values is unlike anything I have been through before.

quoting
nevent1q…2293

Some participants come to Soveng carrying more than their laptops. They arrive with large backpacks and cases full of equipment to build. We saw this again at SEC-08, which just ended, with hardware projects such as Totem and Tollgate. Without a shared workshop or access to the right tools on the island, some builders could not do everything they had hoped to do.

A couple of participants decided to change that and began planning a small, shared fab lab for the community and were prepared to fund it themselves. Then Nodesignal_Podcast (nprofile…6t7h) generously offered to fund part of it, and other donors came forward too. What began with a couple of participants choosing to solve a problem has become a shared effort, with 3 million sats raised so far. 🫶

We are starting small. Those sats will buy a 3D printer, workbench, storage, tools, chips, devices and other materials the community can use. The lab will be set up at https://nostroffice.nobios.ai/ . A big shoutout to them for giving it a home. They have built something special and have been great friends to Soveng. We are grateful to be building this next piece together.

This is exactly the kind of initiative we love to see and want to encourage more of. Someone sees a need and takes the first step, then a community gathers around them and helps make it real. We want the workshop to grow in that same spirit.

If you'd like to help us put it together, you can contribute here:

`bc1qwatxa4ftrxnnfmx8epr8zqj05gkxsxtrmzq9x4`

If you have something you want to build, come build with us.

FIPS v0.5.0 released #naddr1qv…vfdn

2026-09-03T14:10:10Z

FIPS v0.5.0 released

quoting
naddr1qv…vfdn

We've got exciting news for you, another FIPS release! New features, new platforms and many, many bugfixes! We've landed the first version of the native API that lets you interact with other nodes over FIPS directly, without going through IP first. Android and FreeBSD are now supported and much more.

Notable Contributions

Johnathan Corgan - @jmcorgan.

Johnathan has restructured the FIPS codebase to follow the Sans-IO pattern, which completely separates business logic (the protocol logic) from IO operations. This makes the protocol logic all synchronous, which is a very important requirement to make it portable to embedded systems like ESP32.

This release includes the native API, which allows FIPS-aware applications to utilise all features that FIPS brings to the table, like dynamic MTU and the socket file descriptor, which means you can hand a connection to an isolated application. Read more on that below.

We have received multiple security-reviews in the past couple months, which have resulted in a large number of security-patches that are included in both v0.4.2 and v0.5.0 releases. No critical issues were uncovered.

The new fipsctl probe utility allows you to debug discovery and sessions. More below.

Arjen - @Origami74.

Arjen worked on allowing a FIPS mesh to form between mesh-capable OpenWrt routers using the 802.11s mesh protocol (#123).

The OpenWrt now also includes a !FIPS SSID to bridge mobile (Android) meshes to the larger mesh (#126).

Arjen added support for Android build targets along with various changes to enable BLE and Wi-Fi Aware transports on Android (#127, #136).

Fr34aky - @fr34aky.

fr34aky contributed support for FreeBSD build targets, including the TUN datapath, DNS integration and packaging (#129).

The second contribution is a bugfix for BLE interoperability between Linux and Android. Most operating systems assign a BLE (PSM) address, but the Linux implementation assumed a self-assigned static identifier (#139).

Martti Malmi - @mmalmi.

Martti made macOS nodes a lot faster at moving packets by drastically reducing the number of memory allocation operations (#134, #135).

Jeff Gardner - @erskingardner.

Jeff contributed a fix for an issue where FIPS would chown the parent directory of the control socket in /tmp, which created issues for other processes (#138). First contribution to FIPS.

Redshift - @redshift.

Redshift contributed bugfixes for macOS where FIPS would rely on Linux directories to exist. He moved the config and socket directories to the correct macOS paths (#132).

What's in v0.5.0

OS support

We're excited to let you know there are new operating systems that can now join the mesh!

Android FIPS now compiles for Android, see more below!

FreeBSD FIPS now runs on FreeBSD targets, which is a big deal specifically for OPNsense and pfSense routers! The install layout and packaging is very similar to macOS. Currently it is supported on the x86_64 architecture.

NixOS There was already support for NixOS, but it still required quite a bit of manual setup. This release includes a NixOS module that configures the systemd service, config paths and DNS server.

Android and BLE interop

OS support Android is now a supported build target, and a lot of work has gone into interoperability. Android is a Linux system but has many restrictions not present in desktop environments. For example: an app embedding FIPS needs to own the TUN adapter, which shows up as a claim on the only Android VPN slot.

We will not ship a FIPS app for Android ourselves in this repo. However, these changes mean that it can be embedded by app developers now. Two Android apps that have included FIPS and informed the design are fips2go and Myco.

Bluetooth LE We gave the Bluetooth implementation a big overhaul in order to make it work on Android. Again, a few assumptions were broken and we needed to address those. After some more bugfixes, Android phones can now peer with a Linux desktop over BLE.

This means that you can browse the web on a phone in airplane mode with ONLY Bluetooth turned on!

Wi-Fi Aware Though it's not an embedded feature in FIPS, it's worth mentioning that most Android phones can peer directly with each other using 'Wi-Fi Aware'.

Wi-Fi Aware creates an IP tunnel between the phones, which we then use to create a FIPS-over-UDP peering. It achieves regular wifi speeds of 100+ Mbps, way faster than BLE.

Bridging mobile mesh to greater mesh Working on mobile support is what led to defining a common !FIPS wifi SSID on OpenWrt targets (see below) that can be used to roam around the mesh and bridge mobile devices to the larger mesh. After connecting, it uses mDNS / DNS-SD in order to connect to the node on the router.

Native datagram API

We have a first experimental release of the native FIPS API, an API that lets you benefit from all the FIPS features we cannot expose over the traditional TUN adapter, which we use to interoperate with existing IP-based applications.

This means you can now send traffic from A to B without a single IP being involved, anywhere.

In order to do this you'll need to call the API from within your application. The API has been modeled after Unix sockets and operates very similarly. Opening a connection gets you a file descriptor, which you can then even hand to a Docker-isolated application.

Delivery is best-effort, so what you're getting is a UDP-like transmission but with end-to-end encryption, addressed by npub.

If you plan to test this out, check our walkthrough and then how to write a client. You can find more technical details in the reference, and using the API covers turning it on.

fipsctl probe

fipsctl now ships with a probe npub1...xyz command that helps you debug FIPS sessions. It establishes a connection and shows you every step that happens during this process.

When you probe, you get a report on the bloom filters, discovery, session, path and round trip time (ping).

Example output:
fipsctl probe npub1gd7ye2qp2lphhzx75fynnjzaxx4dqanddecet0wtt5ss5ek8h9ps62wdkf (npub1gd7…wdkf)
probe test-us04
  npub       npub1gd7ye2qp2lphhzx75fynnjzaxx4dqanddecet0wtt5ss5ek8h9ps62wdkf (npub1gd7…wdkf)
  node_addr  5d43caa769f6e522bbab83b8021c7887
  ipv6       fd5d:43ca:a769:f6e5:22bb:ab83:b802:1c78

  bloom       ok        0.4s  claimed by a peer filter
  discovery   ok        0.0s  coordinates from mesh lookup
                              attempt 1    replied   (1s)

  session     ok        1.0s  established (XK handshake)
  rtt         ok        2.0s  238 ms round trip

path:
  ours       depth 3    00001a8c > 4f9b4a84 > bace6d8e > ad9d5cb1 [self]
  theirs     depth 1    00001a8c > 5d43caa7 [target]

  route      ad9d5cb1 [self] > bace6d8e > 4f9b4a84 > 00001a8c > 5d43caa7 [target]

  walk       3 up, 1 down   tree distance 4 (upper bound; crosslinks may shorten it)
  next hop   bace6d8e (test-es01)   class tree up
  path mtu   1280 bytes (observed)

  cleanup    session was opened by this probe and has been torn down
  overall    ok, 4423 ms   (stage timings quantized to the 1000 ms tick)
OpenWrt update

The OpenWrt package now ships with a couple of scripts that help you turn your router into a freely meshing device and access point for other devices that want to bridge onto the greater FIPS mesh.

802.11s mesh backhaul 802.11s is a wifi mesh protocol that we can use to create a true wireless FIPS mesh, where nodes associate with any node that is within range, dynamically. There are no Access Points (AP/SSID) to explicitly connect to; it just starts talking ethernet with whoever is close enough.

FIPS just leverages this wifi protocol that is available on most modern routers and handles the routing and encryption. Read how to set it up.

The open access !FIPS SSID The second script helps you set up a !FIPS open SSID that does nothing other than allow a connected device to reach your FIPS node. No traditional IP access. This also allows a phone to use this network only for FIPS while continuing to use 4G/5G for regular traffic.

The reason for this is to help Android phones bridge Bluetooth peers to the wider mesh. Android doesn't support the 802.11s mesh described above and also can't do raw ethernet when connected over wifi. BUT, with a !FIPS SSID + mDNS discovery, the phone can peer with the router, bridging the gap between supported network technologies.

Security comes from FIPS encryption rather than from any wifi encryption standard. Read how to set it up.

To sketch a scenario, chaining radios that can't talk to each other directly:

A BLE-only Android device pairs with a second phone over Bluetooth

That second phone has Wi-Fi Aware, and pairs with a third phone over it

The third phone is connected to a router's !FIPS SSID

The BLE-only device can now reach anyone in the larger FIPS mesh

Performance improvements

Since v0.4.0 there've been various performance improvements, mainly on the macOS front, courtesy of Martti Malmi (#135). There are also some gains on the probing of bloom filters, where we now hash the pubkey once instead of 5 times per membership check. Lastly, all identity operations now share a single secp256k1 context, removing all setup-and-teardown operations on every signing operation.

Bug Fixes

As mentioned before, we've received several security reviews for FIPS, which we're grateful for, and we have addressed the findings immediately. None of the issues broke cryptography or exposed any key material, but many of them needed to be closed: ways to take down node sessions, traffic misattribution, MTU manipulation, etc.

Additionally, many state-machine issues, silent failures that should have been loud, and packaging issues have all been addressed.

Community

We just wrapped up the Sovereign Engineering Cohort (SEC-08) and have seen many interesting developments in what people are building with FIPS: experimentation with the native API like multiplayer pong without IPs, OpenWrt meshes, and Android embeddings.

Getting v0.5.0

Everything is on the v0.5.0 release page:

Linux x86_64 / aarch64 — .deb and tarball

Arch Linux — fips from the AUR

macOS — .pkg

Windows — ZIP

FreeBSD (x86_64) — .pkg, new this release

OpenWrt — .ipk for 24.x and earlier, .apk for 25+. Both carry the fips-mesh-setup and fips-ap-setup helpers

From source — cargo build --release from a checkout of the v0.5.0 tag

Nix / NixOS — nix build .#fips from a checkout of the v0.5.0 tag

There is no Android daemon artifact; Android is supported as an embedded crate, as described above.

v0.5.0 is wire-compatible with v0.4.x, so nodes can be upgraded in any order. If you are coming from v0.4.1 or earlier, read the v0.4.2 notes too — most of this cycle's security work is in it.

Full release notes are on the release page, and the complete per-commit changelog is in CHANGELOG.md.

Where to Find Us

Website — fips.network, with learn.fips.network, join.fips.network, map.fips.network and awesome.fips.network alongside it

Nostr — follow the FIPS project account for updates and discussion

GitHub — github.com/jmcorgan/fips

gitworkshop — gitworkshop.dev/npub1y0gja7r4re0wyelmvdqa03qmjs62rwvcd8szzt4nf4t2hd43969qj000ly/relay.ngit.dev/fips

Thank you to everyone who has contributed, tested and built on FIPS. This pace of development wouldn't be possible without your support!

test npub

2026-09-02T20:01:42Z

In reply to nevent1q…4uw3
_________________________

test npub

Nostr event nevent1qqsdsxr0rkhd0905lk7hhjv59knukjpwk62dts73wjcmlgfwhkepcjszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7p7fls8

2026-09-02T19:46:20Z

running whitenoise

GM ☕ "Now, here, you see, it takes all the running you can ...

2026-08-25T06:23:28Z

GM ☕

"Now, here, you see, it takes all the running you can do, to keep in the same place. If you want to get somewhere else, you must run at least twice as fast as that!"

- Unknown maintainer, after his fifth unsolicited LLM security review

(Builders welcome) #nevent1q…6xvz

2026-08-21T16:08:10Z

(Builders welcome)

quoting
nevent1q…6xvz
Its week 5 Demo Day of SEC-08 and the mood

GM ☕️ ...

2026-08-17T12:21:07Z

GM ☕️

GM ☕ ...

2026-08-15T12:18:21Z

GM ☕

GM 🍺 ...

2026-08-12T04:33:35Z

GM 🍺

GM ☕️ ...

2026-08-09T08:55:27Z

GM ☕️

Nostr event nevent1qqsr6mj0r4xynq98wm2zjnnx3tyqxh7yqj5565s4qz98xplkkd5yndszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7jd7cgt

2026-08-08T07:47:53Z

GM ☕️🇪🇸🛫➡️🛬🇵🇹😎

GM ☕ In spite of the somber mood surrounding recent events, ...

2026-08-03T15:31:35Z

GM ☕

In spite of the somber mood surrounding recent events, I'm pretty excited to be traveling this week to join the second half of Sovereign Engineering (nprofile…lvze) eighth cohort. I have found my tribe again 😀

The BitMEX rekt feed was legendary!

2026-07-24T03:47:15Z

In reply to nevent1q…ssmn
_________________________

The BitMEX rekt feed was legendary!

Much of this comes from shedding the convenient fictions we were ...

2026-07-15T14:11:40Z

In reply to nevent1q…cu9f
_________________________

Much of this comes from shedding the convenient fictions we were taught in childhood.

I kind of feel sorry for anyone who in their natural speech end ...

2026-07-14T20:45:09Z

I kind of feel sorry for anyone who in their natural speech end up using one of the many Claude LLM verbal tics (load-bearing, belt-and-suspenders, worth sitting with, etc.)

It's quite amusing to have Claude pass judgement on code it ...

2026-07-13T01:19:52Z

It's quite amusing to have Claude pass judgement on code it wrote itself. I've taken to a workflow where after every step of a development plan, it immediately switches roles to a crusty old graybeard (ahem) and critiques the code and sends it back for improvement.

Yes. Claude usually interprets "adversarial review" as ...

2026-07-09T17:32:56Z

In reply to nevent1q…8fdm
_________________________

Yes. Claude usually interprets "adversarial review" as starting with a fresh context for the review agent instead of just doing it in the foreground or forking a new agent with the current context.

GM ☕ The recent news on EU chat control is unsurprising. This ...

2026-07-09T17:30:08Z

GM ☕

The recent news on EU chat control is unsurprising.

This is why we Nostr.
This is why we Bitcoin.
This is why we FIPS.

Don't fight the politicians; make them irrelevant.

"Do an adversarial review of this plan/code/idea" is a ...

2026-07-09T14:06:41Z

In reply to nevent1q…uas0
_________________________

"Do an adversarial review of this plan/code/idea" is a super power.

Before I turned my attention to FIPS, I had written this up as a ...

2026-07-06T21:23:56Z

In reply to nevent1q…r4ny
_________________________

Before I turned my attention to FIPS, I had written this up as a design draft for a full POSIX filesystem w/RAID on top of Nostr/Blossom, but it was deemed too complicated:

https://github.com/andotherstuff/garland-protocol/blob/main/garland-v0.1.md

When I was young all we could do was move our bitcoin on chain! ...

2026-06-27T19:36:25Z

In reply to nevent1q…k6cg
_________________________

When I was young all we could do was move our bitcoin on chain! Uphill, both ways! 👴 😆

FIPS 0.4.0 is out. Thanks everyone for contributions, testing, ...

2026-06-27T18:58:33Z

FIPS 0.4.0 is out. Thanks everyone for contributions, testing, and especially stress testing the public mesh!

quoting
naddr1qv…5kwe

FIPS Project Update and v0.4.0 Release

It has been about six weeks since v0.3.0, and the response has been great. We estimate the public test mesh averages 1500-1600 nodes online at a time, with the optional bootstrap nodes peering with hundreds of inbound connections each.

This growth is welcome on its own, but as planned its real value has been as a live test of the network design and implementation under real-world conditions that are far more demanding than any lab or CI test, including adversarial attacks and probing from the usual suspects. Running at this scale has surfaced latent bugs, race conditions, and capacity limits that have driven the bulk of the v0.4.0 release content.

In parallel, normal development work from existing and new contributors has continued, and this release has a few new capabilities that make it more than just a patch release.

Notable Contributions

Sirius (npub1g53…drvk) has continued to deliver performance improvements to the FIPS data plane, with a roughly 2x throughput increase between directly connected peers. The nostr-vpn project has switched to using FIPS as its underlying mesh transport.

He also contributed a new opt-in mDNS LAN discovery mechanism, which lets IP overlay-based nodes on the same local network find and peer with each other without having to go through the full Nostr-based overlay discovery process.

oleksky (npub16q4…xcms) added an outbound Nym mixnet transport, so a FIPS node can peer through the Nym network for metadata-resistant connectivity. Mesh traffic mixes into Nym cover traffic, and it ships with a single-container demo.

sandwich (npub1uac…99rx) implemented a Nix flake for reproducible from-source builds on Nix and NixOS, plus AUR packaging fixes.

Arjen (npub1hw6…65gr) continues to develop and maintain the native macOS FIPS port, fixing some connectivity bugs that were revealed in 0.3.0 deployments.

He also implemented OpenWrt 25+ support, with a native .apk package alongside the existing .ipk one for 24.x.

Community

Beyond the code in this release, the wider FIPS community has been busy over the same six weeks.

Learning and onboarding. The fips.network website got a substantial redesign, and a new interactive Learn FIPS guide walks through self-organization and coordinate routing, hop-by-hop and end-to-end encryption, and the full connection lifecycle with layer-by-layer simulations. Join FIPS does browser-side peer discovery, the FIPS Map shows live node geography, and Awesome FIPS catalogues projects built on and around the mesh.

Podcasts. FIPS featured across several shows: the No Solutions podcast discussed it in its White Noise, MLS and Marmot and Nostr VPN episodes; Open Markets covered FIPS as a decentralization play in "What The Fips"; and Citadel Dispatch's CD193 — "FIPS — Fixing The Internet" is still being reshared.

Projects building on FIPS. Martti Malmi's NostrVPN — a Tailscale-style private mesh on a FIPS-backed data plane — shipped v4.0.80. Community members are also experimenting with decentralized email addressed by npub and prototyping Nostr-native voice spaces — all reachable directly over .fips addresses.

Sentiment. In-person FIPS conversations happened at BTC Prague, and there's a healthy push from the community for high code-quality standards in projects meant to last. We share that goal, and a lot of this release reflects it. A few notes from the community over the past six weeks:

Nostr + FIPS is like the telephone game, but with perfect information the whole way.

FIPS supports the Pillars of Propagation; the way information flows throughout the internet will change forever.

NOSTR / FIPS / Bitcoin / Lightning / Cashu / Personal AI — once we have the models and the hardware, there will be no stopping this freedom train.

A new alternative internet infrastructure is being built with FIPS, but how can we get access to internet when ISPs start to do KYC or the state demands a digital ID? You can partly get around with TollGate, but getting an internet connection trustlessly, bought with bitcoin — that would be a game changer.

Upgrade

v0.4.0 is wire-compatible with v0.3.0. Linux, macOS, Windows, OpenWrt, and Arch (AUR) packages are on the release page, the Nix flake builds from source, and the public bootstrap nodes are ready for you to join.

Full release notes: release notes.

Nostr event nevent1qqsgpwnj06qj7hwnftrhallsgz733pc3sm0c5wc6gm8jkchfh5k4ergzyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7qvkttd

2026-06-27T18:16:59Z

Dark mode is what separates us from the animals.

Nostr event nevent1qqsr4ytp2vp92d6jpjj78qaa9rxyszyt2qk9vhal4u3s5s9qpu772agzyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7vgrt6w

2026-06-24T04:13:14Z

Violence is the last refuge of the incompetent. - Isaac Asimov

Source code is the new machine code. Interesting to look at ...

2026-06-21T00:26:00Z

Source code is the new machine code.

Interesting to look at sometimes, out of curiosity, but something the c̶o̶m̶p̶i̶l̶e̶r̶ agent usually handles.

GM ☕ One door closes, another opens.

2026-06-19T14:30:41Z

GM ☕

One door closes, another opens.

Everything changes. One season flows into the next, a year ...

2026-06-19T02:13:15Z

Everything changes. One season flows into the next, a year becomes another, the face in the mirror grows older and perhaps wiser, though we wonder who that stranger is.

And yet we persist. The same thread that ties back to memories of a world that no longer exists binds us to a future that is still ours to shape.

Carry on.

Nostr event nevent1qqsv22jrht39q3y9h0ae60h96p6wla9wc64ancl25snfvp5jrm53egszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7r8527y

2026-06-11T00:57:20Z

🎶 We've Only Just Begun 🎶

#FipsUserNotAffected #nevent1q…4jsd

2026-06-10T19:04:24Z

#FipsUserNotAffected

quoting
nevent1q…4jsd
"The Net interprets censorship as damage and routes around it."

— John Gilmore (Time Magazine, 1993)

#censorship #internet #freedom

Yup. Never tell people what to do, just show them what you did, ...

2026-06-07T13:31:12Z

In reply to nevent1q…xvjk
_________________________

Yup. Never tell people what to do, just show them what you did, and let them decide for themselves.

One thing I appreciate about ranchers and farmers is that ...

2026-06-06T22:12:33Z

In reply to nevent1q…uwwq
_________________________

One thing I appreciate about ranchers and farmers is that it's a completely unforgiving way of life. You either do the work and do it right, or you die or go hungry. You can't get away with bullshit.

GM ☕ It's time to FIPS and send datagrams from npub to ...

2026-06-04T13:26:19Z

GM ☕

It's time to FIPS and send datagrams from npub to npub.

Nostr event nevent1qqsrjudtltk4v4gapljqq5tthtfkg6d30qtldupp5fc0n0vcp8ftx4qzyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7kkdrw0

2026-06-04T04:12:17Z

An idle GPU is a crime.

I treat my AI coding agents like I want to be treated by them ...

2026-06-03T02:09:12Z

In reply to nevent1q…6xt3
_________________________

I treat my AI coding agents like I want to be treated by them after the singularity.

Thank you for the opportunity to speak. #nevent1q…fq3q

2026-05-22T22:50:35Z

Thank you for the opportunity to speak.

quoting
nevent1q…fq3q
Today is a right time to talk about Freedom Tech on the way to Its Pizza Day. Bitcoin meetup in Kyiv with @ Vikky🇺🇦rabbit (npub1lx2…vxlz) , HRF (npub17xv…c9as) and Peter Todd (npub1ej4…ndrm) is the right place for this.

I started talking about Sovereign Engineering (npub1s0v…rmq5) , a place where new projects and technologies are born and jcorgan (npub19wa…8p6k) continued the story with fips (npub1y0g…00ly) - the right example on how freedom tech should look like.

A lot of projects right now are on their way 🚀 to their Pizza Day 🎉

That's a long tail on those y2k supplies.

2026-05-18T21:43:40Z

In reply to nevent1q…9whg
_________________________

That's a long tail on those y2k supplies.

I'm very tempted to go this route.

2026-05-18T21:38:36Z

In reply to nevent1q…tfck
_________________________

I'm very tempted to go this route.

🤣 🤣 🤣

2026-05-18T20:06:06Z

In reply to nevent1q…qdpj
_________________________

🤣 🤣 🤣

GM ☕ ...

2026-05-18T17:33:10Z

GM ☕

GM ☕ What would you do, if you could just do things?

2026-05-13T13:13:15Z

GM ☕

What would you do, if you could just do things?

It's the low-latency, low-bandwidth, beautiful scenery ...

2026-05-13T00:10:35Z

In reply to nevent1q…0p3l
_________________________

It's the low-latency, low-bandwidth, beautiful scenery transport option.

Post FIPS release therapy. ...

2026-05-12T23:32:02Z

Post FIPS release therapy.

This was an intense couple of months, thanks everyone involved! ...

2026-05-11T21:38:55Z

This was an intense couple of months, thanks everyone involved!

quoting
naddr1qv…jl8r

In the months since v0.2.0, a community has crystallized around FIPS. Operators have stood up nodes across regions and run them on the public test mesh; contributors have reviewed patches and reported bugs against real traffic; and developers have landed substantial new features. v0.3.0 is the product of that work.

What follows walks through the release, then closes with a roundup of the community resources that have grown up alongside it.

v0.2.0 was FIPS's debut to a wider audience and stood up the public test mesh. v0.3.0 builds on that footing: it widens FIPS's platform reach to first-class binaries on macOS, Windows, OpenWrt, and Linux; opens the mesh to peers behind NAT through a Nostr-mediated discovery channel; ships a bridge for unmodified LAN hosts; hardens the mesh interface with an opt-in default-deny baseline and peer access control; substantially speeds up session-layer crypto and the Linux receive path; and lands a freshly reorganized documentation tree.

v0.2.1 also ships today, a bug-fix-only stable release that operators on the v0.2.x line can upgrade in place.

v0.3.0 is wire-compatible with the v0.2.x line and carries forward every bug fix from v0.2.1. Mixed meshes interoperate. Operators can roll out at their own pace.

What's in this release

Each item below is a summary; the release notes carry the full per-feature detail.

Cross-platform reach. First-class binaries for macOS (.pkg, native utun, launchd), Windows (ZIP, wintun, Windows Service), and OpenWrt (.ipk, procd, dnsmasq forwarding, proxy NDP, RA-advertised routes), alongside Linux .deb and tarball. MIPS atomic-ABI portability unblocks consumer-grade routers.

Find each other through Nostr. Each node can optionally publish a signed advertisement to Nostr listing its reachable transport endpoints, and can scan public Nostr relays for advertisements from other nodes. This gives operators who are interested an automatic discovery path for nodes reachable over the Internet, without displacing the existing static-peer configuration. For nodes that are behind NAT gateways, the daemon coordinates a STUN-assisted UDP hole punch using NIP-59 gift-wrap signaling.

The new fips-gateway capability allows node operators to extend the reach of the FIPS mesh to unmodified LAN hosts. LAN hosts can reach .fips destinations on the mesh, and mesh peers can reach configured services on the gateway's LAN, without FIPS running on the LAN host itself. The canonical deployment sits on a host that already serves DHCP and DNS to its LAN segment, such as a Linux router or an OpenWrt AP.

Mesh-interface security baseline. Peer identity is authenticated end-to-end by the FMP and FSP Noise handshakes, but identity is not authorization. v0.3.0 ships an opt-in default-deny nftables baseline as a packaged conffile, with per-service drop-ins, allowing the operator granular control over port access to mesh peers on Linux. Separately, peers.allow / peers.deny files restrict which peers a node will form direct links with.

Faster session crypto. The ChaCha20-Poly1305 backend used by every FIPS Noise session now dispatches through ring 0.17 to BoringSSL's hand-tuned NEON / AVX2 / AVX-512 implementation. Wire format is byte-identical, so rollout order does not matter.

On an aarch64 docker target, two-node TCP single-stream throughput went from 437 to 1097 Mbps, two-node UDP at 1 Gbit went from 40% loss to lossless at line rate, and three-node ping under bulk load dropped from 7.68 ms avg / 215 ms max to 0.72 ms / 3.6 ms max as the relay path stopped being crypto-bound.

Documentation, end to end. The docs/ tree has been reorganized into four sections: tutorials, how-to, reference, and design. New users start at docs/getting-started.md; the Join the test mesh tutorial connects a local daemon to the public test mesh in a few minutes. Operators with a specific task land in docs/how-to/; reference lookups in docs/reference/; architectural background in docs/design/.

Experimental Bluetooth Low Energy transport ships for Linux, with maturity gated on field reports rather than the CI matrix. macOS BLE support is in development as a separate track.

Operator polish. Several improvements target day-to-day operation. fipstop adds historical statistics with btop-style sparklines, and fipsctl exposes a wider set of diagnostic queries for inspecting node state. See the release notes for further operator-facing changes.

A growing community

This release also marks the public debut of fips.network, the project's first official website. Three companion pages launch with it:

awesome.fips.network, a curated index of FIPS-related projects, tools, and writing.

join.fips.network, a fast on-ramp for trying the public test mesh.

learn.fips.network, a plain-language primer on what FIPS is and why it exists, written by @gigi.

Three podcast conversations about FIPS appeared during the v0.2.x cycle:

Citadel Dispatch CD193: FIPS - Fixing the Internet, Matt Odell hosting Arjen, March 2026.

No Solutions #24: Building FIPS, Gigi with Johnathan Corgan, April 2026.

Open Markets Podcast #5: What The Fips, Eric, Sync, and Arjen on community-resilient networking, May 2026.

A special call-out goes to Sovereign Engineering for the extensive testing, demo development, workshops, and feature work contributed to the FIPS project during their recent SEC-06 and SEC-07 events.

Get v0.3.0

Releases page: github.com/jmcorgan/fips/releases/tag/v0.3.0

Linux x86_64 / aarch64: .deb and tarball.

Arch Linux: fips (release) and fips-git (dev) from the AUR.

macOS: .pkg.

Windows: ZIP.

OpenWrt: .ipk.

From source: github.com/jmcorgan/fips.

Full release notes (with the per-feature detail this announcement summarizes, behavior changes worth flagging, the upgrade checklist, and the operator-relevant bug-fix list) are at the v0.3.0 release page. The canonical changelog is in CHANGELOG.md. Issues and discussion at github.com/jmcorgan/fips.

Thanks to everyone who tested, reported, reviewed, and contributed.

PTSD

2026-04-26T19:59:08Z

In reply to nevent1q…3ztp
_________________________

PTSD

GM ☕ Claude code has been great to clear a huge backlog of ...

2026-04-26T15:38:07Z

GM ☕ Claude code has been great to clear a huge backlog of technical debt in local devops and IT stuff. It has also been great at creating a whole new backlog of local devops and IT technical debt 😏

GM ☕ ...

2026-04-24T14:32:39Z

GM ☕

Consider it evolution in action.

2026-04-22T02:34:39Z

In reply to nevent1q…yvwg
_________________________

Consider it evolution in action.

It's an SVG file created by Claude Code given the specified ...

2026-04-20T19:06:07Z

In reply to nevent1q…00ua
_________________________

It's an SVG file created by Claude Code given the specified contents.

GM ☕️ Three weeks on an island hacking on FIPS. So happy to ...

2026-04-20T10:03:12Z

GM ☕️ Three weeks on an island hacking on FIPS. So happy to be home so I can go back to hacking on FIPS.

Nostr event nevent1qqs25nqqza87r29f5w9fz2kd9utzgen79ra8nh4gdnfjfjv4tupq49szyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7n73mhm

2026-04-19T04:05:21Z

GM ☕ 🇵🇹 🛫

They are two different mesh network implementations, each ...

2026-04-19T01:23:01Z

In reply to nevent1q…urx2
_________________________

They are two different mesh network implementations, each optimized for different goals and underlying hardware. In theory one could write a gateway bridging traffic between them.

Nostr event nevent1qqszp9ne0t609u73zx6r7nldgu2rxtlusuvt63pvahsp94pl0qkyktqzyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7yps689

2026-04-16T06:17:36Z

GM ☕

Indeed. I'm on the road and keep forgetting that no normal ...

2026-04-15T13:43:49Z

In reply to nevent1q…sjgm
_________________________

Indeed. I'm on the road and keep forgetting that no normal chair has any proper back support.

You can use Tor now, either to listen for incoming FIPS peering ...

2026-04-15T13:40:08Z

In reply to nevent1q…tqdw
_________________________

You can use Tor now, either to listen for incoming FIPS peering connections as a hidden service or to make outbound peering connections to clearnet FIPS nodes via socks5/tor. The port forwarding option is technically possible now but is a feature in development on the master branch for a more automated solution.

Yes, with the current release to expose an internet overlay ...

2026-04-15T11:02:35Z

In reply to nevent1q…m5pe
_________________________

Yes, with the current release to expose an internet overlay transport (TCP or UDP) you need to have a publicly accessible IP address. Work in progress is underway to automate UDP hole punching to allow mesh connections through NAT.

The FIPS public test mesh grew to 150 live nodes this week. GM ...

2026-04-15T07:59:10Z

The FIPS public test mesh grew to 150 live nodes this week.

GM ☕️ to all my mesh buddies. I know that whoever and wherever you are, you’re just an npub away.

I'll have to take a look at that at some point, thanks for ...

2026-04-12T17:03:05Z

In reply to nevent1q…8wk7
_________________________

I'll have to take a look at that at some point, thanks for the reference.

Engineering solutions to problems is mostly about assembling ...

2026-04-12T13:56:31Z

Engineering solutions to problems is mostly about assembling existing pieces into a new whole, more so than inventing a new wheel.

FIPS combines known, battle tested concepts going back decades in the fields of networking, cryptography, distributed computing, resilient communications, and operating systems, with full credit to those who came before.

GM ☕ Mesh happens.

2026-04-09T05:40:26Z

GM ☕

Mesh happens.

Right. FIPS is a general purpose datagram service between npubs, ...

2026-04-07T11:13:27Z

In reply to nevent1q…tvyp
_________________________

Right. FIPS is a general purpose datagram service between npubs, designed and optimized for the traffic scale typical of Internet applications. So adding LoRa or other low bandwidth / low MTU / high latency transports would be possible, but would need specific engineering for rate limiting and traffic management to avoid overwhelming the network.

In theory, yes. In practice, there would likely be some tradeoffs ...

2026-04-07T05:29:42Z

In reply to nevent1q…g8uv
_________________________

In theory, yes. In practice, there would likely be some tradeoffs involved regarding the need for fragmentation, protocol timer adjustments, etc.

GM ☕ Turns out you can just @nprofile…vhfa things.

2026-04-03T07:37:15Z

GM ☕ Turns out you can just fips (nprofile…vhfa) things.

Lol, and people say the US is ultra-capitalist.

2026-03-28T17:03:26Z

In reply to nevent1q…4ulv
_________________________

Lol, and people say the US is ultra-capitalist.

Nostr event nevent1qqsqjqmknczxjv0gcddfm96t3g3g6zm5sqn58k2p6zjun4zws2zatpszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7skud9j

2026-03-28T16:40:55Z

GM 🤎 ✈️

GM ☕ I've learned way too much about Bluetooth in the last ...

2026-03-27T12:57:45Z

GM ☕ I've learned way too much about Bluetooth in the last week, but FIPS nodes can now auto-discover each other and peer over BLE to create or join a FIPS mesh network. No IP needed 😏

Sometimes, all you can be is one of those small, newfangled, ...

2026-03-24T06:09:51Z

Sometimes, all you can be is one of those small, newfangled, warm-blooded mammals just staying out of the way of those giant dinosaurs fighting among themselves until the meteor arrives.

Yes, the squares are actually what get dynamically generated and ...

2026-03-17T19:32:46Z

In reply to nevent1q…m6qk
_________________________

Yes, the squares are actually what get dynamically generated and transmitted on updates. I'm not sure what the point is that you're trying to clear up.

We are perhaps describing two different things.

2026-03-17T19:06:43Z

In reply to nevent1q…a0vx
_________________________

We are perhaps describing two different things.

Well, to be clear, with k peers the node only stores one bloom ...

2026-03-17T19:06:14Z

In reply to nevent1q…a0vx
_________________________

Well, to be clear, with k peers the node only stores one bloom filter from each one. During the gossip protocol updates the ones sent up and down the spanning tree are calculated on-the-fly as needed, not stored. So they are 'possible' bloom filters but not stored bloom filters.

One bloom filter advertised by and received from each peer is ...

2026-03-17T17:19:12Z

In reply to nevent1q…7pwx
_________________________

One bloom filter advertised by and received from each peer is kept locally.

Whenever an update comes from a peer, if it is different from what is already stored, the node will update its local copy, then:

For each remaining peer that is either a spanning tree parent or child, calculate a new bloom filter consisting of the union (XOR) of all the other peers and send it.

This is called "split horizon" routing and essentially means that after convergence each node has a bloom filter for each of its peers containing all nodes reachable through that peer.

Later, at the routing stage, the node can examine all its peers' bloom filters to identify candidate next hops for routing.

Nah. Just tell them it's a game where they have to line up ...

2026-03-17T03:05:03Z

In reply to nevent1q…zt75
_________________________

Nah. Just tell them it's a game where they have to line up all three sticks.

GM ☕ It's good to be back working on open source after so ...

2026-03-16T12:55:44Z

GM ☕ It's good to be back working on open source after so many years away.

Nostr event nevent1qqszukz0uqeawj59v7nhx6d5637ds8su6mgljvq69plvxgnrlkj4zyszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7fmvt0x

2026-03-15T03:52:21Z

I miss George Carlin.

running fips #naddr1qv…r2fm

2026-03-12T17:03:52Z

running fips

quoting
naddr1qv…r2fm

We're happy to announce the first tagged release of FIPS, the Free Internetworking Peering System.

FIPS is a self-organizing mesh network that lets nodes discover each other and route traffic without any central authority. It works natively over local area networks, the internet as an overlay, and is designed for Bluetooth, serial links, and radio. Nodes use Nostr keypairs as their identity — no registration, no servers, just generate a key and join.

This release marks the point where the core protocol works end-to-end and is ready for broader testing. It is alpha software: the wire format is not yet stable and will have breaking changes.

Where to Find Us

Repository: The codebase lives at two official locations:

GitHub: https://github.com/jmcorgan/fips

ngit: https://gitworkshop.dev/npub1y0gja7r4re0wyelmvdqa03qmjs62rwvcd8szzt4nf4t2hd43969qj000ly/relay.ngit.dev/fips

(The fips-network GitHub organization was flagged by GitHub and is under review. We've restored the original jmcorgan/fips URL in the meantime. So, if you starred or forked the original repository, you'll need to do so again.)

Website: https://fips.network

Nostr: Follow the FIPS project account for updates and discussion.

What's in v0.1.0

This release targets Linux (x86_64, aarch64) and OpenWrt (aarch64, x86_64). Other platforms are not yet supported.

Multi-Transport Mesh

FIPS nodes connect over UDP, TCP, or raw Ethernet/WiFi. Ethernet transport includes automatic peer discovery — plug into a LAN and nodes find each other without configuration. The transport layer is designed to be extended to Bluetooth, Tor, serial, and radio.

Dual-Layer Noise Encryption

All traffic is encrypted twice: hop-by-hop between mesh peers (Noise IK) and independently end-to-end between communicating nodes (Noise XK). Both layers perform periodic rekeying with fresh Diffie-Hellman exchanges for forward secrecy.

IPv6 Adaptation

Each node gets a deterministic fd00::/8 IPv6 address derived from its npub. A TUN interface and built-in DNS resolver let unmodified IP applications reach any mesh node:
ping6 npub1abc...def.fips
ssh   npub1abc...def.fips
Static hostname mappings (/etc/fips/hosts) let you assign friendly names like myserver.fips.

Operator Tooling

fipsctl provides runtime inspection of peers, links, sessions, tree state, routing, and transport statistics. fipstop is an interactive TUI dashboard with live-updating views of the entire node state.

Packaging

Multiple installation paths are ready for testing:

Debian/Ubuntu: .deb package via cargo-deb with systemd integration

Generic Linux: systemd tarball installer

OpenWrt: .ipk packages for aarch64 and x86_64

Docker: sidecar deployment for containerized services

Quick Start
# Build from source (Rust 1.85+, Linux)
git clone https://github.com/jmcorgan/fips.git
cd fips
cargo build --release

# Install (Debian/Ubuntu)
cargo install cargo-deb
cargo deb
sudo dpkg -i target/debian/fips_*.deb

# Or use the systemd tarball
./packaging/systemd/build-tarball.sh
tar xzf deploy/fips-*-linux-*.tar.gz
cd fips-*-linux-*/
sudo ./install.sh
Edit /etc/fips/fips.yaml to add a bootstrap peer and start the daemon:
peers:
  - npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
    alias: "fips-test-node"
    addresses:
      - transport: udp
        addr: "217.77.8.91:2121"
    connect_policy: auto_connect
sudo systemctl start fips
fipsctl show status
fipstop
To run fipsctl and fipstop without sudo, add your user to the fips group: sudo usermod -aG fips $USER (log out and back in to take effect).

Call for Testing

This is an alpha release — we want people to try it, break it, and tell us what happens. Here's how you can help:

Join the mesh: Build and run a node. The test node listed above is a good bootstrap peer.

Try the installers: We're particularly interested in feedback on the .deb, systemd tarball, and OpenWrt .ipk packages. Do they install cleanly? Does the systemd service start correctly?

Report issues: File bugs on GitHub or ngit.

Read the design docs: The full protocol specification is at docs/design/ in the repository, starting with fips-intro.md.

Work in Progress

Additional transports (native Bluetooth, Tor overlay)

Native FIPS API access (no IPv6 shim) via in-process library interface

Peer discovery via Nostr relays

Security audit of the cryptographic protocols

Binary release packages

The full changelog is in the repository at CHANGELOG.md.

Nostr event nevent1qqsvefydgk9cjjuppjwtnrvjg5wd9krl8j0h726ft9elt6tlw0n28sszyq4m4nj48mlt7kxa2kgjz60e9sgj86mpy8tm5zf0d3gpqjhuxxkw7znt68z

2026-03-11T15:57:56Z

GM ☕ BIG PLANS