STOP using VPN, embrace Zero-Trust networking!

[@urzaaaaa]

"Stop using VPN and instead embrace this corporate commercial solution where you depend on third party infastructure." should be the title of this video. Let's be hones, this is advertisement, for commercial product, there is nothing wrong with VPNs.

[@urzaaaaa]

Really thinking about unsubscribing.

[@redlinejoes]

That is partially accurate. I would have to disagree because there's a lot wrong with how VPNs get configured. The trust model is broken and VPNs are included in the inherent trust model. Zero Trust, not this fake zero trust from Twingate, but real self managed Zero Trust like application embedded Zero Trust from OpenZiti is necessary.

[@christianlempa]

It is advertisement, but the ZTNA concept is relevant regardless of the product or service that’s shown in the video. Feel free to do whatever you want, but I hope you reconsider unsubscribe :)

[@eaglefn4918]

You are completely right! This concept is stupid. Do not trust third party infrastructure. Of course, it is free and fast. Otherwise nobody would use it.

[@r4ymaster]

​@@urzaaaaaexactly this, me too, I would rather host my own vpn and not depend on some *insert flavor of the month* cloud solution.

[@ImARichard]

While I can appreciate the tech, for me, it seems like opting to use a third party service over a self managed VPN connection is just not better. It opens up another attack vector that you have no control over. You have to trust that the third party service, Twingate in this case, never makes a mistake. Hell, they don't even have to make a mistake, they just have to become a juicy enough target to be attacked by a good enough adversary and you become collateral damage. From a self hosting perspective one of the largest motivations to do it, aside from learning, was to stop depending on third party services because of how often they become compromised, or accidentally leak your data. VPN isn't a perfect solution of course, but routing all your access through a third party is not better, just different. I realize this is an advertisement but even still compared to your other sponsored videos this felt more like an empty marketing pitch than a video about cool technology.

[@matt2817]

Agreed. Twingate would become a target at some point. Clearly, Twingate would isolate each customer's service/resources but depending on what the attackers have access to (e.g. internal services, customer support tools), compromising Twingate customers might be trivial.

[@EzhegAB]

Completely agree, 100%. Nothing exciting, but the beginning of the video was very intriguing.

[@IngleseAngel]

why are you using a similar profile picture than me? why?

[@RAZR_Channel]

The methodology ( Zero-Trust ) itself is an contradiction… if we are going to bring trust down to absolute 0-Zero : that would include : TwinGate … which will probably fall in line with historical scandals such as Watergate / PizzaGate / Enron / Theranos. that aside this is a brutally overt 23 minute… pounding infomercial. Yet, I have a far better solution : tiny… Classified… Ads…

[@farmeunit]

The thing to remember is that they have teams of people working on their product versus some guy who’s job isn’t just security or VPNs. They likely have multiple jobs and simply can’t focus on everything at once. Not to mention budget, etc..

[@GrishTech]

I understand this is a sponsored video. I think the general audience will appreciate a follow up video comparing all the various solutions out there, such as zerotier, Tailscale, tinc, and why would you choose one over the other.

[@odlanyermuller4849]

This is the way

[@ichilvers]

and NetMaker

[@matthiasbenaets]

I might be talking to a wall but whatever, and who asked? but... 4 out of the 5 latest videos have been just full video ads. I can't take any of the information provided at face value or serious in these case. especially since you try to educate in then. unsubbed for now. but I do appreciate the transparency.

[@christianlempa]

Thanks for addressing this, I'm sorry you feel that way. I hope to have soon some changes in place that would bring you back to the channel.

[@tuqe]

@@christianlempaI don’t mind when part of the video is sponsored, like “here is how you do this complicated thing that is a standard, then here is an open source package that is fine, and here is a shiny package that has a bunch of features (that just happens to have enterprise pricing)”

[@PontschPauPau3451]

It happened to Nick Chapsas, the C# KZbinr, too. At one point not too long ago every single video of his was an ad about AI and some service his users should subscribe to. It's gotten to the point where even once-lauded KZbinrs like these are just becoming typical "influencers" that just shill products. I've unsubscribed as well.

[@kice]

In my opinion, anything can be fully self-hosted, it will be fine to take the money. Because for us, end users, we don’t want to depend on a not proven technology. Also SaaS startups can only survive by targeting enterprises, not us.

[@jaxxarmstrong]

The whole goal to get more secure is to actually minimize the use of 3rd party solutions where you have no real control how your data is being handled or monitored. In this case a self-hosted VPN solution would be much more secure, even if it involves opening up a firewall port for it. You know better, Christian. This pure advertisement hurt your image more than you'd like.

[@canadianwildlifeservice8883]

I also think the message here was that a self-hosted VPN can be more secure if you know what you're doing. But having to create a plethora of firewall rules, VLANS, ect. is a a lot of work. Basically these cloud services create a backdoor to your home network. I mean, whether something is a cloud service, or a remote access trojan is purely based on how it's used and by whom. I personally would not feel comfortable with a backdoor being planted on all my devices just so I can access them "securely". But of course it's not really a backdoor, but a cloud tunnel, but it's really just semantics at this point..

[@Gnanmankoudji]

I confess I'm rather confused by all this Zero-Trust concept. If the principle of Zero-Trust is to add layers where you have to add another trusted third parties, there's something I don't understand. My VPN runs by myself, and I already have to trust the code, which may be open source but isn't infallible, and I also have to trust the hardware that runs it, which isn't infallible either, but it's the best I can do to accept a minimum number of trusted third parties. Zero-Trust just seems like a marketing term to me since it is often used by third parties that you have to trust...

[@B20C0]

@@Gnanmankoudji Zero trust done right is essentially just an added layer of security. You just mistrust devices and users in general no matter the network and implement solutions like MFA, enforce devide policies etc. There's even self hosted open source solutions for that. But you are right, it has become a buzz word of some sort. The underlying principles should be common sense by now.

[@giux900]

openvpn runs wuth no port open on 1194, there is a dedicated tls-auth channel that reply only to authenticated packets, this put your vpn port to not reply any portscan. Is just stealthed.

[@farmeunit]

You act like everyone that runs a home network is also a security professional…. Even “normal people” sometimes need a VPN, but aren’t experienced enough to keep it secure and functional. Not to mention easy. Look at Fortigate’s VPN vulnerabilities, for example.

[@THEMithrandir09]

Non-opensource is such a big turnoff though..

[@Felix-ve9hs]

Zero Trust Network Access is really great ... unless when you don't know if you can trust the ZTNA provider. Just because a lot of big companies are using something, does not make it secure (remember SolarWinds?)

[@LampJustin]

Yeah totally and they don't even seem to support IPv6. At least their website doesn't hand out a Quad-A record. So much on them claiming to be the future

[@Felix-ve9hs]

@@LampJustin In their forum twingate said that they want to roll out IPv6 in the next release of the client, what was 3 months ago.

[@yaroslavurshu2732]

It is ADs?

[@cheebadigga4092]

VPN is better. You're in control.

[@Gnanmankoudji]

I wouldn't dream of using another third party to carry all my most sensitive traffic. Advanced access control is good, but not like that in my opinion.

[@johndroyson7921]

I understand why people are upset about the title and throwing shade at VPNs. But, you clearly stated that this was a sponsored video at the beginning. Honestly, if your goal is to start a career in IT, this is exactly the kind of product to start getting familiar with in your homelab environment. There are ways to secure a VPN without 3rd party services, but this is so much more convenient and easy.

[@christianlempa]

Thanks I think you’re on spot

[@GrishTech]

If twingate went completely open source with their client and control server, they would have an edge over something like tailscale. Twingate ACL's seem better than tailscale though. Tailscale at least keeps their client 100% open-source, which allows alternative control servers to be developed (such as headscale, which has contributions from tailscale developers who contributed on their own time).

[@urzaaaaa]

Twingate Controller "provided on their servers" - no thank you.

[@kenklak]

I’m fine with this being sponsored. I can easily digest this valuable information and decide for myself what to use. Thanks for the info. Some people don’t think you should be able to eat.

[@christianlempa]

Awesome, thank you!

[@eaglefn4918]

I can not believe, that this is your opinion. You put a third party trojan in your network and explain it like the best thing ever. Did you watch this video yourself before publishing it? 😢

[@Felix-ve9hs]

So ZTNA is basically a VPN, but with all the hard work already done for you (dynamic dns, vpn server, firewall/nat rules) and the added ability to have security policies and policy enforcement. Authentication (strong password, certificates, 2FA) and authorization (firewall rules allow you to minimize what a VPN client has access to) are already there with VPN. ZTNA is something that sounds really nice for a corporate environment where users and resources are constantly changing. For a home lab or home network however, most users and services are pretty static, and having to trust and maintain the ZTNA service is just not worth it for me.

[@peterbean410]

yeah, the whole thing ZTNA vs VPN is just BS really.

[@Mr.Jean-Paul]

I use tailscale combined with tailnet lock and headscale, everything local and secure enough!

[@yifeiren8004]

What is the tailgate?

[@NatalieUoker]

tailscale and headscale, but tailgate? is this some tool/application?

[@yifeiren8004]

@@NatalieUoker I am also wondering what tailgate is. I can't find it through google 🙃

[@HenrikLarsson458]

The main issue for me here is the words "Stop using VPN" in this ad supported video. Do you really believe that? You make viewers doubt if your advice is sincere or not. Which will hurt all of your other videos as well. No it is not better/more secure than a self hosted open source VPN, just different.

[@giux900]

Agree with you!

[@yerunski]

The whole video has a watermark 'advertisement'. I'm skipping this one.

[@Blivius92]

Hi Chris, Good video en some good explanation. I’m not going to use it though, I don’t want vpn going through third party networks. Also reconsider your advertisements. Some videos ago you explained why not to use cloudflare tunneling, and here we are talking about vpn trough third party networks. Just advertise something you really stand for :-) Don’t get me wrong though, just a tip :-)

[@christianlempa]

Thanks! I appreciate your honest feedback :)

[@giux900]

I had same thought, very critical and useful video about cloudflare tunneling (for that video i sub this channel) and now ''hey guys let 3th party go inside your network'' just because there is a bunch of money behind. I don't like that. Never sell your criticism and well disposed suspect for the good of money.

[@kyberorg]

That's exactly what I thought.

[@ask_carbon]

Yea its a dislike from me. A bit disappointed too.

[@christianlempa]

Sorry if you think so

[@Glatze603]

@christianlempa: I absolutely share your definition of Zero Trust (07:46), unfortunately most people don't really understand it, as you can see from many of the comments.

[@christianlempa]

Thank you for highlighting this! It's such an important concept to understand, I think that needs more videos. :D

[@DJRhinofart]

A properly configured VPN implementation will have VPN clients come into a "Grey Zone" subnet, and then firewalls between the Grey Zone, and the Internal resources. Firewalls are not just for the Edges of the network. At my day-job we have probably around 100 Firewalls throughout our Corporate Network. Also between the Corporate, and High Security networks have different brand Firewalls.

[@mambo7668]

sure, rely on a third party to route your traffic can you elaborate why vpn is not secure? this looks like advertising

[@romayojr]

there's a huge advertisement watermark in the upper right corner of the video. he eplained why vpn is not secured anymore, the time stamps have titles that will help you find it

[@youdontknowme7298]

Im reallly confused ..... Is this a sponsored video?!? If yes, why doesnt it say so? I only says Advertisment, but thats to vague. Can we be a little more transparent with the viewership?

[@christianlempa]

There's an ad banner in the entire video, as well as a notification when you start watching the video... I'm honestly not sure how much more transparency you need :/

[@youdontknowme7298]

@@christianlempa That Ad banner only means that something in the video is advertised or this video is making money from that. But this video was "Sponsored" by the tool you did. Sorry i wrote it in a confusing way, i just want to help you out and make things more clear to the viewer.

[@MrMcp76]

Zerotrust is the way to go. VPNs provide no protection to your network once a bad actor gets on an end-user's system who is connected to your VPN. Ask me how I know 😞 Great video .. regardless if it is a sponsored video or not

[@christianlempa]

Thank you man!

[@aelidrissi3584]

We understand that ads are okay but please keep the good work on home lab / open source / learning / diy / fun. I have the feeling that this channel is drifting. Hope I am wrong.. and sorry if this was rude to say..

[@Kevin-oj2uo]

Yeah it seems like KZbin ads are not paying enough so they have to start accepting these sponsor videos. I don't like this trending because eventually it will become just for profit like Linus tech tips. I will prefer a video every month as an enthusiast.

[@christianlempa]

I’ll release a video later this day to talk about some of this, hope that gives you some clarity on the topic.

[@X27WCP]

i pass think my selfhosted vpn is pretty safe

[@mvaldes]

This is an ads channel now 😂

[@christianlempa]

😢

[@nicholasbackwell1869]

@mvaldes - I presume by that comment you don't run your own business. I can understand as a consumer why you might feel that way but as anyone in the IT industry might be able to observe, the world is constantly changing and learning theory only goes so far when it comes to tech. I'm sure Christian does a lot of testing and quality control to make his videos which is why he's a popular KZbinr which is more to say then you or me. I'd also like to point out I'm not the only enthusiast that simply likes shiny new toys/tools/equipment... Only examples but any enthusiast in automotive buying car parts or tradesman buying Milwaukee, Klein or whatever else you fancy I'm sure can understand. As anyone who gets up everyday to make a living for themselves why wouldn't you want to get paid for your work? I mean unless your sponsoring Christian?

[@immortalmyth5685]

Getting money from youtube or your works always is a nice thing. If no one donate or sponsor him how can he keep up this channel? But i would like chris give some caption or tell about sponsor. So i can decide to watch to the end of video or not

[@nicholasbackwell1869]

​@@immortalmyth5685 there's an "advertisement" disclaimer in the top right corner of the video and he mentions the video was made possible because of Twingate at like 45 seconds into the video.... it's about as much notice as you get from a coffee cup "Caution! It's hot"

[@Andy-jz1zw]

What's wrong with ads? It's relevant with the content and I would've thought for most of us, its fun to play about with this stuff.

[@blakrj]

@christianlempa - Perhaps you can provide an overview of your infrastructure setup? Simply picking 'frontend' in your case doesn't give much info (i.e. is this a renamed docker_default, or other custom). Can this talk to the main network? What about VLANs? In addition, how different is this to Cloudflare solution you warned about previously?

[@schossel]

This is within some of the worst videos on this channel. Explaining that using a third party server is more secure than your own VPN. Come on. It took me a few minutes to recognize that this whole video is an ad. This happened a few times now with these videos. I'll give you a last chance because mostly I like your channel, but if this is the way it'll be going in the future then I'm gone.

[@dotcaodin]

That's so nice!! Thank you for sharing. I don't understand the complaint about Ads videos once they still bring value to the public. Sincerely, people are focus on bad things only.

[@christianlempa]

Thank you 😊

[@lukasyelle4708]

@@christianlempa I agree, I like seeing the tech regardless if it’s an ad or not! Keep up the great work Christian! Quality content as always.

[@danielberglv259]

Seams awsome, but sadly like so many other services the client for Linux is something that seams to have been put together by an intern during a 30 minute break. It's always the same. Either a Linux client is missing or it may as well be. VPN may be an old way of doing this, but at least it has wide and tested platform support.

[@canadianwildlifeservice8883]

At home I use the Sophos Firewall's openVPN server. I like to think that because it's enterprise-level that it is secure. If you use a long random password, keep the opvn import file safe, and ditch the auto-created firewall rule at the top that allows the VPN users to access everything, you can create a rule that only allows the VPN users to access only hosts/IPs on your network that you allow. This is how it has been done for years. In the video he states that VPN is not secure. Did something drastically change that makes it not secure anymore or this belief just fear mongering by these cloud providers?

[@christianlempa]

There are some security issues highlighted in the video. Btw at Sophos we also have a Zero-Trust Network Access Solution :)

[@canadianwildlifeservice8883]

@@christianlempa Yes, I have heard that it will be included in the upcoming version 20 of Sophos Firewall. I will have to read more about it. I already like the 2FA that is mandatory in the firewall webadmin. I wish the SSL VPN used it as well.

[@Andy-jz1zw]

​​@@canadianwildlifeservice8883If you mean a VPN with MFA via Sophos then it can be enabled. Maybe this is only at the enterprise level - never touched the personal one. Go into the admin portal and look under authentication. You can add mfa and also configure it to work from an AD group. User signs in then will get a qr code then can scan - they then sign in with username, password and mfa code right at the end of the password

[@giux900]

not a good way to sponsor! I liked the clouflare tunneling considerations and the basic criticism that should permeate everything in IT. So the balance about risk/benefit should be our thought, not the title of your video! You should never say stop using vpn. Openvpn is a 21year old protocol full audited with with also hardened versions and widely used worldwide. Is just secure as should be. So, talk about the main point. What is more zero trusted? A self hosted opensource service with user in full control, or a corporate service with closed source software running inside your house? you cannot deleted this comment.

[@christianlempa]

Thanks for you honest feedback

[@muralimenon2681]

With a VPN the client does not get access to all internal resources. You can configure so only a subnet or specific servers are accessible!

[@gabe_0x]

If it's not free and open-source, then it's a waste of everyone's time. I'm happy to pay for bandwidth and hardware, but I will never trust a company with protecting my data.

[@ilovestitch]

It sounds like this is a tool used for correcting issues caused only by verrrrryyyy poorly deployed VPNs and poorly configured firewalls... too much reliance on external servers, closed source, etc...'zero trust' just means 'trust us/our servers with all your data throughput' in this case. same issue with tailscale

[@androidgeeking]

So this is really to hide from ISP but to access remote devices securely? I couldn't access sites from my mobile phone I blocked in my ISP's network but I could on desktop. What gives?

[@yuanyowwu]

Thanks for info. Pretty cool concept.

[@christianlempa]

Glad you liked it!

[@Glatze603]

@ALL: Self-hosting is a trend on a private level. Companies are now moving more than ever to the cloud and are therefore dependent on other companies (see Microsoft). Personally, I'm also a fan of hosting as many services as possible myself, but solutions like those from TG or CF are no less secure - on the contrary. The “big” companies in particular are in the spotlight and can least afford security breaches or poorly programmed security solutions. As far as these approaches are concerned, I believe that this solution is currently at the forefront when it comes to security and integrity.

[@christianlempa]

Well said! As much as the self-hosting fans dislike security services... That's what the big boys use ;)

[@mindenesvegyes8512]

@@christianlempa aha.. said this after the big boys like lastpass hacked more times in row... don't be arrogant ;) I like your channel and learnt a lot but if you continue this "money hungry bitch" behavior and sell your soul for money (sponsors), instant unsub.

[@milosand]

What's the diference with cloudflare Zero trust? You have a video about the security issue of this service. Thanks for your videos.

[@christianlempa]

There will be a comparison video in the future, just takes some time to prepare it

[@DigiDoc101]

My main problem with this product is that their android/iOS apps suck. I'll have to sign in every time I disconnect. With tailscale, it is a click away to toggle on/off. Very annoying!

[@Glatze603]

Hi Christian, even if you can't host it yourself, it offers some very good and important approaches towards Zero Trust! Used correctly (at least 2 docker containers - as lxc and distributed across 2 of 3 Proxmox nodes, in a DMZ with dedicated firewall rules towards LAN networks and the Internet) this is a really good and secure solution for accessing services in your own area access homelab. Thank you for your time and this video 🙂

[@christianlempa]

Thank you so much :)

[@niro1960]

Nope -> 3rd Party ≠ Zero Thrust. Opens-> New attack vector.

[@Glatze603]

@@niro1960 Please find out in more detail what zero trust means!

[@steveyg777]

Can you recommend a more zero configuration solution like twingate for normal people like myself who don't understand all the programming/Linux/docker garbage please?

[@kellyheflin5931]

Hi Chris, can Twingate be implemented onto pfsense firewall network? Thank you.

[@animefreaks4738]

Tailscale vs Twingate. What should I use in 2023?

[@Medalavi]

What is the benefit of Twingate vs Tailsclae or Perimeter81 which using WireGuard Connection?

[@christianlempa]

You have to compare the features and find out what's important to you. Maybe I'll make a comparison video somewhere this year.

[@AbdulWahid1st]

I have a different opinion regarding vpn not secure, especialIy in what u said about ‘client is trusted as part of intranet’. I think vpn is only as secure as how we secure our vpn servers. We should always expect many outside traffic coming from the vpn server, and configure our firewall accordingly. Most of all, aside from network provider, all my data and authentication are transmitted through my own servers. Don’t get me wrong, I love this zero trust concept, and I am using cloudflare tunnel, which I think exactly the same as what twingate doing, maybe, cmiiw. Which is my daily alternative to my vpn. And in terms of speed, I didn’t notice any differences, definitely depending on usage, whether to ssh or stream jellyfin. So which one you like, controlling access via your own firewall, or zero trust provider’s controller or dashboard or whatever.

[@chrisumali9841]

Thanks for the demo and info, have a great day

[@christianlempa]

Thanks, you too!

[@icheema3671]

all the issues highlighted with vpn in this video are quite easy to address.

[@freestudymusic550]

Nice video😊

[@christianlempa]

Thanks 😊

[@keywal]

The 2 device limit put me off this for the home lab.

[@DominatorIII]

Where do you see a 2 device limit?

[@keywal]

​@@DominatorIII Settings > General... 2 devices per user Upgrade to Teams for 5 devices per user

[@Douglas_Gillette]

‘Zero trust’ is marketing BS. It is simply implementing least privilege and re authentication after a period of time. This has been a common and valuable security strategy for a very long time.

[@MR-vj8dn]

But why would you choose to use this service in the first place? I don’t get what it solves or even offers that isn’t there already, but with a proven track record.

[@ashfaaqahamed3902]

Make video on elastic search deployment on kubernetes

[@Raja-oi7xv]

Go with elk stack

[@ashfaaqahamed3902]

@@Raja-oi7xv do u have idea about that

[@gerbrand5980]

Yeah, this is just simply a bad video. Instead of bashing VPN's, you should advertise it as a cool alternative. This should avoid most controversy that you're seeing now in the comments.

[@milutinnikolic7681]

I did this deployment for about 5-6m ago. Working perfect for me.

[@christianlempa]

Awesome :)

[@AnFv86]

Has anyone tried to use the alias instead of the IP? I can't get it to work and I can't understand why.

[@joaopedroalbernaz]

Hey, there's a video on my 24 min AD, what's up with that?

[@theosky7162]

Cloud shall NOT touch my data.

[@heaton922]

anyone can use custom dns - pihole as DNS filter? I tried that is not work. going back tailscale

[@RubenMPSRZ]

Skynet was the name of my wifi since I was living with my parents. 🤣

[@christianlempa]

:D

[@YannMetalhead]

I know it's a sponsored video so I won't complain, but no way I would use something like that.

[@christianlempa]

No worries :)

[@MrZiemwit]

so basically its worst zerotiier/tailscale

[@christianlempa]

Nah you got that wrong bro

[@davidiamyou]

So is it just another Tailscale/Headscale?

[@hackingit]

It is secure alternative to VPNs. These days I am looking for VPNs that are undetectable by websites. I am trying to earn from microtasks but that is region specific and VPNs don't work. Can you suggest a solution?

[@altaccount648]

I would *never* ditch VPNs for important services on my server. Corporations can beg me for my money some more. Thanks, but no thanks.

[@bastelwastel8551]

Yeah, no thank you. I roll my own solution that i have full control over. Outsourcing your security is not my thing, but nice that you get some ad money

[@ebiscaia]

Hi Christian, This is unrelated with the video, but as I know you self-host docker applications in your homelab, I would like to know how you deal with sqlite and multiple replicas. I followed your video about storage in Kubernetes and I am having issues with the database. Thanks.

[@markandrow4010]

Great and thanks.

[@LMLecho]

Unless im missing something or this was baked in after the fact....it clealry days "Advertisement" top right 🤷‍♂️🤷‍♂️🤷‍♂️

[@ohiosuave]

PAYWALL....So I Zero Trust IT...

[@SHSolutions]

Wir nutzen Zscaler. Aus Anwender Sicht, welcher produktiv arbeiten soll, ziemlich lästig und kontraproduktiv…. 👎🏻

[@quangnam10]

i think it look like tailscale

[@MyAeroMove]

We are so worried about security and so bored managing VPN... So, we are outsourcing whole corporate entrance gates to some ... company because ... it's based in US 😂 Please get back that old level of quality to your videos. I'm really missing it.

[@christianlempa]

Don't worry, I'll address some of the concerns in a special video today, we'll get back to it!

[@MrBarto95]

Maybe test netmaker or netbird

[@StaffyDoo]

Headscale, folks.

[@redlinejoes]

Please go read Project Zero Trust by George Finney.

[@MarkoKukovec]

What is the proper ways to secure tokens in the production? How do you not store them in clear text? I mean in the compose we can use environment variables defined in the .env file, but again, variables in .env are stored in clear text. Security in this way is acheaved by who exactly can read .env file. What is better solution? How to encrypt them and decrypt on the fly? You have to put description key somewhere. Thank you for all the help and hints I'll receive on this question.

[@christianlempa]

There are multiple options, I'm still evaluating some for me. Currently, I'm using just environment variables that I pass through the session when I need them, but apparently it's not very convenient. Don't worry, I'll add this topic to the list of videos I'm going to do in the future!

[@PaulBunkey]

Oh, looks just like Tailscale. A fork?

[@christianlempa]

Nope xD

[@trendingtopicresearch9440]

Yes, give a company access to your LAN. What could go wrong.

[@tylersmith8662]

im curious how you come to the conclusion that "VPN is no longer secure"

[@klausdieter8283]

I dont get it :/ is the data between the connector and client encrypted? how will the firewall work with encrypted data?

[@christianlempa]

It is, the firewall will most likely just forward it because the connection is initiated from inside the network.

[@jimmayx]

My question is: as the admin to all the internal services, I would need access to virtually everything. So with a giant winner-takes all account, how are these more secure from an account hijack? Assuming the bad actor meets the basic security requirements and gained access to my account managing my homelab, how am I safer?

[@rushank2112]

I would have not promoted this. Thanks for the efforts!

[@christianlempa]

You're welcome :)

[@joelmeza3145]

What a shame!

[@jrjrjrjdhdjs]

Dont mind the ads because he is showing us tools that can be used in IT/homelab. It would be different if he was showing something unrelated.

[@GottaHache]

Not sure why all the negativity. This video is great and Twingate is awesome

[@Kevin-oj2uo]

It's because we are trusting a third party company to access our infrastructure back home. And VPNs are not that bad or old school. Also its not the only KZbinr sharing these type of videos , so it seems twingate its filling everyone pocket with sponsors.

[@christianlempa]

@gottahache thank you 😊

[@yifeiren8004]

This is just a tunnel....

[@Simonkenteriksson]

Great video :)

[@christianlempa]

Thanks!

[@siegson]

Mr Lempa, this is bad and you know it...

[@plainuser48596]

dude, you've, pretty much, said that they are trustworthy because their website says they are trustworthy...

[@christianlempa]

put your tin foil hat on, bro

[@martinfurstenberg2281]

Start Zero Trust by Trusting a new Company to do my job for me sounds a bit counterintuitiv. 😂

[@AcvaristulLenes]

This is part of subscription hell. The fact that it's an American company, makes it even worse.

[@martinfurstenberg2281]

Sorry but this twingate ad annoys me hard.

[@paul9812-t3i]

Yikes

[@romayojr]

this is good stuff. i’m interested in implementing this in my homelab environment. do you know what the upload limitations are for the free version? i want to use this as a proxy to my nextcloud instance.

[@christianlempa]

Since the traffic is not flowing through their services there’s no other limitation than the ISP on client/server

[@sr.cenora]

Unsubscribed

[@jimallen8238]

I'm going to give Christian the benefit of the doubt on this advertising video. The vast majority of his content is engaging and helpful. This one is an anomaly, as its clearly not a balanced perspective on this tech. Its just a paid ad. I look forward to future, unbiased content.

[@toodarkpark]

How is this "Zero Trust" when the big gaping security hole is that you have to trust Twingate? Security has to be open source. Access cannot be controlled by an entity interested monetary gain. This is my litmus test. Twingate fails.

[@christianlempa]

Software isn’t necessarily more or less secure because it’s open source. Please tell me, when was the last time you analyzed the source code of an app? Or why did we recently find security vulnerabilities in tools like OpenSSL or Sudo that existed for over 20+ years? Zero-Trust is not about the company or the solution itself, it’s a security concept! Twingate is just one of many tools to accomplish this in your environment.

[@toodarkpark]

@@christianlempa I look at the source code of everything that I can. What is your point? We all know that proper security is open source. Open source solutions are the only solutions that have the ability to be held accountable. Are you suggesting to give up the ability for accountability just because you "think" that people don't look at what they deploy? Regardless, the SECURITY concept is zero trust. You are pitching one trust, not zero trust. I think you need to read about how zero trust works as a security concept.

[@toodarkpark]

Sorry for the abrasive tone. Regardless of what I say here, you make valuable content. I learn much by subscribing, and appreciate your library of contributions thus far. You are talking to a multi-decade enterprise security fish. The obvious advert rubbed me the wrong way is all. I was around when Cisco burned us all via LEAP. I don't trust closed source like I used to.