Nostr notes by fips

Unsure what FIPS can actually do? Listen to this podcast to get ...

2026-09-17T17:30:21Z

Unsure what FIPS can actually do? Listen to this podcast to get familiar!

quoting
nevent1q…qw7k
The Internet We Deserve w. FIPs

Intelligence Snacks episode 72 👀

FIPS, Nostr, local-first agents, the end of API-key hell, and a spicy detour into whether AI doom is safety... or cartel theatre.

A better internet is possible, in this episode we talk through why we think this is the case and how we;re using it!

https://www.youtube.com/watch?v=5mNhaiwZMX0

FIPS 0.4.0 is out! Thank you to everyone who has tested, reported ...

2026-06-27T18:49:01Z

FIPS 0.4.0 is out! Thank you to everyone who has tested, reported bugs and helped us improve!

quoting
naddr1qv…5kwe

FIPS Project Update and v0.4.0 Release

It has been about six weeks since v0.3.0, and the response has been great. We estimate the public test mesh averages 1500-1600 nodes online at a time, with the optional bootstrap nodes peering with hundreds of inbound connections each.

This growth is welcome on its own, but as planned its real value has been as a live test of the network design and implementation under real-world conditions that are far more demanding than any lab or CI test, including adversarial attacks and probing from the usual suspects. Running at this scale has surfaced latent bugs, race conditions, and capacity limits that have driven the bulk of the v0.4.0 release content.

In parallel, normal development work from existing and new contributors has continued, and this release has a few new capabilities that make it more than just a patch release.

Notable Contributions

Sirius (npub1g53…drvk) has continued to deliver performance improvements to the FIPS data plane, with a roughly 2x throughput increase between directly connected peers. The nostr-vpn project has switched to using FIPS as its underlying mesh transport.

He also contributed a new opt-in mDNS LAN discovery mechanism, which lets IP overlay-based nodes on the same local network find and peer with each other without having to go through the full Nostr-based overlay discovery process.

oleksky (npub16q4…xcms) added an outbound Nym mixnet transport, so a FIPS node can peer through the Nym network for metadata-resistant connectivity. Mesh traffic mixes into Nym cover traffic, and it ships with a single-container demo.

sandwich (npub1uac…99rx) implemented a Nix flake for reproducible from-source builds on Nix and NixOS, plus AUR packaging fixes.

Arjen (npub1hw6…65gr) continues to develop and maintain the native macOS FIPS port, fixing some connectivity bugs that were revealed in 0.3.0 deployments.

He also implemented OpenWrt 25+ support, with a native .apk package alongside the existing .ipk one for 24.x.

Community

Beyond the code in this release, the wider FIPS community has been busy over the same six weeks.

Learning and onboarding. The fips.network website got a substantial redesign, and a new interactive Learn FIPS guide walks through self-organization and coordinate routing, hop-by-hop and end-to-end encryption, and the full connection lifecycle with layer-by-layer simulations. Join FIPS does browser-side peer discovery, the FIPS Map shows live node geography, and Awesome FIPS catalogues projects built on and around the mesh.

Podcasts. FIPS featured across several shows: the No Solutions podcast discussed it in its White Noise, MLS and Marmot and Nostr VPN episodes; Open Markets covered FIPS as a decentralization play in "What The Fips"; and Citadel Dispatch's CD193 — "FIPS — Fixing The Internet" is still being reshared.

Projects building on FIPS. Martti Malmi's NostrVPN — a Tailscale-style private mesh on a FIPS-backed data plane — shipped v4.0.80. Community members are also experimenting with decentralized email addressed by npub and prototyping Nostr-native voice spaces — all reachable directly over .fips addresses.

Sentiment. In-person FIPS conversations happened at BTC Prague, and there's a healthy push from the community for high code-quality standards in projects meant to last. We share that goal, and a lot of this release reflects it. A few notes from the community over the past six weeks:

Nostr + FIPS is like the telephone game, but with perfect information the whole way.

FIPS supports the Pillars of Propagation; the way information flows throughout the internet will change forever.

NOSTR / FIPS / Bitcoin / Lightning / Cashu / Personal AI — once we have the models and the hardware, there will be no stopping this freedom train.

A new alternative internet infrastructure is being built with FIPS, but how can we get access to internet when ISPs start to do KYC or the state demands a digital ID? You can partly get around with TollGate, but getting an internet connection trustlessly, bought with bitcoin — that would be a game changer.

Upgrade

v0.4.0 is wire-compatible with v0.3.0. Linux, macOS, Windows, OpenWrt, and Arch (AUR) packages are on the release page, the Nix flake builds from source, and the public bootstrap nodes are ready for you to join.

Full release notes: release notes.

FIPS v0.3.0 is out! Peer discovery over Nostr. 2.5x speed ...

2026-05-11T21:46:43Z

FIPS v0.3.0 is out!

Peer discovery over Nostr. 2.5x speed improvements. Windows, MacOS & OpenWrt support. Bluetooth transport. FIPS gateway and maaaany bugfixes!

Want to know more? Start at https://fips.network

quoting
naddr1qv…jl8r

In the months since v0.2.0, a community has crystallized around FIPS. Operators have stood up nodes across regions and run them on the public test mesh; contributors have reviewed patches and reported bugs against real traffic; and developers have landed substantial new features. v0.3.0 is the product of that work.

What follows walks through the release, then closes with a roundup of the community resources that have grown up alongside it.

v0.2.0 was FIPS's debut to a wider audience and stood up the public test mesh. v0.3.0 builds on that footing: it widens FIPS's platform reach to first-class binaries on macOS, Windows, OpenWrt, and Linux; opens the mesh to peers behind NAT through a Nostr-mediated discovery channel; ships a bridge for unmodified LAN hosts; hardens the mesh interface with an opt-in default-deny baseline and peer access control; substantially speeds up session-layer crypto and the Linux receive path; and lands a freshly reorganized documentation tree.

v0.2.1 also ships today, a bug-fix-only stable release that operators on the v0.2.x line can upgrade in place.

v0.3.0 is wire-compatible with the v0.2.x line and carries forward every bug fix from v0.2.1. Mixed meshes interoperate. Operators can roll out at their own pace.

What's in this release

Each item below is a summary; the release notes carry the full per-feature detail.

Cross-platform reach. First-class binaries for macOS (.pkg, native utun, launchd), Windows (ZIP, wintun, Windows Service), and OpenWrt (.ipk, procd, dnsmasq forwarding, proxy NDP, RA-advertised routes), alongside Linux .deb and tarball. MIPS atomic-ABI portability unblocks consumer-grade routers.

Find each other through Nostr. Each node can optionally publish a signed advertisement to Nostr listing its reachable transport endpoints, and can scan public Nostr relays for advertisements from other nodes. This gives operators who are interested an automatic discovery path for nodes reachable over the Internet, without displacing the existing static-peer configuration. For nodes that are behind NAT gateways, the daemon coordinates a STUN-assisted UDP hole punch using NIP-59 gift-wrap signaling.

The new fips-gateway capability allows node operators to extend the reach of the FIPS mesh to unmodified LAN hosts. LAN hosts can reach .fips destinations on the mesh, and mesh peers can reach configured services on the gateway's LAN, without FIPS running on the LAN host itself. The canonical deployment sits on a host that already serves DHCP and DNS to its LAN segment, such as a Linux router or an OpenWrt AP.

Mesh-interface security baseline. Peer identity is authenticated end-to-end by the FMP and FSP Noise handshakes, but identity is not authorization. v0.3.0 ships an opt-in default-deny nftables baseline as a packaged conffile, with per-service drop-ins, allowing the operator granular control over port access to mesh peers on Linux. Separately, peers.allow / peers.deny files restrict which peers a node will form direct links with.

Faster session crypto. The ChaCha20-Poly1305 backend used by every FIPS Noise session now dispatches through ring 0.17 to BoringSSL's hand-tuned NEON / AVX2 / AVX-512 implementation. Wire format is byte-identical, so rollout order does not matter.

On an aarch64 docker target, two-node TCP single-stream throughput went from 437 to 1097 Mbps, two-node UDP at 1 Gbit went from 40% loss to lossless at line rate, and three-node ping under bulk load dropped from 7.68 ms avg / 215 ms max to 0.72 ms / 3.6 ms max as the relay path stopped being crypto-bound.

Documentation, end to end. The docs/ tree has been reorganized into four sections: tutorials, how-to, reference, and design. New users start at docs/getting-started.md; the Join the test mesh tutorial connects a local daemon to the public test mesh in a few minutes. Operators with a specific task land in docs/how-to/; reference lookups in docs/reference/; architectural background in docs/design/.

Experimental Bluetooth Low Energy transport ships for Linux, with maturity gated on field reports rather than the CI matrix. macOS BLE support is in development as a separate track.

Operator polish. Several improvements target day-to-day operation. fipstop adds historical statistics with btop-style sparklines, and fipsctl exposes a wider set of diagnostic queries for inspecting node state. See the release notes for further operator-facing changes.

A growing community

This release also marks the public debut of fips.network, the project's first official website. Three companion pages launch with it:

awesome.fips.network, a curated index of FIPS-related projects, tools, and writing.

join.fips.network, a fast on-ramp for trying the public test mesh.

learn.fips.network, a plain-language primer on what FIPS is and why it exists, written by @gigi.

Three podcast conversations about FIPS appeared during the v0.2.x cycle:

Citadel Dispatch CD193: FIPS - Fixing the Internet, Matt Odell hosting Arjen, March 2026.

No Solutions #24: Building FIPS, Gigi with Johnathan Corgan, April 2026.

Open Markets Podcast #5: What The Fips, Eric, Sync, and Arjen on community-resilient networking, May 2026.

A special call-out goes to Sovereign Engineering for the extensive testing, demo development, workshops, and feature work contributed to the FIPS project during their recent SEC-06 and SEC-07 events.

Get v0.3.0

Releases page: github.com/jmcorgan/fips/releases/tag/v0.3.0

Linux x86_64 / aarch64: .deb and tarball.

Arch Linux: fips (release) and fips-git (dev) from the AUR.

macOS: .pkg.

Windows: ZIP.

OpenWrt: .ipk.

From source: github.com/jmcorgan/fips.

Full release notes (with the per-feature detail this announcement summarizes, behavior changes worth flagging, the upgrade checklist, and the operator-relevant bug-fix list) are at the v0.3.0 release page. The canonical changelog is in CHANGELOG.md. Issues and discussion at github.com/jmcorgan/fips.

Thanks to everyone who tested, reported, reviewed, and contributed.

Or, learn more in one of these podcasts:

Citadel Dispatch CD193: FIPS - Fixing the Internet - Arjen (nprofile…8d6t) : https://fountain.fm/episode/2luFagFMSN3J2IX7m4wj

No Solutions #24: Building FIPS - jcorgan (nprofile…sjfc) : https://fountain.fm/episode/7Zscpi0DAtOBtxjbvdAE

Open Markets Podcast #5: What The Fips - Arjen (nprofile…8d6t) : https://fountain.fm/episode/eaQOAVu8jhFQUhqu3XTu

FIPS v0.2.0 is here! Make sure to update your nodes as it ...

2026-03-22T21:43:13Z

FIPS v0.2.0 is here!

Make sure to update your nodes as it includes some breaking changes!

To join the mesh, connect to our pubic nodes over TCP/UDP:
- testnode1.fips.network
- testnode2.fips.network

quoting
naddr1qv…7h4l

FIPS v0.2.0 is now available. This release includes a major discovery protocol overhaul, Tor transport support, runtime peer management, and 12 bug fixes.

Highlights

Smarter Discovery Routing

The discovery protocol has been rewritten to use bloom-filter-guided tree routing instead of flooding. Lookups are now forwarded only to spanning tree peers whose bloom filter contains the target, reducing discovery traffic by 90%. When no tree peer matches, a non-tree fallback preserves reachability. The new design includes originator retry with exponential backoff and transit-side rate limiting for defense-in-depth.

Tor Transport

Nodes can now peer over Tor using SOCKS5 for outbound connections and directory-mode onion services for inbound. This enables anonymous peering without exposing IP addresses.

Runtime Peer Management

New fipsctl connect and fipsctl disconnect commands allow adding and removing peers at runtime without restarting the daemon. Supports hostname resolution from /etc/fips/hosts.

Reproducible Builds

The build infrastructure now produces deterministic, reproducible packages. Rust toolchain pinning via rust-toolchain.toml and SOURCE_DATE_EPOCH timestamps ensure bit-identical output across builds from the same commit.

Breaking Change

This release changes the discovery wire format. The visited bloom filter has been removed from LookupRequest, and a forwarded flag has been added to LookupResponse. Nodes running v0.1.0 cannot interoperate with v0.2.0 on discovery. All mesh nodes must be upgraded to v0.2.0.

Bug Fixes

DNS responder NXDOMAIN for A queries on .fips names (#9)

Stale sessions blocking reconnect (#5)

Rekey dual-initiation race on Tor links

Rekey cutover race causing AEAD failures

Post-rekey jitter spikes corrupting EWMA (#10)

ICMPv6 PTB source address ignored by Linux (#16)

Parent selection bypassing SRTT eligibility gate

Auto-connect peers permanently abandoned after retry exhaustion

MMP metric discontinuity across rekey

Control socket permissions for non-root users

Reconnect backoff reset on link-dead cycles (#5)

ETX unresponsive to recent loss (#14)

Install

Packages available:

Debian/Ubuntu: .deb package

Systemd tarball: fips-0.2.0-linux-x86_64.tar.gz

OpenWrt: opkg .ipk package

Source: https://github.com/jmcorgan/fips

Contributors

@jmcorgan, @v0l, @alopatindev, @Origami74

Full changelog: https://github.com/jmcorgan/fips/blob/master/CHANGELOG.md