> In this case, you can visit kulfi://http-e9b1c82b43206c96173848ed0afad2fe633fdc8a02ba391a3d37, which is where the Talk App lives.

What is the DNS story for this platform? Or are you intending to be kind of like a replacement for Syncthing where each endpoint has to explicitly approve the other and thus discovery is left as an exercise to the reader?

Actually, even after further thought, I am still able to rename my peers in Syncthing, and unless one has to go to the dashboard for getting that Talk App link(? button?) all the time, it's been my experience that folks will always want aliases for ginormous hex strings

---

p.s. you have some broken images in your Journey docs

Kulfi is a network (peer to peer) which support http/https even tcp can be sent over kulfi.

Kulfi App is a web browser that talks kulfi protocol natively, so you can open kulfi://<id52> natively. malai is the server side part of this story, and can expose existing HTTP/TCP services over kulfi:// network.

For DNS, here is my initial deign/thought: https://github.com/kulfi-project/kulfi/discussions/55

For access control, we are working on a "what-to-do" service, which is an bunch HTTP/JSON APIs, that will be called by the malai (which runs on your server, or even as part of Django/Node/Golang once we wrap malai as a cffi library, and write corresponding Python/Node etc packages). You will be able to write the what-to-do in any framework you like, and we will maintain a general purpose open source what-to-do service.

Looks very cool. Another self-hosted, open source, and private solution in this space is my own https://github.com/connet-dev/connet/

'hehe, malai, wonder if they know' -- 'oh, kulfi, ok they definitely know' -- just a fun quirky name, or an analogy I'm missing?

malai: cream that forms on top of milk when it cools down, its a flavor of kulfi. kulfi: a milk based ice cream / desert. Nothing to do with networking etc, just a desert I enjoyed since childhood :-)

malai also means mountain in my mother tongue Tamil and I am named as malai.

Nice naming of your projects. It just caught my attention :).

Yep, just wondered if there was some analogy/joke like malai is the layer on top and kulfi is.. I don't know, the rod that connects A to B or something (that's nonsense, but that's why I was asking!)

Anyway, project seems great and all, but I'll wait for pista. :)

> It can be used to secure your SSH service, or securely share your database server.

SSH is one of the most secure network daemons ever devised. This is not to say that there is never any need to harden SSH, but given that people usually secure services behind SSH, I find the words “secure your SSH service” strange.

That said, I am no stranger to bastion/jump hosts, but those usually involve accessing one ssh host through another ssh host.

what problem does this solve over ngrok/tailserve?

I read the readme and I don't quite understand the relationship between malai and kulfi, or what the "total cost" (what I need to know, what I need to install) of the stack is here.

Kulfi is the official name of the project, and the name of the "peer to peer internet" "id52/identity based internet", so kulfi net.

Kulfi App is going to be a browser like Google Chrome, available on various app stores, and it will speak both http over tcp and http over kulfi. Kulfi app acts like client (but is also a server, so on your iPhone tomorrow you can install Kulfi, which will let you access any http over kulfi site, and also will run a web server which is exposed over kulfi net for others to access, so my Android phone's Kulfi browser can connect with the your iPhones Kulfi's web server, with no intermediary [1]).

malai is ready now, and it is a Swiss army knife toolkit for working with kulfi net. Currently malai can expose a HTTP or TCP service over kulfi net.

Malai also has a "http bridge" feature, which bridges any malai exposed http over kulfi service with the http over tcp, so people can use regular browsers to access malai exposed HTTP services.

[1]: we are using https://www.iroh.computer/blog/iroh-dns, so their caveats apply.

What's id52?

I feel like I'm missing a lot of context to understand what's being shared here.

e.g. https://github.com/kulfi-project/kulfi/blob/malai-0.2.5/kulf...

  $ echo -n c1b2d4463e503765b7422e126ea7ff5633ba5903f97b700ac818 | wc -c
    52

It would appear the leading "org-", "account-", et al are a separate namespacing of the id52 key

This desperately needs a “how the hell does this work” page for either malai or kulfi (preferably both) because the vibe I’m getting is “it’s magic! Trust us and sign up for an account.”

It's magic man-in-the-middle and we're the magicians here

I’m always wary when there’s clearly some infrastructure required and it isn’t clear how it gets paid for. What’s the catch? What’s between my bridge listener and my target, and what’s their incentive to be there?

Very cool! This is similar to a service we manage at https://tuns.sh that runs entirely as an SSH server.

We love to see new ideas in this space since we think tunnels are great for prototyping and app development.

Sorry, noob here: Can this traverse managed NAT and deep packet inspection?

We are using iroh[1] internally, so the question is does iroh support these things? The quickest way to answer this would be to test it. Can you help me with what kind of setup would be needed for me to test this?

[1]: https://www.iroh.computer

Did you vibe code this or something? How could you not know...?

Yes, Iroh supports this through a variety of hole-punching means as well as via public relay servers.

Sorry, but basic NAT traversal is an essential feature for any P2P network launched in at least the last 20 years, and as such doesn’t seem like something you can just leave to lower layers or even ask your prospective users to figure out themselves.

Kulfi red flags:

Does the same thing as a bunch of other systems (e.g. Tor) without providing any comparison of what this one does better.

Docs pages are TODO, certainly don't explain how it works.

Website is "Copyright 2025 YourCompany, Inc."

Discord link goes to something called "fastn" with apparently no relation to Kulfi.

Vibe coding tools need a post step to fix all the templating issues like wrong links, wrong names, etc.

A few more:

No explanation of how it works

Comments in this thread reveal a bunch of obscure components that also don't have much details.

fastn is an ingredient to kulfi project. fastn.com is a full stack programming language we (FifthTry, Inc, the company behind these) have built, and it is the web server that is going to be part of Kulfi app.

The comparison posts, TODO, copyright etc we will do/fix when we get around to it. It's all open source, you can send PRs as well.

How does fastn handle errors? Is is possible to perform the SQL query client side or does it prevent / add friction for such? Can I visit `/foo/";DROP%20TABLE%20users;/` or does it handle inputs properly?

It sounds a lot like you're trying to reinvent things that already exist for the purpose of having them be your intellectual property, so you can convince everyone to use your thing instead of the free thing, and possibly rugpull them later. Embrace, extend, extinguish!

To be fair, assigning copyright to the reader is a good first step to build trust :)

I use ngrok for exactly this type of functionality. Can someone clarify why would anyone need malai over ngrok?

This is pretty awesome.

Awesome would love to use it.

Feedback: This crowd likes technical docs. These docs are nothing like that, and raise more questions than they answer.

I maintain a list of tunneling solutions here: https://github.com/anderspitman/awesome-tunneling

Usually my first question is what makes this different than the many existing options. Looks like the answer in this case is that it's p2p and built on iroh (which is built on QUIC), which I find interesting. Would love a PR on the list.

Don't we use Tailscale for this?

Or ngrok, or Cloudflare Tunnel or https://github.com/anderspitman/awesome-tunneling

I'm gonna add https://localhost.run as a contender.

It's on the list linked

Unlike tailscale/ngrok, malai is completely open source, does not rely on any company provided infrastructure (we have a http bridge to bridge http/tcp with http/kulfi at *.kulfi.site, but you can run your own http bridge), and once Kulfi app is ready, you will not need the bridge at all and Kulfi app (which is also basically a browser that speaks http(s) over kulfi along with http(s) over tcp) can talk kulfi protocol directly.

Iroh requires relay servers; so wouldn't Malai need those?

Yes, we are currently using iroh provided relay servers. malai will soon connect with any relay server, so in future you can use ones provided by us, or run your own.

Among other clear differences, it looks like tailscale requires you to sign in with some cloud provider and Malai does not.

I use and like tailscale for similar purposes, but I can see why some people might prefer to skip that aspect, especially.

The hosted part of tailscale is optional. https://headscale.net

Indeed.

https://tailscale.com/kb/1312/serve

Tailscale serve is within your tailnet

Tailscale funnel is publicly accessible

https://tailscale.com/kb/1223/funnel

https://tailscale.com/kb/1247/funnel-examples