The trick to having no accounts: a device's identity is the hash of its public key, so browser and device verify each other directly. The server keeps no registry, authorizes nothing, and isn't in the data path -- it brokers the introduction and steps aside. About 75% of connections go direct P2P. The rest fall back to a TURN relay that only sees ciphertext. The server is open source and self-hostable -- and since it's out of the data path, cheap to run.
BitBang started on an ESP32, as the networking for a tiny telepresence robot. Embedded development is difficult and slow, so this CLI is where I've beaten the security model into shape. The embedded version is next. :)
And who bears the cost for that (or does it have some FUP) (bandwidth cant be free/unlimited?)
On cost: I pay for it on bitba.ng and it's capped right now at 10 minutes per connection (mostly to prevent people from connecting and walking away). But you're not stuck with mine -- the signaling server is open source, so you can self-host and point it at your own TURN. The Python library supports "bring your own TURN" by specifying (--turn-url, --turn-user, --turn-credential); adding the same flags to the CLI is a small gap I need to close. There are TURN providers that have reasonably generous free tiers.
Could you provide a list of ones you know? Last I looked I wasn't able to find anything fast or reliable.
I had a similar idea but for wireguard only, where you would allow people to join a vpn through a "shared" jumpbox. To get started with wg is very simple, the problem is the same you need public IP address to scaffold everything.
Out of the two options I probably would prefer going wg route, just because it generalizes better. But this is a pretty cool demo of webrtc.
I think Iroh has a way of doing it using either DNS or BitTorrent DHT. Not perfect but fairly decentralized
A browser can't join a DHT though because of no UDP sockets, so the connecting side would need a native client, which is the thing bitbang avoids. And DHT lets you locate the peer, but you still need somewhere to trade SDP and ICE candidates, so the rendezvous stays either way I think.
What I can do is keep the broker small enough that self-hosting is realistic, which is where it is now -- no accounts, no registry, nothing that grants access, only a simple broker.
On generalizing: wg wins for "put these machines on one network." WebRTC wins on reach, because the connecting side can be a browser -- a phone, a borrowed laptop, a machine you don't administer -- with nothing installed. A wg jumpbox still needs a client on both ends and a public IP for the box. Different tradeoff rather than a strictly better one.
Self-hosting is pretty these days with docker. Exposing it to the internet is the annoying part. I do Jellyfin via netbird, but that means I don't really share it with my friends. I hope something like this getting baked into self-hosting flows is killer.
My other pet peeve is that people use 'Cloud Services' for File transfer. Sometimes when they are in the same LAN!
Nice work again and I hope it catches on/people understand how great this really is :)
The friends case is exactly the gap I kept running into. A mesh VPN is fine for my own devices and hopeless the moment someone else needs in, because now they're installing a client and making an account to look at one thing. Here they get a link.
Baking it into self-hosting flows is the right instinct and I'd love help figuring out where it fits. There's already an OctoPrint plugin; Jellyfin seems like the obvious next one.
Then I see the following line in the 'How it compares' section:
"Self-hostable server (open source)": ngrok->No, Cloudflare Tunnel->No, Tailscale->No, Bitbang->Yes
...and I'm like, "It's Open Source Tailscale!"
And now I "get it"! (you know, epiphany, profound enlightenment and all that!) :-)
(Well, it's an open source alternative to Tailscale, to be more precise, and an excellent one at that!)
Great work, Rich LeGrand!
(Another step forward for open source!)