Top
Best
New

Posted by brogu 1/19/2026

Reticulum, a secure and anonymous mesh networking stack(github.com)
349 points | 94 commentspage 2
blacklion 1/20/2026|
Does anybody know how good routing in this Project protected from malicious actors, or simply badly configured nodes?

As far as I know, most mesh routing protocols is very sensitive to rogue nodes, even if it is misconfiguration and not malicious intent...

ogurechny 1/21/2026||
With current size of the network, it's probably managed by sending messages to operators chat “Hey, IP a.b.c.d is doing that again”.

Remember that Fido and Usenet relied on independent server admins voluntary enforcing the rules for global groups (and allowed the alternative sister hierarchies or local appendices with different rules). It is possible to give more power to local decision maker, and share the global ideas.

Link establishment mentions validation of the circle by the intermediate hops. I suppose that someone who is sending a lot of packets without participation from the other side can be put into exponentially worse and worse queues. Or maybe not. There's a lot of things to test.

blacklion 1/21/2026||
I mean, this is not a solution if we want winder adoption.

I was FIDONet node (and even hub) sysop, and I remember well, that FIDO was rigid hierarchical structure — you have your NC, and NC can discommunicate any node in his network. Yes, it was elected position, but after elections it was mostly dictatorship.

It doesn't seems like «Fully self-configuring multi-hop routing over heterogeneous carriers» advertised by this project, rather opposite.

Evanito 1/20/2026||
> Does anybody know how good routing in this Project protected from malicious actors, or simply badly configured nodes?

Reticulum requires you to manually define your uplinks, including remote servers. If this remote server is blackholing your traffic, you are SOL.

If you define multiple remote servers, then you may be in luck iff your destination is advertising its route on a path (chain of servers) that has no such hostile nodes.

blacklion 1/21/2026||
So, looks like no «Fully self-configuring multi-hop routing over heterogeneous carriers».
otikik 1/20/2026||
> The Old Way: "I trust this site because the browser says the lock icon is green".

> The Zen Way: "I trust this destination because I have verified its hash fingerprint out-of-band, and the math confirms the signature".

PGP already tried something along those lines. It did not see any adoption.

Problem with that approach is: UX is horrible. If someone technical like myself struggled to get it up and running correctly, what chance do less technical folk have?

If you want to build a really boutique environment for 3 guys to feel good about themselves, the Zen path is the right path.

If you want the public to adopt it, you need that green lock icon.

NewJazz 1/20/2026||
The Software shall not be used, directly or indirectly, in the creation of an artificial intelligence, machine learning or language model training dataset, including but not limited to any use that contributes to the training or development of such a model or algorithm.
snickerer 1/20/2026||
Mark's Reticulum implementation has a strong ideolgical background. Not just the oppositon to AI. If anybody is interested in what drives the developer, here's the manifesto: https://github.com/markqvist/Reticulum/blob/master/Zen%20of%...
dotty- 1/20/2026||
I saw this too and immediately thought: well, they published this on GitHub which surely has a clause that grants it a license to use the code for training Copilot for Microsoft at a minimum, sooo should've published on another Git platform.
promiseofbeans 1/20/2026|||
> This repository is a public mirror. All development is happening elsewhere.

So if I have code on a personal (but publicly exposed) git server with a license that includes the above quoted terms, and someone decides they want to be helpful and publish a public read-only mirror of my code to GitHub, then they’re allowed to accept that license on my behalf? I never did a thing and yet I’m now in a contract with Microsoft? How does this work legally?

gpm 1/20/2026|||
Not a lawyer but I'm pretty sure:

1. Microsoft does not gain the license, but will be able to argue that they aren't intentionally committing copyright infringement in the cases where that distinction matters.

2. If Microsoft does something resulting in damages because they thought they had a license, their indemnification clause kicks in and they can recoup those damages from the user who uploaded it (to the extent that that user doesn't go bankrupt anyways)

3. Likely none of this matters because your license can't prevent activities that weren't prohibited by copyright in the first place, and training doesn't appear to be a prohibited activity at least under US law.

exitb 1/20/2026|||
When code is published on GitHub, GitHub itself is not bound by the public-facing license, but rather license grants the uploader aggress to as part of the terms of service. That points to the uploader as a responsible party.

In practice though, none of that is even remotely enforceable.

avodonosov 1/20/2026|||
Not sure GitHub has such a clause. Just looked at their terms and don't see it.
gpm 1/20/2026||
See term D.4., the relevant part of which is

> You grant us and our legal successors the right to store, archive, parse, and display Your Content, and make incidental copies, as necessary to provide the Service, including improving the Service over time. This license includes the right to do things like [...] or otherwise analyze it on our servers; share it with other users

AceJohnny2 1/20/2026||
That could be boilerplate legalese for "obviously we need access to your code if we're to display and share it (as is the purpose for a public git host)"
gpm 1/20/2026||
It doesn't matter what the original purpose of the terms was it matters what they do.
zxcvasd 1/20/2026||
[dead]
throw7 1/20/2026||
Doesn't look like a free software license. No purposeful harm to humans and no AI usage direct or indirect.
ronsor 1/20/2026|
I dislike these "non-free" licenses because the actors they purport to stop aren't going to care (why would a terrorist cell care about licenses? if AI training is fair use, then why would AI companies care about licenses?). All it does is create obstacles for legitimate people.
arthurmorgxn 1/20/2026||
This is cool, I’ve been playing around Offline Protocol’s DORS SDK that they put out last month and it’s been great for cross platform whereas Bitchat’s Noise setup was a little more cumbersome to get started. Need to dig more into LoRa meshes.
andybak 1/20/2026||
So not this Reticulum networking stack: https://github.com/Hubs-Foundation/reticulum
samantp 1/20/2026||
Looks great. Does it need all users to install Reticulum, or app/service prividers (online shop etc) on Reticulum can make their services available for access via browsers?
405nm 1/20/2026|
all users need to be running the reticulum network stack to be able to send, receive, and route packets.

reticulum itself describes the network stack (like tcp/ip) and it has its own protocols like LXMF for messaging and LXST for streaming. applications can be built on top of these protocols.

it’s different than IP, instead of addresses, each node has an identity that’s a cryptographic key pair that you send messages to, the routing happens in the background regardless of network topology or diversity of link types.

you CAN send reticulum packets over a TCP/IP adapter and thus across the normal Internet (there are a lot of testnet and community nodes that are accessed this way), but the protocol also seamlessly bridges over any interface (lora, bluetooth, HAM radio, etc) that is attached to the node.

so like, there could be a message sent over lora to a base station that relays it to another server through the internet, then that server sends it out over a ham radio link to another computer somewhere else, etc.

all the message sender has to know is the pubkey of the node they want to talk to, and the network figures out how to establish a link.

128 hops maximum.

the prerolled binaries of the aforementioned software include the network stack and easy enough presets to find content from other nodes and people to talk to.

TheCraiggers 1/20/2026||
Anybody have any experience running this on a tdeck? I'm kinda toying with the idea of ordering a couple just to play with.
pwndByDeath 1/20/2026|
It is not yet like meshtastic in that. Rnode is more of a lora modem than a lora server. There is a micro recticlum project but not out yet.
TheCraiggers 1/20/2026||
Ahh, yes. I see that now. I appreciate the correction.
egberts1 1/20/2026|
What all three need is a multiple-spanning tree for its master node and supporting slave nodes, much like eBGP.