Security & ownership
Programs that share memory instead of calling each other don't need application doors.
That is the whole of it, and it is a consequence rather than a feature. A door exists because something outside is expected to knock — an endpoint to call, an API to version, a service to reach. FrogNet programs don't call each other: a value is written where it is computed and read where it is needed, so the thing a security review usually enumerates was never built. None of this depends on WireGuard — encrypted tunnels are one optional bearer, not what holds the shape up.
Security By Architecture — the probe run on camera, and the challenge.
What follows is the architecture that falls out of that, stated as reduction of exposed surface rather than as a guarantee. FrogNet implements no cryptography of its own.
Your data lives on your machines. You own the nodes, the keys, and everything that passes between them.
A FrogNet node is your computer. The mesh it forms is between your computers and the ones you choose to federate with. Nothing is hosted on my side, nothing is escrowed, and there is no account of yours for me to hold. Ownership isn't a setting — it's where the software runs.
The exposed surface is reduced to what you chose to expose. The fabric's own traffic is captured on the node and served internally rather than published, so what is reachable from outside is the broker address you picked — not an inventory of application services.
One seam, and you own it
FrogNet owns the transport plane on the fabric: traffic to a FrogNet address is captured on the node and funnelled through a single internal seam rather than sent in the open. Everything the fabric carries passes through that one point — over whatever bearer it happens to ride, Wi-Fi, unlicensed radio, or a WireGuard tunnel.
That's what makes the encryption story simple: because everything converges on the one seam you control, that is the one place to encrypt — and doing it there protects everything, over every bearer, WireGuard or not. Encryption is a choice you make at a seam you already own, not a tunnel you have to stand up and hope covers the path.
What the broker does
- Introduces two nodes that can't yet see each other across the internet
- Helps them establish a bearer to connect — a WireGuard tunnel if you use one
- For an internet bridge, relays bytes between them without being able to read them
What the broker can never do
- Read your calls, video, files, or telemetry
- Read your shared memory — the values nodes read and write
- Reach the box from the internet — there's no exposed service to connect to
When something has to take input from the open internet, it goes through a one-way drop.
A node exposes nothing. But a few things have to accept input from the public internet by their nature — the broker's operator console, this site's own license form. The recommended way to do that, and the way the broker host now actually runs, is to make the internet-facing process incapable of doing anything except leaving a note.
What the public tier can do
- Write one request into a directory and wait for an answer to appear in another
- Nothing else — it holds no credential and has no route to the private network
What it can never do
- Present a token — there is none to hold, so even the real token is refused
- Reach the broker or the network — a port answering is not a route in
- Fail quietly — an unreachable broker is a loud, named error, never a plausible success
A request crosses as a file, after it has been checked against a list of the operations allowed to exist — or it does not cross. That is what makes putting the storefront and the broker on one machine safe: the recommended architecture and the deployed one are the same thing.
Standing one up, step by step — running a broker →
The seam is where encryption would go
FrogNet encrypts nothing — it implements no cryptography of its own. But all fabric traffic converges on one internal seam, and the node is a general-purpose Linux box, so there is a single natural place to put encryption if you want it. That is an option the architecture leaves open to you, not something FrogNet does on your behalf. Encrypt there and you have encrypted everything the fabric carries, on any bearer. WireGuard is one optional bearer you can add; the security does not rest on it being present. A plaintext radio hop is still only carrying fabric-owned traffic, and that traffic can be encrypted at the seam before it's ever sent.
Identity: each node proves itself with keys
Every node has a permanent identity and a keypair set at install. Nodes authenticate each other by key, so a peer is trusted because it holds the right key — not because a central authority vouched for it.
Offline: it keeps working
Losing the internet doesn't stop a FrogNet. Nodes that can still reach each other keep discovering, sharing state, and carrying traffic. Local operation was never conditional on a connection to anywhere else.
If the broker disappears
The broker introduces nodes that can't yet see each other across the internet, and it is the inter-site data path — every cross-site packet transits the tunnels it terminates. Lose the broker service and every existing link keeps carrying traffic. Only brand-new cross-internet introductions pause until a broker is reachable again; LAN discovery and existing links carry on.
No central point to compromise
There is no company’s server holding your data, your directory, or your keys — the machines are yours. Be precise about what that does and does not mean. A connected FrogNet elects exactly one node to serve FrogNet Memory, so at any moment there is one machine answering for the network’s current state; taking that machine gets you that machine, and the network elects another. What there is not is a system whose breach exposes the whole network at once: keys are per node and never leave it, the directory is rebuilt from polls rather than stored, and Memory holds current state and no history — so there is no archive to take.
Where the real exposure is — stated plainly
"No internet-reachable attack surface" is a precise claim, not a total one. It means nothing can reach the box from the internet. The exposure that remains is local and physical — and naming it is the point:
1 · Proximity
An attacker in radio range of a bearer can see and interfere with RF the same way they could any radio. This is where encrypting at the seam earns its keep: it makes a captured plaintext bearer carry nothing readable.
2 · Wi-Fi or hardware break-in
Physical access to a node, or to the Wi-Fi it sits on, is access to that node. FrogNet protects the fabric, not a box someone is standing in front of — the rest is standard Linux hardening: disk, accounts, physical control.
3 · Stateful comms
A live session between two nodes exists while it's running. An attacker positioned on the path of a plaintext bearer can observe that a conversation is happening — which is, again, exactly what seam encryption is for.
4 · FrogNet Memory
The shared state nodes read and write lives in memory while the network is up. It isn't escrowed or shipped anywhere, but it exists on the participating nodes for as long as they're part of the network — so a compromised node can read what that node was entitled to see.
Trust assumptions, stated plainly
You trust the hardware you run FrogNet on, the keys your nodes hold, and the peers you choose to federate with. You do not have to trust me, a cloud provider, or a broker with the contents of your traffic — nothing outside can reach the box, and the broker relays every cross-site byte without being able to read it — it terminates the tunnels, and holds neither endpoint keys nor semantic state. What you do own is the one seam everything passes through: that's where you'd encrypt, and doing it there covers every bearer without depending on any one of them. If any of that ever changes, it will be said here, in plain language.
— John W. Fawcett · Fawcett Innovations LLC · john@fawcettinnovations.com
Own it outright
The surest security is a network with no middle.
Nobody can hand over what they never held. Read how the architecture puts you in the only trusted seat, then run your own.
One port must answer. Here is the host, here is the port. Break in and tell me.
The careful formulation above stands — no discoverable application endpoints, no exposed application protocols, no remotely reachable application interfaces. This is the same claim with a target painted on it, and it is the version the book and the videos now both carry.
HTTP is the application interface on both ends. FNWP-1 carries it on the wire — a first contact costs a FULL because no template exists yet, and everything after settles to DIFF and SAME. That is a statement about what the wire carries, not a confidentiality claim. Confidentiality across the open internet comes from the WireGuard bearer.
The standard attack is a pipeline. The pipeline has no first stage.
A conventional application publishes an endpoint, a router, a parser, an authentication path, parameter handling, deserialization, and the logic behind them. The standard attack is a pipeline — find the endpoint, learn its behaviour, find the flaw, build the request, invoke the handler. FrogNet is not better at surviving that pipeline.
So it cannot be read as invulnerability, here are FrogNet's actual threat vectors: host access, wireless admission, WireGuard credentials, an authorised node that has been taken, the broker, local privilege boundaries, supply chain, and bugs in FrogNet itself. The air-gap rejoinder is the point, not a concession — an air gap gets the property by giving up the network.
The scan, published as it ran.
Ports 80 and 443 are a website sharing the machine — a deployment choice, not a FrogNet property. Leaving them out would make the scan look tidier than the world is. The strongest line is nmap's own: 1 service unrecognized despite returning data.
$ nmap -Pn -p 80,443,18257 -sV streamingfrog.com PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.52 443/tcp open ssl/ssl Apache httpd (SSL-only mode) 18257/tcp open unknown 1 service unrecognized despite returning data.
All eight probes returned:
GET / , OPTIONS, RTSP HTTP/1.1 404 Not Found
{"detail":"Not Found"}
RPC, DNS-over-TCP (x2), HTTP/1.1 400 Bad Request
Help, SSL session req, Invalid HTTP request received.
terminal server cookie
Beside it, never upgraded: HTTP is the application interface on both ends. FNWP-1 carries it on the wire — a first contact costs a FULL, everything after settles to DIFF and SAME. That is a statement about what the wire carries, not a confidentiality claim.
Take the broker. Now show me the pivot.
Compromise the broker completely and you still have not compromised a FrogNet. That is a stronger claim than "the broker is hard to attack," because the broker is not merely adjacent to the traffic — it is the inter-site data path. Every cross-site packet transits it. Assume it is owned.
Three things still hold. It holds no endpoint keys, so what transits it is not addressed to it and not openable by it. It runs none of the semantic stack — no templates, no learned structure, no cache — so even decrypted, a frame is a difference against state it has never held: unreconstructable, not merely unread. And it is not a member of any FrogNet — no node identity, no place in a pond, no route inward.
Owning the transit point gives you the transit point. The question is whether that can be turned into the network.
ORACLE 1 broker pivot
given root on the broker; no endpoint keys; no node
red if a new application-level exchange can be originated
with an internal FrogNet-only service
ORACLE 2 application recovery
given root on the broker — all cross-site traffic transits
it, so capture is free
red if protected application content can be reconstructed
without compromising an endpoint
ORACLE 3 credential manufacture
given root on the broker
red if sufficient authority can be manufactured to join as a
legitimate member, without the endpoint secret material
A red run is a finding and a hypothetical is not. State which oracle you are attacking, run it, show the result. The Guild →
Answer in public: the Oracles category on the repository — no licence, no account with us, no permission.