If you're using iroh-blobs you might be interested in a security fix: https://www.iroh.computer/blog/iroh-blobs-push-fix

New releases of iroh.

Nothing major in terms of features, but we did manage to significantly reduce the binary size.

So now this entire embedded device zoo is running iroh from crates.io. No more patch needed.

https://www.iroh.computer/blog/iroh-1-3-0

> Be alert: targeted attacks on prominent Rustaceans

Alert: You might be a prominent Rustacean without noticing

https://blog.rust-lang.org/2026/09/17/targeted-attacks/

As main talk, we'll hear about #Iroh, the QUIC-based peer to peer network written in Rust, by one of their developers, Philipp. :rust:

Then, we'll hear up to three lighting talks about NixOS or Rust. Reach out if you have something you want to present and talk about! :blobcatspace:

If you are at #RustConf this week and would like to talk about #iroh, we'll be there!

iroh 1.1.0 is out: https://github.com/n0-computer/iroh/releases/tag/v1.1.0
No major new features, semver made us bump the minor version.

There is now a post from the crates.io security team about this as well: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/

Please be careful if any of your CI jobs ran during this period, or if you did a build yourself. Consider the machines and any credentials on it compromised. A simple check is to look for the malicious crates in `~/.cargo/registry/src/`, but that is not comprehensive and depends on your setup.

The compromised crate depended on a fake `proc-macro1` crate from a typosquatted maintainer. `proc-macro1` in turn had a malicious build.rs file which downloaded an unknown payload. That payload remains running afterwards, and connects to 23.254.165.112. More is not yet known about it. Other propular crates that were compromised at the same time were `internment` and `append-only-vec` which also had their dependency changed to the malicious `proc-macro1` crate.

Please be aware that this morning at about 07:10 UTC a malicious version (0.3.10, now removed) of the `arrayref` crate was published. This crate is a transitive dependency of `iroh`, via `blake3` so might have made it onto your machine or CI machines if you happened to update the dependencies before the crates.io security team removed the compromised crates about an hour later.

At the IETF126 meeting in Vienna this week? Want to chat about iroh? About QUIC? Multipath? Holepunching?
Ping us!

The meandering wanders of trying to find out what iroh was:
https://www.iroh.computer/blog/the-road-to-iroh-1-0

Running a self-hosted iroh relay? We have a security fix!
https://www.iroh.computer/blog/iroh-1-0-2

https://github.com/adonm/zuko starting to feel useful (built on @n0iroh and ghostty by @mitchellh ) #ghostty #iroh #kitty #zuko #cage #wayland #ios #linux #bluefin

And our first stable release is out: 1.0.1
Enjoy the quiet bugfixes.

Someone else wrote a lovely overview of iroh: https://kerkour.com/iroh-v1-p2p

Just updated Beaver to use the 1.0 release of @n0iroh in https://tangled.org/me.webbeef.org/beaver/commit/31d0ef05296403bf04a0df4bb1823bc64e5b8074

Iroh is what enables all the cross-device functionality in Beaver by taking care of all the low-level side of things: device discovery, sending bytes around reliably. It "just works"!

4 years, 65 versions, and now iroh 1.0. Here's to the next chapter and stability: a wire protocol you can depend on, with plenty of incremental features on the roadmap.

Dial keys, stay connected.

https://www.iroh.computer/blog/v1

#p2p #iroh #networking
#rust
#python #nodejs #kotlin #swift

Our avid explorer wondered how #QUIC address validation tokes work and what they are good for. And wrote it down: https://www.iroh.computer/blog/address-validation-tokens

(and found some ways in which #iroh can improve wrt them)

The final countdown: iroh v1.0-rc.1 is now ready. Please test it! If you don't report anything serious it'll be called 1.0 in two weeks time.

#iroh #p2p #quic