Security & ownership
The security comes from the shape, not from a promise.
A FrogNet node exposes nothing to the internet. It runs no listening service anyone outside can reach — the node captures the fabric's own traffic and funnels it through a single internal seam. So the questions a security review usually asks about open ports, exposed APIs, and cloud-held data are answered by the architecture before anyone writes a policy. None of this depends on WireGuard — encrypted tunnels are one optional bearer, not the thing holding the security up.
Your data lives on your machines. You own the nodes, the keys, and everything that passes between them.
A FrogNet node is your computer. The mesh it forms is between your computers and the ones you choose to federate with. Nothing is hosted on my side, nothing is escrowed, and there is no account of yours for me to hold. Ownership isn't a setting — it's where the software runs.
The box has no internet-reachable attack surface. Nothing outside can connect to it, because there's no listening service exposed to reach — the fabric's traffic is captured and served internally, not published to the network.
One seam, and you own it
FrogNet owns the transport plane on the fabric: traffic to a FrogNet address is captured on the node and funnelled through a single internal seam rather than sent in the open. Everything the fabric carries passes through that one point — over whatever bearer it happens to ride, Wi-Fi, radio, ham, or a WireGuard tunnel.
That's what makes the encryption story simple: because everything converges on the one seam you control, that is the one place to encrypt — and doing it there protects everything, over every bearer, WireGuard or not. Encryption is a choice you make at a seam you already own, not a tunnel you have to stand up and hope covers the path.
What the broker does
- Introduces two nodes that can't yet see each other across the internet
- Helps them establish a bearer to connect — a WireGuard tunnel if you use one
- For an internet bridge, relays bytes between them without being able to read them
What the broker can never do
- Read your calls, video, files, or telemetry
- Read your shared memory — the values nodes read and write
- Reach the box from the internet — there's no exposed service to connect to
When something has to take input from the open internet, it goes through a one-way drop.
A node exposes nothing. But a few things have to accept input from the public internet by their nature — the broker's operator console, this site's own license form. The recommended way to do that, and the way the broker host now actually runs, is to make the internet-facing process incapable of doing anything except leaving a note.
What the public tier can do
- Write one request into a directory and wait for an answer to appear in another
- Nothing else — it holds no credential and has no route to the private network
What it can never do
- Present a token — there is none to hold, so even the real token is refused
- Reach the broker or the network — a port answering is not a route in
- Fail quietly — an unreachable broker is a loud, named error, never a plausible success
A request crosses as a file, after it has been checked against a list of the operations allowed to exist — or it does not cross. That is what makes putting the storefront and the broker on one machine safe: the recommended architecture and the deployed one are the same thing.
Standing one up, step by step — running a broker →
The seam is the encryption point — not WireGuard
All fabric traffic converges on one internal seam. Encrypt there and you've encrypted everything the fabric carries, on any bearer. WireGuard is one optional bearer you can add; the security does not rest on it being present. A plaintext radio hop is still only carrying fabric-owned traffic, and that traffic can be encrypted at the seam before it's ever sent.
Identity: each node proves itself with keys
Every node has a permanent identity and a keypair set at install. Nodes authenticate each other by key, so a peer is trusted because it holds the right key — not because a central authority vouched for it.
Offline: it keeps working
Losing the internet doesn't stop a FrogNet. Nodes that can still reach each other keep discovering, sharing state, and carrying traffic. Local operation was never conditional on a connection to anywhere else.
If the broker disappears
The broker only introduces nodes that can't yet see each other across the internet. Lose the broker service and every existing link keeps carrying traffic. Only brand-new cross-internet introductions pause until a broker is reachable again; LAN discovery and existing links carry on.
No central point to compromise
There is no master server holding your data, your directory, or your keys. Each node holds its own. That means there is no single system whose breach exposes the network — because the network isn't kept in one place.
Where the real exposure is — stated plainly
"No internet-reachable attack surface" is a precise claim, not a total one. It means nothing can reach the box from the internet. The exposure that remains is local and physical — and naming it is the point:
1 · Proximity
An attacker in radio range of a bearer can see and interfere with RF the same way they could any radio. This is where encrypting at the seam earns its keep: it makes a captured plaintext bearer carry nothing readable.
2 · Wi-Fi or hardware break-in
Physical access to a node, or to the Wi-Fi it sits on, is access to that node. FrogNet protects the fabric, not a box someone is standing in front of — the rest is standard Linux hardening: disk, accounts, physical control.
3 · Stateful comms
A live session between two nodes exists while it's running. An attacker positioned on the path of a plaintext bearer can observe that a conversation is happening — which is, again, exactly what seam encryption is for.
4 · Transient database
The shared state nodes read and write lives in memory while the network is up. It isn't escrowed or shipped anywhere, but it exists on the participating nodes for as long as they're part of the network — so a compromised node can read what that node was entitled to see.
Trust assumptions, stated plainly
You trust the hardware you run FrogNet on, the keys your nodes hold, and the peers you choose to federate with. You do not have to trust me, a cloud provider, or a broker with the contents of your traffic — nothing outside can reach the box, and the broker only introduces nodes and relays bytes it can't read. What you do own is the one seam everything passes through: that's where you encrypt, and doing it there covers every bearer without depending on any one of them. If any of that ever changes, it will be said here, in plain language.
— John W. Fawcett · Fawcett Innovations LLC · john@fawcettinnovations.com
Own it outright
The surest security is a network with no middle.
Nobody can hand over what they never held. Read how the architecture puts you in the only trusted seat, then run your own.