From 8a131b42dd3d7f809bfe9cb359f897a654455be6 Mon Sep 17 00:00:00 2001 From: Alper Gundogdu Date: Fri, 18 Sep 2026 11:49:35 +0100 Subject: [PATCH 1/2] fix(blog): remove retired QUIC 0-RTT claim from why-now The transport section claimed decdn uses QUIC 0-RTT on cdn/probe/v1 and cdn/dht/v1 and "collapses discovery to one-way RTT." That is not how decdn works: every connection completes a full TLS 1.3 handshake. The cold-start cost is bounded by concurrent probing (a ~500ms collection window with early exit) plus connection reuse and QUIC stream multiplexing, per ADR 001/005. Rewrite the bullet to describe the actual mechanism and state explicitly that decdn does not use 0-RTT. Co-Authored-By: Claude Opus 4.8 --- content/blog/01-why-now.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/blog/01-why-now.mdx b/content/blog/01-why-now.mdx index 48ef623..f94bdd4 100644 --- a/content/blog/01-why-now.mdx +++ b/content/blog/01-why-now.mdx @@ -15,7 +15,7 @@ Decentralized CDNs have been attempted for a decade. Most got stuck before they QUIC was an IETF draft until 2021. By 2024 it carried roughly a third of public web traffic and shipped natively in every major OS. The properties that matter for a delivery network are now load-bearing parts of the public internet, not a thing we have to build. -- **0-RTT connection establishment.** A repeat connection sends application data in the first packet, no handshake round-trip. For a CDN where probe fan-out is the critical-path latency — a cache-miss probes ~30 peers in parallel — this collapses inter-continental discovery from ~250–500ms down to one-way RTT. We use 0-RTT on `cdn/probe/v1` and `cdn/dht/v1`. Five years ago we'd have had to build it on top of TCP+TLS ourselves and accept 2× the discovery latency. +- **Concurrent probing, then connection reuse.** For a CDN the critical-path latency is probe fan-out, not the handshake: a cache-miss probes ~30 peers in parallel over `cdn/probe/v1` and `cdn/dht/v1`, taking the fastest good answers within a bounded ~500ms collection window and exiting early once enough reply. Every connection still completes a full TLS 1.3 handshake — decdn does not use 0-RTT — but connection reuse and QUIC stream multiplexing carry repeat requests over an already-open connection instead of paying a fresh handshake each time. Five years ago we'd have had to build all of this on TCP+TLS ourselves. - **NAT traversal as a library function.** iroh ships hole-punching, relay fallback, and direct-path upgrade as a single `Endpoint` API. The fraction of node operators behind residential NAT we can usefully include just went from ~10% to ~95% without us writing networking code. - **Connection migration.** A node operator's IP changing mid-stream — laptop sleep, mobile handoff, ISP renegotiation — doesn't kill the delivery session. This is the difference between "you need a static IP and a real datacenter" and "your spare 1U at home counts." From f8573392f1e7d6e9482f5c3a06f67d918b153148 Mon Sep 17 00:00:00 2001 From: Alper Gundogdu Date: Fri, 18 Sep 2026 12:03:50 +0100 Subject: [PATCH 2/2] fix(blog): grammar in why-now transport bullet Comma after the introductory "For a CDN," and "once enough reply" -> "once enough replies arrive" to fix the subject/number mismatch. Co-Authored-By: Claude Opus 4.8 --- content/blog/01-why-now.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/blog/01-why-now.mdx b/content/blog/01-why-now.mdx index f94bdd4..22bc503 100644 --- a/content/blog/01-why-now.mdx +++ b/content/blog/01-why-now.mdx @@ -15,7 +15,7 @@ Decentralized CDNs have been attempted for a decade. Most got stuck before they QUIC was an IETF draft until 2021. By 2024 it carried roughly a third of public web traffic and shipped natively in every major OS. The properties that matter for a delivery network are now load-bearing parts of the public internet, not a thing we have to build. -- **Concurrent probing, then connection reuse.** For a CDN the critical-path latency is probe fan-out, not the handshake: a cache-miss probes ~30 peers in parallel over `cdn/probe/v1` and `cdn/dht/v1`, taking the fastest good answers within a bounded ~500ms collection window and exiting early once enough reply. Every connection still completes a full TLS 1.3 handshake — decdn does not use 0-RTT — but connection reuse and QUIC stream multiplexing carry repeat requests over an already-open connection instead of paying a fresh handshake each time. Five years ago we'd have had to build all of this on TCP+TLS ourselves. +- **Concurrent probing, then connection reuse.** For a CDN, the critical-path latency is probe fan-out, not the handshake: a cache-miss probes ~30 peers in parallel over `cdn/probe/v1` and `cdn/dht/v1`, taking the fastest good answers within a bounded ~500ms collection window and exiting early once enough replies arrive. Every connection still completes a full TLS 1.3 handshake — decdn does not use 0-RTT — but connection reuse and QUIC stream multiplexing carry repeat requests over an already-open connection instead of paying a fresh handshake each time. Five years ago we'd have had to build all of this on TCP+TLS ourselves. - **NAT traversal as a library function.** iroh ships hole-punching, relay fallback, and direct-path upgrade as a single `Endpoint` API. The fraction of node operators behind residential NAT we can usefully include just went from ~10% to ~95% without us writing networking code. - **Connection migration.** A node operator's IP changing mid-stream — laptop sleep, mobile handoff, ISP renegotiation — doesn't kill the delivery session. This is the difference between "you need a static IP and a real datacenter" and "your spare 1U at home counts."