15 ms·
Tailscale’s human-scale networks are still controlled by Google and Microsoft
- ncmncm 5y agoSee, this should be the very first thing we should find out about Tailscale, and not only after we have invested time and effort.
- beardicus 5y agoHow would you invest effort without first signing up, and how would you sign up without learning of these login limitations?
- ncmncm 5y agoIt is not obvious to somebody trying it out that even if they switch up to a paid subscription, they would still depend on dodgy third parties to authenticate.
- newaccount74 5y agoIt's pretty clearly documented on the Tailscale website. This is not something they are hiding.
- redninja83 5y agoFor anyone who has the same issue, Headscale [https://github.com/juanfont/headscale https://github.com/juanfont/headscale] may be an answer, that has simple OpenID integration now
- stormbrew 5y agoHeadscale isn't really anywhere near as useful until there's an ios client. Even one you have to compile yourself and use a developer key to load would be better than none at all.
- EMIRELADERO 5y agoSomewhat related: Why are the iOS, macOS and Windows GUI clients for Tailscale not open-source?
- heavyset_go 5y agoDid the OP get bumped or something? I could have sworn that I read these exact comments the other day, and hn.algolia.com says it was posted 2 days ago[1], along with the comments. Am I having a stroke? [1] hhttps://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=tailscale+human&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- ign0ramus 5y agoYou're definitely not having a stroke. Here is another thread discussing the same thing. I specifically remember the 'polycule' comments. It was my first time learning about that word. [1] https://news.ycombinator.com/item?id=30937892 https://news.ycombinator.com/item?id=30937892
- chaz6 5y agoTailscale does not provide an audit log (who changed what and when). This ought to be part of the MVP for a security offerring.
- wmf 5y agoIf you're an oppressed freedom fighter you have to self-host everything. No aaS will ever pass your risk management and they especially can't afford to do so on the free plan. In this case check out headscale.
- deleted 5y ago[deleted]
- erikh 5y agoZeroTier isn't controlled by anyone other than ZeroTier. Give it a shot! :)
- cyounkins 5y ago"Is there a way to totally bypass ZeroTier's servers?" - https://github.com/zerotier/ZeroTierOne/issues/610 https://github.com/zerotier/ZeroTierOne/issues/610 Bug was "[closed] since it's already on the road map" (???) for 1.4, but after 1.4 release it is still unclear if it is even possible.
- sockaddr 5y agoYeah. What tailscale is doing here seems like a great way to make networking even more fragile than it already is. I've checked out tailscale on occasion but always return to zerotier. I personally run my own zerotier infra. And standing up roots is relatively easy after you get through it once.
- Ir0nMan 5y agoI have not tried ZeroTier yet but have come across it quite a bit lately. What advantages if any would you say it has compared to just running a simple Wireguard VPN into your remote network?
- watermelon0 5y agoZeroTier is peer-to-peer, like Tailscale, and both of them maintain proxies, in case direct connection cannot be established. The main difference (to Tailscale) is that ZeroTier doesn't need an identity provider, since each machine needs to be whitelisted in ZT admin panel.
- cassianoleal 5y agoIt very much needs an identity provider, only they implement it themselves instead of outsourcing it to Google/MS. On Tailscale you also need to whitelist machines in the web console. There's probably an automated way to do it as well but I haven't looked into it since I only use it for a few static hosts. I've migrated from ZT to TS about a year ago because ZT was much slower (network bandwidth-wise) and CPU-intensive than Tailscale on my setup. YMMV.
- renewiltord 5y agoWhat’s a polycule in this context? Apparently it’s a polyamorous relationship group but I don’t see how Tailscale is particularly useful there so it must mean something else.
- mkeedlinger 5y agoI actually don't think it does mean something else. iliana is quite technical; I would imagine that they relate to other technical folk. I have little network services I've shared with friends before, perhaps they do something similar.
- renewiltord 5y agoOh, so like analogous to the polyamory notion of sharing partners, this is about sharing software/infra with other people. To be clear, not alleging it wasn't technical. The polyamory <-> shared services thing just wasn't obvious to me since I was unfamiliar with the term.
- titanomachy 5y agoI believe that the author is literally polyamorous, has a community of romantic partners that they refer to as a "polycule", and wishes to operate a VPN exclusively for members of that community. I don't think it's meant as a metaphor.
- renewiltord 5y agoOh! Well, can't say that's my proudest moment. Thanks for explaining!
- LilBytes 5y agohttps://twitter.com/ilianathewitch/status/1511136118284070916/photo/1 https://twitter.com/ilianathewitch/status/151113611828407091... Definitely right.
- ggpsv 5y agoI've been using Tailscale for a couple of personal use cases and it has become one of my favorite products. It really simplified my setup and it "just works". That said, I share OP's concerns as someone who has been evaluating alternatives to Google Workspace and Office 365. It is understandable that they may be prioritizing a B2B model, a decision which may be at odds users like OP and myself. That said, I still recommend it to teams/people who do not share this concern. I hesitate investing further than my current setup because of this reason and I've been investigating whether Headscale/ZeroTier fit the bill. It is a shame because it is such a great product and it has been a while since I last had an equivalent experience using software.
- systemvoltage 5y agoWhat is the use case for Tailscale? I can ssh into machines without issue. Configure a firewall port and allow only ssh connections. I’m curious because Tailscale is on HN every other day. I’d like to give it a try but not sure for what problem I have.
- atonse 5y agoIt’s VPN software hooked up to external authentication. So your SSH server wouldn’t even need to have a public IP. which is yet another guard. And the proper authentication adds extra layer of identity guarantees so you know who can and can’t access network resources.
- dx034 5y agoCan it really work if the server doesn't have a public IP? It works if the server blocks all incoming traffic, but doesn't it have to be routable? It can of course work via DHCP, but I would consider my devices at home still to have a public IP, even if they share it.
- archseer 5y agohttps://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
- X-Cubed 5y agoThere are alternative solutions available for those that don't like the Tailscale authentication model, including using Wireguard directly. Tailscale does not need to be all things to all people, and especially not at the free tier for personal use. Adding extra complexity to the product would mean that it would no longer be the easy to use tool that it currently is.
- dddw 5y agoNebula from slack, but very beta.
- spydum 5y agoAgree, and by leveraging other common IDPs, they take themselves out of the high touch account management tasks for that tier.
- notriddle 5y agoIt's funny how you think Google does high-touch account management.
- derefr 5y agoIt's maybe clearer to say, Google enables any company's Google Workspace administrator to do high-touch account management, and/or to set up tricky things with accounts. There's BeyondCorp; there's two-way SAML directory binding (i.e. Google can be your enterprise's IdP for other service, or you can use your enterprise's IdP to sign into Google!); there's GCP Application Default Credentials; MFA device bindings; "application passwords" to pass through 2FA requirements; the ability to tell the auth layer to temporarily disable a user's password prompts via the admin dashboard; Google Take-out; Workspace account data export for terminated users; detachable adjunct accounts (e.g. Youtube channels); etc x1000. Did you know that tucked away within every Google account is a set of AWS-looking credentials, that exist only to allow object-storage clients that only speak the de-facto "S3-compatible" object-storage API, to interact with Google Cloud Storage, authed as a given user? That's the kind of thing that using Google as your IdP gets you. Github, meanwhile... if you're not using Github Enterprise, you can't even sync team memberships from your enterprise directory, so you have to grant your HR people org admin(!) access, so that they can grant and revoke team memberships during employee onboarding/offboarding.
- AdamJacobMuller 5y ago> Tailscale runs on pretty much anything I run it on an SFP: https://plumspace.com/products/smart-sfp/ https://plumspace.com/products/smart-sfp/ It's cool.
- vkat 5y agoNot available anymore? Product page says contact an email address for buying.
- AdamJacobMuller 5y agoThey probably are. I had to email them and send an international wire transfer.. it was not one-click shopping. They are russian but shipped from Germany though, so, sanctions maybe they aren't able to sell anymore, dunno.
- nsonha 5y agoI'm dumb, could you explain what this does and potential uses in home network?
- pzduniak 5y agoIt's an ARM Linux device that you plug into a port that's usually only present in switches.
- johnbellone 5y agoI’d love to hear more about this. Do you happen to have a write up?
- dilyevsky 5y agohttps://blog.benjojo.co.uk/post/smart-sfp-linux-inside https://blog.benjojo.co.uk/post/smart-sfp-linux-inside Tl;dr - they baked a computer inside of network connector cuz it’s already huge. To do… stuff. Kinda like bmc
- kajiryoji 5y agoIf you don't want your technology to have a proprietary stack, then definitely checkout Nebula[1]. It's very easy to setup and works very well in my experience. [1]: https://github.com/slackhq/nebula https://github.com/slackhq/nebula
- brnt 5y agoCan you compare it to Yggdrasil?
- attackroll 5y agoI like how "I’m not sure if they realize it yet, but Tailscale seems to work extremely well for polycules." is thrown in, as if its usual for any company to know what a "polycule" is.
- alexktz 5y agoI had to look it up. A romantic network, or a particular subset of relationships within a romantic network, whose members are closely connected. They can be intimate, familiar, romantic, or sexual in nature , but not limited to. The polycule created is unique to the people involved and the variations, they create.
- groby_b 5y agoAny company in the Bay Area that isn't tiny definitely has somebody on board who knows what a polycule is :)
- adamcstephens 5y agoI'm not sure what this comment is meant to imply, except that Bay Area is the only place that matters?
- groby_b 5y agoIt is specifically addressing the GPs statement "as if its usual for any company to know what a 'polycule' is." It is usual for a large number of companies (and tech folks) to know what that means, but disproportionately so for the Bay area. The blog poster certainly works for a company I'd call Bay adjacent, so they wrote in a language familiar to them. It has nothing to do with "only place that matters", but simply explaining that given the context of the writer, it's a high likelihood they assume general familiarity.
- recuter 5y agoSick. :P
- beardicus 5y agoHaving to use Google or GitHub to log into Tailscale definitely gave me pause when I was signing up. I actually pumped the brakes for a few months when I first encountered that, but eventually relented and chose GitHub. I don't particularly _want_ another login, but I also don't cherish the thought of losing access to Service A because of the actions of Service B.
- deleted 5y ago[deleted]
- aftbit 5y agoAgreed, I also am not using tailscale because of this choice.
- afeiszli 5y agoI'd like to offer Netmaker as an alternative. Caveat, I'm one of the creators so grain of salt, etc. It's completely self-hosted, so none of your traffic will go through our servers. You can also use basic auth by default (though there is also OAuth). Finally, as a bonus, it's much faster because you can use kernel WireGuard. I won't claim it's as user-friendly as Tailscale (yet). It definitely requires more technical knowledge to set up, especially considering it's not a SaaS. But if you're willing to get through the initial setup (Day 0 / Day 1), you should be golden.
- adamcstephens 5y agoWhat is your solution for mobile clients? A quick perusal didn't show anything in the docs.
- afeiszli 5y agoWe don't have our own mobile client yet, so right now we rely on the WireGuard app. You configure a gateway, and then generate raw WireGuard configs + QR codes which hook them into the network: https://docs.netmaker.org/external-clients.html https://docs.netmaker.org/external-clients.html
- 5y ago
- silisili 5y agoThere's something really amiss with this thread. I saw all these comments a day or two ago, but it's saying they are new?
- Arnavion 5y agoI've seen HN do this once before. It took a post from a day ago and changed all the timestamps to be "current time minus a few minutes". It was this thread [1], specifically the first two comments in this subthread [2] had their timestamps faked. The third comment is from after it had been resurrected with the fake timestamps. [1]: https://news.ycombinator.com/item?id=30510400 https://news.ycombinator.com/item?id=30510400 [2]: https://news.ycombinator.com/item?id=30511216 https://news.ycombinator.com/item?id=30511216
- ggpsv 5y agoThat's right. I posted this one the other day https://news.ycombinator.com/item?id=30913492 https://news.ycombinator.com/item?id=30913492
- silisili 5y agoRight, I was noticing specifically SOLAR_FIELDS comment here - https://news.ycombinator.com/item?id=30913492#30914165 https://news.ycombinator.com/item?id=30913492#30914165 On both threads it says 4 hours ago. I thought I was going insane because I remember googling Netmaker at the time, and it definitely wasn't today. Clicking into their profile shows the comment '1 day ago'