27 ms·

Tailscale raises $100M

• gobins 4y ago
  Would love to work for Tailscale but the openings are limited to US and Canada.
• mywaifuismeta 4y ago
  Nice charts without axes. I use those all the time. Especially in pitch decks.
  • nix23 4y ago
    I use them in benchmarks too!
• RobertRoberts 4y ago
  This sounds just creepy that they are suggesting no more anonymity on the internet... as a "fix".
  • jaywalk 4y ago
    What a strange and utterly incorrect way to interpret Tailscale's mission.
    • orangepurple 4y ago
      From the website: What if we all just had a static IP address, and a DNS name? …and the address migrated around the world with you? …and you could connect to any of your devices no matter where they were? Does this not promote the destruction of anonymity on the Internet?
      • jaywalk 4y ago
        I think you've got a fundamental misunderstanding of what Tailscale does. It's all about accessing your own devices. You don't need or want anonymity in that case. They are not a general purpose VPN service, and can't even be used as one.
        • RobertRoberts 4y ago
          No, I think you misunderstand that companies like this have huge visions, not tiny one like "just your own devices". They are claiming they are on the road to "fix the internet", their own words.
        • cassianoleal 4y ago
          > They are not a general purpose VPN service, and can't even be used as one. I'm not sure what you mean by this, but this sounds like exactly what they are, with some functionality on top. It's what I use to VPN into my LAN from outside, and it's pretty general purpose from where I stand.
          • jaywalk 4y ago
            I'm talking about services like NordVPN, Mullvad, etc. They do not funnel your Internet connection through their servers.
            • cassianoleal 4y ago
              Ah, fair enough. Those are not general purpose VPNs though. In fact, they are not even VPNs in the first place. They merely use the same technology to provide a private tunnel to the public Internet (and use the name in marketing material because by now people are familiar with it). What they are not is general purpose private networks.
              • jaywalk 4y ago
                They are absolutely VPNs. If you don't like my term "general purpose" that's fine, but they 100% fit the definition of VPN.
                • cassianoleal 4y ago
                  A VPN is a Virtual Private Network. Those services you mentioned merely provide a secure tunnel to the same public Internet you'd have access without them, avoiding eavesdropping by your ISP or other intermediaries, whilst handing over that capability to the "VPN" provider. There is no private network anywhere in this case. An actual VPN provides you with a private network that just happens to workover of the public Internet, usually encrypted, but is inaccessible from it. A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The benefits of a VPN include increases in functionality, security, and management of the private network. It provides access to resources that are inaccessible on the public network and is typically used for remote workers. Encryption is common, although not an inherent part of a VPN connection. * https://en.wikipedia.org/wiki/Virtual_private_network https://en.wikipedia.org/wiki/Virtual_private_network
      • lvh 4y ago
        No? The fact that some machines (notably: all your _own devices_) need to be able to reliably talk to each other does nothing to impact anonymity on the Internet. Sure, you can route everything out of your own IP using Tailscale also, and that might be desirable if you're on a crappy connection, but it's still completely orthogonal to privacy-preserving techniques like Tor (and may in fact make those easier to deploy). Tailscale doesn't make privacy worse any more than the fact that to a first approximation, no residential Internet provider in the US has rotated an IP in recent memory. (Disclosure: I'm a (small) investor via Latacora's sibling fund, Lagomorphic.)
    • RobertRoberts 4y ago
      It's not their "mission" but it is their system. If you have a static IP address where "...the address migrated around the world with you..." how do you think that will work for people that _NEED_ anonymity? Will they be left out of this new internet?
      • jaywalk 4y ago
        Tailscale is for accessing your own devices, it's not a general purpose VPN service. Anonymity is not a factor.
        • RobertRoberts 4y ago
          The title of the article from Tailscale is "...to fix the Internet"... if it was "only" about "your own devices" then you are assuming they are thinking small.
          • jaywalk 4y ago
            You're assuming that they're thinking something completely outside of anything they've ever said, and something that nobody actually wants. Your assumption is the one that's out of left field, not mine.
            • RobertRoberts 4y ago
              You haven't proved me wrong, you just said I am wrong.
              • jaywalk 4y ago
                I don't have to prove you wrong, I'm not making an assertion. It's on you to prove that your assertion is correct, and you have nothing more than your opinion backing you up.
                • RobertRoberts 4y ago
• tosh 4y ago
  Great product. One of the very few that "just works" and "gets better all the time".
  • contravariant 4y ago
    I hope they don't eventually sacrifice the former in favour of the latter like so many other companies did.
• joshbaptiste 4y ago
  "To paraphrase Larry Wall, Tailscale makes easy things easy" .. Indeed, I run multiple devices via two regionally separated homes and two cheap VPS's .. RaspberryPi, Linux, MacOS and an iPhone all able to communicate effortlessly thanks to TS
  • ignoramous 4y ago
    Quoting Larry Wall there is surely a dig against the HN crowd that likes to quote Rich Hickey's Simple made easy presentation often? https://www.youtube-nocookie.com/embed/LKtk3HCgTa8 https://www.youtube-nocookie.com/embed/LKtk3HCgTa8
• newhouseb 4y ago
  Tailscale is my favorite (product) discovery of 2022. I initially set it up to use as a VPN to get around a misbehaving corporate firewall and accidentally realized it solved a whole bunch of other problems I didn't realize I had. Usually a new product doesn't even live up to the intended use case and so TS is really anomalous IMHO in how good it is. - SSH'ing into a raspberry pi I have at home that does random IoT stuff. - Accessing servers on my local dev machine from other devices for testing (i.e. a Windows box or phone) - Giving access to production bastion devices without publicly exposing anything to the internet. And best of all I don't have to fiddle with the usual networking stuff. It just works. Kudos on the raise! Non-disclaimer: I have no relation to anyone on the team. Tailscale is just a delight to use.
  • cogogo 4y ago
    I've been using it since last summer to SSH to my pi too. Huge relief in terms of securing it. Easy to install and it just works. I'm not particularly savvy either. My only complaint is that if you use it on your phone (iphone 11) and forget to turn it off it drains the battery like crazy.
    • natrys 4y ago
      When I tried Tailscale it seemed to have high CPU problem in general under reasonable load. I don't remember the numbers, but it made me uncomfortable to use it in my low powered servers. I wonder if this is the consequence of being a userspace program unlike wireguard kernel module.
  • chrisweekly 4y ago
    Similar experience. It's profoundly good UX atop a fundamentally strong stack.
  • jclardy 4y ago
    Same here - I've found a ton of uses, for one I can now access my Home Assistant instance without actually exposing it to the internet. Same for the linux VMs I run via ESXi on the same Intel NUC. I can also access my QNAP NAS without exposing that to the internet which is huge given how many vulnerabilities have been found with it. It actually allows me to turn my iPad Pro into a proper development machine as long as I have access to the internet since I can write code locally via Textastic, push to my git repo and test via the VM connected to Tailscale. Of course this was possible with a box on DigitalOcean but I prefer not to pay monthly for a machine just for noodling around.
• HWR_14 4y ago
  I know it was supposed to be a funny throwaway line, but I am irked by the "with $100 million you could interrupt the Super Bowl for 7 full minutes." That's not how sports advertising runs works. You are bidding on a limited amount of space determined by the game. I think there is also a non-linear cost.
  • jaywalk 4y ago
    Of course the NFL would never allow a 7 minute commercial break, although I do believe that the cost is linear. A 60 second commercial's cost is simply 2x 30 second commercials. There's no reason to do anything differently, since in the end it doesn't matter if that 60 seconds are filled by one or two commercials (aside from making the ad sales team's job slightly easier by having one less spot to fill).
    • HWR_14 4y ago
      I think there are reasons why cost would be nonlinear. First, there's simply demand. The people who want to do 60s clearly have a reason that 30s won't work, so they may be willing to pay more (certainly they won't pay less). It's a different segmented market. There is a reason companies with lots of commercials tend to also be official sponsors of the Super Bowl. Second, practically it costs more. Ads are reshuffled around in real-time and the number of times you can be sure you can broadcast a 60 second spot are less than you being able to broadcast a 30 second spot, since the action may resume at an indeterminate time. Third, the Super Bowl specifically sells itself on the quality of the ads. It could do long term damage to the Super Bowl of the ads one year were just one company and not the funny celebrity heavy spots people expect.
      • jaywalk 4y ago
        > the action may resume at an indeterminate time. This is not true. The commercial breaks in all US pro sports have a pre-determined length, and the game action will not resume until the broadcast has rejoined (outside of a mistake somewhere along the line). In the NFL, they have a countdown timer on the stadium scoreboard indicating how much time is left in the commercial break, and even a dedicated guy who stands on the field next to a referee, talking to the TV truck to confirm when the broadcast has rejoined.
• pilif 4y ago
  With such a huge investment comes the obligation to eventually pay it back. Is this another one of my favourite tools going the way of Dropbox, 1Password and all other companies that were formed around what should be a platform feature, which took on way too large investment sums and were eventually forced to become the everything, losing sight of their core values? I sincerely hope not, but there's so much bad precedent.
  • gowld 4y ago
    > should be a platform feature OK, but it's not. Now what? Do we just live without until the platform overlords provide it, or does someone build it on top of the platform? What even is the "platform", when my Android phone is connecting to my iPad and my Windows laptop and Linux desktop and Amazon cloud server? $100M = ~$0.20 / computer user in US and western Europe (wealthy countries in connected software markets)
  • Lightbody 4y ago
    I haven't really felt like 1Password's product materially strayed from the original mission. If anything, I'm even more delighted with the team functionality, shared vaults, quick keyboard access in 1Password 8, etc. I wouldn't put them in the Dropbox bucket. Also, I think the value Tailscale provides is fairly unique and far from obviously a platform feature like file storage and perhaps even password management.
    • xyzzy_plugh 4y ago
      Indeed, 1Password is practically a utility at this point, as far as I'm concerned. I really like the direction they're heading and they're solving some pretty tricky problems without compromising on security, predominantly in the enterprise domain. The experience is the same regardless of whether you're an enterprise user or a personal or family user. It's polished enough that my grandma can use it.
      • alberth 4y ago
        > I really like the direction [1Password] is heading I thought customers were complainingly loudly against their new direction of making 1Password an Electron app. Is that not the case? Note: I'm not a 1Password customer.
• eadmund 4y ago
  > For people who believe there’s a catch — and most still do — then I don’t know how to write a blog post or hire a marketing or sales team to change their minds. I think the catch is that (at least at the free level) one must trust an identity providers. For many companies that's probably fair enough, but for high-security companies and private individuals one absolutely cannot trust anything running outside of one's physical control. Service providers can be suborned, either legally by corrupt regimes or illegally by employees. There is no way that I would permit Google, Microsoft or GitHub (their three supported options) to gate access to my private devices. I think that one must also trust Tailscale themselves, although I could be wrong about that.
  • lmeyerov 4y ago
    Yep we had it rejected w an enterprise we work with as the org needed to own the full control plane so we couldn't bring it in, and not on the schedule for the org's security team for them to bring it in. Making a smarter, easier, and less creepily managed VPN more palatable to enterprises would be awesome, so the marketing value of their fundraise is real.
    • RL_Quine 4y ago
      There's a kind of WIP control server implementation, it's not production ready in my opinion but it's definitely usable. https://github.com/juanfont/headscale https://github.com/juanfont/headscale
      • lmeyerov 4y ago
        Super cool, and a lot of contributors! Can this work the rest of the wireguard ecosystem (agents, UIs, ...) for a full VPN soln without involving the VC-tied company?
        • RL_Quine 4y ago
          Yes, it's usable with every tailscale client (except for iOS). You provide an argument to make headscale your controller, and then it works much the same as the hosted Tailscale service, with some only minor differences in configuration.
• boesboes 4y ago
  For anyone else who wonders wtf tailscale is: > Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. It enables encrypted point-to-point connections using the open source WireGuard protocol, which means only devices on your private network can communicate with each other. It seems to take care of key distribution, nat-traversal, authentication etc etc Neat! No sure how that is 'fixing internet' exactly, but really cool anyway
  • gowld 4y ago
    "Fixing the internet" == you can comunicate with computers that want to comunicate with you, and not with others.
    • contravariant 4y ago
      "Fixing the internet" == you can communicate with computers that you want to communicate with, and not with others.
      • philipov 4y ago
        "Fixing the internet" == computers that mutually consent to communicating with each other are able to communicate with each other
        • xeyownt 4y ago
          "Fixing the internet" == computers whose _owners_mutually consent to communicating with each other are able to communicate with each other
      • lupire 4y ago
        You can do some things that you don't want to do. If someone uses a rubber hose, you might be forced to communicate against your will, using the fixed Internet.
  • yrro 4y ago
• capableweb 4y ago
  > We’re here to fix the Internet That's such a broad "mission statement" that I wonder if it's effective at all. I mean, what SaaS wouldn't say that they fix something with the internet? That's to whole reason for online businesses solving one or another problem. How could that statement help them guide their implementations of various solutions?
  • lvh 4y ago
    I think the best way to get a feel for what that means is Remembering the LAN[0] and then just trying it out (really, it's easy) and deciding for yourself if they're living up to it. Or grep Twitter for "tailscale" -- all these nerds aren't astroturfing :) (Disclosure: I'm a (small) investor via Latacora's sibling fund, Lagomorphic.) [0]: https://tailscale.com/blog/remembering-the-lan/ https://tailscale.com/blog/remembering-the-lan/
  • gowld 4y ago
    The internet, at its essence, means connecting machines aross (intra)networks. Not everything those machines do. That's what Tailscale (+wireguard) is for.
  • MatthiasPortzel 4y ago
    My understanding/hope is that the author uses "internet" to mean the technology. Colloquially we use "internet" to also refer to every technology that runs on top of the internet (like the web), but 'connect devices together' is a meaningful statement and the internet is the technology that we currently use to do that.
• bambax 4y ago
  I read almost all of TFA (started to jump paragraphs near the end) and still couldn't figure out what it was or did, even after being told, repeatedly, that they "make easy things easy". Apparently, it's a VPN.
  • gowld 4y ago
    The blog post is poor. It has TailScale's "house style" of folksy reminiscence and Avery's stream-of-consciousness writing stylewrapped around an announcement. It only says two things, one at the top, and one at the bottom: "We raised a $100m for our war chest; we don't have any plans for how to use it besides extending runway for our current operations". The middle is left trying to justify why that is a good thing, despite not having a reason beyond "we know a lot of rich people who know we are wicked smart and talented, so they want a piece of equity in us". The home page is a pretty clear exposition of what TailScale is: https://tailscale.com/ https://tailscale.com/
    • MatthiasPortzel 4y ago
      I thought the post was remarkably well written. I had a vague idea what Tailscale did going into it, but this post did a good job of describing the company's values and vision. I'm not sure what the intended audience of the announcement was, but for me it was interesting.
  • isthisnametaken 4y ago
    I got bored long before then. It's a terrible piece of self-backslapping drivel
• RL_Quine 4y ago
  Unfortunately despite claiming that they would, they've never allowed their iOS application to allow configuration of the control server (every other client they have released does). Maybe some more funding will allow them to focus on the client quality.
  • pilif 4y ago
    also, their iOS client still has abysmal background battery usage even when not connected. It has been more than a year now, so, yes, seeing them improve in such areas would be cool. But given the huge amount of money invested, pressure will go into other directions. I'm afraid my (aside of the iOS issues) beloved Tailscale is on a path to expensive enterprisey bloat, losing what made it so good (the JSON based ACLs, the external authentication provider reliance, etc - GitHub Auth is a killer-feature for me for example)
  • bradfitz 4y ago
    (Tailscale engineer here) That's https://github.com/tailscale/tailscale/issues/1572 https://github.com/tailscale/tailscale/issues/1572 which we haven't given up on. It's just not done. We did it for macOS and we thought the same thing would've worked for iOS (they share ton of the same code) but it apparently didn't work. The mobile apps have been a low priority thus far. We just recently hired some people to work on them, though. The highest priority for them currently is fixing battery life (we do some dumb things when LTE + wifi are both available, and when using exit nodes, and some unnecessary heart beating that sucks on mobile) and then there's also a mobile app redesign (or just "design" coming). We like Headscale and we're super glad that it exists. (they saved us some work by doing it first, as our control server wasn't in a releasable state) We keep Juan et al updated when there's protocol changes or things they can do. (e.g. recent https://github.com/juanfont/headscale/issues/552 https://github.com/juanfont/headscale/issues/552)
    • pilif 4y ago
      About the battery usage: what I can’t explain is that there’s a lot of background energy usage on iOS when Tailscale is running even when it’s not connected. If this was about heart beating, I would expect that to only happen when the client is connected. Also, in the battery stats, the background usage is there and tailscale is listed, but with - % of battery usage. However, when I force quit tailscale, all of the background energy usage goes away.
• Lightbody 4y ago
  We love Tailscale. Everyone employee has it, and we use it to provide access to dev, staging, and prod environments as well. Fun little thing we did with it: nobody can access the prod network without requesting access via a Slack bot (powered by https://indent.com/ https://indent.com/). So somebody requests access, another authorized person approves it, and the Tailscale ACLs are updated for X minutes and then reset. Access to secure environments is super low friction but more secure (with fantastic audit trails) than ever.
  • fwip 4y ago
    That's gonna be exciting next time Slack is down.
    • dx034 4y ago
      I'd assume they have a fallback option to provide access.
      • VWWHFSfQ 4y ago
        I wouldn't assume anything
      • Lightbody 4y ago
        It's a very safe assumption: we're just automating Tailscale ACLs. Tailscale admins (3 of us) can still come in and manually change them.
        • fwip 4y ago
          That's reassuring, the phrasing of "nobody can access prod without a Slack bot" was worrying.
    • obogobo 4y ago
      it was down for many folks about 2 hours after you posted this lol
  • 4y ago
• atonse 4y ago
  As I’ve said in a past thread for another product (oxide), I LOVE Tailscale and am really happy for the team for their well earned growth and success. However this is the path that could move them towards being pressured to add a bunch of bloat, followed by acquisition pressure and a big payout that will likely eventually cause the product to stagnate after the founding team leaves and the buyers don't care. I really hope they’re all already rich enough that they aren’t tempted by that. :-) Update: altered content to add more speculative version.
• sk8terboi 4y ago
  So it's a way around any firewall and security? Interesting.
  • cpuguy83 4y ago
    An phenomenal read on how it works: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
• throwaway92394 4y ago
  Am I the only one that has an issue with a VPN that I can't self host? Presumably if Tailscale get's PWN'd or subpoenaed then your network is breached no?
  • lvh 4y ago
    Depends on the kind of breach. Tailscale is extremely carefully designed to minimize that risk. Notably: Tailscale doesn't get your keys. (Granted: a compromised agent would still be a problem. It's a thing I have some plans for :-)) (Disclosure: I'm a (small) investor via Latacora's sibling fund, Lagomorphic.)
  • moloch 4y ago
    No, they don't have access to the Wireguard keys and everything is point-to-point. They'd have to push a backdoored software update to gain access (and this is a threat with any vendor product).
    • soraminazuki 4y ago
      IIUC Tailscale controls key distribution, so you'd still have to trust them. However, it might still be possible to eliminate that need for trust by verifying peer connections out of band.
  • bfm 4y ago
    A self hosted alternative we've been using for our infrastructure is innernet, which was discussed on https://news.ycombinator.com/item?id=26628285 https://news.ycombinator.com/item?id=26628285 last year
  • cassianoleal 4y ago
    You're certainly not the only one. There is headscale [0] if you're worried about that though. [0] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
  • cpuguy83 4y ago
    Tailscale's data plane is [1] mostly p2p except for some cases where it doesn't work and it goes through an encrypted relay. So your data does not run through Tailscale servers. There is an oss [2]coordination server that does let you totally self-host. [1] https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/ [2] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
• hu3 4y ago
  They are open source too: https://github.com/tailscale/tailscale https://github.com/tailscale/tailscale edit: Only the client is open source. See clarification below.
  • bfm 4y ago
    The control server is not open source. Thankfully headspace https://github.com/juanfont/headscale https://github.com/juanfont/headscale is filling that gap
  • cassianoleal 4y ago
    The clients are. The control server, which is the bit that Tailscale host, is not. There is an open source alternative called headscale [0]. The main downside is that you'll need to run it. The closed source centralised control server has other potential issues though, and it ends up being up to the user to decide what's the right balance of security vs convenience. [0] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
    • gowld 4y ago
      To be clear, headscale is an alternative to the control server, compatible with Tailscale clients.
      • cassianoleal 4y ago
        Yes, sorry if my phrasing was confusing. Thanks for clarifying.
    • hu3 4y ago
      Thanks for clarifying. I did not know that.
• l30n4da5 4y ago
  Ive been using Tailscale for my local machines for a month or so now. don't really have any complaints about them.
• lajamerr 4y ago
  I remember reading a previous HN post about Tailscale and a certain commenter said that Tailscale is ideologically driven, small-scale operation and they prefer an alternative like NetMaker which has more backing. $100M seems more than a small-scale operation or is $100M in tech actually small scale?
  • jonfw 4y ago
    Tailscale has been much larger than Netmaker for as long as Netmaker has existed
• api 4y ago
  As the founder of what some say is a competitor (ZeroTier) I'd like to congratulate the Tailscale team. We don't really see Tailscale as the competition. We see the competition as: (1) The old school castle and moat IT model that dominates at 99% of companies. If we can disrupt this then TS, ZT, and four other upstarts could all become billion dollar companies. Right now 1-2% of this market has been disrupted at most. (2) The put everything in the cloud and everyone gets a thin client model. If that wins then all of us lose because there is no market for endpoint connectivity. We also lose all privacy, all data ownership, and all ability to experiment or innovate without paying for it by the instance-hour with TOS-enforcement bots looking over our shoulder.
  • ryanar 4y ago
    I am guessing two of the other startups are strongDM and Teleport. Wonder what others are in this space and have gone to Series B+
  • hwpky 4y ago
    Agree with this Adam. Avery and the team at Tailscale are building a fantastic product and totally deserve the round and recognition, huge congratulations - we're super happy for them. In many ways they're also an ice-breaker for the zero trust overlay network architecture, which means they've got the most work to do. As the current top comment on this thread correctly notes, with huge investment comes the obligation to eventually pay it back. The market hasn't even come close yet to crossing the chasm and seeped into mainstream conscience to become the accepted norm - yet. That said, we believe fiercely that networks should be simple to reason about, easy to use and safe to operate. That private connectivity should “just work”, and just work in exactly the same way, everywhere too. Flexible to change, simple to automate and only available to the right things at the right times. When you think about it, building private networks is actually pretty complex right now and can be pretty insecure too. It's some unholy combination of spell casting meets a yak shaving contest to wrangle firewalls, VPNs, MTUs, and manage IPs, subnets, ACLs, NSGs, VPCs, NAT, routing, VLANs, certificates & secret keys, then hoping a zero-day doesn't show up that drops someone straight into the network via the VPN server, who then starts poking around the squishy centre. Once you've used products like Enclave, Tailscale or ZeroTier and seen how simple private networks really can be - at a certain point you almost stop and ask the question, why would you not do it like this. There will always be nay-sayers and people for whom this approach just isn't a fit, and that's fine - but I personally find it hard to imagine that this genie can be put back in the bottle. - Founder @ https://enclave.io https://enclave.io
• deleted 4y ago
  [deleted]
• jonfw 4y ago
  There is another interesting company in this space- Netmaker[0]. It's been getting a lot of traction in the homelab space- namely because it takes advantage of kernel wireguard, which is more performant than the userspace wireguard that tailscale uses. [0] - https://www.netmaker.org/ https://www.netmaker.org/
  • ignoramous 4y ago
    There's https://zerotier.com https://zerotier.com, https://netbird.io https://netbird.io, https://defined.net https://defined.net, https://github.com/tonarino/innernet https://github.com/tonarino/innernet and likely many more.
• deleted 4y ago
  [deleted]
• aaronax 4y ago
  I have heard of but never really looked in to Tailscale until today. I'm not impressed. "Fixing the Internet" is not done by layering more private network garbage on top of it. Their claim[0] that after you install Tailscale on all your devices: "This final configuration is called 'zero trust networking',” is pretty interesting. It seems this would be more like having a trusted internal network (sure it is overlaid on an untrusted network). A true zero-trust network would mean all of your clients and servers are secure in a manner that they can operate on the public Internet...like O365, Salesforce, etc. To say that you run a zero-trust network because you implement a fancy VPN is C-suite dreaming at its finest. "get around a misbehaving corporate firewall" like newhouseb sings praises for is exactly the sort of thing that should be happening less, and the opposite of "fixing the Internet". Follow the policies of the network you are being allowed to use, or lobby for them the be fixed. Don't like ISPs messing with DNS traffic? Get rules/laws implemented that prohibit that, instead of garbage like hiding your DNS in DNS over HTTPS. (DNS over TLS seems more acceptable to me.) [0] https://tailscale.com/blog/how-tailscale-works/ https://tailscale.com/blog/how-tailscale-works/
  • rcfox 4y ago
    "Don't like entities abusing their power over you? Just change the laws that allow them to do that!" What.
    • gkbrk 4y ago
      This is how people fix things caused by commercial entities being abusive. It's done quite a bit, most of the critical things people rely on are regulated. Do you live in a place that doesn't regulate things?
      • rcfox 4y ago
        You could spend time to learn about the process, deal with months or years of lobbying, deal with counter-lobbying, and eventually win your position or maybe not. Or you could use this technical workaround. And maybe we're all worse-off for it, but now you're done dealing with that issue.
• user3939382 4y ago
  Every time I've looked at setting up distributed VPN I've wanted layer 2, I haven't used WireGuard yet but apparently it's layer 3. I would love to be able to connect remotely and have my newly connected machine act like just another machine on the LAN. That in turn makes all kinds of other network-related operations simpler and homogeneous, in that the remote property of the connected machine(s) is abstracted away.
  • Meleagris 4y ago
    Check out ZeroTier. I believe it fills the same needs as Tailscale, but with layer 2.
• jollybean 4y ago
  " What if we all just had a static IP address, and a DNS name? …and the address migrated around the world with you? …and you could connect to any of your devices no matter where they were? …and it was always encrypted? …and there was always a correctly configured firewall? …and you never had to worry about certificates? …and every device in your organization was tied to a user identity and SSO and MFA? …and all this just happened automatically? " So why do people care about that? Those all seem like positive things but they are in and of themselves, not value creating. From this article and even their landing page ... I think they might need an explanation that makes more sense than IT/Networking Admin. Even as a developer, I don't quite see the obvious benefit. Instead of taking about 'what if you could have this tech that does ABC' - instead, talk about it in terms of problems 'what if you didn't have this problem or that one'. etc..
  • MobiusHorizons 4y ago
    Have you ever tried running a server or sshing to things that weren’t in a cloud provider? Have you ever run something you want access over the internet without wanting that thing on the open internet getting attacked? Tailscale provides a solution to the problems you run into in those situations. It gives you a way to access (or selectively give specific people access to) these devices from anywhere on the internet while still having those assets behind a firewall.
• tmikaeld 4y ago
  I guess their biggest competitor will be Cloudflare Tunnels with Access, which does the same thing and more, for free.
• deleted 4y ago
  [deleted]
• syntaxing 4y ago
  Tailscale is absolutely amazing for accessing local first platforms (like home assistant and jellyfin). Sure, I can set up wireguard, but Tailscale is plug in play. Biggest gripe is that it messes with my DNS like nextDNS on iOS.
• anuvrat1 4y ago
  There exists ZeroTier too, which can be self-hosted. [1]: https://www.zerotier.com/ https://www.zerotier.com/
• ineedasername 4y ago
  It sounds similar to what hamachi could have been if it was really invested in product management & enterprise features.
  • orliesaurus 4y ago
    interesting, that's the first thing I also thought of! (in fact I grep'd "hamachi" on this thread) I totally agree - it's a shame hamachi just gave up
• brightball 4y ago
  How does it work for something like a security DVR where you can’t access the system itself? Is there an equivalent way to just access the network like a VPN?
  • smackeyacky 4y ago
    Yes, you can set up one node as a gateway to the network, then access everything on that local network. I use it this way to access devices that can't run the tailscale software.
  • bruckie 4y ago
    Yes. Tailscale subnet router. https://tailscale.com/kb/1019/subnets/ https://tailscale.com/kb/1019/subnets/
• nickysielicki 4y ago
  Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it takes 15 minutes to get every device you own up and running and talking. This is the lowest friction personal VPN to ever exist, and once you see how easy it is for your own devices, you’ll wish you had it at work. The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. Being based on open source wireguard, and being just a STUN/TURN server at its core… I’m sure that Tailscale will be the first but maybe not the best. I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. Web3 happens when people can host stuff on their phones, and Tailscale is something that lets you host things on your phone.
  • zionic 4y ago
  • mnkmnk 4y ago
    Cloudflare already has a competing product https://www.cloudflare.com/en-in/lp/ppc/cloudflare-for-teams/ https://www.cloudflare.com/en-in/lp/ppc/cloudflare-for-teams...
    • nickysielicki 4y ago
      It’s not really a competing product until they relaunch it with a heavy consumer focus and with some of the properties that Tailscale has, ie: avoiding going through the cloudflare CDN. But more to my point, cloudflare is definitely in a position to outcompete Tailscale, it’s just a couple tweaks and a marketing shift.
      • ThePhysicist 4y ago
        I don't think Tailscale will focus on the consumer market, I'd be very surprised at least if they did. I think they built a developer-friendly product to get mindshare and early adoptors, but eventually the real market for such such products is in the B2B space, i.e. implementing the "BeyondCorp" model of zero-trust networking. There's also a market for building cloud mesh services but I'm not sure if Tailscale is well positioned for that as there are good open-source solutions available for that already.
• flemhans 4y ago
  What's the state of affairs when it comes to self-hosting? I'm waiting to deploy either Nebula, ZeroTier, or Tailscale, but we don't want to rely on third parties for auth or coordination.
  • benoliver999 4y ago
    Nebula is the only completely self hosted option I think. But I couldn't get NAT traversal to work and it's the main reason I want a system like this. Tailscale hosts all the auth and coordination stuff and uses SSO. Zerotier lets you host an auth server, which also handles connections, but when required some already-established connections go through zerotier servers (encrypted). We use the latter option at work
• Dave3of5 4y ago
  Crazy how people can raise these sums of money, it's all about who you know. I also notice they have a careers page so I had a gander. A 6 stage interview process! Good lord tech companies really have gone down the shitter
• tomc1985 4y ago
  Another day, another overly hyperbolic press rele.... er, blog post Le sigh... Let's make tech boring and demure again!
• lettergram 4y ago
  “To fix the internet” I really wish we could get some clear copy on what that means in a title.
• arsome 4y ago
  I was going to try TailScale but then it seemed the only option to do so as an individual was to login with a 3rd party cloud provider, which I in no way want tied into my networks. I gave up and just setup wireguard directly instead, I don't trust Tailscale either if that's their attitude towards privacy, it's permanently marred my vision of their product.
  • Saris 4y ago
    Yeah that's the biggest hangup I have, it just seems strange to rely on a third party login to be able to access something as important as a VPN. If my google account or whatever gets shut off for any reason I'd be pretty hosed.
    • ignoramous 4y ago
      Avery, co-founder at Tailscale, has some strong opinions about why SSO is sufficient for their product. They wrote a bit about their thought process: Factors in authentication (2019), https://apenwarr.ca/log/20190114 https://apenwarr.ca/log/20190114 > It seems to me that the above successful enrollment patterns all use one or more of the following techniques: > A human authenticates you and issues you a token (usually in person). > A short-distance, physical link (proximity-based authentication) like a biometric sensor, or USB or bluetooth connection. > Delegation to an existing authenticator [SSO]... > What people tend to miss... is that enrollment is necessary whether or not you send a push notification to the phone during login. The push notification is only secure if this specific browser instance is enrolled; but if this browser is enrolled, then the push notification adds no extra security... The enrollment was the security. Fully expect them to ship u2f authenticators or sell them at tsCare shops!
  • aftbit 4y ago
    Same, I abandoned Tailscale sign up for this reason as well. Perhaps consider https://github.com/juanfont/headscale https://github.com/juanfont/headscale ?
  • JeremyNT 4y ago
    Indeed, this is why I won't use it either. I settled on Slack's Nebula [0] instead of wireguard because it handles direct p2p communication between nodes automatically. There also exists an open source implementation of the tailscale control server [1] that you could self host. [0] https://github.com/slackhq/nebula https://github.com/slackhq/nebula [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
• jbverschoor 4y ago
  Congrats1 solid productg, good interface, great positioning towards the enterpise
• wackget 4y ago
  > Gets $100M investment > Still produces graphs without axis labels
• woopwoop24 4y ago
  i wanted to to use tailscale really bad, but since you cannot login without the given choices they provide, i am not sure any security minded person would mind using it. i rolled my own with a simple vps, a haproxy and ansible.
• adtac 4y ago
  >To put the market in perspective, there are VPNs that only work if [...] UDP isn’t blocked isn't that true with WireGuard/Tailscale too?
  • xena 4y ago
    Tailscale employee here. Tailscale has a fallback that does connections to a relay server called DERP. DERP works over HTTPS, so if you can't access the outside world via HTTPS then you have much bigger problems than Tailscale not working.
    • anderspitman 4y ago
      Is DERP raw HTTP or based on WebSockets?
      • ignoramous 4y ago
        derp seems to be its own protocol. tailscale seems to prefer websocket transport for derp frames: https://github.com/tailscale/tailscale/blob/505f844/derp/derphttp/derphttp_client.go#L5 https://github.com/tailscale/tailscale/blob/505f844/derp/der...
• rvz 4y ago
  I bet they will get acquired by Cloudflare. If they reject their offer then Cloudflare will kill them. Sorry.
• abetlen 4y ago
  If you run a Kubernetes cluster for self-hosting software or development I highly recommend setting up a Tailscale subnet router [1]. This will allow you to access any IP (pods or services) in your cluster from any of your Tailscale-connected computers. You can even configure Tailscale DNS to point to the DNS server in your cluster to connect using the service names directly ie. http://my-service.namespace.svc.cluster.local http://my-service.namespace.svc.cluster.local [1] https://tailscale.com/kb/1185/kubernetes/#subnet-router https://tailscale.com/kb/1185/kubernetes/#subnet-router
• chimen 4y ago
  Funding scares me. It bring sharks onboard who do not share the same vision. They will demand revenue and ROI above all else. I like Tailscale but I hate this business model down to the core (Netlify as an example). Tailscale was doing fine as it was, capable people there already. It quickly became an "exit type of business", too quickly. These companies usually bring something really easy to use, let people onboard and modify their network/DNS/etc to hell until they get vendor stuck and then they squeeze every possible dollar out of their pockets. Once you're in, after days or weeks of fine tuning, after you managed to pollute your codebase with their configs and IP addresses, it's hard to get out. I suspect those "free slots" will change soon ,but we won't see those types of graphs anywhere soon and be prepared to get charged for bandwidth and everything else possible.
  • jnsaff2 4y ago
    > They will demand revenue and ROI above all else. I don't think this is true. They mostly demand growth over all else.
    • AceJohnny2 4y ago
      Growth as a precursor for revenue. Massive growth just means you can dominate the market then have more flexibility on the price you'll charge.
  • josephruscio 4y ago
    Tailscale investor here. I can assure you we share the same vision with the founders.
    • ncmncm 4y ago
      You cannot do that. You might personally share a vision with somebody identifiable. But the vision you say you share is anyway not implemented. Make the service usable without depending on some internet behemoth who might yank my authentication credentials anytime without notice, and we can talk.
• madjam002 4y ago
  Things I’m really looking forward to seeing from Tailscale / projects I’d like to tinker with: - Better iOS battery life, there have been many improvements but it’s still too much to leave running 24/7, I understand they’re making improvements here - Their in built SSH server which seems to be in development - Using Tailscale ACLs to control access to Kubernetes ingress resources, they recently released an nginx auth plugin so I imagine this is now possible if you attach a Tailscale sidecar to the nginx ingress controller - Arbitrary ACLs which also seem to be in progress, it would be awesome to define in ACLs who has access to different parts of e.g a backoffice application - Official support for DNS extra records, already using this with the Headscale self hosted control plane for personal projects but it would be great to use it on Tailscale too - Kernel Wireguard for the data plane, I think this is on the roadmap? Overall a fantastic piece of software which I use for both personal and professional projects.
• mengibar10 4y ago
  Excuse my ignorance but this is something I have been longing to ask for. Do these services compromise security? Wouldn't you put too much trust on these services, like 1Password. If that service is compromised in someway aren't you exposed? Is these a good article debate on this topic. Thanks.
• nitsky 4y ago
  I'm a huge fan of Tailscale and the team I work with uses it daily, for free, to connect to our servers and each other's computers. Thanks!
• knur 4y ago
  I love tailscale. Lately I have been migrating all my self-hosted stuff into a raspberry pi (instead of running a public instance in the cloud). It gives me a bit of piece of mind knowing that it adds an extra layer of security (to hit any of my endpoints/apps you would need to infiltrate my VPN). And it will save me a lot of money on hosting. I don't need to expose my computers publicly or enable upnp or anything. It just works.
• apeace 4y ago
  Tailscale's CEO has been tweeting a series of "rejected headlines" for their fundraising announcement. They're pretty funny. I thought the HN crowd would like this one: > Tailscale raises $100M to do what any Hacker News reader could have done in a weekend [0] [0] https://twitter.com/apenwarr/status/1521873453921583105?cxt=HHwWgoC-4fr1454qAAAA https://twitter.com/apenwarr/status/1521873453921583105?cxt=...
  • jrockway 4y ago
    There are already comments where people are showing their simple 400 step procedure that can get you 1% of Tailscale. Never forget https://news.ycombinator.com/item?id=8863 https://news.ycombinator.com/item?id=8863
  • apitman 4y ago
    Makes me miss n-gate.
• deleted 4y ago
  [deleted]
• stephenanand 4y ago
  [dead]
• Ansil849 4y ago
  I couldn't readily find any mention of any third-party security audits. Compare that to the numerous audits a VPN like Mullvad has had - https://mullvad.net/en/blog/tag/audits/ https://mullvad.net/en/blog/tag/audits/.
• tomputer 4y ago
  For almost a decade I have worked with IPsec and OpenVPN solutions for both client and site-to-site VPN tunnels. On enterprise hardware, community/proprietary software and at public cloud providers. I still work with these because today many vendors only support IPsec. A few years ago I discovered WireGuard and I was really amazed how easy it was to setup a tunnel. Especially if you've dealt with IPsec before. It felt as easy as creating an SSH tunnel between two servers, with only 4 or 5 lines of code in a config on both sides. Then last year I discovered Tailscale and I was blown away! How did this even work[1] without opening ports in the firewall? And how cool is it that I no longer have overlapping addresses[2] from other networks. Within 15 minutes I had my own mesh network between my Mac, iPhone, Raspberry Pi and other servers. Fantastic! I'm on the Personal/Free plan but if this would no longer be free, I would be happy to pay for this service (shut up and take my money). [1] https://tailscale.com/blog/how-tailscale-works/ https://tailscale.com/blog/how-tailscale-works/ [2] https://tailscale.com/kb/1015/100.x-addresses/ https://tailscale.com/kb/1015/100.x-addresses/
  • benoliver999 4y ago
    We used openvpn for years and it felt like every client had an obscure reason it wouldn't work, and we'd have to find a workaround. Installed zerotier and it couldn't be simpler now.
• tomhallett 4y ago
  I'm trying to connect Tailscale's product with their goal "The internal dashboard and CI system that will never need to be public-facing. The HR database that will always have far less than a thousand queries per second. The dozens or hundreds of devs that ssh or RDP into servers, not the millions of users being served." Does this mean - instead of deploying a dashboard/ci to aws, I should host it "locally" on a single computer (macbook, raspberry pi) and then internal employees can access that site via Tailscale's network layer?
• AndyNemmity 4y ago
  Tailscale is one of the products I most love. It does what I want it to do. I don't have to think about it after that. If all tools were this reasonable, I'd be very happy.
• klazutin 4y ago
  I've tried Tailscale recently after reading all the raving reviews here on HN. The service is very easy to install and the apps are nice to use, everything is just very well done. However, I just don't see much difference from my vanilla Wireguard setup. Granted, my use case is very simple, just connect a few devices at home and in the cloud into a single network and use one of them as an exit node, but I'm still not sure what would make me prefer Tailscale over Wireguard. So far the biggest difference has been that it makes me use an external identity provider instead of having to manually exchange keys between devices, and I'm not sure I'm very comfortable with that.
  • lupire 4y ago
    The answer here depends on a side by side pair of walkthroughs for setting up and maintaining Tailscale vs plain Wireguard.
  • bibabaloo 4y ago
    NAT and firewall traversal are two other things that Tailscale gives you that you don't easily get with Wireguard alone, FWIW.
• fullstackchris 4y ago
  Crap... is this literally the product I've been MVPing the past few weeks? (https://kurynt.com https://kurynt.com) - or do I still have a chance? Full disclosure - there is little to no functionality yet, but the homepage is enough
  • fullstackchris 4y ago
    OK, reading the comments it is a totally different product, but I guess I have to try it! "Zero config VPN. Installs on any device in minutes, manages firewall rules for you, and works from anywhere." Okay... at first I said to myself, _no way_. But then I thought, "Any sufficiently advanced technology is indistinguishable from magic."
• benjaminwootton 4y ago
  Every time I refresh my feed I read about another company raising tens of $millions. A lot of that is Crypto related, but money seems to be absolutely flooding into tech at the moment despite all of the doom and gloom around
• ignoramous 4y ago
  > We've raised $100M in a Series B financing led by CRV and Insight Partners I see they are staying away from a16z ;) > We don't want to put revenue ahead of quality, because our stats say quality is where all our growth comes from. Dr. Deming shining through here [0], but really, even this 1986 article paints a neat little picture of how I presume tailscale's operating at the moment: https://hbr.org/1986/01/the-new-new-product-development-game https://hbr.org/1986/01/the-new-new-product-development-game > How, Avery, on earth, are you all planning to spend one hundred million dollars? Wireguard platinum sponsorship in 3, 2, 1...? > Now I just tell people: We're here to fix the Internet. If we don't, who will? I called this a year ago, as it was pretty evident to me even then (downvotes notwithstanding), but I'd not be surprised if tailscale became a ISP someday, given their holistic approach to product development: https://news.ycombinator.com/item?id=26249199 https://news.ycombinator.com/item?id=26249199 But hey, there are many more people working to fix the internet... including tailscale clones and other over-funded/under-funded developers, which brings me to... > I mean, imagine. What if the Internet just worked like it was supposed to? [and goes on to list e2ee + Mobile IP + SSO + DDNS + NAT Traversal] If you squint just enough, it reads like the MASQUE protocol (built atop QUIC) that Google, Apple, Cloudflare are working to standardize: https://ietf-wg-masque.github.io/ https://ietf-wg-masque.github.io/ That said, in time, I see tailscale not only compete with Zscaler, but also with Tanium, Cloudflare, CrowdStrike, F5, Palo Alto Networks and the likes. Once they are embed in an enterprise' network, there's very little their product couldn't expand into to make other SaaS / solutions obsolete. [0] Systems thinking and Deming, https://archive.is/tXJhw https://archive.is/tXJhw
• kall 4y ago
  Congratulations to Tailscale. Imagine how many times you can migrate to a new novel database architecture with that kind of money.
• crthpl 4y ago
  From their privacy policy: > The personal information we collect, use, and disclose includes business contact information such as names, job titles, and company email addresses, as well as information about individual devices (such as device hardware and operating system) and aggregated usage statistics (such as amount of data transmitted in a period of time). > Your personal information will be transferred ... to certain third parties that provide services on our behalf. > We use service providers to provide services such as ... data analysis to better understand and improve product and website usage, and providing advertising and marketing services. :/
• falcolas 4y ago
  First - congratulations! I like the idea behind your product. Easily configured VPN tunnels are something I enjoy having. But, and I'm probably just shouting into the void at this point, relying upon your network being secured as a method of securing your office/product will only result in heartache. If you're a company SEO or similar trying to protect your company from threats, your first assumption must be "the network is compromised" no matter whether it's on the internet, or VPN tunnels, or firewalled local network.
  • JoachimSchipper 4y ago
    You may want to take a second look at Tailscale - it can be used as a classic VPN ("exit node"), but it really wants to broker host-to-host connectivity secured by ACLs and SSO.
    • falcolas 4y ago
      Respectfully, this doesn't change the advice. Always assume the network is compromised - that someone who shouldn't has access your hosts via the network. A user's device is taken, a new user is added via social engineering, a computer is left unlocked, a host is compromised...
• aetherspawn 4y ago
  Started using Tailscale the other week and it just blew my mind. But: Now that they have more money, I just wish they could spend some time making it enterprisey and not hobbyist-ey. Things like: improve all the screens with high-density modes so we can filter thousands of devices, not hundreds. And make it integrate better with Windows Intune for hands-free deployment i.e. if we're a Hybrid 365 environment, please detect the users credentials from their Windows install and login automatically. Maybe release an installer for enterprise deployment that silently downloads and installs the latest version so that we can i.e. integrate it into a Windows Autopilot unboxing experience.
  • ignoramous 4y ago
    Consider penning your feature requests over at https://github.com/tailscale/tailscale/issues https://github.com/tailscale/tailscale/issues
• neycoda 4y ago
  The fact that money got involved in this means it's already a privacy risk.
• fijiaarone 4y ago
  Netskope / Zavala’s / Cisco Umbrella DNS proxy server VPN with a free personal level?
• simonebrunozzi 4y ago
  Avery is an incredible founder. Met him just once in 2013 (maybe? He was at Google I think), had him mentioned perhaps a dozen times by various folks in the industry, always in absolutely fantastic terms.
• nikolay 4y ago
  If I was Cloudflare, I'd have bought Tailscale long ago!