4 ms·
I thought that Tailscale was pretty interesting. Avery Pennarun, its CTO, is somebody whose judgment I am used to trusting. Then I learned that to use it, I w
by ncmncm 5y ago
I thought that Tailscale was pretty interesting.
Avery Pennarun, its CTO, is somebody whose judgment I am used to trusting.
Then I learned that to use it, I would be dependent on authenticating using a login on one of the unaccountable internet behemoths who could take away my account for any random reason or no expressed reason at all.
No, thank you.
- naikrovek 5y agoGoogle does that, Microsoft doesn't. Microsoft will ban you from a particular service if you egregiously violate the terms of service for a particular application of theirs, but never the whole account. Google will throw you on your ass in the blink of an eye.
- skoskie 5y agoIs there anything in there TOS that states it or has this just been their practice so far?
- ncmncm 5y agoDoes it matter? Whether they say they will do it, or just do it without saying they will, the experience is the same. What matters most is if they can. Then, if they ever have done. What I want is that they can't.
- naikrovek 5y agoyou want a free service written, maintained, and hosted by others that they don't control. Am I understanding you?
- ncmncm 5y agoNo. I would be happy to pay for service, but they offer no choice but to rely on somebody else's authentication, regardless.
- naikrovek 5y agoread harder next time. https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/
- Handytinge 5y agoThis isn't a very nice comment (from my reading anyway). > Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. > Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.
- ncmncm 5y agoThank you. It is hard to interpret what this might mean, for me.
- rrdharan 5y agoI agree, GitHub is awful.
- __float 5y agoIf you use an identity provider like Okta or OneLogin, then you're not tied to any "contentful" services like GitHub or a Google account that "historically" seem to have more problems of this type. As far as threat models go, I can't really say I understand this one too much.
- margalabargala 5y agoAs an example: shortly after Russia invaded Ukraine, Namecheap cancelled all accounts of all of its customers who were located in Russia. This was done regardless of what content if any was hosted by the account, whether or not the person in question supported the war, or whether the person in question was actively fleeing Russia and may have been relying on technical infrastructure they had previously set up to help them do so. Just because a service you sign up for is not contentful, does not mean that they won't choose to boot you off for some reason completely unrelated to anything you control or anything you chose to do.
- woodruffw 5y agoThis is a strange example to pick given that (1) it's a war, and (2) a significant percentage (majority?) of Namecheap's employees and offices are in Ukraine. If we (the US) decided to invade Canada tomorrow, you can be certain that the maple syrup would stop flowing. Edit: According to their website[1], the overwhelming majority of their employees are in Ukraine. Two of the three cities they have offices in are on the current combat front. [1]: https://www.namecheap.com/careers/ukraine https://www.namecheap.com/careers/ukraine
- klabb3 5y agoI don't think parent is saying it's unexpected, but rather that having a third-party identity provider (especially a corporation) is an unwarrented and/or unwanted political dependency. I deeply empathize with this sentiment but also recognize why many companies choose to rely on them (identity is very difficult).
- DarylZero 5y ago
- boesboes 5y agoOh, that is a shame. I can see why they do it like this for businesses, but for personal accounts I refuse to use SSO. Been bitten by that a few times too many. I _could_ use my github account, but I don't trust them at all anymore. And I'm not going to setup an account with some other service just to use this. So that is a hard pass for personal use. For a company it makes sense to have to use whatever sso provider you are already using i guess
- systemvoltage 5y agoYes. If they can’t build basic auth and make sure it’s secure, it sends quite the message. Super annoying and borderline unacceptable.
- chipsa 5y agoThey don't want to build basic auth. They probably could, but it gives them more headaches and customer service touch points compared to delegating that out. Like: what if the user forgets their password? Or what if they lose their 2FA device?
- systemvoltage 5y agoYes, welcome to operating a SaaS.
- ibejoeb 5y agoIs that generally true? A third-party authentication servive is needed just to get it going, or is that needed for specific use cases?
- ncmncm 5y agoApparently the third-party authentication service is needed just to get it going. If you get an "enterprise license" you can choose among more authentication services, but not yourself. Some people suggest trying Nebula instead.
- kyawzazaw 5y agoAvery Pennarun is CEO. David Crawshaw is CTO.
- ncmncm 5y agoI am corrected.
- stavrianos 5y agoWhat precisely are the consequences of the third-party auth? Is it, they get an IP ping each time a device connects or does anything? Or, does that only happen once, but they can revoke access at any time? *Surely* they aren't granted access to the content? That would be mindboggling.
- PLG88 5y agoYou should checkout the opensource project OpenZiti (https://openziti.github.io/ https://openziti.github.io/). It has its own internal PKI system so you dont need to (but can) like to an external 3rd party. It also allows you to close all inbound ports and link listeners (as every endpoint has embedded identity so makes outbound only connections) and can be embedded directly into apps with SDKs as well as deploy on any popular OS or as a virtual appliance.
- dstanbro 5y agoIf you're that concerned with 3rd party auth, I'm surprised you're not more concerned about trusting your virtual network to a SaaS platform (who could definitely decrypt the traffic). For those more privacy minded, they'd probably wanna go with one of the self-hosted alternatives, of which there are now a few.