19 ms·

Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it t

Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it takes 15 minutes to get every device you own up and running and talking. This is the lowest friction personal VPN to ever exist, and once you see how easy it is for your own devices, you’ll wish you had it at work. The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. Being based on open source wireguard, and being just a STUN/TURN server at its core… I’m sure that Tailscale will be the first but maybe not the best. I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. Web3 happens when people can host stuff on their phones, and Tailscale is something that lets you host things on your phone.

zionic 4y ago
mnkmnk 4y ago
Cloudflare already has a competing product https://www.cloudflare.com/en-in/lp/ppc/cloudflare-for-teams/ https://www.cloudflare.com/en-in/lp/ppc/cloudflare-for-teams...
- nickysielicki 4y ago
  It’s not really a competing product until they relaunch it with a heavy consumer focus and with some of the properties that Tailscale has, ie: avoiding going through the cloudflare CDN. But more to my point, cloudflare is definitely in a position to outcompete Tailscale, it’s just a couple tweaks and a marketing shift.
  - ThePhysicist 4y ago
    I don't think Tailscale will focus on the consumer market, I'd be very surprised at least if they did. I think they built a developer-friendly product to get mindshare and early adoptors, but eventually the real market for such such products is in the B2B space, i.e. implementing the "BeyondCorp" model of zero-trust networking. There's also a market for building cloud mesh services but I'm not sure if Tailscale is well positioned for that as there are good open-source solutions available for that already.
    - nickysielicki 4y ago
      It costs them so little to provide their free consumer service (iirc: they fall-back to providing transit, but it’s very rare and only occurs when UDP is completely blocked) that it benefits them to keep their focus on consumers because if everyone is using Tailscale, the business customers are inevitable.
    - windexh8er 4y ago
      They already (sort of) do [0] as they have a "Personal Pro" plan that's not too obvious - personally, I hope they expand to make it more cloud-native via a la carte pricing for those users as I'd pay an extra $x/month for an additional subnet router or three. And, IMO, it's a smart approach - those who are the targeted "Prosumer" might leverage this for their homelab and carry it over with them into the enterprise. I say that it's a smart approach because in my time at a vendor that was slinging security middle boxes - we used to give away our small form factor product to those homelab'ers for free. They'd take them home and see how much the solution could provide, they got comfortable with the UI, and they learned it for their own use cases. And then the path into an enterprise conversation held much less friction. [0] https://tailscale.com/pricing/ https://tailscale.com/pricing/
      - seedie 4y ago
        I remember Astaro did this with their Astaro Security Gateway UTM solution. Provide a full featured software appliance for home users and hope the admins are so caught up that they don't want to change to another vendor at work. Astaro got acquired by Sophos in 2011 but I just checked, they still offer the Sophos UTM Gateway in a Home edition. https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-home-edition https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-h...
siavosh 4y ago
I’m pretty ignorant on this topic, but what are the benefits of having a personal VPN?
- gzer0 4y ago
  I am able to route traffic on my mobile device through my home network via the use of their "exit node" option. It allows one of my home devices to act as an exit node for my entire personal tailscale network. This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365
  - karlshea 4y ago
    I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?
    - nickysielicki 4y ago
      NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.
      - karlshea 4y ago
        Ahhh that is slick
      - anderspitman 4y ago
        For more background on just how much Tailscale is doing for you with respect to NAT: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
      - devman0 4y ago
        Is forwarding a single port that difficult in most circumstances? I do realize there are some instances where that is hard like CGNAT, but if I have easy access to wireguard in my network already what does tailscale buy me?
tepitoperrito 4y ago
Like a hybrid NNCP-GO and nebula sdn. Neat!
lazzlazzlazz 4y ago
> a direct ring of trust with friends The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product like Tailscale seems to rely completely on centralized identity providers (you have to choose Google, Microsoft, or Github on sign-in). Ultimately, if you want to maintain full control of your online identity and network, you'll probably need some of the decentralized (but economically aware) resources you seem to have issues with — or at the very least a means of transitioning authentication to private key methods with DIDs.
- nickysielicki 4y ago
  I feel like people are so concerned about infinite scaling that nobody ever tries to scale to 5 anymore. I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow. With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today? I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere. edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.
  - discardedrefuse 4y ago
    > And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated. How many of your friends and family are "friends" with bots on Facebook?
  - anderspitman 4y ago
    Definitely stealing mom-technical. Though I do disagree somewhat with the conflation with blue-collar. I would almost argue white-collar folks are less likely to understand computers.
systemvoltage 4y ago
Well put, there is no moat. Corporate customers really don’t want yet another network infra if they have Cloudflare + ZTN offerings. Cloudflare, please make a box I can buy and stick it in the closet with a WAN connection. Routers suck, it’s time to reinvent them. Also please don’t make them look like goddamn spaceships.
- jgrahamc 4y ago
  What's this box going to do?
  - systemvoltage 4y ago
    I was thinking a router that’s connected to Cloudflare network. Every device that connects to it is automatically on Cloudflare tunnels or Tailscale like VPN. And generally do the routing stuff better than ubiquity products (can manage your home router through their control panel from anywhere). Remote devices would need a client installed on it to access the VPN, of course.
    - babelfish 4y ago
      https://blog.cloudflare.com/cloudflare-for-offices/ https://blog.cloudflare.com/cloudflare-for-offices/
discardedrefuse 4y ago
> I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. Might want to check out Yggdrasil. It lets you can create a real mesh routed, E2E encrypted network. You can keep your network private, or connect it to the greater network and route others. There's no ring-of-trust (I can't imagine that as a viable solution at scale). But the config file has an AllowedPublicKeys section if you want to specify who can route through your node. https://github.com/yggdrasil-network/yggdrasil-go https://github.com/yggdrasil-network/yggdrasil-go
- _abox 4y ago
  Thanks, I thought I knew all the major mesh VPN options (tinc, nebula, tailscale, zero tier, hamachi) and yet I never heard of yggdrasil. This is the kind of comment I love HN for!
  - ctrlc-root 4y ago
    Here's one more: https://fastd.readthedocs.io/en/v22/index.html https://fastd.readthedocs.io/en/v22/index.html
  - PLG88 4y ago
    Here is another (sort of), OpenZiti - https://openziti.github.io/ https://openziti.github.io/. OpenZiti provides a mesh overlay network built on zero trust priinciples with outbound only connections so that we do not need inbound ports or link listeners. Similar to TS, you can host anything anywhere and has options to deploy on any popular host OS or as a virtual appliance. What makes it realluy unique though is that it can actually be embedded inside the application via a suite of SDKs. Yes, private, zero trust connectivity inside an application! That provides the highest security and convenience as it can be completely transparent to the user! Disclaimer, I work for the company who built and maintains OpenZiti so I am opinionated.
    - 4y ago
anderspitman 4y ago
> Web3 happens when people can host stuff on their phones This has essentially been the guiding principle of my side projects for the last two years. Folks shouldn't need to understand DNS, TLS, HTTPS, IP addresses, ports, NAT, CGNAT, etc in order to own their data. Self-hosting a small server for you and your friends shouldn't be any more difficult or less secure than installing an app on your phone.
polote 4y ago
> The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. The same thing is being said on HN about all kind of network software, but tell me one software that Cloudflare is really known for except its cdn ? None. HN is really a strong echo chamber and some people believe Cloudflare and Stripe are going to be the leader in all software areas. (Even though Cloudflare is not the leading CDN and Stripe is not the leading payment processor). They are both amazing companies but they won't fix all problems of the world. I would even argue that they won't even solve more than their current core domains
- freedomben 4y ago
  We must be in different circles, because WAF (web application firewall) is what I would say they're most known for. But I agree Cloudflare isn't well known (at least yet) fort many of the other things they offer. Been a lot of buzz around workers but I haven't tried it myself yet.
  - devman0 4y ago
    CDN and Reverse Proxy are Cloudflare's bread and butter really, WAF came later. The issue is that those technologies are rather invisible to most users when they are working correctly.
- nickysielicki 4y ago
  I bring up cloudflare because the technologies involved with Tailscale are really cloudflare core competencies. Cloudflare runs 1.1.1.1/WARP which is a massive dns server and wireguard VPN, respectively. They already have Cloudflare Access. It’s a natural fit. It’s pretty easy to imagine that cloudflare is better positioned to steal customers from Tailscale than Cisco, F5, or Fortinet. Cloudflare needs to solve two problems: they need to introduce a free tier of Access that doesn’t use the CDN and creates direct connections between endpoints (to basically remove all operating costs), and they need to make the onboarding process for hobbyists easier instead of having a “contact sales” link on their homepage for these products. That’s doable.
- 4y ago
Melatonic 4y ago
I think your last point is what many of us are hoping Web3 really is
1vuio0pswjnm7 4y ago
"Being based on open source wireguard, and being just a STUN/TURN server at its core... I'm sure that Tailscale will be the first but maybe not the best." I like this assessment. "[J]ust a STUN/TURN server at its core." It gives me hope maybe more people are starting to learn how to look at peer-to-peer not as something that is unreasonably complex and off-limits to ordinary users. LAN-like connectivity is not just for offices and gamers. Of course, following a STUN/TURN standard is just one approach to a rendezvous server. It isn't the first or last approach to have worked. By "rendezvous server" I mean a program that accepts connections and saves each client's address and open port number and makes this data available to other connecting clients, thereby allowing one client to connect directly to another client without involving the rendezvous server. The server needs only to tell clients about IP addresses and port numbers, nothing more.^1 Thus it can be a relatively small, relatively simple program.^2 I hope that going forward there will be even more choice in small, open source rendezvous servers, not created for commercial purposes, that ordinary users can run on globally reachable IP addresses. Most users must "lease" these addresses from others. Because not every user has a globally reachable IP address available, the use of "hosting" and now what people today call "cloud" services has been necessary. Enormous amounts of traffic are passing through these third party "cloud" providers. They are, to use a popular term, "gatekeepers". Business customers, including ones who already control globally reachable IPv4 address space, let alone individual customers without such resources, are effectively beholden to them if they want to be on the internet. Not only that, the services are generally expensive. However no data needs to be sent to or received from a rendezvous server other than address and port information. If customers are charged based on ingress/egress, it could be affordable for users to run these small programs on a "cloud server" due to the smaller amount of data transfer. With less data being sent to these third party providers, the privacy concerns would arguably be reduced as well (cf. eliminated). The ability to connect devices directly over a network, including the internet, should not be monopolised like so many other aspects of the computers and the internet today. It should be available for everyone. The only cost should be paying for the globally reachable IP address and a tiny amount of traffic required for running a rendezvous server. 1. The advantage here is that the program can be easier and quicker to compile and users may be more inclined to read the source code and, optionally, make edits and recompile. Non-commercial, not a complex program like a web browser that is prohibitively slow to compile that almost no one compiles for themselves, nor one that few people have both the aptitude and inclination to read, edit and improve its source code. 2. Yes, there can be exceptions. For example, in some cases two clients using the same ISP might not be able to reach other directly. But these cases are the exceptions, not the rule.
lewisl9029 4y ago
Also been a happy user since their very early days. I do have some nits though: - It's kind of finicky on Android, especially with exit nodes enabled. Sometimes I lose connectivity completely after connecting to an exit node, until I flip my WiFi on and off, then everything starts working. - Not being able to auto-update the desktop clients, or at least update remotely, is a bit of a pain, and potentially a security risk?
enos_feedler 4y ago
Isn’t it only possible to host things on your phone if you can have a listener that binds to a socket/port? I don’t think mobile apis allow for this. Am I wrong?
- nickysielicki 4y ago
  I think so, it’s not something I’m too familiar with, but I found apps for both iOS and Android that let you host a web server that can be accessed from another computer on your LAN.
  - enos_feedler 4y ago
    Do those apps need to be in the foreground? It kind of defeats the purpose if so
frutiger 4y ago
> I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. This is basically just `git pull` on steroids.
CryptoPunk 4y ago
>>I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. The network will coalesce around using a handful of hub nodes for the packet forwarding, and a malicious party need only to coopt that central cluster of nodes to unmask all web users. The "blockchain bullshit" enables trusted decentralized interaction at scale.
- nickysielicki 4y ago
  It would only unmask those connecting directly to the central cluster nodes, everyone behind them would be fine.
  - CryptoPunk 4y ago
    I'm suggesting every one would connect directly to the central cluster.
dovholuknf 4y ago
You don't need to dream about it. You can absolutely do this today with OpenZiti. You just need to be able to set it up which is - imo (I am a dev on the project and wrote the quickstarts) just as easy to get up and running as anything. I do it in "under a minute" but I work on the project so my timing is not fair... :) You can find information about it over at https://openziti.github.io/ https://openziti.github.io/ you don't even need to trust the software itself. You can add a 3rd party certificate to the server and mint your own private keys/certs and deliver them to your friends and have 100% control over where and how and whom you trust. You control access down to individual services, not CIDR blocks, not IP addresses. You can embed the sdks into any of your own apps if you're into that sort of thing. :) you could setup a relay server in some cloud provider for the 'untrusted' traffic (hmmmm you make me wonder if we could integrate with tor somehow now too...) Seems like it'd do most/much of the things you want it to. I'd be happy to help you out. We have a discourse you can post questions to.
- qrkourier 4y ago
  I guess it's like anything else. You can trust someone a little to manage your crypto keys or you can do it yourself whether its PKI or a Bitcoin wallet. You have to know and do more to trust less. For me, it's a really great value if software makes DiY crypto convenient enough to do crypto stuff safely enough that I don't have to trust or pay a 3rd party and don't end up wrecked because I got in over my head. Like bowling bumpers, but for cryptography.
- CMCDragonkai 4y ago
  You said you can embed this in an application? What does that mean? Is this a C library that is embeddable?
  - PLG88 4y ago
    You can literally embed private, outbound-only connectivity into your application code using one of the many SDKs - C, Java, Go etc etc... here is a good overview https://ziti.dev/ https://ziti.dev/. As you can embed inside you app, you can now build 'zitifications' which is apps which have native, private connectivity embedded both client or server side. Here are a couple of cool artciles on some we have already done: - Springboot framework: https://blogs.oracle.com/javamagazine/post/java-zero-trust-openziti https://blogs.oracle.com/javamagazine/post/java-zero-trust-o... - Prometheus: https://openziti.github.io/articles/zitification/prometheus/part1.html https://openziti.github.io/articles/zitification/prometheus/...

zionic 4y ago

mnkmnk 4y ago

Cloudflare already has a competing product https://www.cloudflare.com/en-in/lp/ppc/cloudflare-for-teams/ https://www.cloudflare.com/en-in/lp/ppc/cloudflare-for-teams...

nickysielicki 4y ago
It’s not really a competing product until they relaunch it with a heavy consumer focus and with some of the properties that Tailscale has, ie: avoiding going through the cloudflare CDN. But more to my point, cloudflare is definitely in a position to outcompete Tailscale, it’s just a couple tweaks and a marketing shift.
- ThePhysicist 4y ago
  I don't think Tailscale will focus on the consumer market, I'd be very surprised at least if they did. I think they built a developer-friendly product to get mindshare and early adoptors, but eventually the real market for such such products is in the B2B space, i.e. implementing the "BeyondCorp" model of zero-trust networking. There's also a market for building cloud mesh services but I'm not sure if Tailscale is well positioned for that as there are good open-source solutions available for that already.
  - nickysielicki 4y ago
    It costs them so little to provide their free consumer service (iirc: they fall-back to providing transit, but it’s very rare and only occurs when UDP is completely blocked) that it benefits them to keep their focus on consumers because if everyone is using Tailscale, the business customers are inevitable.
  - windexh8er 4y ago
    They already (sort of) do [0] as they have a "Personal Pro" plan that's not too obvious - personally, I hope they expand to make it more cloud-native via a la carte pricing for those users as I'd pay an extra $x/month for an additional subnet router or three. And, IMO, it's a smart approach - those who are the targeted "Prosumer" might leverage this for their homelab and carry it over with them into the enterprise. I say that it's a smart approach because in my time at a vendor that was slinging security middle boxes - we used to give away our small form factor product to those homelab'ers for free. They'd take them home and see how much the solution could provide, they got comfortable with the UI, and they learned it for their own use cases. And then the path into an enterprise conversation held much less friction. [0] https://tailscale.com/pricing/ https://tailscale.com/pricing/
    - seedie 4y ago
      I remember Astaro did this with their Astaro Security Gateway UTM solution. Provide a full featured software appliance for home users and hope the admins are so caught up that they don't want to change to another vendor at work. Astaro got acquired by Sophos in 2011 but I just checked, they still offer the Sophos UTM Gateway in a Home edition. https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-home-edition https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-h...

siavosh 4y ago

I’m pretty ignorant on this topic, but what are the benefits of having a personal VPN?

gzer0 4y ago
I am able to route traffic on my mobile device through my home network via the use of their "exit node" option. It allows one of my home devices to act as an exit node for my entire personal tailscale network. This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365
- karlshea 4y ago
  I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?
  - nickysielicki 4y ago
    NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.
    - karlshea 4y ago
      Ahhh that is slick
    - anderspitman 4y ago
      For more background on just how much Tailscale is doing for you with respect to NAT: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
    - devman0 4y ago
      Is forwarding a single port that difficult in most circumstances? I do realize there are some instances where that is hard like CGNAT, but if I have easy access to wireguard in my network already what does tailscale buy me?

tepitoperrito 4y ago

Like a hybrid NNCP-GO and nebula sdn. Neat!

lazzlazzlazz 4y ago

> a direct ring of trust with friends The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product like Tailscale seems to rely completely on centralized identity providers (you have to choose Google, Microsoft, or Github on sign-in). Ultimately, if you want to maintain full control of your online identity and network, you'll probably need some of the decentralized (but economically aware) resources you seem to have issues with — or at the very least a means of transitioning authentication to private key methods with DIDs.

nickysielicki 4y ago
I feel like people are so concerned about infinite scaling that nobody ever tries to scale to 5 anymore. I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow. With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today? I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere. edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.
- discardedrefuse 4y ago
  > And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated. How many of your friends and family are "friends" with bots on Facebook?
- anderspitman 4y ago
  Definitely stealing mom-technical. Though I do disagree somewhat with the conflation with blue-collar. I would almost argue white-collar folks are less likely to understand computers.

systemvoltage 4y ago

Well put, there is no moat. Corporate customers really don’t want yet another network infra if they have Cloudflare + ZTN offerings. Cloudflare, please make a box I can buy and stick it in the closet with a WAN connection. Routers suck, it’s time to reinvent them. Also please don’t make them look like goddamn spaceships.

jgrahamc 4y ago
What's this box going to do?
- systemvoltage 4y ago
  I was thinking a router that’s connected to Cloudflare network. Every device that connects to it is automatically on Cloudflare tunnels or Tailscale like VPN. And generally do the routing stuff better than ubiquity products (can manage your home router through their control panel from anywhere). Remote devices would need a client installed on it to access the VPN, of course.
  - babelfish 4y ago
    https://blog.cloudflare.com/cloudflare-for-offices/ https://blog.cloudflare.com/cloudflare-for-offices/

discardedrefuse 4y ago

> I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. Might want to check out Yggdrasil. It lets you can create a real mesh routed, E2E encrypted network. You can keep your network private, or connect it to the greater network and route others. There's no ring-of-trust (I can't imagine that as a viable solution at scale). But the config file has an AllowedPublicKeys section if you want to specify who can route through your node. https://github.com/yggdrasil-network/yggdrasil-go https://github.com/yggdrasil-network/yggdrasil-go

_abox 4y ago
Thanks, I thought I knew all the major mesh VPN options (tinc, nebula, tailscale, zero tier, hamachi) and yet I never heard of yggdrasil. This is the kind of comment I love HN for!
- ctrlc-root 4y ago
  Here's one more: https://fastd.readthedocs.io/en/v22/index.html https://fastd.readthedocs.io/en/v22/index.html
- PLG88 4y ago
  Here is another (sort of), OpenZiti - https://openziti.github.io/ https://openziti.github.io/. OpenZiti provides a mesh overlay network built on zero trust priinciples with outbound only connections so that we do not need inbound ports or link listeners. Similar to TS, you can host anything anywhere and has options to deploy on any popular host OS or as a virtual appliance. What makes it realluy unique though is that it can actually be embedded inside the application via a suite of SDKs. Yes, private, zero trust connectivity inside an application! That provides the highest security and convenience as it can be completely transparent to the user! Disclaimer, I work for the company who built and maintains OpenZiti so I am opinionated.
  - 4y ago

anderspitman 4y ago

> Web3 happens when people can host stuff on their phones This has essentially been the guiding principle of my side projects for the last two years. Folks shouldn't need to understand DNS, TLS, HTTPS, IP addresses, ports, NAT, CGNAT, etc in order to own their data. Self-hosting a small server for you and your friends shouldn't be any more difficult or less secure than installing an app on your phone.

polote 4y ago

> The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. The same thing is being said on HN about all kind of network software, but tell me one software that Cloudflare is really known for except its cdn ? None. HN is really a strong echo chamber and some people believe Cloudflare and Stripe are going to be the leader in all software areas. (Even though Cloudflare is not the leading CDN and Stripe is not the leading payment processor). They are both amazing companies but they won't fix all problems of the world. I would even argue that they won't even solve more than their current core domains

freedomben 4y ago
We must be in different circles, because WAF (web application firewall) is what I would say they're most known for. But I agree Cloudflare isn't well known (at least yet) fort many of the other things they offer. Been a lot of buzz around workers but I haven't tried it myself yet.
- devman0 4y ago
  CDN and Reverse Proxy are Cloudflare's bread and butter really, WAF came later. The issue is that those technologies are rather invisible to most users when they are working correctly.
nickysielicki 4y ago
I bring up cloudflare because the technologies involved with Tailscale are really cloudflare core competencies. Cloudflare runs 1.1.1.1/WARP which is a massive dns server and wireguard VPN, respectively. They already have Cloudflare Access. It’s a natural fit. It’s pretty easy to imagine that cloudflare is better positioned to steal customers from Tailscale than Cisco, F5, or Fortinet. Cloudflare needs to solve two problems: they need to introduce a free tier of Access that doesn’t use the CDN and creates direct connections between endpoints (to basically remove all operating costs), and they need to make the onboarding process for hobbyists easier instead of having a “contact sales” link on their homepage for these products. That’s doable.
4y ago

Melatonic 4y ago

I think your last point is what many of us are hoping Web3 really is

1vuio0pswjnm7 4y ago

"Being based on open source wireguard, and being just a STUN/TURN server at its core... I'm sure that Tailscale will be the first but maybe not the best." I like this assessment. "[J]ust a STUN/TURN server at its core." It gives me hope maybe more people are starting to learn how to look at peer-to-peer not as something that is unreasonably complex and off-limits to ordinary users. LAN-like connectivity is not just for offices and gamers. Of course, following a STUN/TURN standard is just one approach to a rendezvous server. It isn't the first or last approach to have worked. By "rendezvous server" I mean a program that accepts connections and saves each client's address and open port number and makes this data available to other connecting clients, thereby allowing one client to connect directly to another client without involving the rendezvous server. The server needs only to tell clients about IP addresses and port numbers, nothing more.^1 Thus it can be a relatively small, relatively simple program.^2 I hope that going forward there will be even more choice in small, open source rendezvous servers, not created for commercial purposes, that ordinary users can run on globally reachable IP addresses. Most users must "lease" these addresses from others. Because not every user has a globally reachable IP address available, the use of "hosting" and now what people today call "cloud" services has been necessary. Enormous amounts of traffic are passing through these third party "cloud" providers. They are, to use a popular term, "gatekeepers". Business customers, including ones who already control globally reachable IPv4 address space, let alone individual customers without such resources, are effectively beholden to them if they want to be on the internet. Not only that, the services are generally expensive. However no data needs to be sent to or received from a rendezvous server other than address and port information. If customers are charged based on ingress/egress, it could be affordable for users to run these small programs on a "cloud server" due to the smaller amount of data transfer. With less data being sent to these third party providers, the privacy concerns would arguably be reduced as well (cf. eliminated). The ability to connect devices directly over a network, including the internet, should not be monopolised like so many other aspects of the computers and the internet today. It should be available for everyone. The only cost should be paying for the globally reachable IP address and a tiny amount of traffic required for running a rendezvous server. 1. The advantage here is that the program can be easier and quicker to compile and users may be more inclined to read the source code and, optionally, make edits and recompile. Non-commercial, not a complex program like a web browser that is prohibitively slow to compile that almost no one compiles for themselves, nor one that few people have both the aptitude and inclination to read, edit and improve its source code. 2. Yes, there can be exceptions. For example, in some cases two clients using the same ISP might not be able to reach other directly. But these cases are the exceptions, not the rule.

lewisl9029 4y ago

Also been a happy user since their very early days. I do have some nits though: - It's kind of finicky on Android, especially with exit nodes enabled. Sometimes I lose connectivity completely after connecting to an exit node, until I flip my WiFi on and off, then everything starts working. - Not being able to auto-update the desktop clients, or at least update remotely, is a bit of a pain, and potentially a security risk?

enos_feedler 4y ago

Isn’t it only possible to host things on your phone if you can have a listener that binds to a socket/port? I don’t think mobile apis allow for this. Am I wrong?

nickysielicki 4y ago
I think so, it’s not something I’m too familiar with, but I found apps for both iOS and Android that let you host a web server that can be accessed from another computer on your LAN.
- enos_feedler 4y ago
  Do those apps need to be in the foreground? It kind of defeats the purpose if so

frutiger 4y ago

CryptoPunk 4y ago

>>I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust. The network will coalesce around using a handful of hub nodes for the packet forwarding, and a malicious party need only to coopt that central cluster of nodes to unmask all web users. The "blockchain bullshit" enables trusted decentralized interaction at scale.

nickysielicki 4y ago
It would only unmask those connecting directly to the central cluster nodes, everyone behind them would be fine.
- CryptoPunk 4y ago
  I'm suggesting every one would connect directly to the central cluster.

dovholuknf 4y ago

You don't need to dream about it. You can absolutely do this today with OpenZiti. You just need to be able to set it up which is - imo (I am a dev on the project and wrote the quickstarts) just as easy to get up and running as anything. I do it in "under a minute" but I work on the project so my timing is not fair... :) You can find information about it over at https://openziti.github.io/ https://openziti.github.io/ you don't even need to trust the software itself. You can add a 3rd party certificate to the server and mint your own private keys/certs and deliver them to your friends and have 100% control over where and how and whom you trust. You control access down to individual services, not CIDR blocks, not IP addresses. You can embed the sdks into any of your own apps if you're into that sort of thing. :) you could setup a relay server in some cloud provider for the 'untrusted' traffic (hmmmm you make me wonder if we could integrate with tor somehow now too...) Seems like it'd do most/much of the things you want it to. I'd be happy to help you out. We have a discourse you can post questions to.

qrkourier 4y ago
I guess it's like anything else. You can trust someone a little to manage your crypto keys or you can do it yourself whether its PKI or a Bitcoin wallet. You have to know and do more to trust less. For me, it's a really great value if software makes DiY crypto convenient enough to do crypto stuff safely enough that I don't have to trust or pay a 3rd party and don't end up wrecked because I got in over my head. Like bowling bumpers, but for cryptography.
CMCDragonkai 4y ago
You said you can embed this in an application? What does that mean? Is this a C library that is embeddable?
- PLG88 4y ago
  You can literally embed private, outbound-only connectivity into your application code using one of the many SDKs - C, Java, Go etc etc... here is a good overview https://ziti.dev/ https://ziti.dev/. As you can embed inside you app, you can now build 'zitifications' which is apps which have native, private connectivity embedded both client or server side. Here are a couple of cool artciles on some we have already done: - Springboot framework: https://blogs.oracle.com/javamagazine/post/java-zero-trust-openziti https://blogs.oracle.com/javamagazine/post/java-zero-trust-o... - Prometheus: https://openziti.github.io/articles/zitification/prometheus/part1.html https://openziti.github.io/articles/zitification/prometheus/...