3 ms·

> a direct ring of trust with friends The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product li

> a direct ring of trust with friends The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product like Tailscale seems to rely completely on centralized identity providers (you have to choose Google, Microsoft, or Github on sign-in). Ultimately, if you want to maintain full control of your online identity and network, you'll probably need some of the decentralized (but economically aware) resources you seem to have issues with — or at the very least a means of transitioning authentication to private key methods with DIDs.

nickysielicki 4y ago
I feel like people are so concerned about infinite scaling that nobody ever tries to scale to 5 anymore. I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow. With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today? I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere. edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.
- discardedrefuse 4y ago
  > And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated. How many of your friends and family are "friends" with bots on Facebook?
- anderspitman 4y ago
  Definitely stealing mom-technical. Though I do disagree somewhat with the conflation with blue-collar. I would almost argue white-collar folks are less likely to understand computers.
zanny 4y ago
I self host headscale as my control node of my tailscale vpn so no sign ins required, I just give keys out to anyone I want in my vpn. My problem is the client doesn't support multiple servers, so I can't have a work vpn and a home vpn, not even with an easy toggle - you have to run tailscale with different conf options for both. Changing namespaces also isn't easy, so having friends and family segregated even on one server is also a pain point.
- GekkePrutser 4y ago
  Thanks the main objection I have with tailscale is that you can't self-host (and you need external identity providers). I had no idea there was a self host option. I'll investigate. I assume it's an unsupported community option?
  - seedie 4y ago
    op is talking about headscale [0] "An open source, self-hosted implementation of the Tailscale control server" [0] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- Handytinge 4y ago
  I'd love to try headscale, but a bit of research shows that the tailscale macOS client requires a CLI param to connect to a custom server, registry keys for Windows, Android client requires custom compile, and there's no iOS client at all. Unfortunately if I need to bring anyone into my mesh network who is non technical, this is now a non starter.
cma 4y ago
What are DIDs: Device IDs?
- lazzlazzlazz 4y ago
  Decentralized Identifiers: https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/
  - aaaaaaaaata 4y ago
    Very cool. Microsoft doing newish work on this, too! https://www.microsoft.com/en-us/security/business/identity-access-management/decentralized-identity-solution https://www.microsoft.com/en-us/security/business/identity-a...
Serow225 4y ago
fwiw, those on the Enterprise plan can bring their own IdP :) https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/

nickysielicki 4y ago

I feel like people are so concerned about infinite scaling that nobody ever tries to scale to 5 anymore. I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow. With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today? I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere. edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.

discardedrefuse 4y ago
> And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated. How many of your friends and family are "friends" with bots on Facebook?
anderspitman 4y ago
Definitely stealing mom-technical. Though I do disagree somewhat with the conflation with blue-collar. I would almost argue white-collar folks are less likely to understand computers.

zanny 4y ago

I self host headscale as my control node of my tailscale vpn so no sign ins required, I just give keys out to anyone I want in my vpn. My problem is the client doesn't support multiple servers, so I can't have a work vpn and a home vpn, not even with an easy toggle - you have to run tailscale with different conf options for both. Changing namespaces also isn't easy, so having friends and family segregated even on one server is also a pain point.

GekkePrutser 4y ago
Thanks the main objection I have with tailscale is that you can't self-host (and you need external identity providers). I had no idea there was a self host option. I'll investigate. I assume it's an unsupported community option?
- seedie 4y ago
  op is talking about headscale [0] "An open source, self-hosted implementation of the Tailscale control server" [0] https://github.com/juanfont/headscale https://github.com/juanfont/headscale
Handytinge 4y ago
I'd love to try headscale, but a bit of research shows that the tailscale macOS client requires a CLI param to connect to a custom server, registry keys for Windows, Android client requires custom compile, and there's no iOS client at all. Unfortunately if I need to bring anyone into my mesh network who is non technical, this is now a non starter.

cma 4y ago

What are DIDs: Device IDs?

lazzlazzlazz 4y ago
Decentralized Identifiers: https://www.w3.org/TR/did-core/ https://www.w3.org/TR/did-core/
- aaaaaaaaata 4y ago
  Very cool. Microsoft doing newish work on this, too! https://www.microsoft.com/en-us/security/business/identity-access-management/decentralized-identity-solution https://www.microsoft.com/en-us/security/business/identity-a...

Serow225 4y ago

fwiw, those on the Enterprise plan can bring their own IdP :) https://tailscale.com/kb/1119/sso-saml-oidc/ https://tailscale.com/kb/1119/sso-saml-oidc/