6 ms·

Huge fan of Tailscale here too. They solved every single complaint I had with using WireGuard (provisioning, key exchange, IP assignment, ACLs, etc.) and did it

by atonse 4y ago

Huge fan of Tailscale here too. They solved every single complaint I had with using WireGuard (provisioning, key exchange, IP assignment, ACLs, etc.) and did it in a splendid and elegant tool that just disappears. One of the few products I recommend enthusiastically. To be clear, WireGuard seemed to have the right level of abstraction as a tool for others to build on (just like it built on top of the noise framework), and someone like Tailscale ran with it.

colordrops 4y ago
The main reason I use wireguard on my personal network is to keep 3rd party clouds out of it. My understanding is that a closed source node that phones home is part of their solution. For my personal case, this is a total no-go.
- Operyl 4y ago
  It's worth noting that the Tailscale client is, almost entirely, open source. It's just the iOS/macOS/Windows client code that's closed source (just GUI wrapping it), iirc[0]. The DERP code is also open source. Additionally, there's an open source reimplementation of the control plane called headscale, as well. The Tailscale team has complimented it, but of course it's all on your own if you choose to run it.[1] [0] https://github.com/tailscale/tailscale https://github.com/tailscale/tailscale [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale EDIT: Android code is actually entirely open, oops!
  - ngcc_hk 4y ago
    Wonder why those are closed source if just gui wrapping.
    - sneak 4y ago
      Well, you can't sometimes or halfway be committed to software freedom, so it's because they only open sourced the other parts for marketing.
    - Tostino 4y ago
      To make it harder for a competitor to pop up and offer their own flavor of the binaries and support. It's just to raise the barrier of entry to others monetizing your project
    - danielheath 4y ago
      Maybe because nobody on iOS/macOS/Windows cares if there's closed source code running on their machine.
      - rollcat 4y ago
        I do, and wherever all other things are equal, I always choose an open source solution. But if all other things were always equal, I'd be running OpenBSD full time, so...
        cynix 4y ago
        Being open source is not as useful on iOS though, since there’s no way to verify that what they uploaded to the App Store was actually built from the source that you can see.
        rollcat 4y ago
        How often do you rebuild your system and verify all checksums? What's your threat model?
        cynix 4y ago
        The point was that you _could_ verify whether a binary package matches the source if you wanted to on other platforms, not that you _have to_ do it all the time. With iOS you don’t have that ability so you’d have to have complete trust in the developers. The threat model is someone publishing innocent source code but sneaking in something malicious in the version they publish on the App Store, of course.
        rollcat 4y ago
        > The point was that you _could_ verify whether a binary package matches the source if you wanted to on other platforms [...]. Which platforms? From Debian wiki (https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds): > Reproducible builds of Debian as a whole is still not a reality, though individual reproducible builds of packages are possible and being done. So while we are making very good progress, it is a stretch to say that Debian is reproducible. Apart from Debian and NixOS, I'm not aware of any other large-scale efforts to make builds reproducible, so this something you have to assess on a case-by-case basis for every single piece of software you might want to download and install. Not IF the checksums match, but IF the project aims for reproducible builds in the first place. By the way, if you download an iOS app on an M1 Mac, you can inspect its archive freely, including generating and comparing checksums of each file, disassembling the executable, and so on. So while not every iOS app can be downloaded on a Mac (the developer actually has to opt out), and not everyone has access to an M1 Mac, this is not entirely impossible. > With iOS you don’t have that ability so you’d have to have complete trust in the developers. This is not entirely true. I also have a certain degree of trust in the application sandbox provided by the OS, and in the app review process. I know neither is perfect but it's not like everything I install runs with full root. > The threat model is someone publishing innocent source code but sneaking in something malicious in the version they publish on the App Store, of course. What is your strategy for applications that do not publish any source code? Do you exclusively use software with source available? Don't get me wrong, you raise valid and important points, but this is a way bigger fish and "if only Apple did X" is just the first step.
    - cortesoft 4y ago
      So they can make money?
    - justsomehnguy 4y ago
      Because if I need to deploy some tech for a company with a thousands of clients I want something what doesn't need my attention for every other client station. I need something robust what would work 99% of times and for a 1% what disbehave I can OR just change the environment so the client would run or drop a ticket to the guys who I am paying for diagmosing these things and after a couple of days or weeks: Just install a new version which would work OR Have the understanding how I can change the environment so it would work. The thing is what I don't need to spend my time on solving these things.
- thejosh 4y ago
  Wireguard is absolutely fantastic for a small network, when you know what you're doing. It's dead easy to setup and configure, you forward some ports, and boom you have a shared network. I couldn't believe how easy it is to configure. I set it up for work, do a key rotation on a schedule and it's great. Tailscale I use for home use on my personal laptop + machines and it's fantastic as I don't need to port forward or anything. I changed over from using Wireguard with minimal effort, just changing some IPs over. Probably end up using MagicDNS (their DNS solution), then if I need to change off I'll just change this. Their free tier is very generous for a single user.
  - pkulak 4y ago
    My problem is that Wireguard alone works too well. Years ago I got it all set up, forwarded the one port, and it’s been perfect ever since. I really want an excuse to try Tailscale. Some day. Haha
    - cpuguy83 4y ago
      Excuse is no need to do port forwards.
      - oynqr 4y ago
        Having a VPS in the mix removes that hassle.
deleted 4y ago
[deleted]
onelovetwo 4y ago
Is this a replacement for something like Mullvad?
- linsomniac 4y ago
  No. Mullvad is VPN to the Internet, Tailscale is a VPN among your own machines.

by atonse 4y ago

colordrops 4y ago

The main reason I use wireguard on my personal network is to keep 3rd party clouds out of it. My understanding is that a closed source node that phones home is part of their solution. For my personal case, this is a total no-go.

Operyl 4y ago
It's worth noting that the Tailscale client is, almost entirely, open source. It's just the iOS/macOS/Windows client code that's closed source (just GUI wrapping it), iirc[0]. The DERP code is also open source. Additionally, there's an open source reimplementation of the control plane called headscale, as well. The Tailscale team has complimented it, but of course it's all on your own if you choose to run it.[1] [0] https://github.com/tailscale/tailscale https://github.com/tailscale/tailscale [1] https://github.com/juanfont/headscale https://github.com/juanfont/headscale EDIT: Android code is actually entirely open, oops!
- ngcc_hk 4y ago
  Wonder why those are closed source if just gui wrapping.
  - sneak 4y ago
    Well, you can't sometimes or halfway be committed to software freedom, so it's because they only open sourced the other parts for marketing.
  - Tostino 4y ago
    To make it harder for a competitor to pop up and offer their own flavor of the binaries and support. It's just to raise the barrier of entry to others monetizing your project
  - danielheath 4y ago
    Maybe because nobody on iOS/macOS/Windows cares if there's closed source code running on their machine.
    - rollcat 4y ago
      I do, and wherever all other things are equal, I always choose an open source solution. But if all other things were always equal, I'd be running OpenBSD full time, so...
      - cynix 4y ago
        Being open source is not as useful on iOS though, since there’s no way to verify that what they uploaded to the App Store was actually built from the source that you can see.
        rollcat 4y ago
        How often do you rebuild your system and verify all checksums? What's your threat model?
        cynix 4y ago
        The point was that you _could_ verify whether a binary package matches the source if you wanted to on other platforms, not that you _have to_ do it all the time. With iOS you don’t have that ability so you’d have to have complete trust in the developers. The threat model is someone publishing innocent source code but sneaking in something malicious in the version they publish on the App Store, of course.
        rollcat 4y ago
        > The point was that you _could_ verify whether a binary package matches the source if you wanted to on other platforms [...]. Which platforms? From Debian wiki (https://wiki.debian.org/ReproducibleBuilds https://wiki.debian.org/ReproducibleBuilds): > Reproducible builds of Debian as a whole is still not a reality, though individual reproducible builds of packages are possible and being done. So while we are making very good progress, it is a stretch to say that Debian is reproducible. Apart from Debian and NixOS, I'm not aware of any other large-scale efforts to make builds reproducible, so this something you have to assess on a case-by-case basis for every single piece of software you might want to download and install. Not IF the checksums match, but IF the project aims for reproducible builds in the first place. By the way, if you download an iOS app on an M1 Mac, you can inspect its archive freely, including generating and comparing checksums of each file, disassembling the executable, and so on. So while not every iOS app can be downloaded on a Mac (the developer actually has to opt out), and not everyone has access to an M1 Mac, this is not entirely impossible. > With iOS you don’t have that ability so you’d have to have complete trust in the developers. This is not entirely true. I also have a certain degree of trust in the application sandbox provided by the OS, and in the app review process. I know neither is perfect but it's not like everything I install runs with full root. > The threat model is someone publishing innocent source code but sneaking in something malicious in the version they publish on the App Store, of course. What is your strategy for applications that do not publish any source code? Do you exclusively use software with source available? Don't get me wrong, you raise valid and important points, but this is a way bigger fish and "if only Apple did X" is just the first step.
  - cortesoft 4y ago
    So they can make money?
  - justsomehnguy 4y ago
    Because if I need to deploy some tech for a company with a thousands of clients I want something what doesn't need my attention for every other client station. I need something robust what would work 99% of times and for a 1% what disbehave I can OR just change the environment so the client would run or drop a ticket to the guys who I am paying for diagmosing these things and after a couple of days or weeks: Just install a new version which would work OR Have the understanding how I can change the environment so it would work. The thing is what I don't need to spend my time on solving these things.
thejosh 4y ago
Wireguard is absolutely fantastic for a small network, when you know what you're doing. It's dead easy to setup and configure, you forward some ports, and boom you have a shared network. I couldn't believe how easy it is to configure. I set it up for work, do a key rotation on a schedule and it's great. Tailscale I use for home use on my personal laptop + machines and it's fantastic as I don't need to port forward or anything. I changed over from using Wireguard with minimal effort, just changing some IPs over. Probably end up using MagicDNS (their DNS solution), then if I need to change off I'll just change this. Their free tier is very generous for a single user.
- pkulak 4y ago
  My problem is that Wireguard alone works too well. Years ago I got it all set up, forwarded the one port, and it’s been perfect ever since. I really want an excuse to try Tailscale. Some day. Haha
  - cpuguy83 4y ago
    Excuse is no need to do port forwards.
    - oynqr 4y ago
      Having a VPS in the mix removes that hassle.

deleted 4y ago

[deleted]

onelovetwo 4y ago

Is this a replacement for something like Mullvad?

linsomniac 4y ago
No. Mullvad is VPN to the Internet, Tailscale is a VPN among your own machines.