9 ms·

Maybe I have a fundamental misunderstanding of how Tailscale works, but I always feel like there is a disconnect in how it is received on HN. Usually people ar

Maybe I have a fundamental misunderstanding of how Tailscale works, but I always feel like there is a disconnect in how it is received on HN. Usually people are pretty critical/cynical of sending sensitive data to a closed source third party server, no matter how strong their claims of 'being the good guys' are (eg see Telegram). But somehow we're all meant to be happy giving full control of our entire network to a commercial company running a closed source command and control server?

ocimbote 4y ago
I think that by the sheer nature of Wireguard, it doesn't matter much. We don't send any readable data to Tailscale, they, for the greater part, handle plumbing between nodes. What goes in the pipes remains unnoticed and unknown to them. Their MagicDNS feature may raise different concerns though, but I'll let others comment on it.
- edf13 4y ago
  This new service allows them (or if they’re hacked - anyone)… to MitM your connections - they state themselves they could ssl terminate the connections as they own the ts.net level, they say they don’t but that’s now…
  - ignoramous 4y ago
    > This new service allows them (or if they’re hacked - anyone)… to MitM your connections... TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?). Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. The providers running those load balancers control IPs + DNS records too, for good measure. I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.
deleted 4y ago
[deleted]
EMIRELADERO 4y ago
Forget the server, what especially worries me is the client. For some weird reason the GUI clients for Windows, macOS and iOS are closed-source. I never understood exactly why that is, considering that the Linux and Android ones are fully open. The fact that there isn't a reason documented anywhere certainly worries me.
- maxrev17 4y ago
  Maybe the codebases need some tidying for open source, the chronology seems to make sense. I guess it isn't as simple as 'make repo public'.
  - EMIRELADERO 4y ago
    I see no reason why the tidying couldn't be done in public. Why not make a public repo that's closed off to external influence until it's "tidy" enough?
    - maccard 4y ago
      If they use a proprietary third party library, they might not have a source distribution license of said library. The same way that you can't just unilaterally decalare an MIT licensed project is GPL without ensuring that all of the code was dual licensed or covered under a CLA. EDIT: I saw another comment that says that it's "just" the GUI applications for Windows and Mac that aren't open, but the core functionality is. I know that in Windows-land, it's _very_ common to use proprietary UI libraries like Telerik UI[0], or devexpress [1] [0] https://www.telerik.com/purchase/individual/winforms.aspx https://www.telerik.com/purchase/individual/winforms.aspx [1] https://www.devexpress.com/ https://www.devexpress.com/
- Operyl 4y ago
  They’ve said that closed source systems will keep the GUI closed source: https://tailscale.com/opensource/ https://tailscale.com/opensource/
  - 4y ago
IceWreck 4y ago
Why depend on Tailscale when you can go 100% open source and use slack's nebula or plain old wireguard or one of those open source wireguard manager apps.
- uniqueuid 4y ago
  Plain old wireguard doesn't do double-nat hole punching. And many of the open-source alternatives (such as innernet) also don't.
- mosselman 4y ago
  "Plain old wireguard" In my mind wireguard was still the new kid on the block. Technology moves so fast.
  - doix 4y ago
    Same here. Also, in my mind, wireguard just works. I tried setting up OpenVPN one time and gave up. Wireguard was a breath of fresh air. Generated some QR codes for my mobile devices, rsynced some .conf files to my machines and I was good to go.
  - yepguy 4y ago
    Calling something "plain old" in no way implies that it's old. https://en.wiktionary.org/wiki/plain_old https://en.wiktionary.org/wiki/plain_old
- leetnewb 4y ago
  Nebula seems to be under Defined Networking (https://www.defined.net/ https://www.defined.net/) now. It lacks the ease and tooling of the multitude of others that emerged in the space. My gut is that it's usable for the clever home user but meant for a professional IT dept with the ability/desire to build their own tooling and automation around it. The spartan mobile app is a sign of such. Tailscale is probably more easily usable for the average user than nebula or even vanilla wireguard.
- jonathantf2 4y ago
  Because the whole point of Tailscale is that it's zero config, I don't really want ot mess about with wireguard.
mudrockbestgirl 4y ago
And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. Or create add-ons that are useful and no longer privacy-preserving. The fact that they are a VC-funded business makes me believe this is how the company will end up: Customer data will be monetized in one way or another. How else are going to create returns for shareholders that justify their valuation? Certainly not by open sourcing stuff and not looking at your data. We've seen these VC incentives play out again and again in other companies. Just use wireguard. It really isn't that hard.
- secunit 4y ago
  >Just use wireguard. It really isn't that hard. I love WG and use it extensively, but the attraction of Tailscale (and why I use it) is that it takes disparate concepts and gives you a nice visual control panel to manage them and see the status of all your devices in one place. Nothing. Absolutely nothing exists for Wireguard that does even some of that, which doesn't also cost money. I don't think Wireguard is even capable of the 'DERP' server concept to get around NAT limitations. So no, you can't 'just use Wireguard' to accomplish what Tailscale does.
- secunit 4y ago
  >And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. I can't (and refuse) to live my lie by "what ifs." If they do any of those things, it's easy enough to pivot to the 3 or 4 other providers our there, like ZeroTier, who offer the same thing. My hope is if they do, the FOSS community will have gotten their act together and built a capable replacement, which is usually the case.
- augusto-moura 4y ago
  Not really true, tailscale clients do allow you to point to different control servers and open source implementations do exist[1] and are thriving. The clients are also open source and you can even create one yourself if you are willing to. The thing is, what makes tailscale works really well as a "central" control server is that it makes a lot easier to connect your personal machines. You don't need to deploy your own server, or mess with networking stuff. You just download it, log-in and there you go. I myself have invited some non-tech friends to my network for playing lan games from time time and they find pretty easy to setup tailscale on their side. [1]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
rs_rs_rs_rs_rs 4y ago
>But somehow we're all meant to be happy giving full control of our entire network to a commercial company running a closed source command and control server? Yes, Tailscale is THAT good this tradeoff is worth it.
simjnd 4y ago
I remember reading that Tailscale is "helping out" [1] development of Headscale [2], an open-source re-implementation of their command server so that the two remain compatible as new features are added to the official one. [1]: https://tailscale.com/opensource/ https://tailscale.com/opensource/ [2]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
deleted 4y ago
[deleted]
fudgefactorfive 4y ago
Honestly, I hate the idea of having a middle man, but having tried and researched extensively how to make something like a direct tunnel between two clients over the internet it just doesn't always work. NAT is a godsend for IPv4 exhaustion, but it's also fundamentally crippled the ability for people to host things or make things available directly from their homes. Hole-punching is an inexact process due to the variety of different NAT types, some of which (e.g. Carrier-grade) simply do not allow that sort of connection. So there must be a middle man that accepts packets on their publicly available port and passes it on to another established connection. TURN/STUN (et. al.) exist but are archaic and do the same thing but with less accountability. I hate it too but until we have IPv6 by default with user controlled firewalls hosting something in your garage without a business line is not feasible. Hell I have a 5$ a month VPS purely so it can act as the middle man to the servers in my home. At least then I only need to trust myself as the middle man.
- ithkuil 4y ago
  Their middle man in the data plane handles encrypted packets so that's not the problem here. The problem is their control plane that controls the encryption keys. A malicious admin inside TS (or a hack) could grant itself membership in any of their customer's networks. (Or at least this is the worry I read from GP)
  - fudgefactorfive 4y ago
    That's definitely a concern, but I feel this can be mitigated by running your own network on top of theirs. Anyone in my home is part of my network, doesn't mean they're in the wg network too. Aside from that, it's definitely a problem that they could include themselves in any customer network, but the accountability still stands. If someone got in without your screw-up, at least you know who to point the finger at once the dust settles. I'd argue it should be treated as a base to overlay your network on top of. Although admittedly I say that as someone that doesn't use their services for similar reasons.
    - ithkuil 4y ago
apitman 4y ago
I agree it's not ideal, but I can tell you why I'm excited about things like[0] Tailscale, Cloudflare Tunnel, ngrok, etc. They enable you to move your selfhosted services from expensive, slow VPSes you don't control to fast devices in your own home[4]. IMO this is strictly better than a VPS in terms of privacy and data control. It's a step in the right direction, back towards the initial intent of the internet, but also forward with the lessons we've learned in the real world. The reality today is that selfhosting is way too hard[1]. It shouldn't be any more complicated or less secure than running an app on your phone. I think services like Tailscale are going to enable the first generation of selfhosting that approaches that level of simplicity. Once the market is proven, the second generation is going be designed for selfhosters and have features like end-to-end encryption, domain name integration, and simple GUI interfaces. The other key pieces are strong sandboxing, which is now possible on all major desktop OSes through virtualization (mobile is coming[2]), and dead-simple cloud backups. The technology for all these things exists, it just hasn't been integrated yet. [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling [1]: https://moxie.org/2022/01/07/web3-first-impressions.html https://moxie.org/2022/01/07/web3-first-impressions.html [2]: https://twitter.com/kdrag0n/status/1584017653269958656?lang=en https://twitter.com/kdrag0n/status/1584017653269958656?lang=... [4]: I concede that the network upload connection is likely much slower, but expect that to improve over time.
- VikingCoder 4y ago
  Strong sandboxing, yes. But I'd especially appreciate it if it was wrapped up in an interface like Sandstorm.io. I want to teach something like Tailscale about my contacts, so they are allowed to communicate with my services (through their services). Then I want to run an app inside a strong sanbox that has capability-based APIs to do things kind of like ZeroMQ for sending messages TO THE CONTACTS. I don't want the API to look like a tcp/ip or udp connection. I want the app to think it's sending a message to a contact I've given it permission to talk to. If this was running in a strong sandbox, I think this would be an awesome way to develop and use simple federated apps. If something like Mastodon existed on top of this, I'd think it would be really secure and much easier to tell people to stand up their own node...
rkangel 4y ago
Leaving aside adoption, there is a degree to which HN is impressed that Tailscale has taken a set of technical problems that have caused many of us pain over the years and that drive some less than ideal setups and just made them go away. They are magically taken care of behind an easy to use setup that Just Works. There's basically none of the "you have to tweak this setting under this circumstance" needed to get it working. That is difficult engineering requiring people who understand the problem domain and have a clear picture of the right architecture, as well as good product engineering.
- djbusby 4y ago
  Isn't TailScale "just" WireGuard?
  - apitman 4y ago
    No. For example: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
  - rkangel 4y ago
    Nope. It's Wireguard 'underneath' but a whole lot more over the top. Try this: Go set up a Wireguard connection from your PC at home to one at work. Then do the same thing with tailscale. One will be a lot easier than the other. And that's only 2 computers...
    - djbusby 4y ago
      Um. I already have like 100s of WG connection. Office to cloud, various servers all over connected to others, servers on many WG "subnets". WG is the easiest VPN I've ever used. Dropped all these other crazy rigs (stunnel, ssh-tunnel, etc) cause WG always "just works" and is on every platform. However, I've spent loads of time as network admin, planning IP-space for VPN layers, first time in 1997.
    - deleted 4y ago
      [deleted]

ocimbote 4y ago

I think that by the sheer nature of Wireguard, it doesn't matter much. We don't send any readable data to Tailscale, they, for the greater part, handle plumbing between nodes. What goes in the pipes remains unnoticed and unknown to them. Their MagicDNS feature may raise different concerns though, but I'll let others comment on it.

edf13 4y ago
This new service allows them (or if they’re hacked - anyone)… to MitM your connections - they state themselves they could ssl terminate the connections as they own the ts.net level, they say they don’t but that’s now…
- ignoramous 4y ago
  > This new service allows them (or if they’re hacked - anyone)… to MitM your connections... TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?). Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. The providers running those load balancers control IPs + DNS records too, for good measure. I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.

deleted 4y ago

[deleted]

EMIRELADERO 4y ago

Forget the server, what especially worries me is the client. For some weird reason the GUI clients for Windows, macOS and iOS are closed-source. I never understood exactly why that is, considering that the Linux and Android ones are fully open. The fact that there isn't a reason documented anywhere certainly worries me.

maxrev17 4y ago
Maybe the codebases need some tidying for open source, the chronology seems to make sense. I guess it isn't as simple as 'make repo public'.
- EMIRELADERO 4y ago
  I see no reason why the tidying couldn't be done in public. Why not make a public repo that's closed off to external influence until it's "tidy" enough?
  - maccard 4y ago
    If they use a proprietary third party library, they might not have a source distribution license of said library. The same way that you can't just unilaterally decalare an MIT licensed project is GPL without ensuring that all of the code was dual licensed or covered under a CLA. EDIT: I saw another comment that says that it's "just" the GUI applications for Windows and Mac that aren't open, but the core functionality is. I know that in Windows-land, it's _very_ common to use proprietary UI libraries like Telerik UI[0], or devexpress [1] [0] https://www.telerik.com/purchase/individual/winforms.aspx https://www.telerik.com/purchase/individual/winforms.aspx [1] https://www.devexpress.com/ https://www.devexpress.com/
Operyl 4y ago
They’ve said that closed source systems will keep the GUI closed source: https://tailscale.com/opensource/ https://tailscale.com/opensource/
- 4y ago

IceWreck 4y ago

Why depend on Tailscale when you can go 100% open source and use slack's nebula or plain old wireguard or one of those open source wireguard manager apps.

uniqueuid 4y ago
Plain old wireguard doesn't do double-nat hole punching. And many of the open-source alternatives (such as innernet) also don't.
mosselman 4y ago
"Plain old wireguard" In my mind wireguard was still the new kid on the block. Technology moves so fast.
- doix 4y ago
  Same here. Also, in my mind, wireguard just works. I tried setting up OpenVPN one time and gave up. Wireguard was a breath of fresh air. Generated some QR codes for my mobile devices, rsynced some .conf files to my machines and I was good to go.
- yepguy 4y ago
  Calling something "plain old" in no way implies that it's old. https://en.wiktionary.org/wiki/plain_old https://en.wiktionary.org/wiki/plain_old
leetnewb 4y ago
Nebula seems to be under Defined Networking (https://www.defined.net/ https://www.defined.net/) now. It lacks the ease and tooling of the multitude of others that emerged in the space. My gut is that it's usable for the clever home user but meant for a professional IT dept with the ability/desire to build their own tooling and automation around it. The spartan mobile app is a sign of such. Tailscale is probably more easily usable for the average user than nebula or even vanilla wireguard.
jonathantf2 4y ago
Because the whole point of Tailscale is that it's zero config, I don't really want ot mess about with wireguard.

mudrockbestgirl 4y ago

And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. Or create add-ons that are useful and no longer privacy-preserving. The fact that they are a VC-funded business makes me believe this is how the company will end up: Customer data will be monetized in one way or another. How else are going to create returns for shareholders that justify their valuation? Certainly not by open sourcing stuff and not looking at your data. We've seen these VC incentives play out again and again in other companies. Just use wireguard. It really isn't that hard.

secunit 4y ago
>Just use wireguard. It really isn't that hard. I love WG and use it extensively, but the attraction of Tailscale (and why I use it) is that it takes disparate concepts and gives you a nice visual control panel to manage them and see the status of all your devices in one place. Nothing. Absolutely nothing exists for Wireguard that does even some of that, which doesn't also cost money. I don't think Wireguard is even capable of the 'DERP' server concept to get around NAT limitations. So no, you can't 'just use Wireguard' to accomplish what Tailscale does.
secunit 4y ago
>And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. I can't (and refuse) to live my lie by "what ifs." If they do any of those things, it's easy enough to pivot to the 3 or 4 other providers our there, like ZeroTier, who offer the same thing. My hope is if they do, the FOSS community will have gotten their act together and built a capable replacement, which is usually the case.
augusto-moura 4y ago
Not really true, tailscale clients do allow you to point to different control servers and open source implementations do exist[1] and are thriving. The clients are also open source and you can even create one yourself if you are willing to. The thing is, what makes tailscale works really well as a "central" control server is that it makes a lot easier to connect your personal machines. You don't need to deploy your own server, or mess with networking stuff. You just download it, log-in and there you go. I myself have invited some non-tech friends to my network for playing lan games from time time and they find pretty easy to setup tailscale on their side. [1]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale

rs_rs_rs_rs_rs 4y ago

>But somehow we're all meant to be happy giving full control of our entire network to a commercial company running a closed source command and control server? Yes, Tailscale is THAT good this tradeoff is worth it.

simjnd 4y ago

I remember reading that Tailscale is "helping out" [1] development of Headscale [2], an open-source re-implementation of their command server so that the two remain compatible as new features are added to the official one. [1]: https://tailscale.com/opensource/ https://tailscale.com/opensource/ [2]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale

deleted 4y ago

[deleted]

fudgefactorfive 4y ago

Honestly, I hate the idea of having a middle man, but having tried and researched extensively how to make something like a direct tunnel between two clients over the internet it just doesn't always work. NAT is a godsend for IPv4 exhaustion, but it's also fundamentally crippled the ability for people to host things or make things available directly from their homes. Hole-punching is an inexact process due to the variety of different NAT types, some of which (e.g. Carrier-grade) simply do not allow that sort of connection. So there must be a middle man that accepts packets on their publicly available port and passes it on to another established connection. TURN/STUN (et. al.) exist but are archaic and do the same thing but with less accountability. I hate it too but until we have IPv6 by default with user controlled firewalls hosting something in your garage without a business line is not feasible. Hell I have a 5$ a month VPS purely so it can act as the middle man to the servers in my home. At least then I only need to trust myself as the middle man.

ithkuil 4y ago
Their middle man in the data plane handles encrypted packets so that's not the problem here. The problem is their control plane that controls the encryption keys. A malicious admin inside TS (or a hack) could grant itself membership in any of their customer's networks. (Or at least this is the worry I read from GP)
- fudgefactorfive 4y ago
  That's definitely a concern, but I feel this can be mitigated by running your own network on top of theirs. Anyone in my home is part of my network, doesn't mean they're in the wg network too. Aside from that, it's definitely a problem that they could include themselves in any customer network, but the accountability still stands. If someone got in without your screw-up, at least you know who to point the finger at once the dust settles. I'd argue it should be treated as a base to overlay your network on top of. Although admittedly I say that as someone that doesn't use their services for similar reasons.
  - ithkuil 4y ago

apitman 4y ago

I agree it's not ideal, but I can tell you why I'm excited about things like[0] Tailscale, Cloudflare Tunnel, ngrok, etc. They enable you to move your selfhosted services from expensive, slow VPSes you don't control to fast devices in your own home[4]. IMO this is strictly better than a VPS in terms of privacy and data control. It's a step in the right direction, back towards the initial intent of the internet, but also forward with the lessons we've learned in the real world. The reality today is that selfhosting is way too hard[1]. It shouldn't be any more complicated or less secure than running an app on your phone. I think services like Tailscale are going to enable the first generation of selfhosting that approaches that level of simplicity. Once the market is proven, the second generation is going be designed for selfhosters and have features like end-to-end encryption, domain name integration, and simple GUI interfaces. The other key pieces are strong sandboxing, which is now possible on all major desktop OSes through virtualization (mobile is coming[2]), and dead-simple cloud backups. The technology for all these things exists, it just hasn't been integrated yet. [0]: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling [1]: https://moxie.org/2022/01/07/web3-first-impressions.html https://moxie.org/2022/01/07/web3-first-impressions.html [2]: https://twitter.com/kdrag0n/status/1584017653269958656?lang=en https://twitter.com/kdrag0n/status/1584017653269958656?lang=... [4]: I concede that the network upload connection is likely much slower, but expect that to improve over time.

VikingCoder 4y ago
Strong sandboxing, yes. But I'd especially appreciate it if it was wrapped up in an interface like Sandstorm.io. I want to teach something like Tailscale about my contacts, so they are allowed to communicate with my services (through their services). Then I want to run an app inside a strong sanbox that has capability-based APIs to do things kind of like ZeroMQ for sending messages TO THE CONTACTS. I don't want the API to look like a tcp/ip or udp connection. I want the app to think it's sending a message to a contact I've given it permission to talk to. If this was running in a strong sandbox, I think this would be an awesome way to develop and use simple federated apps. If something like Mastodon existed on top of this, I'd think it would be really secure and much easier to tell people to stand up their own node...

rkangel 4y ago

Leaving aside adoption, there is a degree to which HN is impressed that Tailscale has taken a set of technical problems that have caused many of us pain over the years and that drive some less than ideal setups and just made them go away. They are magically taken care of behind an easy to use setup that Just Works. There's basically none of the "you have to tweak this setting under this circumstance" needed to get it working. That is difficult engineering requiring people who understand the problem domain and have a clear picture of the right architecture, as well as good product engineering.

djbusby 4y ago
Isn't TailScale "just" WireGuard?
- apitman 4y ago
  No. For example: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
- rkangel 4y ago
  Nope. It's Wireguard 'underneath' but a whole lot more over the top. Try this: Go set up a Wireguard connection from your PC at home to one at work. Then do the same thing with tailscale. One will be a lot easier than the other. And that's only 2 computers...
  - djbusby 4y ago
    Um. I already have like 100s of WG connection. Office to cloud, various servers all over connected to others, servers on many WG "subnets". WG is the easiest VPN I've ever used. Dropped all these other crazy rigs (stunnel, ssh-tunnel, etc) cause WG always "just works" and is on every platform. However, I've spent loads of time as network admin, planning IP-space for VPN layers, first time in 1997.
  - deleted 4y ago
    [deleted]