5 ms·

And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself

And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. Or create add-ons that are useful and no longer privacy-preserving. The fact that they are a VC-funded business makes me believe this is how the company will end up: Customer data will be monetized in one way or another. How else are going to create returns for shareholders that justify their valuation? Certainly not by open sourcing stuff and not looking at your data. We've seen these VC incentives play out again and again in other companies. Just use wireguard. It really isn't that hard.

secunit 4y ago
>Just use wireguard. It really isn't that hard. I love WG and use it extensively, but the attraction of Tailscale (and why I use it) is that it takes disparate concepts and gives you a nice visual control panel to manage them and see the status of all your devices in one place. Nothing. Absolutely nothing exists for Wireguard that does even some of that, which doesn't also cost money. I don't think Wireguard is even capable of the 'DERP' server concept to get around NAT limitations. So no, you can't 'just use Wireguard' to accomplish what Tailscale does.
secunit 4y ago
>And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. I can't (and refuse) to live my lie by "what ifs." If they do any of those things, it's easy enough to pivot to the 3 or 4 other providers our there, like ZeroTier, who offer the same thing. My hope is if they do, the FOSS community will have gotten their act together and built a capable replacement, which is usually the case.
augusto-moura 4y ago
Not really true, tailscale clients do allow you to point to different control servers and open source implementations do exist[1] and are thriving. The clients are also open source and you can even create one yourself if you are willing to. The thing is, what makes tailscale works really well as a "central" control server is that it makes a lot easier to connect your personal machines. You don't need to deploy your own server, or mess with networking stuff. You just download it, log-in and there you go. I myself have invited some non-tech friends to my network for playing lan games from time time and they find pretty easy to setup tailscale on their side. [1]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale
- fesc 4y ago
  Yeah, but having that is clearly not aligned with making money. They could make it more difficult or impossible to use headscale at any moment.
  - secunit 4y ago
    They could, but let's cross that bridge when we get to it. You're trying to justify the dislike of a product because of what they might do. That's a pretty weak argument.
  - nine_k 4y ago
    Once a FOSS ecosystem exists, it can always be maintained as such. What may theoretically happen is that the same client won't be able to join both an open-source controller and a controller from Tailscale-turned-evil. I suppose that corporations, especially those without huge IT departments, will and do happily pay Tailscale the reasonable money, and have their secure VPN just working. For them, it's no different than paying for Zoom or Office365, only cheaper. They totally do not want to depend on in-house networking expertise. So I think Tailscale will be doing well financially,
phpisthebest 4y ago
I fail to see how that is any different to other modern network control solutions out there? Every major network vendor is moving towards a cloud control service of some kind. Further, Honestly at this point I would trust TailScale over say OpenVPN, or Cisco, or .....
iquerno 4y ago
At this point you could stir up hysteria over anything. Your cloud provider, ISP, operating system support team, XYZ SaaS provider could also just invent a new billing policy to screw the customer over. At the same time, ^ the big providers have profitable revenue streams, so they don't have much incentive to change their billing. VC startups of course on growing instead of verifying that their business model actually works, and end up either: - locking the software behind a paywall - locking the software behind a paywall - inventing a proprietary + open-source + pay us royalties license - pretending that their software is free whilst employing a proprietary + pay us royalties for anything bigger than a hobby project license - going bust
eddieroger 4y ago
> Just use wireguard. It really isn't that hard. For us. For the folks who browse HN all day, yeah. But have you tried getting a non-technologist to use it? I set a friend up with Tailscale between her Synology and laptop and it was a breeze - something I could do over the phone. For me getting Wireguard set up wasn't tricky, but I definitely leaned on Google some, and I would argue I know what I'm doing. I would love for a company to release bridge as open source that I could deploy on a VM somewhere but still have it be Tailscale easy for normal folks, but there's no money in that model.
lxgr 4y ago
> Just use wireguard. It really isn't that hard. In many situations it's not just hard, it's outright impossible. For example, how would you connect two Raspberry Pis between two CG-NATted internet connections using Wireguard, without resorting to setting up a publicly reachable VPN server? If you have a public and at least semi-stable IPv4 address and control your firewall/NAT, great. But unfortunately less and less people do, these days.
- candiddevmike 4y ago
  Use IPv6?
  - lxgr 4y ago
    Not an option, as long as I regularly need to access my devices from IPv4-only networks. Have you tried using IPv6 on a hotel wi-fi, in-flight, or a corporate guest network?
- antx 4y ago
  Tailscale actually has a great write-up on the subject [0] TLDR; Ideally, IPv6. Otherwise, NAT traversal techniques such as STUN, or hole-punching. [0]: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
  - lxgr 4y ago
    > Ideally, IPv6. Yes, if you have it everywhere you want to host services and everywhere you want to access these services, that's great. Realistically, I think it's going to be decades until an IPv6-only service is feasible. > Otherwise, NAT traversal techniques such as STUN, or hole-punching. Neither of which Wireguard supports out of the box. To be clear, it absolutely shouldn't – it's a different concern, and the appeal of Wireguard is specifically that it isn't trying to do everything and the kitchen sink. So, is there an easy-to-use NAT traversal orchestration service for Wireguard out there that isn't Tailscale?
    - 4y ago
lmeyerov 4y ago
Having evaluated them -- Road 1: Sale to usual suspects like Palo Alto (though that window is closing due to raising $100M) or Cisco (that window may close if they raise again?). It is basically modern vpn, though will be years with a big enterprise culture reset & a consumer tier for that to become true. They will run out of acquirers soon who would have the incentive to overpay, eg, if they raise more and narrows down to say oracle, ms, apple, and google, not sure why any would buy vs build. Hopefully they will not dip much into the funds so they can cleanly exit without forcing an acquirer to screw over their users. (See: Evernote) Road 2: IPO and become a platform for bigger stuff... Like end-user-friendly VPN. Who knows, but good luck! Flipping to 'real' enterprise sales and figuring out the consumer tiers are big culture shifts, but luckily... Hireable. Meanwhile, growing just with more niche/skilled Linux power user teams gets them far -- the compliance checkbox is huge for growth, see Drata and Vanta -- so am not worried :) Agreed with the OSS concern so we decided against putting them in the critical path of our enterprise offering (a shame!), but as an internal tool, it looks great!
jimmygrapes 4y ago
Spoken like somebody who has never had a "Can you help me get my microsoft wifi [Spectrum cable internet] to make sure my gmail [person@icloud.com] doesn't send my retirement [tax refund] to the hackers" type call.

secunit 4y ago

>Just use wireguard. It really isn't that hard. I love WG and use it extensively, but the attraction of Tailscale (and why I use it) is that it takes disparate concepts and gives you a nice visual control panel to manage them and see the status of all your devices in one place. Nothing. Absolutely nothing exists for Wireguard that does even some of that, which doesn't also cost money. I don't think Wireguard is even capable of the 'DERP' server concept to get around NAT limitations. So no, you can't 'just use Wireguard' to accomplish what Tailscale does.

secunit 4y ago

>And even if everything is secure right now, you cannot guarantee this stays the case in the future. By using the "tailscale ecosystem" you are locking yourself into a provider that can change the ecosystem (clients, services, servers) or put things behind a paywalls anytime. I can't (and refuse) to live my lie by "what ifs." If they do any of those things, it's easy enough to pivot to the 3 or 4 other providers our there, like ZeroTier, who offer the same thing. My hope is if they do, the FOSS community will have gotten their act together and built a capable replacement, which is usually the case.

augusto-moura 4y ago

Not really true, tailscale clients do allow you to point to different control servers and open source implementations do exist[1] and are thriving. The clients are also open source and you can even create one yourself if you are willing to. The thing is, what makes tailscale works really well as a "central" control server is that it makes a lot easier to connect your personal machines. You don't need to deploy your own server, or mess with networking stuff. You just download it, log-in and there you go. I myself have invited some non-tech friends to my network for playing lan games from time time and they find pretty easy to setup tailscale on their side. [1]: https://github.com/juanfont/headscale https://github.com/juanfont/headscale

fesc 4y ago
Yeah, but having that is clearly not aligned with making money. They could make it more difficult or impossible to use headscale at any moment.
- secunit 4y ago
  They could, but let's cross that bridge when we get to it. You're trying to justify the dislike of a product because of what they might do. That's a pretty weak argument.
- nine_k 4y ago
  Once a FOSS ecosystem exists, it can always be maintained as such. What may theoretically happen is that the same client won't be able to join both an open-source controller and a controller from Tailscale-turned-evil. I suppose that corporations, especially those without huge IT departments, will and do happily pay Tailscale the reasonable money, and have their secure VPN just working. For them, it's no different than paying for Zoom or Office365, only cheaper. They totally do not want to depend on in-house networking expertise. So I think Tailscale will be doing well financially,

phpisthebest 4y ago

I fail to see how that is any different to other modern network control solutions out there? Every major network vendor is moving towards a cloud control service of some kind. Further, Honestly at this point I would trust TailScale over say OpenVPN, or Cisco, or .....

iquerno 4y ago

At this point you could stir up hysteria over anything. Your cloud provider, ISP, operating system support team, XYZ SaaS provider could also just invent a new billing policy to screw the customer over. At the same time, ^ the big providers have profitable revenue streams, so they don't have much incentive to change their billing. VC startups of course on growing instead of verifying that their business model actually works, and end up either: - locking the software behind a paywall - locking the software behind a paywall - inventing a proprietary + open-source + pay us royalties license - pretending that their software is free whilst employing a proprietary + pay us royalties for anything bigger than a hobby project license - going bust

eddieroger 4y ago

> Just use wireguard. It really isn't that hard. For us. For the folks who browse HN all day, yeah. But have you tried getting a non-technologist to use it? I set a friend up with Tailscale between her Synology and laptop and it was a breeze - something I could do over the phone. For me getting Wireguard set up wasn't tricky, but I definitely leaned on Google some, and I would argue I know what I'm doing. I would love for a company to release bridge as open source that I could deploy on a VM somewhere but still have it be Tailscale easy for normal folks, but there's no money in that model.

lxgr 4y ago

> Just use wireguard. It really isn't that hard. In many situations it's not just hard, it's outright impossible. For example, how would you connect two Raspberry Pis between two CG-NATted internet connections using Wireguard, without resorting to setting up a publicly reachable VPN server? If you have a public and at least semi-stable IPv4 address and control your firewall/NAT, great. But unfortunately less and less people do, these days.

candiddevmike 4y ago
Use IPv6?
- lxgr 4y ago
  Not an option, as long as I regularly need to access my devices from IPv4-only networks. Have you tried using IPv6 on a hotel wi-fi, in-flight, or a corporate guest network?
antx 4y ago
Tailscale actually has a great write-up on the subject [0] TLDR; Ideally, IPv6. Otherwise, NAT traversal techniques such as STUN, or hole-punching. [0]: https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
- lxgr 4y ago
  > Ideally, IPv6. Yes, if you have it everywhere you want to host services and everywhere you want to access these services, that's great. Realistically, I think it's going to be decades until an IPv6-only service is feasible. > Otherwise, NAT traversal techniques such as STUN, or hole-punching. Neither of which Wireguard supports out of the box. To be clear, it absolutely shouldn't – it's a different concern, and the appeal of Wireguard is specifically that it isn't trying to do everything and the kitchen sink. So, is there an easy-to-use NAT traversal orchestration service for Wireguard out there that isn't Tailscale?
  - 4y ago

lmeyerov 4y ago

Having evaluated them -- Road 1: Sale to usual suspects like Palo Alto (though that window is closing due to raising $100M) or Cisco (that window may close if they raise again?). It is basically modern vpn, though will be years with a big enterprise culture reset & a consumer tier for that to become true. They will run out of acquirers soon who would have the incentive to overpay, eg, if they raise more and narrows down to say oracle, ms, apple, and google, not sure why any would buy vs build. Hopefully they will not dip much into the funds so they can cleanly exit without forcing an acquirer to screw over their users. (See: Evernote) Road 2: IPO and become a platform for bigger stuff... Like end-user-friendly VPN. Who knows, but good luck! Flipping to 'real' enterprise sales and figuring out the consumer tiers are big culture shifts, but luckily... Hireable. Meanwhile, growing just with more niche/skilled Linux power user teams gets them far -- the compliance checkbox is huge for growth, see Drata and Vanta -- so am not worried :) Agreed with the OSS concern so we decided against putting them in the critical path of our enterprise offering (a shame!), but as an internal tool, it looks great!

jimmygrapes 4y ago

Spoken like somebody who has never had a "Can you help me get my microsoft wifi [Spectrum cable internet] to make sure my gmail [person@icloud.com] doesn't send my retirement [tax refund] to the hackers" type call.