12 ms·

Tailnet Lock

235 points by iyaja 4y ago

darthShadow 4y ago
Should be tailnet lock rather than talent lock... :)
- denlekke 4y ago
  "Talent Lock": the new MBA euphemism for H1-Bs
- blymphony 4y ago
  Sounds like a fancy name for a hiring freeze
  - radicaldreamer 4y ago
    I thought I read the title wrong when I got to the post... I was like man I'm seeing hiring freezes and layoffs everywhere these days!
xena 4y ago
Hey @dang can you update this to "Tailnet Lock"? This is about a feature named "tailnet lock", not a hiring freeze :)
- altairprime 4y ago
  “@dang” doesn’t do anything on HN. Emailing the mods using the footer Contact link is the fastest way – and the only certain way – to get the mod team’s attention (including but not limited to dang).
  - OrderlyTiamat 4y ago
    I think he does have a script checking for mentions because he does tend to reply to <at>dang, which is fairly easy to set up even if no infra on hn itself supports it.
    - altairprime 4y ago
      There are more mods than just dang. Emailing the contact address notifies all of them, and lets them make more rapid fixes, than depending on one single person to write tooling for what you describe.
      - xena 4y ago
        If mentioning dang doesn't work, why did it work? :)
        altairprime 4y ago
        If mentioning dang does work, why didn’t it work for the forty-five minutes prior to my reply, and then work five minutes after? I’ve emailed the mods tens of times over the years to point out a thread that has a correction, or that I think dang may want to reply to, without saying that I’ve done so. Did I do so this time? (Y/N) Assigning meaning to the timing is inappropriate, as it disregards the possibility of coincidence (he found the thread organically), unstated actions (someone emailed the mods), and/or human distraction (he was at lunch) by the however-notified dang. I also view it as impolite to try using @dang to burden all mod duties onto one person rather than to a team of mods. Whether it works or not, it’s evidence of site users setting dang up in their minds as a single point of failure – either because they think it’s the only way, or for the convenience of not having to write a two sentence email to the mod team. That irks me, and so I occasionally post a reminder about the contact form, phrased to allow for the cases where the @ is just a learned behavior and they just don’t know about the contact link in the footer yet.
- dang 4y ago
  Fixed now. Thanks!
shawnz 4y ago
This solves the #1 concern I had with tailscale. Now I feel comfortable recommending this software to anybody.
- wooltail 4y ago
  It still makes me jittery how much stuff they've packed into the client. The RCE vulnerability in their windows client is pretty strong indicator that things are moving a bit too fast for comfort.
  - jchw 4y ago
    Agreed: I do feel the Windows client in particular is a little scary. In general, Tailscale clients feel reasonable, if light; but the Windows client is kind of iffy. There's a bug that I believe still exists where on some machines, it will crash on startup most of the time, seemingly the result of a race condition or other bug where GetLastError returns something unexpected, in a not-very-well maintained Win32 API wrapping library for Go. This is mostly benign (although annoying) but the contrast in how competent Tailscale seems to be about the core guts vs the clients feels a little jarring at times! Still love it though.
    - bradfitz 4y ago
      FWIW, we've recently taken over maintenance of those Go libraries because they seem to have been abandoned upstream. And we now have people working on Windows full-time. (Early on, the Tailscale team was all primarily Linux and macOS users so Windows was admittedly neglected for too long)
      - jchw 4y ago
        It amazes me how you're seemingly always on top of any concern I or others could have. Thanks for the information.
    - dblohm7 4y ago
      Tailscalar here. There were a few things going on with that issue you mentioned; one of them is the way the wrapper library was written, the other was with some stuff in the GUI client that was happening on a background goroutine but shouldn't have been. That should be fixed in the current stable release. As for the Windows client in general, it is going to be receiving a lot of love over the next few months!
ignoramous 4y ago
> ...by architecting our infrastructure with security and privacy in mind. The blog and the website loads in so many trackers (reasonable, given metrics are important when you're busy hyperscaling a venture-backed startup), that folks at Tailscale should seriously reconsider positioning themselves as some paragons of privacy. No offence (:
- fsociety 4y ago
  Why does a for-profit company have to practice perfect anonymity to sell a product which does have security/privacy in mind?
  - ignoramous 4y ago
    > Why does a for-profit company have to... https://news.ycombinator.com/item?id=25457440 https://news.ycombinator.com/item?id=25457440 > ...practice perfect anonymity to sell a product which does have security/privacy in mind? So are free users "the product?" No. If we're going to fix the Internet, there's no point only fixing it for big companies who can pay a lot. That misses the point of the whole adventure. The Internet is for everyone. We have to fix it for everyone, or why bother? We knew we had to design a business model and a technical architecture that removes any incentive to abuse your privacy. - CEO at Tailscale, https://archive.is/R7jqw https://archive.is/R7jqw
- cpach 4y ago
  Are you sure people who complain about such things are in Tailscale’s target demographic?
  - yjftsjthsd-h 4y ago
    Well, if Tailscale is bothering to talk about "architecting our infrastructure with security and privacy in mind", they seem to think so.
- slig 4y ago
  > website loads in so many trackers Not on my browser. Maybe you should consider a better browser and/or install some extensions.
aborsy 4y ago
I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or install a bad update). The problem with malicious updates can be addressed by providing as easy way to check the code signature. With a standalone infrequently updated app such as an AppImage app, this can be easily done by verifying the GPG signature upon download.
- sneak 4y ago
  How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account? Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that. I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and it doesn't involve Google or Microsoft at any point.
  - crawshaw 4y ago
    Tailscalar here. IdP trust is on the list. There are some "easy" things we can do that help on the surface but make life harder for users. And there are some not-so-easy things we are researching. I hope to have answers in 2023.
    - sureglymop 4y ago
      I recently read this blog [0] about how tailscale was thinking of open sourcing a small coordination server but headscale had already been created so that effort was put on hold. Is tailscale at this point in any way involved in headscale or contributing to it or are there plans to fork it to keep it maintained? Asking out of curiosity. [0]: https://tailscale.com/blog/opensource/ https://tailscale.com/blog/opensource/
ohbtvz 4y ago
Why is there a post by tailscale on the front page every single day?
- chipsa 4y ago
  Baader-Meinhof They're not. It's just roughly when the post a new blog entry, which is... usually about once a week? Sometimes it's about new features, sometimes it's about internals which might be helpful for other people to know about (like the previous entry was about internals of the TUN/TAP, and how they managed to speed it up a bunch).
- Ao7bei3s 4y ago
  Tailscale are _the_ company pushing the state of the art in VPN's, and they write great, detailed technical articles and whitepapers about it. As someone who has worked on a different, more traditional, enterprise VPN product, this is extremely interesting to me. Most other companies have neither the cool tech (most haven't even switched from IPsec), nor the ability to put out anything other than marketing fluff, nor the focus to actually keep working on the core VPN tech instead of trying to check all boxes (monitoring/firewalling/device management/...) but not innovating anywhere. Tailscale also scales down to individual, private users, has a free plan, some open source code and an open source reimplementation, all of which appeals to the HN audience. This article in particular is interesting because Tailscale inserting malicious nodes is the #1 concern I had around their product, and their solution (tailnet locks) is interesting and probably better than the solution I would have come up with (using Wireguard's support for additional symmetric secrets).
- TheFlyingFish 4y ago
  Obviously "every single day" is hyperbole, but I agree with you that a much higher proportion of Tailscale blog posts end up on the front page than most corporate blogs. Finally I think it comes down to this: Tailscale is full of the same kind of people who tend to hang out on Hackernews. HN loves Tailscale because Tailscale is HN's ingroup. Fly.io is in a similar situation, and similarly sees a higher-than-average fraction of their blog posts getting traction on HN. For an interesting counterexample, look at warp.dev. They have a lot of the same markers - tackling an interesting problem that affects many HNers daily (the limitations of the terminal), building things from the ground up in Rust, and writing highly technical blog posts about it - but at the same time, it's clear that as an organization, they don't quite get it. They can't understand, for instance, why putting telemetry in their terminal emulator is absolute suicide as far as HN is concerned, or why "moving the terminal to the cloud" is a phrase that will never make HN happy. Unlike Tailscale and Fly, they are not "of the race that knows Joseph", as it were. That's not to say that there aren't individuals at Warp who are members of the HN ingroup. But at the organizational level, Warp just isn't quite it.
tiffanyh 4y ago
Cloudflare + Tailscale would be a super interesting combination for a business. I wonder if Tailscale is an acquisition target.
- lilyball 4y ago
  Please don't give them any ideas
- TkTech 4y ago
  From a business sense, it would likely be a reasonable and profitable acquisition for both parties. From a personal standpoint, I would like to see Cloudflare (among others) smashed into a neutral backbone provider and all its product offerings spun off, ala https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System. It's dangerous for one company to control so much of the internet's infrastructure and it's causing massive problems (like https://news.ycombinator.com/item?id=32912075 https://news.ycombinator.com/item?id=32912075). Tailscale should remain independent.
KingMachiavelli 4y ago
Wow, I was advocating for switching to Tailscale (from just manual SSH key management) and was asked if we could do pretty much exactly this. Great to see such quick progress.
unshavedyak 4y ago
For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduced access to ports. So maybe that alone is worth $5/m. .. well, $10/m, since i have two users. $10/m seems a bit steep just for some small access to my internal network for things like Camera Feeds, etc. Dyn DNS + some safe self hosted VPN might be more affordable and just as safe compared to Tailscale. .. thoughts on the best service to price ratio for my needs?
- dkjaudyeqooe 4y ago
  > i could expose my IP via Dyn DNS Not if your IP is behind CGNAT or the like. > $10/m seems a bit steep They have a free multi-user plan but it's in small print on the pricing page and requires use of Github for user management.
- TheFlyingFish 4y ago
  Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN." If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices. If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices can communicate as if they were all on the same LAN, without worrying about their traffic being eavesdropped. As for the pricing, I'm fairly confident that Tailscale won't mind if you're sharing a free plan (so single-user) across e.g. your laptop and your wife's, even though there are technically two "users" there. They've made it pretty clear that the divide they care about is "personal use free, company use paid."
  - unshavedyak 4y ago
    On the note of free plan. It's actually a bit of a shame.. i want to pay, i like $5/m, but it looks like $5/m is less devices than if i used free? Though i just noticed that the Personal Pro plan works with up to 100 devices for $4/m. Might give that a try. I really like paying.. as i hate free VC services. edit: Wow, the signup requirement is bizarre though. I don't have or want Google or Microsoft.. i do have a Github, which i guess i'll have to use... but what the hell? So odd that i can't just signup with my email.
kerneis 4y ago
I found the blog post slightly confusing because it never explicitly spells out that endorsing a new node is a manual operation that the administrator has to perform from one of the trusted nodes. Of course this is what you'd want, anything automatic would ruin the purpose of tailnet lock. But still not seeing it mentioned, neither in the text nor in the pictures, made me wonder what I had missed, until I watched the video which features that very step as part of the demo.
- mdeeks 4y ago
  I had the same issue. I think the idea is that you build something yourself on a trusted node that decides whether or not to endorse a new node. Off the top of my head I'd do something dead simple like verify the user account matches our domain and then also query an inventory system to verify it is indeed a device we manage through MDM (though I'm not sure how this will work for mobile devices. We don't MDM those). When a new device attempts to join you should have some data on it via the API (User, OS, Tailscale version, source IP, machine name). You could use that data to decide to endorse it or not.
  - tailscaletom 4y ago
    (Tailscalar and a tailnet lock author here) If you're okay with trusting Tailscale's control plane, we have a feature for exactly this use case! Its called Device Authorization: https://tailscale.com/kb/1099/device-authorization/ https://tailscale.com/kb/1099/device-authorization/ You could also use tailnet lock in this fashion, by issuing a `tailscale lock sign` command for the new node once you've verified the provenance of the new device. Because it involves signatures with keys on your device it could never be as simple as a REST API, but maybe we could offer a more easy to automate command or better client library support (suggestions welcome!)
- tailscaletom 4y ago
  (Tailscalar and a tailnet lock author here) Thanks for the feedback!! Writing the documentation for how this worked was a challenge, and its good to hear what pieces we need to call out more strongly in the future. If you're interested in gory details around tailnet lock internals, we have the beginnings of a whitepaper here: https://tailscale.com/kb/1230/tailnet-lock-whitepaper/ https://tailscale.com/kb/1230/tailnet-lock-whitepaper/
teaearlgraycold 4y ago
At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.
- 0x0000000 4y ago
  It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing keys. Tailscale does a lot of that lifting for you, so you can easily and quickly get a working VPN, at a low cost, with good performance. Personally I manage wireguard myself, but I also self-host my own VMs, storage server, applications, etc. Tailscale is like taking your car in for an oil change instead of doing it yourself, plenty of people find that worth it.
  - teaearlgraycold 4y ago
    What does everyone use it for?
    - TheFlyingFish 4y ago
      Not GP, and I can only answer for myself, but: Personally, I use it to connect my home devices as if they were always together on the same LAN, even when they're not. E.g. Raspberry Pi, home NAS, "home" server that's actually in a different physical location, etc. All accessible anywhere at any time, even (say) from my laptop in a moving vehicle, without connections dropping even when my IP changes. It really is like magic. At work, we use it so that remote employees can access locally-hosted applications, office NAS, etc. ACLs make it easy to employ the principle of least privilege, so that having a route into the office LAN doesn't immediately mean any and every device is compromised.
    - TkTech 4y ago
      I have it on all my personal and family servers and devices. I use it so that for both myself and my family all our internal stuff (unraid network shares, jellyfin, homepages, photo backups, etc, etc) "just works" for the less technical members of the family even when they're not at home. It seamlessly detects when the peer is local so it doesn't route out to the internet and back, has an easy ACL to segment things (wife's phone doesn't need access to dd-wrt), and a bunch of other features. We've been able to do this with existing VPNs for a long, long time, but tailscale is by far the most painless offering I've ever used and I migrated away from OpenVPN completely.
deleted 4y ago
[deleted]
presto8 4y ago
This is a useful addition to Tailscale. But if one is going to manage public keys anyway, just use Nebula at that point?
user- 4y ago
I have little to no idea what Tailscale does. Is it a VPN like Mullvad? What makes it so special? Ive heard a bit about tailscale networks connecting devices together easily. Is it for your own network only, or can other people access your tailscale devices directly as well? Ie, I host a minecraft server on my linux desktop. Can tailscale help me in the use case of providing an IP to people to connect to it? Or am I just back to regular old port forwading and my external IP?
- leesalminen 4y ago
  Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard. You can think of it as a LAN for all your devices regardless of what network they’re physically connected to. The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though. Tailscale does as of recently have the ability to do what you’re saying for Minecraft. It’s called Tailscale Funnel. This lets you expose a port on any of your devices to the public internet with a TLS enabled host name. Another option for your Minecraft server is to use Cloudflare Tunnel. Works great for this kind of thing and is pretty much functionally equivalent to Tailscale Funnel.
  - xeonmc 4y ago
    Does either Funnel or Tunnel allow this use case for old UDP-based games like Quake etc? I would like to just be able to send strangers a temporary permalink to my server for a one-off session, then turn it off or have it expire automatically once we're finished. This would not be feasible if I have to also ask whomever I come across to install clients, as opposed to just connecting from within the game.
    - telotortium 4y ago
      Seems like they're only TCP, unfortunately.
  - apenwarr 4y ago
    I recommend against using Funnel for this use case (because it exposes your server to everyone in the world, not just your trusted users). Tailscale node sharing is free and secure for private networks of friends, and there are lots of people using it with Minecraft: https://tailscale.com/kb/1084/sharing/ https://tailscale.com/kb/1084/sharing/ To answer the question in another thread, node sharing also works with UDP. (Funnel is TCP-only due to the vagaries of IP addresses and TLS certificates when facing the outside world, sigh.)

Tailnet Lock

235 points by iyaja 4y ago

darthShadow 4y ago

Should be tailnet lock rather than talent lock... :)

denlekke 4y ago
"Talent Lock": the new MBA euphemism for H1-Bs
blymphony 4y ago
Sounds like a fancy name for a hiring freeze
- radicaldreamer 4y ago
  I thought I read the title wrong when I got to the post... I was like man I'm seeing hiring freezes and layoffs everywhere these days!

xena 4y ago

Hey @dang can you update this to "Tailnet Lock"? This is about a feature named "tailnet lock", not a hiring freeze :)

altairprime 4y ago
“@dang” doesn’t do anything on HN. Emailing the mods using the footer Contact link is the fastest way – and the only certain way – to get the mod team’s attention (including but not limited to dang).
- OrderlyTiamat 4y ago
  I think he does have a script checking for mentions because he does tend to reply to <at>dang, which is fairly easy to set up even if no infra on hn itself supports it.
  - altairprime 4y ago
    There are more mods than just dang. Emailing the contact address notifies all of them, and lets them make more rapid fixes, than depending on one single person to write tooling for what you describe.
    - xena 4y ago
      If mentioning dang doesn't work, why did it work? :)
      - altairprime 4y ago
        If mentioning dang does work, why didn’t it work for the forty-five minutes prior to my reply, and then work five minutes after? I’ve emailed the mods tens of times over the years to point out a thread that has a correction, or that I think dang may want to reply to, without saying that I’ve done so. Did I do so this time? (Y/N) Assigning meaning to the timing is inappropriate, as it disregards the possibility of coincidence (he found the thread organically), unstated actions (someone emailed the mods), and/or human distraction (he was at lunch) by the however-notified dang. I also view it as impolite to try using @dang to burden all mod duties onto one person rather than to a team of mods. Whether it works or not, it’s evidence of site users setting dang up in their minds as a single point of failure – either because they think it’s the only way, or for the convenience of not having to write a two sentence email to the mod team. That irks me, and so I occasionally post a reminder about the contact form, phrased to allow for the cases where the @ is just a learned behavior and they just don’t know about the contact link in the footer yet.
dang 4y ago
Fixed now. Thanks!

shawnz 4y ago

This solves the #1 concern I had with tailscale. Now I feel comfortable recommending this software to anybody.

wooltail 4y ago
It still makes me jittery how much stuff they've packed into the client. The RCE vulnerability in their windows client is pretty strong indicator that things are moving a bit too fast for comfort.
- jchw 4y ago
  Agreed: I do feel the Windows client in particular is a little scary. In general, Tailscale clients feel reasonable, if light; but the Windows client is kind of iffy. There's a bug that I believe still exists where on some machines, it will crash on startup most of the time, seemingly the result of a race condition or other bug where GetLastError returns something unexpected, in a not-very-well maintained Win32 API wrapping library for Go. This is mostly benign (although annoying) but the contrast in how competent Tailscale seems to be about the core guts vs the clients feels a little jarring at times! Still love it though.
  - bradfitz 4y ago
    FWIW, we've recently taken over maintenance of those Go libraries because they seem to have been abandoned upstream. And we now have people working on Windows full-time. (Early on, the Tailscale team was all primarily Linux and macOS users so Windows was admittedly neglected for too long)
    - jchw 4y ago
      It amazes me how you're seemingly always on top of any concern I or others could have. Thanks for the information.
  - dblohm7 4y ago
    Tailscalar here. There were a few things going on with that issue you mentioned; one of them is the way the wrapper library was written, the other was with some stuff in the GUI client that was happening on a background goroutine but shouldn't have been. That should be fixed in the current stable release. As for the Windows client in general, it is going to be receiving a lot of love over the next few months!

ignoramous 4y ago

> ...by architecting our infrastructure with security and privacy in mind. The blog and the website loads in so many trackers (reasonable, given metrics are important when you're busy hyperscaling a venture-backed startup), that folks at Tailscale should seriously reconsider positioning themselves as some paragons of privacy. No offence (:

fsociety 4y ago
Why does a for-profit company have to practice perfect anonymity to sell a product which does have security/privacy in mind?
- ignoramous 4y ago
  > Why does a for-profit company have to... https://news.ycombinator.com/item?id=25457440 https://news.ycombinator.com/item?id=25457440 > ...practice perfect anonymity to sell a product which does have security/privacy in mind? So are free users "the product?" No. If we're going to fix the Internet, there's no point only fixing it for big companies who can pay a lot. That misses the point of the whole adventure. The Internet is for everyone. We have to fix it for everyone, or why bother? We knew we had to design a business model and a technical architecture that removes any incentive to abuse your privacy. - CEO at Tailscale, https://archive.is/R7jqw https://archive.is/R7jqw
cpach 4y ago
Are you sure people who complain about such things are in Tailscale’s target demographic?
- yjftsjthsd-h 4y ago
  Well, if Tailscale is bothering to talk about "architecting our infrastructure with security and privacy in mind", they seem to think so.
slig 4y ago
> website loads in so many trackers Not on my browser. Maybe you should consider a better browser and/or install some extensions.

aborsy 4y ago

I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or install a bad update). The problem with malicious updates can be addressed by providing as easy way to check the code signature. With a standalone infrequently updated app such as an AppImage app, this can be easily done by verifying the GPG signature upon download.

sneak 4y ago
How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account? Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that. I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and it doesn't involve Google or Microsoft at any point.
- crawshaw 4y ago
  Tailscalar here. IdP trust is on the list. There are some "easy" things we can do that help on the surface but make life harder for users. And there are some not-so-easy things we are researching. I hope to have answers in 2023.
  - sureglymop 4y ago
    I recently read this blog [0] about how tailscale was thinking of open sourcing a small coordination server but headscale had already been created so that effort was put on hold. Is tailscale at this point in any way involved in headscale or contributing to it or are there plans to fork it to keep it maintained? Asking out of curiosity. [0]: https://tailscale.com/blog/opensource/ https://tailscale.com/blog/opensource/

ohbtvz 4y ago

Why is there a post by tailscale on the front page every single day?

chipsa 4y ago
Baader-Meinhof They're not. It's just roughly when the post a new blog entry, which is... usually about once a week? Sometimes it's about new features, sometimes it's about internals which might be helpful for other people to know about (like the previous entry was about internals of the TUN/TAP, and how they managed to speed it up a bunch).
Ao7bei3s 4y ago
Tailscale are _the_ company pushing the state of the art in VPN's, and they write great, detailed technical articles and whitepapers about it. As someone who has worked on a different, more traditional, enterprise VPN product, this is extremely interesting to me. Most other companies have neither the cool tech (most haven't even switched from IPsec), nor the ability to put out anything other than marketing fluff, nor the focus to actually keep working on the core VPN tech instead of trying to check all boxes (monitoring/firewalling/device management/...) but not innovating anywhere. Tailscale also scales down to individual, private users, has a free plan, some open source code and an open source reimplementation, all of which appeals to the HN audience. This article in particular is interesting because Tailscale inserting malicious nodes is the #1 concern I had around their product, and their solution (tailnet locks) is interesting and probably better than the solution I would have come up with (using Wireguard's support for additional symmetric secrets).
TheFlyingFish 4y ago
Obviously "every single day" is hyperbole, but I agree with you that a much higher proportion of Tailscale blog posts end up on the front page than most corporate blogs. Finally I think it comes down to this: Tailscale is full of the same kind of people who tend to hang out on Hackernews. HN loves Tailscale because Tailscale is HN's ingroup. Fly.io is in a similar situation, and similarly sees a higher-than-average fraction of their blog posts getting traction on HN. For an interesting counterexample, look at warp.dev. They have a lot of the same markers - tackling an interesting problem that affects many HNers daily (the limitations of the terminal), building things from the ground up in Rust, and writing highly technical blog posts about it - but at the same time, it's clear that as an organization, they don't quite get it. They can't understand, for instance, why putting telemetry in their terminal emulator is absolute suicide as far as HN is concerned, or why "moving the terminal to the cloud" is a phrase that will never make HN happy. Unlike Tailscale and Fly, they are not "of the race that knows Joseph", as it were. That's not to say that there aren't individuals at Warp who are members of the HN ingroup. But at the organizational level, Warp just isn't quite it.

tiffanyh 4y ago

Cloudflare + Tailscale would be a super interesting combination for a business. I wonder if Tailscale is an acquisition target.

lilyball 4y ago
Please don't give them any ideas
TkTech 4y ago
From a business sense, it would likely be a reasonable and profitable acquisition for both parties. From a personal standpoint, I would like to see Cloudflare (among others) smashed into a neutral backbone provider and all its product offerings spun off, ala https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System https://en.wikipedia.org/wiki/Breakup_of_the_Bell_System. It's dangerous for one company to control so much of the internet's infrastructure and it's causing massive problems (like https://news.ycombinator.com/item?id=32912075 https://news.ycombinator.com/item?id=32912075). Tailscale should remain independent.

KingMachiavelli 4y ago

Wow, I was advocating for switching to Tailscale (from just manual SSH key management) and was asked if we could do pretty much exactly this. Great to see such quick progress.

unshavedyak 4y ago

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduced access to ports. So maybe that alone is worth $5/m. .. well, $10/m, since i have two users. $10/m seems a bit steep just for some small access to my internal network for things like Camera Feeds, etc. Dyn DNS + some safe self hosted VPN might be more affordable and just as safe compared to Tailscale. .. thoughts on the best service to price ratio for my needs?

dkjaudyeqooe 4y ago
> i could expose my IP via Dyn DNS Not if your IP is behind CGNAT or the like. > $10/m seems a bit steep They have a free multi-user plan but it's in small print on the pricing page and requires use of Github for user management.
TheFlyingFish 4y ago
Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN." If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices. If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices can communicate as if they were all on the same LAN, without worrying about their traffic being eavesdropped. As for the pricing, I'm fairly confident that Tailscale won't mind if you're sharing a free plan (so single-user) across e.g. your laptop and your wife's, even though there are technically two "users" there. They've made it pretty clear that the divide they care about is "personal use free, company use paid."
- unshavedyak 4y ago
  On the note of free plan. It's actually a bit of a shame.. i want to pay, i like $5/m, but it looks like $5/m is less devices than if i used free? Though i just noticed that the Personal Pro plan works with up to 100 devices for $4/m. Might give that a try. I really like paying.. as i hate free VC services. edit: Wow, the signup requirement is bizarre though. I don't have or want Google or Microsoft.. i do have a Github, which i guess i'll have to use... but what the hell? So odd that i can't just signup with my email.

kerneis 4y ago

I found the blog post slightly confusing because it never explicitly spells out that endorsing a new node is a manual operation that the administrator has to perform from one of the trusted nodes. Of course this is what you'd want, anything automatic would ruin the purpose of tailnet lock. But still not seeing it mentioned, neither in the text nor in the pictures, made me wonder what I had missed, until I watched the video which features that very step as part of the demo.

mdeeks 4y ago
I had the same issue. I think the idea is that you build something yourself on a trusted node that decides whether or not to endorse a new node. Off the top of my head I'd do something dead simple like verify the user account matches our domain and then also query an inventory system to verify it is indeed a device we manage through MDM (though I'm not sure how this will work for mobile devices. We don't MDM those). When a new device attempts to join you should have some data on it via the API (User, OS, Tailscale version, source IP, machine name). You could use that data to decide to endorse it or not.
- tailscaletom 4y ago
  (Tailscalar and a tailnet lock author here) If you're okay with trusting Tailscale's control plane, we have a feature for exactly this use case! Its called Device Authorization: https://tailscale.com/kb/1099/device-authorization/ https://tailscale.com/kb/1099/device-authorization/ You could also use tailnet lock in this fashion, by issuing a `tailscale lock sign` command for the new node once you've verified the provenance of the new device. Because it involves signatures with keys on your device it could never be as simple as a REST API, but maybe we could offer a more easy to automate command or better client library support (suggestions welcome!)
tailscaletom 4y ago
(Tailscalar and a tailnet lock author here) Thanks for the feedback!! Writing the documentation for how this worked was a challenge, and its good to hear what pieces we need to call out more strongly in the future. If you're interested in gory details around tailnet lock internals, we have the beginnings of a whitepaper here: https://tailscale.com/kb/1230/tailnet-lock-whitepaper/ https://tailscale.com/kb/1230/tailnet-lock-whitepaper/

teaearlgraycold 4y ago

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

0x0000000 4y ago
It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing keys. Tailscale does a lot of that lifting for you, so you can easily and quickly get a working VPN, at a low cost, with good performance. Personally I manage wireguard myself, but I also self-host my own VMs, storage server, applications, etc. Tailscale is like taking your car in for an oil change instead of doing it yourself, plenty of people find that worth it.
- teaearlgraycold 4y ago
  What does everyone use it for?
  - TheFlyingFish 4y ago
    Not GP, and I can only answer for myself, but: Personally, I use it to connect my home devices as if they were always together on the same LAN, even when they're not. E.g. Raspberry Pi, home NAS, "home" server that's actually in a different physical location, etc. All accessible anywhere at any time, even (say) from my laptop in a moving vehicle, without connections dropping even when my IP changes. It really is like magic. At work, we use it so that remote employees can access locally-hosted applications, office NAS, etc. ACLs make it easy to employ the principle of least privilege, so that having a route into the office LAN doesn't immediately mean any and every device is compromised.
  - TkTech 4y ago
    I have it on all my personal and family servers and devices. I use it so that for both myself and my family all our internal stuff (unraid network shares, jellyfin, homepages, photo backups, etc, etc) "just works" for the less technical members of the family even when they're not at home. It seamlessly detects when the peer is local so it doesn't route out to the internet and back, has an easy ACL to segment things (wife's phone doesn't need access to dd-wrt), and a bunch of other features. We've been able to do this with existing VPNs for a long, long time, but tailscale is by far the most painless offering I've ever used and I migrated away from OpenVPN completely.

deleted 4y ago

[deleted]

presto8 4y ago

This is a useful addition to Tailscale. But if one is going to manage public keys anyway, just use Nebula at that point?

user- 4y ago

I have little to no idea what Tailscale does. Is it a VPN like Mullvad? What makes it so special? Ive heard a bit about tailscale networks connecting devices together easily. Is it for your own network only, or can other people access your tailscale devices directly as well? Ie, I host a minecraft server on my linux desktop. Can tailscale help me in the use case of providing an IP to people to connect to it? Or am I just back to regular old port forwading and my external IP?

leesalminen 4y ago
Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard. You can think of it as a LAN for all your devices regardless of what network they’re physically connected to. The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though. Tailscale does as of recently have the ability to do what you’re saying for Minecraft. It’s called Tailscale Funnel. This lets you expose a port on any of your devices to the public internet with a TLS enabled host name. Another option for your Minecraft server is to use Cloudflare Tunnel. Works great for this kind of thing and is pretty much functionally equivalent to Tailscale Funnel.
- xeonmc 4y ago
  Does either Funnel or Tunnel allow this use case for old UDP-based games like Quake etc? I would like to just be able to send strangers a temporary permalink to my server for a one-off session, then turn it off or have it expire automatically once we're finished. This would not be feasible if I have to also ask whomever I come across to install clients, as opposed to just connecting from within the game.
  - telotortium 4y ago
    Seems like they're only TCP, unfortunately.
- apenwarr 4y ago
  I recommend against using Funnel for this use case (because it exposes your server to everyone in the world, not just your trusted users). Tailscale node sharing is free and secure for private networks of friends, and there are lots of people using it with Minecraft: https://tailscale.com/kb/1084/sharing/ https://tailscale.com/kb/1084/sharing/ To answer the question in another thread, node sharing also works with UDP. (Funnel is TCP-only due to the vagaries of IP addresses and TLS certificates when facing the outside world, sigh.)