6 ms·

> I'm skeptical of the obvious counterpoint that this assists a flywheel of greater b2c satisfaction leading to b2b success... Okay. But it does? Our stats con

> I'm skeptical of the obvious counterpoint that this assists a flywheel of greater b2c satisfaction leading to b2b success... Okay. But it does? Our stats continue to show that making nerds happy (we're also nerds) leads to more corporate sales. (https://tailscale.com/blog/free-plan/ https://tailscale.com/blog/free-plan/ etc) So if we can make something that we want ourselves and our friends and fellow nerds also like, and that also then leads to more corporate sales... why not?

mdeeks 3y ago
Anecdata: It directly lead us (Instacart) to try and then adopt Tailscale. Many of us had used it at home and were happy nerds. This gave it a huge initial leg up vs other "enterprisey" VPNs when we were in the evaluation stage. Tailscale sold itself after that. The docs were excellent and it really is simple to use and run. I was able to do a full PoC in day and prove that I could join all of our environments and clouds into one VPN and have DNS resolving correctly everywhere.
- deleted 3y ago
  [deleted]
- LilBytes 3y ago
  Same here. Tried Tailscsle at home, took it to work and implemented it for our own needs. Seems to me making nerds happy had a great conversion rate to paying customers.
throwaway20222 3y ago
This is a pretty tried and true process historically as well, just… “ask your developer.”
agnokapathetic 3y ago
A lot of the people making purchasing decisions to acquire products like Tailscale are in security departments and have a very low opinion of Mullvad (VPN of choice for all kinds of abusive/fraud/hacking traffic).
- throwaway894345 3y ago
  Why would this affect the security of someone adopting Tailscale? It's not like partnering with Mullvad makes it easier for hackers/fraudsters/etc to attack a Tailscale user. Maybe I'm an idiot, but I would assume that 'hackers/fraudsters trust it' probably means that they do a decent job of respecting privacy?
- phpisthebest 3y ago
  >>> and have a very low opinion of Mullvad We do? I have a high opinion of them, one of the few VPN services I would trust not to give in even to governmental pressure. I firmly believe they would shut down their service before the compromised user privacy. That is very commendable
  - sitzkrieg 3y ago
    i agree. meanwhile people are using vpns they saw advertised on youtube
  - peddling-brink 3y ago
    Are you a CISO or otherwise have that purchasing power? I’ve found that CISO types hold opinions that are not usually met by ground floor or even middle management folks.
- nly 3y ago
  A VPN that can block activity X by definition is monitoring you to decide whether you're doing activity X.
  - mpalmer 3y ago
    Surely any solution worth using is going to be doing that on the client side in a way that's independently verifiable.
- lannisterstark 3y ago
  >(VPN of choice for all kinds of abusive/fraud/hacking traffic). This is a pretty bad take. With your logic anything pro-privacy like Signal/Matrix etc would also be "x of choice for abuse/fraud/hacking etc" and thus shouldn't be used.
ogaj 3y ago
I appreciate the response - great blog post. I don't doubt this works for certain companies and components of the ecosystem; it worked for Dropbox (at least for a long time). Tailscale is clearly a superior product to it's competitors and I have regularly recommended colleagues and clients to evaluate whether it fits their needs. However, unfortunately, that is frequently not enough to "win" in the crowded and bureaucratic enterprise software space. I would love to be proved wrong here and wish you the greatest success!
- Spooky23 3y ago
  The big problem with Tailscale in enterprise is it can't touch anything that interacts with lots of compliance domains, which typically require FIPS. There are creative ways to get around that, but it makes implementation a complex story and heavy lift.
  - tptacek 3y ago
    Which "compliance domains" are you thinking of that require FIPS crypto for access VPNs? Be specific, if you can? Thanks!
    - Spooky23 3y ago
      Say you were a county social services department. You wish to use Tailscale to microsegment federal tax data (subject to IRS 1075 safeguards requirements) relating to your child support unit from other traffic (say Medicaid enrollment) which does not have that requirement. I’m pretty confident that you would draw an audit finding for that reason with a pure tailscale solution. (I also think that’s bullshit.)
      - tptacek 3y ago
        1075 does not appear to require that access VPNs use FIPS cryptography. Arguably, it would if you were relying exclusively on WireGuard for data protection, but it's uncommon for people to do that (we're WireGuard true believers and we do in places depend on WireGuard authentication and encryption for our security model, but it's a weird enough thing to do that we notice it when we do it).
michaelt 3y ago
A lot of B2C VPNs position themselves as kinda sketchy and anti-corporate. If the cops or the MPAA come calling, we'll tell them to go to hell. Netflix blocks our servers? We'll set up new ones. Accused of torrenting? We didn't see anything, and we don't know who you are either. We're incorporated in a jurisdiction that makes us almost impossible to sue. We've got 4 employees, and not a single clothes iron between us. B2B VPN products often have the opposite market positioning - straight-laced, trustworthy stuff. Absolutely not claiming to be difficult to sue. We've got 50+ employees, all of them wear shirts and some even wear ties. And suppliers like cloudflare are more than happy to help you MITM all your employees' https traffic, in the name of "security". These just seem like positions in the market that are very hard to reconcile.
- fomine3 3y ago
  Cloudflare is on a somewhat interesting position. They are known for negative about banning copyright violation or controversial contents (than competitors), but also provides enterprise solutions.
  - mschuster91 3y ago
    > They are known for negative about banning copyright violation or controversial contents (than competitors) They're required to do the former (and Switter) by American laws, and for the latter: they banned the Daily Stormer, 8chan after a terrorist incident, and Kiwi Farms after their members called for open violence. It's not hard to see why these three got banned, inciting violence is not covered by "free speech".
- drsnow 3y ago
  This is simply a false dichotomy and that you don't realize such is damning

mdeeks 3y ago

Anecdata: It directly lead us (Instacart) to try and then adopt Tailscale. Many of us had used it at home and were happy nerds. This gave it a huge initial leg up vs other "enterprisey" VPNs when we were in the evaluation stage. Tailscale sold itself after that. The docs were excellent and it really is simple to use and run. I was able to do a full PoC in day and prove that I could join all of our environments and clouds into one VPN and have DNS resolving correctly everywhere.

deleted 3y ago
[deleted]
LilBytes 3y ago
Same here. Tried Tailscsle at home, took it to work and implemented it for our own needs. Seems to me making nerds happy had a great conversion rate to paying customers.

throwaway20222 3y ago

This is a pretty tried and true process historically as well, just… “ask your developer.”

agnokapathetic 3y ago

A lot of the people making purchasing decisions to acquire products like Tailscale are in security departments and have a very low opinion of Mullvad (VPN of choice for all kinds of abusive/fraud/hacking traffic).

throwaway894345 3y ago
Why would this affect the security of someone adopting Tailscale? It's not like partnering with Mullvad makes it easier for hackers/fraudsters/etc to attack a Tailscale user. Maybe I'm an idiot, but I would assume that 'hackers/fraudsters trust it' probably means that they do a decent job of respecting privacy?
phpisthebest 3y ago
>>> and have a very low opinion of Mullvad We do? I have a high opinion of them, one of the few VPN services I would trust not to give in even to governmental pressure. I firmly believe they would shut down their service before the compromised user privacy. That is very commendable
- sitzkrieg 3y ago
  i agree. meanwhile people are using vpns they saw advertised on youtube
- peddling-brink 3y ago
  Are you a CISO or otherwise have that purchasing power? I’ve found that CISO types hold opinions that are not usually met by ground floor or even middle management folks.
nly 3y ago
A VPN that can block activity X by definition is monitoring you to decide whether you're doing activity X.
- mpalmer 3y ago
  Surely any solution worth using is going to be doing that on the client side in a way that's independently verifiable.
lannisterstark 3y ago
>(VPN of choice for all kinds of abusive/fraud/hacking traffic). This is a pretty bad take. With your logic anything pro-privacy like Signal/Matrix etc would also be "x of choice for abuse/fraud/hacking etc" and thus shouldn't be used.

ogaj 3y ago

I appreciate the response - great blog post. I don't doubt this works for certain companies and components of the ecosystem; it worked for Dropbox (at least for a long time). Tailscale is clearly a superior product to it's competitors and I have regularly recommended colleagues and clients to evaluate whether it fits their needs. However, unfortunately, that is frequently not enough to "win" in the crowded and bureaucratic enterprise software space. I would love to be proved wrong here and wish you the greatest success!

Spooky23 3y ago
The big problem with Tailscale in enterprise is it can't touch anything that interacts with lots of compliance domains, which typically require FIPS. There are creative ways to get around that, but it makes implementation a complex story and heavy lift.
- tptacek 3y ago
  Which "compliance domains" are you thinking of that require FIPS crypto for access VPNs? Be specific, if you can? Thanks!
  - Spooky23 3y ago
    Say you were a county social services department. You wish to use Tailscale to microsegment federal tax data (subject to IRS 1075 safeguards requirements) relating to your child support unit from other traffic (say Medicaid enrollment) which does not have that requirement. I’m pretty confident that you would draw an audit finding for that reason with a pure tailscale solution. (I also think that’s bullshit.)
    - tptacek 3y ago
      1075 does not appear to require that access VPNs use FIPS cryptography. Arguably, it would if you were relying exclusively on WireGuard for data protection, but it's uncommon for people to do that (we're WireGuard true believers and we do in places depend on WireGuard authentication and encryption for our security model, but it's a weird enough thing to do that we notice it when we do it).

michaelt 3y ago

A lot of B2C VPNs position themselves as kinda sketchy and anti-corporate. If the cops or the MPAA come calling, we'll tell them to go to hell. Netflix blocks our servers? We'll set up new ones. Accused of torrenting? We didn't see anything, and we don't know who you are either. We're incorporated in a jurisdiction that makes us almost impossible to sue. We've got 4 employees, and not a single clothes iron between us. B2B VPN products often have the opposite market positioning - straight-laced, trustworthy stuff. Absolutely not claiming to be difficult to sue. We've got 50+ employees, all of them wear shirts and some even wear ties. And suppliers like cloudflare are more than happy to help you MITM all your employees' https traffic, in the name of "security". These just seem like positions in the market that are very hard to reconcile.

fomine3 3y ago
Cloudflare is on a somewhat interesting position. They are known for negative about banning copyright violation or controversial contents (than competitors), but also provides enterprise solutions.
- mschuster91 3y ago
  > They are known for negative about banning copyright violation or controversial contents (than competitors) They're required to do the former (and Switter) by American laws, and for the latter: they banned the Daily Stormer, 8chan after a terrorist incident, and Kiwi Farms after their members called for open violence. It's not hard to see why these three got banned, inciting violence is not covered by "free speech".
drsnow 3y ago
This is simply a false dichotomy and that you don't realize such is damning