16 ms·

The New Internet

517 points by ingve 2y ago

locusofself 2y ago
I'm distracted by all the references to being "old" because the author remembers the 1990s.
- duggan 2y ago
  Life moves pretty fast. I wouldn’t be too surprised if the median age of Tailscale’s audience was 24.
  - heraldgeezer 2y ago
    People born in 2000 use this? What is it? Can we call things for what they are? Is this a VPN? :) Im tired and I am 34. So tired.
- RadiozRadioz 2y ago
  Seeing the average age range of people who put "founder" on their LinkedIn, I'm not very surprised.
indigodaddy 2y ago
So the answer to the bad old internet is to install tailscale on everything?
- sneilan1 2y ago
  I think the message from this post is we’ll pay rent to Tailscale instead of AWS eventually.
zokier 2y ago
Of course these ideas are not that new. IPv6 was supposed to give end-to-end connectivity to all, and originally IPsec was supposed to be mandatory part of IPv6, giving each internet host cryptographic identity. And so on.
- Fnoord 2y ago
  I was curious why the article didn't mention IPv6 at all, since Tailscale does support it. IPv6 -together with WireGuard- gives privacy, security, and performance. The downside is the complexity to set it up. Tailscale builds on the shoulder of giants. IPv4, WireGuard, Samy Kamkar NAT punching, OpenSSH, and probably many more. One of the upsides is the combination of these, and that the management interface in general is easy. But what counts for CA is also true for Tailscale: both are using FOSS to in the end deliver a (proprietary) service. But because almost everything is build on top of FOSS and there's Headscale (and they're cool with it), this isn't a major issue to me. Like, it is a downside, but not a major one, as vendor lock-in is practically non-existent. In fact, it is likely an upside from a business/support PoV.
  - wmf 2y ago
    Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.
    - Bluecobra 2y ago
      There are some very valid points here though: https://apenwarr.ca/log/20170810 https://apenwarr.ca/log/20170810
      - deleted 2y ago
        [deleted]
      - throw0101d 2y ago
        Here is a list of of proposals for what could have replaced IPv4: * https://www.rfc-editor.org/rfc/rfc1454.html https://www.rfc-editor.org/rfc/rfc1454.html Here are the technical criteria for choosing the (then-labelled) IPng: * https://datatracker.ietf.org/doc/html/rfc1726 https://datatracker.ietf.org/doc/html/rfc1726 And finally the evaluation of the available candidates and why the winner was chosen: * https://datatracker.ietf.org/doc/html/rfc1752 https://datatracker.ietf.org/doc/html/rfc1752 If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions. > There's one thing I forgot to mention in that big long story above: somewhere in that whole chain of events, we completely stopped using bus networks. Ethernet is not actually a bus anymore. It just pretends to be a bus. Basically, we couldn't get ethernet's famous CSMA/CD to keep working as speeds increased, so we went back to the good old star topology. Except for 802.11 Wifi.
metadat 2y ago
I really enjoy and appreciate the tailscale service, but this article didn't click for me. I love an inspiring CEO rally speech as much as the next early adopter, and agree that there is a ridiculous amount of developer friction and complexity in computing, but tailscale still has its own friction and isn't on track to solve the big picture issues _at all_. As a concrete example, a few weeks ago, I invited my dad to my tailnet with the intent of using remote desktop into his machine to help him fix something. He accepted the invite, and then I couldn't ping his machine despite it appearing in my TS domain web interface. Now he hates tailscale, and I lost credibility because prior I told him how awesome it is. In his view, it wasted his time and doesn't "work right", and metadat is a fool.
- Cyphus 2y ago
  Is your dad running Windows? Windows firewall is known to block icmp traffic, a problem that neither Tailscale nor any other p2p VPN can solve.
  - metadat 2y ago
    Maybe, but even ICMP pings? He also couldn't ping my systems, it seemed really broken.
    - eddythompson80 2y ago
      Ping uses ICMP. Windows blocks ICMP by default, so yes `ping <windows-host>` doesn't work by default. Is your system your father was trying to ping a Windows system as well? The other thing to check is if he was running another VPN on his machine at the same time. Running multiple VPNs at the same time (both Windows and Linux) requires extra fiddling to map the routing correctly to prevent their rules from overlapping/breaking each. https://tailscale.com/kb/1105/other-vpns https://tailscale.com/kb/1105/other-vpns
      - metadat 2y ago
        No other VPN, but my windows machine firewall is on and it pings fine. Anyway, tailscale still has more to go. Inviting someone to your tailnet doesn't seem to be the same as adding a machine yourself.
0x0000000 2y ago
The new internet, an overlay network on top of the existing internet. Cool?
- wmf 2y ago
  It seems less bad than the competing vision of tunneling absolutely everything over HTTPS.
  - oneplane 2y ago
    At least it's not a network that revolves around middle-out compression.
- fuzzfactor 2y ago
  What's really needed along those lines is a regular ordinary Mbone that's permanent this time: https://en.wikipedia.org/wiki/Mbone https://en.wikipedia.org/wiki/Mbone
imiric 2y ago
I like Tailscale, but this reads as too self-aggrandizing. You have a mesh VPN product with some value-added services on top of it. That's great, but this idea isn't novel or unique. Why should your solution be the "new internet" instead of any of the alternatives? I wouldn't want to rely on a single company for all my internet infrastructure, anyway. So I'll stick with the traditional internet with all its complexity. Its major problems aren't technical but social, and no new technology will solve those.
- eddythompson80 2y ago
  > Its major problems aren't technical but social, and no new technology will solve those. Really? Isn't the major problem of the current internet is inherent centralization of services because the initial promise of 100% decentralized network is simply too complex to realistically manage? I view that problem as deeply technical. Unless if by "social" you simply mean everyone should become an experienced sysadmin. (or the slight variation of, everyone should know an experienced sysadmin who's willing to run their application for them for free) Take something as mainstream as social media. Imagine a world where Facebook/Twitter/TikTok/YouTube/Reddit/HN/etc worked (seamlessly) like bittorrent. An application on your machine when you run it, it joins a "Facebook" network where your friends see you online through their instance of the application. Your feed/wall/etc is served to them directly from your machine. All your communication with them is handled directly between the 2 (or 1000 or millions) of you. No centralized server needed. You can easily extend and apply this majority of centralized application today. The only ones I can think of where this wouldn't work would be inherently centralized services like banking for example. There are already plenty of p2p networks that show that this is a viable solution. Bittorrent, soulseek, bitcoin, etc. All the problems you will run into however to make this as seamless as just connecting to facebook.com are purely technical. The initial big hurdle is seamless p2p connectivity. That is without port forwarding, dynamic dns, and requiring advanced networking, security, and other sysadmin knowledge from every user. Next would be problems like what happens when the node is offline? What happens to latency and load if you need to connect to thousands, hundreds of thousands, or millions of machines just to pull a "feed"? How is caching handled? How are updates/notifications pushed? How do nodes communicate when they are wildly out of date? Where is your data stored? How do you handle discoverability, security, etc. All deeply technical problems. Most are solvable, but you're gonna have to invest a significant amount of effort to solve them one by one to reach the same brain-dead simple experience as a centralized service. The fediverse has been trying to solve just a small subset of these problems for over a decade now, and the solutions still require a highly capable sysadmin to give users a similar (or only slightly worse) experience than twitter.com.
figassis 2y ago
I love Tailscale, but this post gives me the creeps. The internet succeeded because it was built on standards and was completely free. With Tailscale, I get wireguard is open source and we have things like Headscale. But the whole everyone gets an IP, doesn’t it depend on Tailscale owning a massive ip address space? We can all wait until full ipv6 rollout, or we can depend on centralized ipv4, and servers and proprietary stuff. Maybe a bit hypocritical?
- yegle 2y ago
  100.64.0.0/10 is a reserved IP block for carrier-grade NAT.
  - metadat 2y ago
    More info about Carrier-Grade NAT (for others who, like me, are only encountering this term for the time): https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT Can anyone elighten me regarding what is different or special about 100.64.0.0/10 vs say, 192.168.0.0 or 10.0.0.0. Edit: Answered my own question by digging into more wikis, there is a helpful table of reservations and intentions here: https://en.wikipedia.org/wiki/Reserved_IP_addresses https://en.wikipedia.org/wiki/Reserved_IP_addresses
    - throw0101d 2y ago
      > Can anyone elighten me regarding what is different or special about 100.64.0.0/10 vs say, 192.168.0.0 or 10.0.0.0. A bit of context: if an ISP cannot get enough IPv4 addresses for the WAN-side of people's home routers, some problems exist: * something in 192.168/16 is generally used for the LAN-side of people's home routers, so that cannot be used on the WAN side * 10/8 is used for business/enterprise corporate networks, so it also cannot be used on the WAN side because if people VPN connect to the corporate, then the router may get confused * similarly for 172.12/12: often used for corporate networks So the IETF/IANA set aside 100.64.0.0/10 as it had no 'legacy' of use anywhere else, and is specifically called out to only be used for ISPs for CG-NAT purposes. This way its routing does not clash with any other use (home or corporate/business). IPv4 address space is nearly exhausted. However, ISPs must continue to support IPv4 growth until IPv6 is fully deployed. To that end, many ISPs will deploy a Carrier-Grade NAT (CGN) device, such as that described in [RFC6264]. Because CGNs are used on networks where public address space is expected, and currently available private address space causes operational issues when used in this context, ISPs require a new IPv4 /10 address block. This address block will be called the "Shared Address Space" and will be used to number the interfaces that connect CGN devices to Customer Premises Equipment (CPE). * https://www.rfc-editor.org/rfc/rfc6598.html https://www.rfc-editor.org/rfc/rfc6598.html
sweca 2y ago
Even though I don't agree with the whole "New Internet" thing, this article is very well written.
- sneilan1 2y ago
  I agree. This is article reads well. It has flow, good punctuation and pacing. Apart from the message that we will eventually pay Tithe to our new overlord tailscale, it was great.
  - Spivak 2y ago
    I mean it was given as an internal presentation about the business strategy, it's the kind of thing I would expect. 1. We took a hard-problem, peer-to-peer networking and IdM, and (mostly) solved it. 2. We're hoping this will drive people to build apps that leverage the unique capabilities of authenticated p2p mesh networks. It doesn't even have to be specifically for Tailscale. 3. People will want to use those apps and (if we're good at our jobs) choose to pay us to run the network for them over our competitors or building something in-house. 4. $$$ I'm not sure I would say this is as nefarious as the tone of the comments here suggest. Wanting a "killer app" for your software platform is pretty normal which is really what he's talking about. I would be nervous declaring victory or an inevitability without being to name what that killer app actually is but trying to figure it out/build it is a good strategy. It's one of those times where the desire for engineers to solve their pet-problems, play with shiny new toys, and build Halo LAN Party over Tailscale is aligned with the business.
nomoreusernames 2y ago
the new internet? i'm still on BBS. dont wanna use computers without ansi art.
jclulow 2y ago
An incredibly long ramp up to complaining about centralised control by rent seekers (a very reasonable complaint!) which gets bogged down in some ostensibly unrelated shade about whether client-server computing makes sense (it does) or is itself somehow responsible for the rent seeking (it isn't; you can seek rent on proprietary peer to peer systems as well!) to then arrive at: > There’s going to be a new world of haves and have-nots. Where in 1970 you had or didn’t have a mainframe, and in 1995 you had or didn’t have the Internet, and today you have or don’t have a TLS cert, tomorrow you’ll have or not have Tailscale. And if you don’t, you won’t be able to run apps that only work in a post-Tailscale world. The king is dead, long live the king!
- mystified5016 2y ago
  Rent seekers are bad! Don't you all hate landlords?! Now let me tell you why you should pay rent to me as well as everyone you currently pay rent to!
- ssss11 2y ago
  Lol. The tailscale CEO is preaching “tomorrow you’ll have or not have Tailscale. And if you don’t, you won’t be able to run apps that only work in a post-Tailscale world.”?? That won’t go down well in 10 years if they don’t become Microsoft-scale juggernauts.
  - IAmNotACellist 2y ago
    Or they'll just get bought by Microsoft, Amazon, or Cloudflare and that'll be that I like Tailscale just because it's OpenVPN without the unbearable agony of setting it up so it actually works
  - 01HNNWZ0MV43FF 2y ago
    Yeah it's a weird flex. I'd use Tailscale today if it was open all the way up and down. If not, why bother? TLS and http don't charge licensing fees...
    - p_l 2y ago
sfRattan 2y ago
As I've been deliberately moving toward self-hosted computing, under my control, on my home network, I've had a feeling more and more that we're on the cusp of something transformative... For those who want it and those who care. There's an ecosystem of mostly FOSS software now designed to run on a home network and replace big, centralized, cloud providers. That software is right on the edge of being easy enough for everyone to use and for sufficient numbers of people to deploy and administer. News like Immich (to replace Google Photos) getting a major investment thanks to Louis Rossman and FUTO [1] is encouraging. The ecosystem of software you can now run on a commodity built NAS or homelab is, for me, the most exciting thing in computing since I first used the Internet in the late 90s. The rollout and transformation, if it happens, won't look like all this stuff becoming so easy that every individual can run a server. But it is possible that every extended family will have at least one member who can run a server or administer a private network for the whole clan. And that's where tech like tailscale's offering will come in. That's where I see the author's vision being a believable moonshot: Each extended family, and some small communities, with their own little interconnected, distributed network-citadels, behind the firewalls of which they do their computing, their sharing, and their work. Most family members won't need to understand it any more than they understand the centralized clouds they use now. And most networks won't be as well secured as a massive company can make its cloud offering, but a patchwork heterogeneity of network-citadels creates its own sort of security, and significantly lowers the value of any one "citadel" to even motivated adversaries. [1]: https://www.youtube.com/watch?v=uyTPqxgqgjU https://www.youtube.com/watch?v=uyTPqxgqgjU
- Bluecobra 2y ago
  > As I've been deliberately moving toward self-hosted computing, under my control, on my home network Funnily enough, I was once like this but now I have deliberately moved everything to the big cloud providers as I don’t want to deal with the toil of running my own homelab anymore. This is coming from someone who used to have a FreeBSD server with ZFS disks and using jails to run various things like pf, samba, etc. Eventually things would fail and it felt like I was back at work again when all I want to do is drink a cold beer and watch YouTube. Perhaps I will try again one day as things get easier. For now I am content with having my photos and videos automatically synced up to iCloud/Google Photos.
OJFord 2y ago
This is a 'gimme some of that Wix money', IPO/acq ramp-up post right?
OneOffAsk 2y ago
> In fact, we didn’t found Tailscale to be a networking company. Networking didn’t come into it much at all at first. I always just assumed they were building some kind of logging software (“tail”scale), used Wireguard to connect hosts, and just kind of stopped there. Don’t get me wrong, Tailscale is a nice way to connect machines. It’s nice because Wireguard is nice.
- justinsaccount 2y ago
  https://apenwarr.ca/log/20190216 https://apenwarr.ca/log/20190216
  - svnt 2y ago
    This long blog post (by the now-CEO of Tailscale), if you skip to the end, describes that parent’s hypothesis is basically exactly correct. > Update 2019-04-26: Based on a lot of positive feedback from people who read this blog post, I ended up starting a company that might be able to help you with your logs problems. We're building pipelines that are very similar to what's described here. Update 2020-08-26: Aha! Okay, for some reason this article is trending again, and I'd better provide an update on my update. We did implement parts of this design for use in our core product, which is now quite distinct from logs processing. After investigating the "logs" market last year, we decided not to commercialize a logs processing service. The reason is that the characteristics we want our design to have: cheap, lightweight, simple, fast, and reliable - are all things you would expect from the low-cost provider in a market. The "logs processing" space is crowded with a lot of premium products that are fancy, feature-filled, etc, and reliable too, and thus able to charge a lot of money. Instead, we built a minimalistic version of the above design for our internal use, collecting distributed telemetry about Tailscale connection success rates to help debug the network. Big companies can also use it to feed into their IDS and SIEM systems. We considered open sourcing the logs services we built (since open source is where attributes like cheap, lightweight, etc tend to flourish) but we can't afford the support overhead right now for a product that is at best tangential to our main focus. Sorry! Hopefully someday.
- kiitos 2y ago
  Wireguard by itself is good, but it isn't nice. Tailscale is nice because it builds on top of Wireguard (which is good) and adds UX stuff (which makes it nice). Nice requires humane UX.
ZoomZoomZoom 2y ago
Isn't yggdrasil[1] supposed to be the New Internet? If not, why Tailscale specifically, and not Netbird, Nebula, Netmaker or some other competitor? The article is indeed very well written, but gives the wrong vibes, like something's coming: acquisition, pivot, split, shutting down, etc. Also, "we're re just getting started", the famous last words. Just to balance my healthy mistrust, I'd like to add that I'm a satisfied Tailscale user, mostly impressed with how little it requires of me to just work. [1] https://yggdrasil-network.github.io https://yggdrasil-network.github.io
- tionis 2y ago
  Yggdrasil would indeed better fit the description. It should however be noted, that, while it does work great, is still a research project.
Aeolun 2y ago
I really liked the premise of the post until I got to the last paragraph and had to do a quick double take. Sure Tailscale makes the internet easier again, but I still have to rely on a landlord. Something I didn’t/don’t have to for the internet. As much as a lot of stuff has been centralized, even today I can connect to any server in the world with just the link.
- paulnpace 2y ago
  > I really liked the premise of the post until I got to the last paragraph and had to do a quick double take. "Be sure to drink your Ovaltine."
- jmprspret 2y ago
  > I still have to rely on a landlord. This is a very good point. Counterpoint is self-hosting Headscale which I mentioned in another comment here: https://github.com/juanfont/headscale https://github.com/juanfont/headscale Works with native Tailscale clients with a few config changes. I use it myself.
Bluecobra 2y ago
> Every device gets an IP address and a DNS name and end-to-end encryption and an identity, and safely bypasses firewalls. Tailscale can certainly be blocked on NGFW firewalls like Palo Alto. I am not a BOFH, but also can’t have random employees circumventing security policies by setting up tailscale and leaving permanent backdoors in my corporate network. I remember the good old days when everyone had a public IP on the Internet and how easy it was to setup things. It was cool and fun while it lasted. But now things are different and security is a nightmare when we have to deal with things like ransomware.
- iczero 2y ago
  Tailscale doesn't even try to hide their MP or DP traffic. Last I checked, management was plain https and data was plain wireguard.
- vwkd 2y ago
  > can’t have random employees circumventing security policies by setting up tailscale and leaving permanent backdoors in my corporate network Tailscale isn't exactly an open door. Only machines signed-in via SSO can access a Tailscale network. If you don't trust your employees to safeguard their credentials and machines then how do you trust them at all? Keep them in an airtight underground bunker chained to their desks? Not sure what threat you're modeling for...
  - Bluecobra 2y ago
    I'm talking about people who want to use Tailscale for personal reasons. For example someone can setup a Tailscale instance between their work computer and home computer and circumvent the corporate VPN/MFA policies for remote access. I doubt they being malicious but what if their home PC gets hit with malware? A threat actor could then use the existing Tailscale instance to get into the corporate network.
iczero 2y ago
> centralization is bad except when we do it TL;DR
teddyh 2y ago
The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem. What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC. But Tailscale has every incentive to prevent such things to be widely and compatibly implemented, because it would destroy their business. Their whole business depends on the problem persisting. (Repost of <https://news.ycombinator.com/item?id=38570370 https://news.ycombinator.com/item?id=38570370>)
- whoistraitor 2y ago
  Ie. A form of perverse incentive or the cobra effect. Endemic to capitalism, especially in infrastructure.
- DyslexicAtheist 2y ago
  I never thought of this. Forces me to rethink every negative post people made against DNSSEC which shaped my opinion. I still think that IPv6 and DNSSEC do more harm in practice than what they solve. Maybe the SCW podcast can do a deepdive on this together with somebody who is militantly-pro DNSSEC. <3 ... edit: maybe even invite 2 or 3 DNSSEC advocates @tptacek :)
  - teddyh 2y ago
    Regarding DNSSEC: • Blog post: <https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...> • As a podcast episode: <https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-for-and-against/ https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-fo...>
  - tptacek 2y ago
    I don't think the analysis upthread should make you rethink DNSSEC, since it, too, is a centralized system; rather than being controlled by Avery Pennarun (you could do worse), it's controlled by an unholy alliance of world governments and companies like Verisign. If we could find a credible DNSSEC advocate (for our audience; that is: a cryptography engineer, vulnerability researcher, or an engineering leader at a major firm), we would absolutely invite them on. 'teddyh below gave you links to two pro-DNSSEC resources; fun note: the latter source (Geoff Huston, one of the world's more respected networking researchers) has since then written this: https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/ https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/.
howis 2y ago
How is having a TLS cert considered to currently be a “have”? Seems like a deployment issue for your colo and edge presence (for those eschewing AWS).
ivlad 2y ago
IPv6 + transport mode IPsec + opportunistic encryption with TOFU or other topologies of trust (including WoT, DNSSEC and PKI). All that is standard, most of it is available and only requires configuration (and, ideally, being turned on by default). There is very little use for companies like Tailscale in this setup, it’s scalable and works.
- wmf 2y ago
  Gets killed by IPv6 firewalls.
udev4096 2y ago
> You know what, nobody ever got fired for buying AWS. > That’s an IBM analogy. Wow, this dialogue comes in the first episode of halt and catch fire. I didn't know this was a real thing Here's the clip at 1.51 minutes, if anyone's interested: https://www.youtube.com/watch?v=XOR8mk0tLpc https://www.youtube.com/watch?v=XOR8mk0tLpc
EVa5I7bHFq9mnYK 2y ago
That looks like Hamachi of 20 years ago.
- sulandor 2y ago
  nordvpn is the new frosties tony
throw782349872 2y ago
I've been an active Tailscale user for years now, preaching the Gospel of Wireguard Control Planes to all who will listen (and many who won't) in both my personal and professional life. It's been really disheartening to watch the steady enshittification of Tailscale, Inc. I knew it was coming with 100% certainty once they raised 100mil in 2022. It's still heartbreaking because the product itself is quite good. The worst part is because Tailscale, Inc got there "first" (I know nebula existed before Tailscale did. shut up, okay?) and now the other competitors like NetMaker, NetBird, are all following almost the exact same business model ("open core+" - open source client and some kind of claim to an open source control plane with infinity caveats to funnel enterprise dollarydoos back to the vulture capitalists)
- sulandor 2y ago
  thanks for your insights. > The worst part is because Tailscale, Inc got there "first" never heard of nebula but please clarify where they got first. i'm sure you are aware that branded/purposebuilt vpn's existed long before the first iphone.
- kiitos 2y ago
  not sure what you mean by "enshittification" are you describing the process of a company achieving commercial success?
iovoid 2y ago
I think the author misdiagnoses the problem, and the proposed solution simply hides the centralization instead of removing it. The reason AWS is expensive is not because of IPv4, or the datacenters. It's mostly in their software/managed offerings, and the ability to quickly add more servers. If you are a "serious company" and you don't want to pay AWS or a similar company, renting a rack and colocating your own servers (either within your premises or in a datacenter) is doable and done by lots of companies. I disagree that certificates have caused centralization, and they're not something separating the haves and have-nots and are in no way comparable to having or not a mainframe. HTTPS becoming pseudo-mandatory didn't push people into having their own (sub)domains, which is nowadays the only requirement to obtain a certificate. It already happened out of convenience. The other point of centralization mentioned is DNS, which tailscale doesn't avoid at all. MagicDNS still relies on the ICANN root, as does the tailscale control plane. And if all you wanted was a free subdomain, there are plenty of people offering that. If you are behind CGNAT, tailnets aren't particularly less centralized, as traffic has to flow through the DERP servers. I doubt tailscale can keep providing these free of charge when the volume is in the tbps instead of the gbps. I agree that tailscale (and similar solutions) help in the last remaining case, which is accessing your computer that is behind a NAT. I even think they could reach the dozens of millions of users. This is, in my opinion, not enough to claim the title of "the new internet".
- j2kun 2y ago
  This rests on the incorrect assumption, pointed out in the post, that most applications need the kind of scale that warrants quickly scaling to more servers.
  - mrkeen 2y ago
    The article tried to make k8s all about scale, when that's not the whole story. On other socials, a screenshot of the 'Not scaling' section is getting responses of "Those idiot developers think they need k8s scaling for their 1 req/s sites, ha ha." The author brags about being able to (skip testing, CI/CD pipelines and just) edit their perl scripts (in prod,) really quickly. What uptime is associated with that practice? As many 9's as it takes for Brad to debug his perl program in prod? This approach doesn't even scale to 2 developers unless they're sitting in the same room. DevOps isn't a machine where you put unnecessary complexity in one end and get req/s out the other end. It's about risk and managing deployments better. If I really wanted to engineer for req/s, I'd look at moving off k8s and onto bare metal.
k_bx 2y ago
I'm one of the people who actually use Tailscale for production systems where there are servers physically close to me, or at some other controlled locations, and then there are hundreds of users hundreds kilometers away, all working via Tailscale. I should say two things. Tailscale is amazing and I love it. The system could not exist without it, or I'd have to have at least ten more people in my team to manage all this 24/7. It's working, and it's good enough. That being said, you do need to lower your expectations: it's not as good as "the internet". The latency spikes periodically, the connection drops sometimes, the MagicDNS just magically stops working or interferes with the system. Since we have many users, we've encountered every possible problem one can encounter, and then there's still something new you'll see tomorrow. In any case, we believe in Tailscale and its vision, it's a categorically new approach that simultaneously gives you the control on hardware, reduces the cost, and improves the security. Our first big production server was a 4-core Linux Laptop! We love Tailscale and we wish the product prosperous life and development. Thank you TEAM TAILSCALE!
- aquariusDue 2y ago
  Would you mind going into more detail about the 4-core Linux Laptop as a production server via Tailscale, please? I too use Tailscale and love it for self-hosting internal stuff but I never thought about using it for public facing production stuff. Now I'm really curious to hear more about your setup (if you're willing to share of course).
  - phantompeace 2y ago
    Not the person you’ve asked but I regularly use it for backends for projects. Connect your database machine to your Tailscale network and have your code talk over the Tailscale IP to connect to it. I’ve served multiple Flask frontends that have talked to backends this way - works great! I use various cloud VMs to host the frontend, and they all talk to an Optiplex Micro box under my desk for their backends.
    - k_bx 2y ago
      This, plus you get free domain name with HTTPS cert working.
kkfx 2y ago
Ehm, sorry no. OSes matter much as before because even if today giants want to call desktop and co "just endpoints" a politically correct variant of old dumb terminals of "their mainframes", actually we know very well that "the intelligence" must be in "endpoints" and no "mainframe alike" modern solution can scale or serve well in that regards. Of course we need networking, a network of individual hosts, not of dumb endpoints. Devs have lost such knowledge because big tech have trained them to loose it and now we see more and more limits of their model. The new internet must be the very old one, a network of hosts communicating each others, without *NAT and alike in the middle explicitly done in most case to lock users hosts behind some giant iron curtain. The modern web today matter because we lack UIs because commercial desktops have decided for widgets based UIs and have strongly hit their limits, finding in the modern web a crappy modern version of the old classic DocUIs and we know as well we need DocUIs. Slowly we start coming back to the end-users programming admitting that visual crap and all tentative to make programming hard on purpose led to unsustainable crapware ecosystems. Maybe in a decade spreadsheets and "calculators" will be finally dropped and Jupyter/R alike tools will have finally substituted them eventually with some LLM plugged in to help the dumb mean users. In another decade we probably will be back at LispM because try other paths to profit from users is not sustainable anymore. The shortest this period will be the less damage we will suffer.
oefrha 2y ago
I’m confused by this New Internet talk. Tailscale is nice and all, but it gives you virtual private networks. To talk to anything you need to first be invited to that private network. It’s more like the New LAN, great for intranet and shit. But how am I supposed to build Internet apps intended for everyone if they need to be invited to my network first? Not to mention most Internet services do need a central backend to function even if there are no barriers among clients at all (because the clients are completely unreliable), including even the textbook p2p example of file transfer: while direct p2p is nice in many cases, with a central service the recipient can receive at any time, instead of having to coordinate with the sender to both stay online simultaneously and for the duration of the transfer, which is quite difficult nowadays with most of the computing happening on phones.
- wmf 2y ago
  Maybe there will eventually be an Intertailnet that connects all the tailnets together (in some secure, opt-in way of course).
lockywolf 2y ago
My ISP deployed ipv6 via serving ULAs to clients behind the ISP box, and doing a NAT to a single dynamic public IP. Another one just blocks all incoming connections on ipv6 entirely.
dakiol 2y ago
One thing I don’t understand. The article claims that we need to pay rent to big corps like AWS, which is true only if you’re offering something on the internet (e.g., you have a saas). As a consumer I don’t pay to AWS, I only pay to my isp. Now, the article wants everyone (the ones who have something to offer, and the consumers) to switch to this new internet… so both producers and consumers (peers now) need to pay rent to tailscale (unless you selfhost, but selfhosting is like the first story tell tell in the article about asking your isp for a static ip address, opening ports and the like; self hosting is too much work). Smells like more centralisation, not less.
- vwkd 2y ago
  As a buyer you also don't pay VAT to the government. You pay the seller a price that's marked up exactly by VAT, which the seller then pays to the government. In summary, if you don't pay it directly doesn't mean you don't pay it indirectly.
rubi1945 2y ago
> I read a post recently where someone bragged about using Kubernetes to scale all the way up to 500,000 page views per month. But that’s 0.2 requests per second. I could serve that from my phone, on battery power, and it would spend most of its time asleep. lmao
jpeeler 2y ago
Did anyone else immediately do the calculation of 8.1 billion (world population 2024) * 1/20000 = 405k user base? Which makes me wonder what percentage are paying users.
jonathanlydall 2y ago
Speaking of Tailscale, does anyone know on Windows how to prevent it significantly slowing down file transfers between peer computers on my home LAN? I don't really understand it, I can use the direct IP address of the other machine and I can still see tailscaled.exe using a lot of CPU and my file transfer being only 65MB/s. If I right click the system tray icon and exit from Tailscale, the transfer speed instantly jumps to 109MB/s (which is the maximum my Gb/s LAN).
- jonathanlydall 2y ago
  Looks like it's due to this: https://github.com/tailscale/tailscale/issues/6999#issuecomment-1829594060 https://github.com/tailscale/tailscale/issues/6999#issuecomm...
idunnoman1222 2y ago
Ipv6 is for poor people, until the poors figure out something really cool you can do with it the rich will never switch
- sulandor 2y ago
  imho at this point it's a generational thing. there's just no love in v6, so it'll take over once the old guard go out of office and nobody cares enough anymore.
sidcool 2y ago
I love this blog post. It resonates so much. But I honestly don't know how to deploy applications efficiently without containerization. And where there's containers there's kubernetes. So on and so forth
Ericson2314 2y ago
When is the government going to start requiring IPv6 more aggressively? It's that simple.
signal_space 2y ago
Any one play with https://github.com/slackhq/nebula https://github.com/slackhq/nebula
thr0w 2y ago
> Sure, Apple’s there selling popular laptops, but you could buy a different laptop or a different phone. > But the liberation didn’t last long. If you deploy software, you probably pay rent to AWS. There's no Azure? GCP? Hetzner? Digital Ocean? > You pay exorbitant rents to cloud providers for their computing power because your own computer isn’t in the right place to be a decent server. You do that because you don't know what port-forwarding is (vast majority of software people do not), or you don't have the place or infra in your dwelling to stash a laptop server running 24/7 without interruption.
- literallyroy 2y ago
  You probably also have a residential IP and need to pay some service (Ngrok?) to convert that into a static address that’s useful right?
buro9 2y ago
I love this. Except to use tailscale you do need to bring in a while OIDC authentication provider. It's all small and aimed at avoiding scale until the very first step, when suddenly only the big complex thing is acceptable. I still just want to just use my email and a top. The only one of the auth providers tailscale supports that I have is GitHub, but I don't use GitHub as beyond work as I self host my git. When the onboarding is "maintain and run a full oidc provider", all we've done is trade one aspect of complexity for another.
littlecranky67 2y ago
Tailscale complaining about centralized actors controling the internet, yet not allowing to sign up for Tailscale with your email but strictly requiring to use a Microsoft/Meta/Google account. Cant make this up.
- SparkyMcUnicorn 2y ago
  You can use just about any OIDC. Some of the self-hosted options presented during sign up include Keycloak, Ory, Gitea, Zitadel, Authelia, and more. There's also a workaround to create a passkey account by signing up with any SSO provider, inviting yourself as an external user, accepting that invite and sining in with a passkey, then leave the original SSO network. Then you're not tied to any external service at all.
  - littlecranky67 2y ago
    Or, wild idea, just allow email signups like everyone else.
    - SparkyMcUnicorn 2y ago
      Agree or disagree, a tailscale co-founder responded as to why they went this path. https://news.ycombinator.com/item?id=22760130 https://news.ycombinator.com/item?id=22760130 > (I'm a Tailscale co-founder) The idea is to avoid building yet another commercial service that holds onto your username and password. People have enough identities already. More details here: https://tailscale.com/blog/how-tailscale-works/ https://tailscale.com/blog/how-tailscale-works/ We know we keep getting feedback that people want a different way to authorize their accounts (especially for personal use), so we're looking at other options. We just really want to stay out of the username+password business; it's simply bad security practice.
pomatic 2y ago
I'll preface this by saying: I DO appreciate tailscale and what they've done for frictionless VPNs; I use it daily. But this post has a really unfortunate tone, it comes across as really arrogant. Not ambitious, but arrogant. The notion that the population as a whole is buying tailscale because it might offer some as-yet unpublished capabilities at some non-determinant point in the future... is delusional. And tailscale's moat is very shallow - yes, there's some nifty networking stuff going on, but it's well understood and the functionality will be replicated by competitors as tailscale gains mainstream traction, however big their warchest is.
rldjbpin 2y ago
"layers" have been a major motif of the write up. > We’re removing layers, and layers, and layers of complexity, and making it easier to work on what you wanted to work on in the first place. as an avid user, i'd say they are in fact adding more layers to the problem. it is well-designed and relatively accessible, sure, but it represents a stop-gap solution while everyone eventually pushes to the eventual solution. it has always been the double-edged nature of abstraction. we give trust and responsibility to another party while for us networking works out "magically". but the moment your remote client has some auth issues, you snap back to reality. besides bandwidth costs, it seems that their otherwise generous pricing model is economically viable in post-ai landscape. i'd personally like to act like a "landowner" of the internet, but currently being a rentor seems like a good idea while we all wait for social housing to finally get accepted.
sarmudi08 2y ago
[flagged]
aborsy 2y ago
I used to use Wireguard. It connects a peer to a peer, but stops there. I have since replaced it with Tailscale. It goes much beyond Wireguard, and connects everything to everything. A lot of my networking problems went away. After using Taildrop for several months, I feel the post is right about it. It’s a frictionless one click peer to peer file transfer tool that is very useful. It should have been built into the internet. The idea of entirely decentralized internet is wishful thinking. You always need servers. Even with IP6, you have to run a STUN or DDNS server, since ip addresses change. Do you want to run them at home? I don’t. I do think Tailscale is on path to different networking.
olsbkj 2y ago
[dead]

The New Internet

517 points by ingve 2y ago

locusofself 2y ago

I'm distracted by all the references to being "old" because the author remembers the 1990s.

duggan 2y ago
Life moves pretty fast. I wouldn’t be too surprised if the median age of Tailscale’s audience was 24.
- heraldgeezer 2y ago
  People born in 2000 use this? What is it? Can we call things for what they are? Is this a VPN? :) Im tired and I am 34. So tired.
RadiozRadioz 2y ago
Seeing the average age range of people who put "founder" on their LinkedIn, I'm not very surprised.

indigodaddy 2y ago

So the answer to the bad old internet is to install tailscale on everything?

sneilan1 2y ago
I think the message from this post is we’ll pay rent to Tailscale instead of AWS eventually.

zokier 2y ago

Of course these ideas are not that new. IPv6 was supposed to give end-to-end connectivity to all, and originally IPsec was supposed to be mandatory part of IPv6, giving each internet host cryptographic identity. And so on.

Fnoord 2y ago
I was curious why the article didn't mention IPv6 at all, since Tailscale does support it. IPv6 -together with WireGuard- gives privacy, security, and performance. The downside is the complexity to set it up. Tailscale builds on the shoulder of giants. IPv4, WireGuard, Samy Kamkar NAT punching, OpenSSH, and probably many more. One of the upsides is the combination of these, and that the management interface in general is easy. But what counts for CA is also true for Tailscale: both are using FOSS to in the end deliver a (proprietary) service. But because almost everything is build on top of FOSS and there's Headscale (and they're cool with it), this isn't a major issue to me. Like, it is a downside, but not a major one, as vendor lock-in is practically non-existent. In fact, it is likely an upside from a business/support PoV.
- wmf 2y ago
  Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.
  - Bluecobra 2y ago
    There are some very valid points here though: https://apenwarr.ca/log/20170810 https://apenwarr.ca/log/20170810
    - deleted 2y ago
      [deleted]
    - throw0101d 2y ago
      Here is a list of of proposals for what could have replaced IPv4: * https://www.rfc-editor.org/rfc/rfc1454.html https://www.rfc-editor.org/rfc/rfc1454.html Here are the technical criteria for choosing the (then-labelled) IPng: * https://datatracker.ietf.org/doc/html/rfc1726 https://datatracker.ietf.org/doc/html/rfc1726 And finally the evaluation of the available candidates and why the winner was chosen: * https://datatracker.ietf.org/doc/html/rfc1752 https://datatracker.ietf.org/doc/html/rfc1752 If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions. > There's one thing I forgot to mention in that big long story above: somewhere in that whole chain of events, we completely stopped using bus networks. Ethernet is not actually a bus anymore. It just pretends to be a bus. Basically, we couldn't get ethernet's famous CSMA/CD to keep working as speeds increased, so we went back to the good old star topology. Except for 802.11 Wifi.

metadat 2y ago

I really enjoy and appreciate the tailscale service, but this article didn't click for me. I love an inspiring CEO rally speech as much as the next early adopter, and agree that there is a ridiculous amount of developer friction and complexity in computing, but tailscale still has its own friction and isn't on track to solve the big picture issues _at all_. As a concrete example, a few weeks ago, I invited my dad to my tailnet with the intent of using remote desktop into his machine to help him fix something. He accepted the invite, and then I couldn't ping his machine despite it appearing in my TS domain web interface. Now he hates tailscale, and I lost credibility because prior I told him how awesome it is. In his view, it wasted his time and doesn't "work right", and metadat is a fool.

Cyphus 2y ago
Is your dad running Windows? Windows firewall is known to block icmp traffic, a problem that neither Tailscale nor any other p2p VPN can solve.
- metadat 2y ago
  Maybe, but even ICMP pings? He also couldn't ping my systems, it seemed really broken.
  - eddythompson80 2y ago
    Ping uses ICMP. Windows blocks ICMP by default, so yes `ping <windows-host>` doesn't work by default. Is your system your father was trying to ping a Windows system as well? The other thing to check is if he was running another VPN on his machine at the same time. Running multiple VPNs at the same time (both Windows and Linux) requires extra fiddling to map the routing correctly to prevent their rules from overlapping/breaking each. https://tailscale.com/kb/1105/other-vpns https://tailscale.com/kb/1105/other-vpns
    - metadat 2y ago
      No other VPN, but my windows machine firewall is on and it pings fine. Anyway, tailscale still has more to go. Inviting someone to your tailnet doesn't seem to be the same as adding a machine yourself.

0x0000000 2y ago

The new internet, an overlay network on top of the existing internet. Cool?

wmf 2y ago
It seems less bad than the competing vision of tunneling absolutely everything over HTTPS.
- oneplane 2y ago
  At least it's not a network that revolves around middle-out compression.
fuzzfactor 2y ago
What's really needed along those lines is a regular ordinary Mbone that's permanent this time: https://en.wikipedia.org/wiki/Mbone https://en.wikipedia.org/wiki/Mbone

imiric 2y ago

I like Tailscale, but this reads as too self-aggrandizing. You have a mesh VPN product with some value-added services on top of it. That's great, but this idea isn't novel or unique. Why should your solution be the "new internet" instead of any of the alternatives? I wouldn't want to rely on a single company for all my internet infrastructure, anyway. So I'll stick with the traditional internet with all its complexity. Its major problems aren't technical but social, and no new technology will solve those.

eddythompson80 2y ago
> Its major problems aren't technical but social, and no new technology will solve those. Really? Isn't the major problem of the current internet is inherent centralization of services because the initial promise of 100% decentralized network is simply too complex to realistically manage? I view that problem as deeply technical. Unless if by "social" you simply mean everyone should become an experienced sysadmin. (or the slight variation of, everyone should know an experienced sysadmin who's willing to run their application for them for free) Take something as mainstream as social media. Imagine a world where Facebook/Twitter/TikTok/YouTube/Reddit/HN/etc worked (seamlessly) like bittorrent. An application on your machine when you run it, it joins a "Facebook" network where your friends see you online through their instance of the application. Your feed/wall/etc is served to them directly from your machine. All your communication with them is handled directly between the 2 (or 1000 or millions) of you. No centralized server needed. You can easily extend and apply this majority of centralized application today. The only ones I can think of where this wouldn't work would be inherently centralized services like banking for example. There are already plenty of p2p networks that show that this is a viable solution. Bittorrent, soulseek, bitcoin, etc. All the problems you will run into however to make this as seamless as just connecting to facebook.com are purely technical. The initial big hurdle is seamless p2p connectivity. That is without port forwarding, dynamic dns, and requiring advanced networking, security, and other sysadmin knowledge from every user. Next would be problems like what happens when the node is offline? What happens to latency and load if you need to connect to thousands, hundreds of thousands, or millions of machines just to pull a "feed"? How is caching handled? How are updates/notifications pushed? How do nodes communicate when they are wildly out of date? Where is your data stored? How do you handle discoverability, security, etc. All deeply technical problems. Most are solvable, but you're gonna have to invest a significant amount of effort to solve them one by one to reach the same brain-dead simple experience as a centralized service. The fediverse has been trying to solve just a small subset of these problems for over a decade now, and the solutions still require a highly capable sysadmin to give users a similar (or only slightly worse) experience than twitter.com.

figassis 2y ago

I love Tailscale, but this post gives me the creeps. The internet succeeded because it was built on standards and was completely free. With Tailscale, I get wireguard is open source and we have things like Headscale. But the whole everyone gets an IP, doesn’t it depend on Tailscale owning a massive ip address space? We can all wait until full ipv6 rollout, or we can depend on centralized ipv4, and servers and proprietary stuff. Maybe a bit hypocritical?

yegle 2y ago
100.64.0.0/10 is a reserved IP block for carrier-grade NAT.
- metadat 2y ago
  More info about Carrier-Grade NAT (for others who, like me, are only encountering this term for the time): https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT Can anyone elighten me regarding what is different or special about 100.64.0.0/10 vs say, 192.168.0.0 or 10.0.0.0. Edit: Answered my own question by digging into more wikis, there is a helpful table of reservations and intentions here: https://en.wikipedia.org/wiki/Reserved_IP_addresses https://en.wikipedia.org/wiki/Reserved_IP_addresses
  - throw0101d 2y ago
    > Can anyone elighten me regarding what is different or special about 100.64.0.0/10 vs say, 192.168.0.0 or 10.0.0.0. A bit of context: if an ISP cannot get enough IPv4 addresses for the WAN-side of people's home routers, some problems exist: * something in 192.168/16 is generally used for the LAN-side of people's home routers, so that cannot be used on the WAN side * 10/8 is used for business/enterprise corporate networks, so it also cannot be used on the WAN side because if people VPN connect to the corporate, then the router may get confused * similarly for 172.12/12: often used for corporate networks So the IETF/IANA set aside 100.64.0.0/10 as it had no 'legacy' of use anywhere else, and is specifically called out to only be used for ISPs for CG-NAT purposes. This way its routing does not clash with any other use (home or corporate/business). IPv4 address space is nearly exhausted. However, ISPs must continue to support IPv4 growth until IPv6 is fully deployed. To that end, many ISPs will deploy a Carrier-Grade NAT (CGN) device, such as that described in [RFC6264]. Because CGNs are used on networks where public address space is expected, and currently available private address space causes operational issues when used in this context, ISPs require a new IPv4 /10 address block. This address block will be called the "Shared Address Space" and will be used to number the interfaces that connect CGN devices to Customer Premises Equipment (CPE). * https://www.rfc-editor.org/rfc/rfc6598.html https://www.rfc-editor.org/rfc/rfc6598.html

sweca 2y ago

Even though I don't agree with the whole "New Internet" thing, this article is very well written.

sneilan1 2y ago
I agree. This is article reads well. It has flow, good punctuation and pacing. Apart from the message that we will eventually pay Tithe to our new overlord tailscale, it was great.
- Spivak 2y ago
  I mean it was given as an internal presentation about the business strategy, it's the kind of thing I would expect. 1. We took a hard-problem, peer-to-peer networking and IdM, and (mostly) solved it. 2. We're hoping this will drive people to build apps that leverage the unique capabilities of authenticated p2p mesh networks. It doesn't even have to be specifically for Tailscale. 3. People will want to use those apps and (if we're good at our jobs) choose to pay us to run the network for them over our competitors or building something in-house. 4. $$$ I'm not sure I would say this is as nefarious as the tone of the comments here suggest. Wanting a "killer app" for your software platform is pretty normal which is really what he's talking about. I would be nervous declaring victory or an inevitability without being to name what that killer app actually is but trying to figure it out/build it is a good strategy. It's one of those times where the desire for engineers to solve their pet-problems, play with shiny new toys, and build Halo LAN Party over Tailscale is aligned with the business.

nomoreusernames 2y ago

the new internet? i'm still on BBS. dont wanna use computers without ansi art.

jclulow 2y ago

An incredibly long ramp up to complaining about centralised control by rent seekers (a very reasonable complaint!) which gets bogged down in some ostensibly unrelated shade about whether client-server computing makes sense (it does) or is itself somehow responsible for the rent seeking (it isn't; you can seek rent on proprietary peer to peer systems as well!) to then arrive at: > There’s going to be a new world of haves and have-nots. Where in 1970 you had or didn’t have a mainframe, and in 1995 you had or didn’t have the Internet, and today you have or don’t have a TLS cert, tomorrow you’ll have or not have Tailscale. And if you don’t, you won’t be able to run apps that only work in a post-Tailscale world. The king is dead, long live the king!

mystified5016 2y ago
Rent seekers are bad! Don't you all hate landlords?! Now let me tell you why you should pay rent to me as well as everyone you currently pay rent to!
ssss11 2y ago
Lol. The tailscale CEO is preaching “tomorrow you’ll have or not have Tailscale. And if you don’t, you won’t be able to run apps that only work in a post-Tailscale world.”?? That won’t go down well in 10 years if they don’t become Microsoft-scale juggernauts.
- IAmNotACellist 2y ago
  Or they'll just get bought by Microsoft, Amazon, or Cloudflare and that'll be that I like Tailscale just because it's OpenVPN without the unbearable agony of setting it up so it actually works
- 01HNNWZ0MV43FF 2y ago
  Yeah it's a weird flex. I'd use Tailscale today if it was open all the way up and down. If not, why bother? TLS and http don't charge licensing fees...
  - p_l 2y ago

sfRattan 2y ago

As I've been deliberately moving toward self-hosted computing, under my control, on my home network, I've had a feeling more and more that we're on the cusp of something transformative... For those who want it and those who care. There's an ecosystem of mostly FOSS software now designed to run on a home network and replace big, centralized, cloud providers. That software is right on the edge of being easy enough for everyone to use and for sufficient numbers of people to deploy and administer. News like Immich (to replace Google Photos) getting a major investment thanks to Louis Rossman and FUTO [1] is encouraging. The ecosystem of software you can now run on a commodity built NAS or homelab is, for me, the most exciting thing in computing since I first used the Internet in the late 90s. The rollout and transformation, if it happens, won't look like all this stuff becoming so easy that every individual can run a server. But it is possible that every extended family will have at least one member who can run a server or administer a private network for the whole clan. And that's where tech like tailscale's offering will come in. That's where I see the author's vision being a believable moonshot: Each extended family, and some small communities, with their own little interconnected, distributed network-citadels, behind the firewalls of which they do their computing, their sharing, and their work. Most family members won't need to understand it any more than they understand the centralized clouds they use now. And most networks won't be as well secured as a massive company can make its cloud offering, but a patchwork heterogeneity of network-citadels creates its own sort of security, and significantly lowers the value of any one "citadel" to even motivated adversaries. [1]: https://www.youtube.com/watch?v=uyTPqxgqgjU https://www.youtube.com/watch?v=uyTPqxgqgjU

Bluecobra 2y ago
> As I've been deliberately moving toward self-hosted computing, under my control, on my home network Funnily enough, I was once like this but now I have deliberately moved everything to the big cloud providers as I don’t want to deal with the toil of running my own homelab anymore. This is coming from someone who used to have a FreeBSD server with ZFS disks and using jails to run various things like pf, samba, etc. Eventually things would fail and it felt like I was back at work again when all I want to do is drink a cold beer and watch YouTube. Perhaps I will try again one day as things get easier. For now I am content with having my photos and videos automatically synced up to iCloud/Google Photos.

OJFord 2y ago

This is a 'gimme some of that Wix money', IPO/acq ramp-up post right?

OneOffAsk 2y ago

> In fact, we didn’t found Tailscale to be a networking company. Networking didn’t come into it much at all at first. I always just assumed they were building some kind of logging software (“tail”scale), used Wireguard to connect hosts, and just kind of stopped there. Don’t get me wrong, Tailscale is a nice way to connect machines. It’s nice because Wireguard is nice.

justinsaccount 2y ago
https://apenwarr.ca/log/20190216 https://apenwarr.ca/log/20190216
- svnt 2y ago
  This long blog post (by the now-CEO of Tailscale), if you skip to the end, describes that parent’s hypothesis is basically exactly correct. > Update 2019-04-26: Based on a lot of positive feedback from people who read this blog post, I ended up starting a company that might be able to help you with your logs problems. We're building pipelines that are very similar to what's described here. Update 2020-08-26: Aha! Okay, for some reason this article is trending again, and I'd better provide an update on my update. We did implement parts of this design for use in our core product, which is now quite distinct from logs processing. After investigating the "logs" market last year, we decided not to commercialize a logs processing service. The reason is that the characteristics we want our design to have: cheap, lightweight, simple, fast, and reliable - are all things you would expect from the low-cost provider in a market. The "logs processing" space is crowded with a lot of premium products that are fancy, feature-filled, etc, and reliable too, and thus able to charge a lot of money. Instead, we built a minimalistic version of the above design for our internal use, collecting distributed telemetry about Tailscale connection success rates to help debug the network. Big companies can also use it to feed into their IDS and SIEM systems. We considered open sourcing the logs services we built (since open source is where attributes like cheap, lightweight, etc tend to flourish) but we can't afford the support overhead right now for a product that is at best tangential to our main focus. Sorry! Hopefully someday.
kiitos 2y ago
Wireguard by itself is good, but it isn't nice. Tailscale is nice because it builds on top of Wireguard (which is good) and adds UX stuff (which makes it nice). Nice requires humane UX.

ZoomZoomZoom 2y ago

Isn't yggdrasil[1] supposed to be the New Internet? If not, why Tailscale specifically, and not Netbird, Nebula, Netmaker or some other competitor? The article is indeed very well written, but gives the wrong vibes, like something's coming: acquisition, pivot, split, shutting down, etc. Also, "we're re just getting started", the famous last words. Just to balance my healthy mistrust, I'd like to add that I'm a satisfied Tailscale user, mostly impressed with how little it requires of me to just work. [1] https://yggdrasil-network.github.io https://yggdrasil-network.github.io

tionis 2y ago
Yggdrasil would indeed better fit the description. It should however be noted, that, while it does work great, is still a research project.

Aeolun 2y ago

I really liked the premise of the post until I got to the last paragraph and had to do a quick double take. Sure Tailscale makes the internet easier again, but I still have to rely on a landlord. Something I didn’t/don’t have to for the internet. As much as a lot of stuff has been centralized, even today I can connect to any server in the world with just the link.

paulnpace 2y ago
> I really liked the premise of the post until I got to the last paragraph and had to do a quick double take. "Be sure to drink your Ovaltine."
jmprspret 2y ago
> I still have to rely on a landlord. This is a very good point. Counterpoint is self-hosting Headscale which I mentioned in another comment here: https://github.com/juanfont/headscale https://github.com/juanfont/headscale Works with native Tailscale clients with a few config changes. I use it myself.

Bluecobra 2y ago

> Every device gets an IP address and a DNS name and end-to-end encryption and an identity, and safely bypasses firewalls. Tailscale can certainly be blocked on NGFW firewalls like Palo Alto. I am not a BOFH, but also can’t have random employees circumventing security policies by setting up tailscale and leaving permanent backdoors in my corporate network. I remember the good old days when everyone had a public IP on the Internet and how easy it was to setup things. It was cool and fun while it lasted. But now things are different and security is a nightmare when we have to deal with things like ransomware.

iczero 2y ago
Tailscale doesn't even try to hide their MP or DP traffic. Last I checked, management was plain https and data was plain wireguard.
vwkd 2y ago
> can’t have random employees circumventing security policies by setting up tailscale and leaving permanent backdoors in my corporate network Tailscale isn't exactly an open door. Only machines signed-in via SSO can access a Tailscale network. If you don't trust your employees to safeguard their credentials and machines then how do you trust them at all? Keep them in an airtight underground bunker chained to their desks? Not sure what threat you're modeling for...
- Bluecobra 2y ago
  I'm talking about people who want to use Tailscale for personal reasons. For example someone can setup a Tailscale instance between their work computer and home computer and circumvent the corporate VPN/MFA policies for remote access. I doubt they being malicious but what if their home PC gets hit with malware? A threat actor could then use the existing Tailscale instance to get into the corporate network.

iczero 2y ago

> centralization is bad except when we do it TL;DR

teddyh 2y ago

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem. What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC. But Tailscale has every incentive to prevent such things to be widely and compatibly implemented, because it would destroy their business. Their whole business depends on the problem persisting. (Repost of <https://news.ycombinator.com/item?id=38570370 https://news.ycombinator.com/item?id=38570370>)

whoistraitor 2y ago
Ie. A form of perverse incentive or the cobra effect. Endemic to capitalism, especially in infrastructure.
DyslexicAtheist 2y ago
I never thought of this. Forces me to rethink every negative post people made against DNSSEC which shaped my opinion. I still think that IPv6 and DNSSEC do more harm in practice than what they solve. Maybe the SCW podcast can do a deepdive on this together with somebody who is militantly-pro DNSSEC. <3 ... edit: maybe even invite 2 or 3 DNSSEC advocates @tptacek :)
- teddyh 2y ago
  Regarding DNSSEC: • Blog post: <https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...> • As a podcast episode: <https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-for-and-against/ https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-fo...>
- tptacek 2y ago
  I don't think the analysis upthread should make you rethink DNSSEC, since it, too, is a centralized system; rather than being controlled by Avery Pennarun (you could do worse), it's controlled by an unholy alliance of world governments and companies like Verisign. If we could find a credible DNSSEC advocate (for our audience; that is: a cryptography engineer, vulnerability researcher, or an engineering leader at a major firm), we would absolutely invite them on. 'teddyh below gave you links to two pro-DNSSEC resources; fun note: the latter source (Geoff Huston, one of the world's more respected networking researchers) has since then written this: https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/ https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/.

howis 2y ago

How is having a TLS cert considered to currently be a “have”? Seems like a deployment issue for your colo and edge presence (for those eschewing AWS).

ivlad 2y ago

IPv6 + transport mode IPsec + opportunistic encryption with TOFU or other topologies of trust (including WoT, DNSSEC and PKI). All that is standard, most of it is available and only requires configuration (and, ideally, being turned on by default). There is very little use for companies like Tailscale in this setup, it’s scalable and works.

wmf 2y ago
Gets killed by IPv6 firewalls.

udev4096 2y ago

> You know what, nobody ever got fired for buying AWS. > That’s an IBM analogy. Wow, this dialogue comes in the first episode of halt and catch fire. I didn't know this was a real thing Here's the clip at 1.51 minutes, if anyone's interested: https://www.youtube.com/watch?v=XOR8mk0tLpc https://www.youtube.com/watch?v=XOR8mk0tLpc

EVa5I7bHFq9mnYK 2y ago

That looks like Hamachi of 20 years ago.

sulandor 2y ago
nordvpn is the new frosties tony

throw782349872 2y ago

I've been an active Tailscale user for years now, preaching the Gospel of Wireguard Control Planes to all who will listen (and many who won't) in both my personal and professional life. It's been really disheartening to watch the steady enshittification of Tailscale, Inc. I knew it was coming with 100% certainty once they raised 100mil in 2022. It's still heartbreaking because the product itself is quite good. The worst part is because Tailscale, Inc got there "first" (I know nebula existed before Tailscale did. shut up, okay?) and now the other competitors like NetMaker, NetBird, are all following almost the exact same business model ("open core+" - open source client and some kind of claim to an open source control plane with infinity caveats to funnel enterprise dollarydoos back to the vulture capitalists)

sulandor 2y ago
thanks for your insights. > The worst part is because Tailscale, Inc got there "first" never heard of nebula but please clarify where they got first. i'm sure you are aware that branded/purposebuilt vpn's existed long before the first iphone.
kiitos 2y ago
not sure what you mean by "enshittification" are you describing the process of a company achieving commercial success?

iovoid 2y ago

I think the author misdiagnoses the problem, and the proposed solution simply hides the centralization instead of removing it. The reason AWS is expensive is not because of IPv4, or the datacenters. It's mostly in their software/managed offerings, and the ability to quickly add more servers. If you are a "serious company" and you don't want to pay AWS or a similar company, renting a rack and colocating your own servers (either within your premises or in a datacenter) is doable and done by lots of companies. I disagree that certificates have caused centralization, and they're not something separating the haves and have-nots and are in no way comparable to having or not a mainframe. HTTPS becoming pseudo-mandatory didn't push people into having their own (sub)domains, which is nowadays the only requirement to obtain a certificate. It already happened out of convenience. The other point of centralization mentioned is DNS, which tailscale doesn't avoid at all. MagicDNS still relies on the ICANN root, as does the tailscale control plane. And if all you wanted was a free subdomain, there are plenty of people offering that. If you are behind CGNAT, tailnets aren't particularly less centralized, as traffic has to flow through the DERP servers. I doubt tailscale can keep providing these free of charge when the volume is in the tbps instead of the gbps. I agree that tailscale (and similar solutions) help in the last remaining case, which is accessing your computer that is behind a NAT. I even think they could reach the dozens of millions of users. This is, in my opinion, not enough to claim the title of "the new internet".

j2kun 2y ago
This rests on the incorrect assumption, pointed out in the post, that most applications need the kind of scale that warrants quickly scaling to more servers.
- mrkeen 2y ago
  The article tried to make k8s all about scale, when that's not the whole story. On other socials, a screenshot of the 'Not scaling' section is getting responses of "Those idiot developers think they need k8s scaling for their 1 req/s sites, ha ha." The author brags about being able to (skip testing, CI/CD pipelines and just) edit their perl scripts (in prod,) really quickly. What uptime is associated with that practice? As many 9's as it takes for Brad to debug his perl program in prod? This approach doesn't even scale to 2 developers unless they're sitting in the same room. DevOps isn't a machine where you put unnecessary complexity in one end and get req/s out the other end. It's about risk and managing deployments better. If I really wanted to engineer for req/s, I'd look at moving off k8s and onto bare metal.

k_bx 2y ago

I'm one of the people who actually use Tailscale for production systems where there are servers physically close to me, or at some other controlled locations, and then there are hundreds of users hundreds kilometers away, all working via Tailscale. I should say two things. Tailscale is amazing and I love it. The system could not exist without it, or I'd have to have at least ten more people in my team to manage all this 24/7. It's working, and it's good enough. That being said, you do need to lower your expectations: it's not as good as "the internet". The latency spikes periodically, the connection drops sometimes, the MagicDNS just magically stops working or interferes with the system. Since we have many users, we've encountered every possible problem one can encounter, and then there's still something new you'll see tomorrow. In any case, we believe in Tailscale and its vision, it's a categorically new approach that simultaneously gives you the control on hardware, reduces the cost, and improves the security. Our first big production server was a 4-core Linux Laptop! We love Tailscale and we wish the product prosperous life and development. Thank you TEAM TAILSCALE!

aquariusDue 2y ago
Would you mind going into more detail about the 4-core Linux Laptop as a production server via Tailscale, please? I too use Tailscale and love it for self-hosting internal stuff but I never thought about using it for public facing production stuff. Now I'm really curious to hear more about your setup (if you're willing to share of course).
- phantompeace 2y ago
  Not the person you’ve asked but I regularly use it for backends for projects. Connect your database machine to your Tailscale network and have your code talk over the Tailscale IP to connect to it. I’ve served multiple Flask frontends that have talked to backends this way - works great! I use various cloud VMs to host the frontend, and they all talk to an Optiplex Micro box under my desk for their backends.
  - k_bx 2y ago
    This, plus you get free domain name with HTTPS cert working.

kkfx 2y ago

Ehm, sorry no. OSes matter much as before because even if today giants want to call desktop and co "just endpoints" a politically correct variant of old dumb terminals of "their mainframes", actually we know very well that "the intelligence" must be in "endpoints" and no "mainframe alike" modern solution can scale or serve well in that regards. Of course we need networking, a network of individual hosts, not of dumb endpoints. Devs have lost such knowledge because big tech have trained them to loose it and now we see more and more limits of their model. The new internet must be the very old one, a network of hosts communicating each others, without *NAT and alike in the middle explicitly done in most case to lock users hosts behind some giant iron curtain. The modern web today matter because we lack UIs because commercial desktops have decided for widgets based UIs and have strongly hit their limits, finding in the modern web a crappy modern version of the old classic DocUIs and we know as well we need DocUIs. Slowly we start coming back to the end-users programming admitting that visual crap and all tentative to make programming hard on purpose led to unsustainable crapware ecosystems. Maybe in a decade spreadsheets and "calculators" will be finally dropped and Jupyter/R alike tools will have finally substituted them eventually with some LLM plugged in to help the dumb mean users. In another decade we probably will be back at LispM because try other paths to profit from users is not sustainable anymore. The shortest this period will be the less damage we will suffer.

oefrha 2y ago

I’m confused by this New Internet talk. Tailscale is nice and all, but it gives you virtual private networks. To talk to anything you need to first be invited to that private network. It’s more like the New LAN, great for intranet and shit. But how am I supposed to build Internet apps intended for everyone if they need to be invited to my network first? Not to mention most Internet services do need a central backend to function even if there are no barriers among clients at all (because the clients are completely unreliable), including even the textbook p2p example of file transfer: while direct p2p is nice in many cases, with a central service the recipient can receive at any time, instead of having to coordinate with the sender to both stay online simultaneously and for the duration of the transfer, which is quite difficult nowadays with most of the computing happening on phones.

wmf 2y ago
Maybe there will eventually be an Intertailnet that connects all the tailnets together (in some secure, opt-in way of course).

lockywolf 2y ago

My ISP deployed ipv6 via serving ULAs to clients behind the ISP box, and doing a NAT to a single dynamic public IP. Another one just blocks all incoming connections on ipv6 entirely.

dakiol 2y ago

One thing I don’t understand. The article claims that we need to pay rent to big corps like AWS, which is true only if you’re offering something on the internet (e.g., you have a saas). As a consumer I don’t pay to AWS, I only pay to my isp. Now, the article wants everyone (the ones who have something to offer, and the consumers) to switch to this new internet… so both producers and consumers (peers now) need to pay rent to tailscale (unless you selfhost, but selfhosting is like the first story tell tell in the article about asking your isp for a static ip address, opening ports and the like; self hosting is too much work). Smells like more centralisation, not less.

vwkd 2y ago
As a buyer you also don't pay VAT to the government. You pay the seller a price that's marked up exactly by VAT, which the seller then pays to the government. In summary, if you don't pay it directly doesn't mean you don't pay it indirectly.

rubi1945 2y ago

> I read a post recently where someone bragged about using Kubernetes to scale all the way up to 500,000 page views per month. But that’s 0.2 requests per second. I could serve that from my phone, on battery power, and it would spend most of its time asleep. lmao

jpeeler 2y ago

Did anyone else immediately do the calculation of 8.1 billion (world population 2024) * 1/20000 = 405k user base? Which makes me wonder what percentage are paying users.

jonathanlydall 2y ago

Speaking of Tailscale, does anyone know on Windows how to prevent it significantly slowing down file transfers between peer computers on my home LAN? I don't really understand it, I can use the direct IP address of the other machine and I can still see tailscaled.exe using a lot of CPU and my file transfer being only 65MB/s. If I right click the system tray icon and exit from Tailscale, the transfer speed instantly jumps to 109MB/s (which is the maximum my Gb/s LAN).

jonathanlydall 2y ago
Looks like it's due to this: https://github.com/tailscale/tailscale/issues/6999#issuecomment-1829594060 https://github.com/tailscale/tailscale/issues/6999#issuecomm...

idunnoman1222 2y ago

Ipv6 is for poor people, until the poors figure out something really cool you can do with it the rich will never switch

sulandor 2y ago
imho at this point it's a generational thing. there's just no love in v6, so it'll take over once the old guard go out of office and nobody cares enough anymore.

sidcool 2y ago

I love this blog post. It resonates so much. But I honestly don't know how to deploy applications efficiently without containerization. And where there's containers there's kubernetes. So on and so forth

Ericson2314 2y ago

When is the government going to start requiring IPv6 more aggressively? It's that simple.

signal_space 2y ago

Any one play with https://github.com/slackhq/nebula https://github.com/slackhq/nebula

thr0w 2y ago

> Sure, Apple’s there selling popular laptops, but you could buy a different laptop or a different phone. > But the liberation didn’t last long. If you deploy software, you probably pay rent to AWS. There's no Azure? GCP? Hetzner? Digital Ocean? > You pay exorbitant rents to cloud providers for their computing power because your own computer isn’t in the right place to be a decent server. You do that because you don't know what port-forwarding is (vast majority of software people do not), or you don't have the place or infra in your dwelling to stash a laptop server running 24/7 without interruption.

literallyroy 2y ago
You probably also have a residential IP and need to pay some service (Ngrok?) to convert that into a static address that’s useful right?

buro9 2y ago

I love this. Except to use tailscale you do need to bring in a while OIDC authentication provider. It's all small and aimed at avoiding scale until the very first step, when suddenly only the big complex thing is acceptable. I still just want to just use my email and a top. The only one of the auth providers tailscale supports that I have is GitHub, but I don't use GitHub as beyond work as I self host my git. When the onboarding is "maintain and run a full oidc provider", all we've done is trade one aspect of complexity for another.

littlecranky67 2y ago

Tailscale complaining about centralized actors controling the internet, yet not allowing to sign up for Tailscale with your email but strictly requiring to use a Microsoft/Meta/Google account. Cant make this up.

SparkyMcUnicorn 2y ago
You can use just about any OIDC. Some of the self-hosted options presented during sign up include Keycloak, Ory, Gitea, Zitadel, Authelia, and more. There's also a workaround to create a passkey account by signing up with any SSO provider, inviting yourself as an external user, accepting that invite and sining in with a passkey, then leave the original SSO network. Then you're not tied to any external service at all.
- littlecranky67 2y ago
  Or, wild idea, just allow email signups like everyone else.
  - SparkyMcUnicorn 2y ago
    Agree or disagree, a tailscale co-founder responded as to why they went this path. https://news.ycombinator.com/item?id=22760130 https://news.ycombinator.com/item?id=22760130 > (I'm a Tailscale co-founder) The idea is to avoid building yet another commercial service that holds onto your username and password. People have enough identities already. More details here: https://tailscale.com/blog/how-tailscale-works/ https://tailscale.com/blog/how-tailscale-works/ We know we keep getting feedback that people want a different way to authorize their accounts (especially for personal use), so we're looking at other options. We just really want to stay out of the username+password business; it's simply bad security practice.

pomatic 2y ago

I'll preface this by saying: I DO appreciate tailscale and what they've done for frictionless VPNs; I use it daily. But this post has a really unfortunate tone, it comes across as really arrogant. Not ambitious, but arrogant. The notion that the population as a whole is buying tailscale because it might offer some as-yet unpublished capabilities at some non-determinant point in the future... is delusional. And tailscale's moat is very shallow - yes, there's some nifty networking stuff going on, but it's well understood and the functionality will be replicated by competitors as tailscale gains mainstream traction, however big their warchest is.

rldjbpin 2y ago

"layers" have been a major motif of the write up. > We’re removing layers, and layers, and layers of complexity, and making it easier to work on what you wanted to work on in the first place. as an avid user, i'd say they are in fact adding more layers to the problem. it is well-designed and relatively accessible, sure, but it represents a stop-gap solution while everyone eventually pushes to the eventual solution. it has always been the double-edged nature of abstraction. we give trust and responsibility to another party while for us networking works out "magically". but the moment your remote client has some auth issues, you snap back to reality. besides bandwidth costs, it seems that their otherwise generous pricing model is economically viable in post-ai landscape. i'd personally like to act like a "landowner" of the internet, but currently being a rentor seems like a good idea while we all wait for social housing to finally get accepted.

sarmudi08 2y ago

[flagged]

aborsy 2y ago

I used to use Wireguard. It connects a peer to a peer, but stops there. I have since replaced it with Tailscale. It goes much beyond Wireguard, and connects everything to everything. A lot of my networking problems went away. After using Taildrop for several months, I feel the post is right about it. It’s a frictionless one click peer to peer file transfer tool that is very useful. It should have been built into the internet. The idea of entirely decentralized internet is wishful thinking. You always need servers. Even with IP6, you have to run a STUN or DDNS server, since ip addresses change. Do you want to run them at home? I don’t. I do think Tailscale is on path to different networking.

olsbkj 2y ago

[dead]