7 ms·

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet

by teddyh 2y ago

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem. What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC. But Tailscale has every incentive to prevent such things to be widely and compatibly implemented, because it would destroy their business. Their whole business depends on the problem persisting. (Repost of <https://news.ycombinator.com/item?id=38570370 https://news.ycombinator.com/item?id=38570370>)

whoistraitor 2y ago
Ie. A form of perverse incentive or the cobra effect. Endemic to capitalism, especially in infrastructure.
DyslexicAtheist 2y ago
I never thought of this. Forces me to rethink every negative post people made against DNSSEC which shaped my opinion. I still think that IPv6 and DNSSEC do more harm in practice than what they solve. Maybe the SCW podcast can do a deepdive on this together with somebody who is militantly-pro DNSSEC. <3 ... edit: maybe even invite 2 or 3 DNSSEC advocates @tptacek :)
- teddyh 2y ago
  Regarding DNSSEC: • Blog post: <https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...> • As a podcast episode: <https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-for-and-against/ https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-fo...>
- tptacek 2y ago
  I don't think the analysis upthread should make you rethink DNSSEC, since it, too, is a centralized system; rather than being controlled by Avery Pennarun (you could do worse), it's controlled by an unholy alliance of world governments and companies like Verisign. If we could find a credible DNSSEC advocate (for our audience; that is: a cryptography engineer, vulnerability researcher, or an engineering leader at a major firm), we would absolutely invite them on. 'teddyh below gave you links to two pro-DNSSEC resources; fun note: the latter source (Geoff Huston, one of the world's more respected networking researchers) has since then written this: https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/ https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/.
  - DyslexicAtheist 2y ago
    thanks much appreciated to you and teddyh for these links. really needed this opposite views.
  - teddyh 2y ago
    The title of that article which you link to is “Calling time on DNSSEC?”, and Betteridge's law of headlines applies to it. Here’s the final paragraphs from that article: “I guess the question we should be asking is — if we want a secured namespace what aspects should we change about the way DNSSEC is used to make it simpler, faster, and more robust?”
    - tptacek 2y ago
      I'm happy just to see more people reading it. People can make their own call about it.
- jeroenhd 2y ago
  I may be in favour of DNSSEC, but I admit that it's time for a v2 of the RFC that removes the stupid "encryption can't be done at the endpoint" restriction. In practice you can just turn on validation on many computers and gain its benefits, especially if used in the manner as described here where you can just block connections to unprotected hostnames to work around the most glaring issue, but the whole spec is written for a world we've moved beyond. IPv6 doesn't have that problem, though.
  - DyslexicAtheist 2y ago
    thanks!
viraptor 2y ago
Zerotier does kind of that. It's a tunnel, but also the traffic is direct (unless double Nat is involved) and if you could route the traffic directly to the endpoint IPs, you can skip zt. The location service can be self-hosted if you want. You don't have to use them as a service if you don't want to. Apart from dnssec it's pretty much what you're asking for.
- lockywolf 2y ago
  Double NAT is now almost everywhere in the world, except maybe USA.
  - viraptor 2y ago
    What kind of Nat though? You can use upnp, predictable mapping, etc. and still allow the traffic through. And that's only with ipv4, because you can run zerotier over IPv6.
    - throw0101d 2y ago
      > What kind of Nat though? You can use upnp, predictable mapping, etc. and still allow the traffic through. Your computer can talk to your home router (CPE) and punch a hole for a connection, but if your WAN port does not have a public IP address, but rather itself also has a private address (probably 100.64/10), the CPE cannot talk to the ISP's router to punch a hole: * https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT The two layers of NAT (home network (192.168) -> CPE NAT (100.64/10) -> ISP NAT ('real' public IPv4)) prevent hole punching.
      - viraptor 2y ago
        Double Nat on one side is not that universal. Across Europe and Australia I've seen it maybe once on a residential connection. I'm sure it's used, but the comment about the US in the post above just doesn't match my experience.
throwaway211 2y ago
[flagged]
- deleted 2y ago
  [deleted]
- smolder 2y ago
  This is a poor analogy. Historically there is a significant cost to making bad cars with frequent repair needs.
  - sulandor 2y ago
    this is a poor statement. the cost is not in dispute, but the bearer of it. historically car owners need to pay for repairs.
    - smolder 2y ago
      Look at how the early 90s Ford Tempo resale value compared to Toyotas of the era. Trash cars don't keep their value. Toyota could then charge a premium because they were known for quality.
      - throwaway290 2y ago
        is resale value what the manufacturer wants? I mean they want to sell new cars after all...
        throw0101d 2y ago
        > is resale value what the manufacturer wants? I mean they want to sell new cars after all... They have a higher resale value because they have a reputation of lasting a long time, and people are thus perhaps more willing to pay a higher initial purchase price because they know their "investment" will last longer. And while they may not be planing to sell their car after only a few years, knowing that they'll get back more of their "investment" is also probably sitting in the back of their mind ('just in case').
Animats 2y ago
And, worse, incentivized to require users to use a "coordination server" which helps with the NAT and firewall traversal problem by being something you can reach from outbound-only clients. There's a lot of verbiage there, but the general idea seems to be that Tailscale sits at the middle of this as the means by which machines find each other. There are other ways to do that. There are dynamic DNS schemes, so you can give your machine which only has a temporary IP address a permanent name. That's been around for decades, and seems to have a bad reputation. There are schemes with multiple coordination nodes that know about each other, and published lists of such nodes. The list may be out of date, but as long as the published list has one live node, you can connect and get updated. That's how Kademlia, which underlies Etherium's network and some file sharing systems, works. That's about 20 years old, and sort of has a sketchy reputation. It's possible to go only halfway, and separate discovery from transmission. Peertube does that. You find a file to stream via ordinary HTTP to a server you find by ordinary web search means. Anybody can set up such a server. The actual streaming, for files wanted by many clients, is distributed, with people currently watching also sending out blocks to other people watching. This scales well, in case your video goes viral. It's not used much, though. So it's definitely possible to do this without someone in the middle able to cut off your air supply.
- pphysch 2y ago
  How is trusting a dynamic DNS provider different than trusting Tailscale's coordination nodes?
  - Animats 2y ago
    Not everybody has to use the same dynamic DNS provider.
  - transpute 2y ago
    Competition Jurisdiction Resilience Biodiversity
sulandor 2y ago
> The eternal problem with companies like it's not a problem specific to any kind of corporation or corporations per se, but organizations or even broader, solutions. though, do you really think that having a solution to a problem is worse than just having the problem?
- teddyh 2y ago
  It is a problem if a company makes a lot of money ”solving” the problem, but: • This does not really solve the problem, since a real solution would be to change the internet to make the problem go away • A company making a lot of money gets to have an enormous influence on what is considered reasonable to standardize on. See for instance Google’s and Microsoft’s influence on things like the W3C. (Or if Tailscale is allowed to define what ”The New Internet” will be.)
  - sulandor 2y ago
    seems indeed that microsoft is making lots of money by defending the status quo
    - teddyh 2y ago
      All large incumbents defend the status quo, except when advocating for larger barriers to entry for new and smaller competitors.
hnarn 2y ago
This sounds like a reasonable point, but the more I think about it, the more it sounds like digital flagellation. IPv6 was released in 1998. It had been 21 (!) years since the release of IPv6 and still what you're describing had not been implemented when Tailscale was released in 2019. Who was stopping anyone from doing it then, and who is stopping anyone from doing it now? It's easy to paint companies as bad actors, especially since they often are, but Google, Cloudflare and Tailscale all became what they are for a reason: they solved a real problem, so people gave them money, or whatever is money-equivalent, like personal data. If your argument is inverted, it's a kind of inverse accelerationism (decelerationism?) whereby only in making the Internet worse for everyone, the really good solutions can see the light. I don't buy it. Tailscale is not the reason we're not seeing what you're describing, the immense work involved in creating it is why, and it's only when that immense amount of work becomes slightly less immense that any solution at all emerges. Tailscale for example would probably not exist if they had to invent Wireguard, and the fact that Tailscale now exists has led to Headscale existing, creating yet another springboard in a line of springboards to create "something" like what you describe -- for those willing to put in the time.
- deleted 2y ago
  [deleted]
- throw0101d 2y ago
  > Who was stopping anyone from doing it then, and who is stopping anyone from doing it now? The folks who either (a) got in early on the IPv4 address land rush (especially the Western developed countries), or (b) with buckets of money who buy addresses. If you're India, there probably weren't enough IPv4 address in the first place to handle your population, so you're doing IPv6: * https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... Or even if you're in the West, if you're poor (a community Native American ISP): > We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices. * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * Discussion: https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624 IPv4 'wasn't a problem' because the megacorps who generally run things where I'm guessing you're from (the West) were able to solve it in other means… until they can't. T-Mobile US has 120M and a few years ago it turns out that money couldn't solve IPv4-only anymore so they went to IPv6: * https://www.youtube.com/watch?v=QGbxCKAqNUE https://www.youtube.com/watch?v=QGbxCKAqNUE IPv6 is not taking off because IPv4 (and NAT/STUN/TURN) is 'better', but rather because (a) inertial, and (b) it 'works' (with enough kludges thrown at it).
tomjen3 2y ago
I think that is excessively negative take. Tailscales value proposition is also "you can connect to your network wherever you are, safely, and others cannot". That does not go away because of IPsec.
- teddyh 2y ago
  Network- and location-based security is ultimately unworkable. It’s like if you, in order to work, had to go to a ”virtual office” to even send mail to your colleagues. Mail, and related internet-enabled services, should be accessible from anywhere, and be secured at the end points, not at the network layer. (Most attacks are internal, anyway.)
  - tomjen3 2y ago
    Why should you have access to the SSH host for my pie? Or, more to the point, the server that I use to run my RSS feed reader? Or my NAS? Tailscale makes these more secure and more accessible for me. They are never meant to have the world access them. Now for email and a few other things, sure, their nature is that they need to access the world.
    - teddyh 2y ago
      > Why should you have access to the SSH host for my pie? Because that is how the internet is meant to work. It is an end-to-end network. If SSH would not be secure enough to handle this, it would need a secure replacement. > Or my NAS? […] They are never meant to have the world access them. What is a NAS, if not a Network-Attached Storage, i.e. meant to be accessed from the network? The concept of a ”local”, ”secure” network is a dangerous illusion. Embrace ”zero trust” networking.
      - otabdeveloper4 2y ago
        > Because that is how the internet is meant to work. No. The "internet" is literally the "inter-network", a way to connect private networks between each other. The fact that VPN technologies sit behind proprietary corporate intellectual property is not by design, it is a failure of the internet standardization process as it was gamed by corporate interests.
ZhongXina 2y ago
No, we definitely don't want "automatic IPSec" (especially IPSec!), or really any enforced encryption at the network level, even if it's something sane at this moment like WireGuard. Look at old VPN protocols or authentication schemes like RADIUS which have glaring security holes and are impossible to fix because of compatibility issues, and they're running at much smaller scales than the whole internet. Hell, the way the industry is solving TCP ossification problems is by throwing TCP away and reimplementing it on top of UDP, that should tell us something.
- teddyh 2y ago
  Your argument seems to be to never implement anything, because eventually it will become old and it will be hard to move away from it? This seems to be an argument against anything new, and it is therefore hard to take seriously.
  - api 2y ago
    It’s an argument against complexity. IP had amazing longevity because of its simplicity and openness. Even if something is open, complexity is almost like closed as we can see with crazy complicated web standards for which there are few implementations.
  - zbentley 2y ago
    Not GP, but I interpreted it as an argument to innovate/proliferate implementations early and often, but to standardize minimally and as late as possible.
  - snek_case 2y ago
    The argument is more that encryption technologies can become outdated quickly. You also make it harder for small embedded devices to implement network connections if you mandate that all traffic must be encrypted. A simple protocol is more likely to last.
- jeroenhd 2y ago
  IPSec is still widely deployed, securely even. All manual, of course, because it doesn't do the stuff that makes HTTPS easy. IPSec is not always a VPN protocol. L2TP over IPSec is often used as one, but IPSec does little more than encrypt a tunnel between two IP addresses. IPSec in tunnel mode can be a minimal VPN, but it's not used as such as in VPN scenarios without a second packet encapsulation protocol, as it lacks authorization beyond key exchange. As for the risk of ossification: that didn't go away with the current system either. HTTPS over TLS 1.3 looks like a TLS 1.2 session resumption on the wire (in its default configuration) because shitty middleboxes are used often enough that it would impede the protocol. The "let's remake TCP over UDP" approach QUIC takes has very similar origins. UDP is generally allowed by random firewalls over that network, while other (more suited) protocols for this type of stuff like SCTP are not. The operating system doesn't allow opening raw network sockets without high privileges, so adding a new QUIC protocol at the layer of TCP and UDP to implement them at the right spot in the stack wouldn't be usable for many devices. Same is true for the TCP stack you have to use what the OS provides or get higher privileges to do your own; patching the TCP state machine isn't practical. So, if you want to implement a better version of TCP optimised for web browsing and such, you use UDP, because while technically incorrect, it'll work in most cases and has the least restrictions. In the context of the network, IPSec is the new protocol here, not the result of ossification.
spacecadet 2y ago
Companies like you list solve people problems. Their business is about using abstraction to create customer experiences that match the market demand. I want to say that "institutions" solve computer science problems, but it's much more complicated than that.
benreesman 2y ago
So far as I’m aware, TailScale has been at all times a good actor. I have no problem criticizing tech companies, but I try to wait until they behave badly.
- mrmetanoia 2y ago
  Wouldn't the point be they're an indecent, possibly bad, actor by default since they're a business at all rather than just creating or contributing to protocols/standards to resolve the issues their product relies on to exist? The only way they could be a good actor is if they're using the money from their sales to fund that initiative with a plan to obsolete themselves. I suppose if you follow that thread though a lot of businesses just shouldn't exist except for fulfilling the need they fill for the sake of those in need.
  - jtwoodhouse 2y ago
    Companies are allowed to solve problems for a profit. People can choose to sell their time and energy or give it away. The choice is the default. In fact, I prefer that capitalist model at this point having seen countless OSS/nonprofit efforts turn into glorified abandonware. At least the business has an interest in remaining a going concern and maintaining the stack.
  - wmf 2y ago
    BTW the best way to make standards happen is to sell a product based on the standard. Academic standards don't go anywhere.
    - benreesman 2y ago
      I have no idea what the adoption is, but this reminds me of the really nice work the buf.build people are doing with ConnectRPC. I have a SaaS-crush on buf because they did such a good job on fixing such an annoying problem.
- eqvinox 2y ago
  > I have no problem criticizing tech companies, but I try to wait until they behave badly. I'd rather not wait until they have a (quasi-)monopoly on something though. Twitter was great until…
pvillano 2y ago
Cloudflare sells bulletproof vests
discardedrefuse 2y ago
Yggdrasil is p2p ipv6 e2ee. https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ Last I checked, it hasn't solved DNS yet (there are unofficial projects trying to do that). I tested a small private network with a few devices and it worked very well.
otabdeveloper4 2y ago
The problem with TCP/IP is the lack of a standard and robust VPN/overlay network protocol. Everything we have is extremely fragmented and/or proprietary. IPv6 is completely useless and doesn't solve this problem. Normal people don't care if they have to pay 5 dollars instead of 50 cents to rent an IP address. This is a problem specific only to the huge providers, and we don't need to rollout a whole internet upgrade just to optimize a tiny part of the operational costs for huge providers.
- PLG88 2y ago
  We are trying to change that with OpenZiti - https://openziti.io/ https://openziti.io/. Its an open source network overlay built with zero trust principles and deny by default in mind. We also built it for developers, so includes SDKs and other means to embed overlay networking directly into the SDLC.
  - otabdeveloper4 2y ago
    It's a complex problem that hasn't even been formulated properly yet. For example, every existing solution touts "security" and yet completely mangles the difference between authentication and encryption. Authentication is important - you don't want random servers or users to enroll on your network, and you want good tools to rotate and manage secrets. Encryption isn't important unless you care about state-level actors sniffing your traffic at the backbone. (And if you care about that then you already have your own datacenter.) Meanwhile encrypting all network traffic is a huge performance penalty. (Orders of magnitude for some valid use cases.)

by teddyh 2y ago

whoistraitor 2y ago

Ie. A form of perverse incentive or the cobra effect. Endemic to capitalism, especially in infrastructure.

DyslexicAtheist 2y ago

I never thought of this. Forces me to rethink every negative post people made against DNSSEC which shaped my opinion. I still think that IPv6 and DNSSEC do more harm in practice than what they solve. Maybe the SCW podcast can do a deepdive on this together with somebody who is militantly-pro DNSSEC. <3 ... edit: maybe even invite 2 or 3 DNSSEC advocates @tptacek :)

teddyh 2y ago
Regarding DNSSEC: • Blog post: <https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-is-needed.html https://blog.technitium.com/2023/05/for-dnssec-and-why-dane-...> • As a podcast episode: <https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-for-and-against/ https://blog.apnic.net/2023/03/16/podcast-dnssec-the-case-fo...>
tptacek 2y ago
I don't think the analysis upthread should make you rethink DNSSEC, since it, too, is a centralized system; rather than being controlled by Avery Pennarun (you could do worse), it's controlled by an unholy alliance of world governments and companies like Verisign. If we could find a credible DNSSEC advocate (for our audience; that is: a cryptography engineer, vulnerability researcher, or an engineering leader at a major firm), we would absolutely invite them on. 'teddyh below gave you links to two pro-DNSSEC resources; fun note: the latter source (Geoff Huston, one of the world's more respected networking researchers) has since then written this: https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/ https://blog.apnic.net/2024/05/28/calling-time-on-dnssec/.
- DyslexicAtheist 2y ago
  thanks much appreciated to you and teddyh for these links. really needed this opposite views.
- teddyh 2y ago
  The title of that article which you link to is “Calling time on DNSSEC?”, and Betteridge's law of headlines applies to it. Here’s the final paragraphs from that article: “I guess the question we should be asking is — if we want a secured namespace what aspects should we change about the way DNSSEC is used to make it simpler, faster, and more robust?”
  - tptacek 2y ago
    I'm happy just to see more people reading it. People can make their own call about it.
jeroenhd 2y ago
I may be in favour of DNSSEC, but I admit that it's time for a v2 of the RFC that removes the stupid "encryption can't be done at the endpoint" restriction. In practice you can just turn on validation on many computers and gain its benefits, especially if used in the manner as described here where you can just block connections to unprotected hostnames to work around the most glaring issue, but the whole spec is written for a world we've moved beyond. IPv6 doesn't have that problem, though.
- DyslexicAtheist 2y ago
  thanks!

viraptor 2y ago

Zerotier does kind of that. It's a tunnel, but also the traffic is direct (unless double Nat is involved) and if you could route the traffic directly to the endpoint IPs, you can skip zt. The location service can be self-hosted if you want. You don't have to use them as a service if you don't want to. Apart from dnssec it's pretty much what you're asking for.

lockywolf 2y ago
Double NAT is now almost everywhere in the world, except maybe USA.
- viraptor 2y ago
  What kind of Nat though? You can use upnp, predictable mapping, etc. and still allow the traffic through. And that's only with ipv4, because you can run zerotier over IPv6.
  - throw0101d 2y ago
    > What kind of Nat though? You can use upnp, predictable mapping, etc. and still allow the traffic through. Your computer can talk to your home router (CPE) and punch a hole for a connection, but if your WAN port does not have a public IP address, but rather itself also has a private address (probably 100.64/10), the CPE cannot talk to the ISP's router to punch a hole: * https://en.wikipedia.org/wiki/Carrier-grade_NAT https://en.wikipedia.org/wiki/Carrier-grade_NAT The two layers of NAT (home network (192.168) -> CPE NAT (100.64/10) -> ISP NAT ('real' public IPv4)) prevent hole punching.
    - viraptor 2y ago
      Double Nat on one side is not that universal. Across Europe and Australia I've seen it maybe once on a residential connection. I'm sure it's used, but the comment about the US in the post above just doesn't match my experience.

throwaway211 2y ago

[flagged]

deleted 2y ago
[deleted]
smolder 2y ago
This is a poor analogy. Historically there is a significant cost to making bad cars with frequent repair needs.
- sulandor 2y ago
  this is a poor statement. the cost is not in dispute, but the bearer of it. historically car owners need to pay for repairs.
  - smolder 2y ago
    Look at how the early 90s Ford Tempo resale value compared to Toyotas of the era. Trash cars don't keep their value. Toyota could then charge a premium because they were known for quality.
    - throwaway290 2y ago
      is resale value what the manufacturer wants? I mean they want to sell new cars after all...
      - throw0101d 2y ago
        > is resale value what the manufacturer wants? I mean they want to sell new cars after all... They have a higher resale value because they have a reputation of lasting a long time, and people are thus perhaps more willing to pay a higher initial purchase price because they know their "investment" will last longer. And while they may not be planing to sell their car after only a few years, knowing that they'll get back more of their "investment" is also probably sitting in the back of their mind ('just in case').

Animats 2y ago

And, worse, incentivized to require users to use a "coordination server" which helps with the NAT and firewall traversal problem by being something you can reach from outbound-only clients. There's a lot of verbiage there, but the general idea seems to be that Tailscale sits at the middle of this as the means by which machines find each other. There are other ways to do that. There are dynamic DNS schemes, so you can give your machine which only has a temporary IP address a permanent name. That's been around for decades, and seems to have a bad reputation. There are schemes with multiple coordination nodes that know about each other, and published lists of such nodes. The list may be out of date, but as long as the published list has one live node, you can connect and get updated. That's how Kademlia, which underlies Etherium's network and some file sharing systems, works. That's about 20 years old, and sort of has a sketchy reputation. It's possible to go only halfway, and separate discovery from transmission. Peertube does that. You find a file to stream via ordinary HTTP to a server you find by ordinary web search means. Anybody can set up such a server. The actual streaming, for files wanted by many clients, is distributed, with people currently watching also sending out blocks to other people watching. This scales well, in case your video goes viral. It's not used much, though. So it's definitely possible to do this without someone in the middle able to cut off your air supply.

pphysch 2y ago
How is trusting a dynamic DNS provider different than trusting Tailscale's coordination nodes?
- Animats 2y ago
  Not everybody has to use the same dynamic DNS provider.
- transpute 2y ago
  Competition Jurisdiction Resilience Biodiversity

sulandor 2y ago

> The eternal problem with companies like it's not a problem specific to any kind of corporation or corporations per se, but organizations or even broader, solutions. though, do you really think that having a solution to a problem is worse than just having the problem?

teddyh 2y ago
It is a problem if a company makes a lot of money ”solving” the problem, but: • This does not really solve the problem, since a real solution would be to change the internet to make the problem go away • A company making a lot of money gets to have an enormous influence on what is considered reasonable to standardize on. See for instance Google’s and Microsoft’s influence on things like the W3C. (Or if Tailscale is allowed to define what ”The New Internet” will be.)
- sulandor 2y ago
  seems indeed that microsoft is making lots of money by defending the status quo
  - teddyh 2y ago
    All large incumbents defend the status quo, except when advocating for larger barriers to entry for new and smaller competitors.

hnarn 2y ago

This sounds like a reasonable point, but the more I think about it, the more it sounds like digital flagellation. IPv6 was released in 1998. It had been 21 (!) years since the release of IPv6 and still what you're describing had not been implemented when Tailscale was released in 2019. Who was stopping anyone from doing it then, and who is stopping anyone from doing it now? It's easy to paint companies as bad actors, especially since they often are, but Google, Cloudflare and Tailscale all became what they are for a reason: they solved a real problem, so people gave them money, or whatever is money-equivalent, like personal data. If your argument is inverted, it's a kind of inverse accelerationism (decelerationism?) whereby only in making the Internet worse for everyone, the really good solutions can see the light. I don't buy it. Tailscale is not the reason we're not seeing what you're describing, the immense work involved in creating it is why, and it's only when that immense amount of work becomes slightly less immense that any solution at all emerges. Tailscale for example would probably not exist if they had to invent Wireguard, and the fact that Tailscale now exists has led to Headscale existing, creating yet another springboard in a line of springboards to create "something" like what you describe -- for those willing to put in the time.

deleted 2y ago
[deleted]
throw0101d 2y ago
> Who was stopping anyone from doing it then, and who is stopping anyone from doing it now? The folks who either (a) got in early on the IPv4 address land rush (especially the Western developed countries), or (b) with buckets of money who buy addresses. If you're India, there probably weren't enough IPv4 address in the first place to handle your population, so you're doing IPv6: * https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption https://www.google.com/intl/en/ipv6/statistics.html#tab=per-... Or even if you're in the West, if you're poor (a community Native American ISP): > We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices. * https://community.roku.com/t5/Features-settings-updates/It-s-2022-and-still-no-IPv6/m-p/854673/highlight/true#M35732 https://community.roku.com/t5/Features-settings-updates/It-s... * Discussion: https://news.ycombinator.com/item?id=35047624 https://news.ycombinator.com/item?id=35047624 IPv4 'wasn't a problem' because the megacorps who generally run things where I'm guessing you're from (the West) were able to solve it in other means… until they can't. T-Mobile US has 120M and a few years ago it turns out that money couldn't solve IPv4-only anymore so they went to IPv6: * https://www.youtube.com/watch?v=QGbxCKAqNUE https://www.youtube.com/watch?v=QGbxCKAqNUE IPv6 is not taking off because IPv4 (and NAT/STUN/TURN) is 'better', but rather because (a) inertial, and (b) it 'works' (with enough kludges thrown at it).

tomjen3 2y ago

I think that is excessively negative take. Tailscales value proposition is also "you can connect to your network wherever you are, safely, and others cannot". That does not go away because of IPsec.

teddyh 2y ago
Network- and location-based security is ultimately unworkable. It’s like if you, in order to work, had to go to a ”virtual office” to even send mail to your colleagues. Mail, and related internet-enabled services, should be accessible from anywhere, and be secured at the end points, not at the network layer. (Most attacks are internal, anyway.)
- tomjen3 2y ago
  Why should you have access to the SSH host for my pie? Or, more to the point, the server that I use to run my RSS feed reader? Or my NAS? Tailscale makes these more secure and more accessible for me. They are never meant to have the world access them. Now for email and a few other things, sure, their nature is that they need to access the world.
  - teddyh 2y ago
    > Why should you have access to the SSH host for my pie? Because that is how the internet is meant to work. It is an end-to-end network. If SSH would not be secure enough to handle this, it would need a secure replacement. > Or my NAS? […] They are never meant to have the world access them. What is a NAS, if not a Network-Attached Storage, i.e. meant to be accessed from the network? The concept of a ”local”, ”secure” network is a dangerous illusion. Embrace ”zero trust” networking.
    - otabdeveloper4 2y ago
      > Because that is how the internet is meant to work. No. The "internet" is literally the "inter-network", a way to connect private networks between each other. The fact that VPN technologies sit behind proprietary corporate intellectual property is not by design, it is a failure of the internet standardization process as it was gamed by corporate interests.

ZhongXina 2y ago

No, we definitely don't want "automatic IPSec" (especially IPSec!), or really any enforced encryption at the network level, even if it's something sane at this moment like WireGuard. Look at old VPN protocols or authentication schemes like RADIUS which have glaring security holes and are impossible to fix because of compatibility issues, and they're running at much smaller scales than the whole internet. Hell, the way the industry is solving TCP ossification problems is by throwing TCP away and reimplementing it on top of UDP, that should tell us something.

teddyh 2y ago
Your argument seems to be to never implement anything, because eventually it will become old and it will be hard to move away from it? This seems to be an argument against anything new, and it is therefore hard to take seriously.
- api 2y ago
  It’s an argument against complexity. IP had amazing longevity because of its simplicity and openness. Even if something is open, complexity is almost like closed as we can see with crazy complicated web standards for which there are few implementations.
- zbentley 2y ago
  Not GP, but I interpreted it as an argument to innovate/proliferate implementations early and often, but to standardize minimally and as late as possible.
- snek_case 2y ago
  The argument is more that encryption technologies can become outdated quickly. You also make it harder for small embedded devices to implement network connections if you mandate that all traffic must be encrypted. A simple protocol is more likely to last.
jeroenhd 2y ago
IPSec is still widely deployed, securely even. All manual, of course, because it doesn't do the stuff that makes HTTPS easy. IPSec is not always a VPN protocol. L2TP over IPSec is often used as one, but IPSec does little more than encrypt a tunnel between two IP addresses. IPSec in tunnel mode can be a minimal VPN, but it's not used as such as in VPN scenarios without a second packet encapsulation protocol, as it lacks authorization beyond key exchange. As for the risk of ossification: that didn't go away with the current system either. HTTPS over TLS 1.3 looks like a TLS 1.2 session resumption on the wire (in its default configuration) because shitty middleboxes are used often enough that it would impede the protocol. The "let's remake TCP over UDP" approach QUIC takes has very similar origins. UDP is generally allowed by random firewalls over that network, while other (more suited) protocols for this type of stuff like SCTP are not. The operating system doesn't allow opening raw network sockets without high privileges, so adding a new QUIC protocol at the layer of TCP and UDP to implement them at the right spot in the stack wouldn't be usable for many devices. Same is true for the TCP stack you have to use what the OS provides or get higher privileges to do your own; patching the TCP state machine isn't practical. So, if you want to implement a better version of TCP optimised for web browsing and such, you use UDP, because while technically incorrect, it'll work in most cases and has the least restrictions. In the context of the network, IPSec is the new protocol here, not the result of ossification.

spacecadet 2y ago

Companies like you list solve people problems. Their business is about using abstraction to create customer experiences that match the market demand. I want to say that "institutions" solve computer science problems, but it's much more complicated than that.

benreesman 2y ago

So far as I’m aware, TailScale has been at all times a good actor. I have no problem criticizing tech companies, but I try to wait until they behave badly.

mrmetanoia 2y ago
Wouldn't the point be they're an indecent, possibly bad, actor by default since they're a business at all rather than just creating or contributing to protocols/standards to resolve the issues their product relies on to exist? The only way they could be a good actor is if they're using the money from their sales to fund that initiative with a plan to obsolete themselves. I suppose if you follow that thread though a lot of businesses just shouldn't exist except for fulfilling the need they fill for the sake of those in need.
- jtwoodhouse 2y ago
  Companies are allowed to solve problems for a profit. People can choose to sell their time and energy or give it away. The choice is the default. In fact, I prefer that capitalist model at this point having seen countless OSS/nonprofit efforts turn into glorified abandonware. At least the business has an interest in remaining a going concern and maintaining the stack.
- wmf 2y ago
  BTW the best way to make standards happen is to sell a product based on the standard. Academic standards don't go anywhere.
  - benreesman 2y ago
    I have no idea what the adoption is, but this reminds me of the really nice work the buf.build people are doing with ConnectRPC. I have a SaaS-crush on buf because they did such a good job on fixing such an annoying problem.
eqvinox 2y ago
> I have no problem criticizing tech companies, but I try to wait until they behave badly. I'd rather not wait until they have a (quasi-)monopoly on something though. Twitter was great until…

pvillano 2y ago

Cloudflare sells bulletproof vests

discardedrefuse 2y ago

Yggdrasil is p2p ipv6 e2ee. https://yggdrasil-network.github.io/ https://yggdrasil-network.github.io/ Last I checked, it hasn't solved DNS yet (there are unofficial projects trying to do that). I tested a small private network with a few devices and it worked very well.

otabdeveloper4 2y ago

The problem with TCP/IP is the lack of a standard and robust VPN/overlay network protocol. Everything we have is extremely fragmented and/or proprietary. IPv6 is completely useless and doesn't solve this problem. Normal people don't care if they have to pay 5 dollars instead of 50 cents to rent an IP address. This is a problem specific only to the huge providers, and we don't need to rollout a whole internet upgrade just to optimize a tiny part of the operational costs for huge providers.

PLG88 2y ago
We are trying to change that with OpenZiti - https://openziti.io/ https://openziti.io/. Its an open source network overlay built with zero trust principles and deny by default in mind. We also built it for developers, so includes SDKs and other means to embed overlay networking directly into the SDLC.
- otabdeveloper4 2y ago
  It's a complex problem that hasn't even been formulated properly yet. For example, every existing solution touts "security" and yet completely mangles the difference between authentication and encryption. Authentication is important - you don't want random servers or users to enroll on your network, and you want good tools to rotate and manage secrets. Encryption isn't important unless you care about state-level actors sniffing your traffic at the backbone. (And if you care about that then you already have your own datacenter.) Meanwhile encrypting all network traffic is a huge performance penalty. (Orders of magnitude for some valid use cases.)