10 ms·

I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks

by cedws 2y ago

I'm a big fan of Tailscale but it's unfortunate that it's proprietary, so it's really nice to see an open source alternative. The commercial pricing also looks very reasonable. Wishing your product much success.

jamilbk 2y ago
Thanks for the support!
dotBen 2y ago
Do you think purchasers within enterprises especially care if it's a proprietary or commercially-supported FOSS offering?
- jdironman 2y ago
  Those with purchasing 'influence' might. Accounts payable? No.
- otabdeveloper4 2y ago
  Yes. A shitload of legal nuance depending on what you choose here. (Software supply chain issues are increasingly important nowadays, and executives usually care about this stuff more, because it can carry huge risks.)
- PLG88 2y ago
  They do if they are building it into their product/commercial offering. Less so if its a direct and internal usage.
- alemanek 2y ago
  Anecdotal but the company I work for does. But, not for the reasons the wider community cares. Strong FOSS projects tend to have multiple options for commercial support. So, if a hostile company acquires your commercial support provider, looking at you Broadcom, you have some options to move to someone friendlier for support. So, for my employer it is about having options.
indianmouse 2y ago
Second that. I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pitfalls / troubleshooting stuff which actually consumed a lot of time and effort. Is there an open source option with Firezone where I could try it out to have a head to head comparison (or if a comparison that already exists) or a guide that could be used for setting up one's own server and client apps for a self-hosted and self-managed solution using Firezone? Please recommend / respond with the opinion of whether the thought process is worth it? Thanks.
- jamilbk 2y ago
  We have a few intrepid users self-hosting the entire Firezone stack, but we don't have documentation to support it (yet), and wouldn't recommend it for production. It's something we'd like to write and maintain eventually, even if only for smaller / hobby deployments. We do have a self-hosted community support channel on Discord if you are feeling adventurous: https://discord.gg/DY8gxpSgep https://discord.gg/DY8gxpSgep I would recommend starting here with a local development cluster: https://github.com/firezone/firezone/blob/main/docs/CONTRIBUTING.md https://github.com/firezone/firezone/blob/main/docs/CONTRIBU...
  - indianmouse 2y ago
    Thank you so much. Will check it out and probably create a pull request to add the documentation while I'm implementing it.
Terretta 2y ago
This comment sounds like a promo for Tailscale. It's actually a suggestion to Firezone to model after what Tailscale are getting right. We need competition in this space, but tooling non-SV businesses can leverage. Tailscale is pulling this off well. Tailscale is building a remarkable moat at extraordinary pace: capabilities real commercial use needs, on pricing that doesn't penalize the security-minded startup. One key difference with their platform is the recognition so often missed inside the HN bubble that most B2B and B2C are on M365 and Entra, not Google like 3 devs in a cafe. Tailscale seems to understand the difference, but rather than going "enterprise" brings the startup ways into the business context, letting a business be like a startup while still complying with "requirements" such as sound patterns for tying into legacy internal and third party systems and networks. A related difference is emphasis on "everything as code" from config to policy, enabling gitops of course, but also easier integration and automation. That said, Firezone's choice to let groups flow from IdP and map resources to groups, can be a competitive advantage, since the only thing better than everything as code is no-code, meaning, no moving parts. For instance, with Firezone, you can make systems automatically accessible to Microsoft Teams, team by team. Adding someone to a team or kicking them from a team, can give them access or remove their access. That's a massive security gain and overhead reduction. But the biggest differentiation seems to be solving corner cases that come up in real world use and rolling those out faster than firms can come up the curve in their own Zero Trust implementation. Tailscale must have an excellent forward-deployed product sensing practice, to either discover or listen to these problems from commercial users then tackle them and get it rolled out for all customers. Their docs are also use-case focused and self-service empowering: https://tailscale.com/kb/1300/production-best-practices https://tailscale.com/kb/1300/production-best-practices with a clear understanding of how devs spend their time https://tailscale.com/kb/1360/developer-tools https://tailscale.com/kb/1360/developer-tools and generally organized by the "Diataxis" systematic approach to technical documentation authoring: https://diataxis.fr/ https://diataxis.fr/ Finally, contrary to popular practice here, Tailscale don't have predatory pricing for SSO, no “SSO tax”. The $0 plan includes SSO. Even if you're a one person shop, there's no reason not to get SSO going for yourself, every future SaaS you integrate with, and every future onboarding/offboarding will thank you. Switching to this later is far more costly than adopting it early, and we should all be supporting one another to make SSO (or Oauth2+OIDC) the norm instead of an "Enterprise Call Us" pricing discriminator. It's great to see Firezone including OIDC in the starter plan, as that brings most of what anyone needs from "SSO", without most of the headaches. And this benefits Firezone too, they can't leak user passwords. "Zero Trust" (such a terrible name for a pattern that actually means "enable trust on everything that matters") is a big deal, and more focus on this space is huge. It's worth building in this ecosystem, and worth paying attention to what overachievers are getting right.

by cedws 2y ago

jamilbk 2y ago

Thanks for the support!

dotBen 2y ago

Do you think purchasers within enterprises especially care if it's a proprietary or commercially-supported FOSS offering?

jdironman 2y ago
Those with purchasing 'influence' might. Accounts payable? No.
otabdeveloper4 2y ago
Yes. A shitload of legal nuance depending on what you choose here. (Software supply chain issues are increasingly important nowadays, and executives usually care about this stuff more, because it can carry huge risks.)
PLG88 2y ago
They do if they are building it into their product/commercial offering. Less so if its a direct and internal usage.
alemanek 2y ago
Anecdotal but the company I work for does. But, not for the reasons the wider community cares. Strong FOSS projects tend to have multiple options for commercial support. So, if a hostile company acquires your commercial support provider, looking at you Broadcom, you have some options to move to someone friendlier for support. So, for my employer it is about having options.

indianmouse 2y ago

Second that. I have tried to use Headscale with Tailscale clients and have been fairly successful in achieving a private P2P VPN. Since I have a lot of spare servers, was able to setup a GUI, Headscale server and configure Tailscale clients across different OS flavors. But it is not for the faint of heart or non-technical folks or for enterprise use. What I have implemented was for personal use and it has it's own pitfalls / troubleshooting stuff which actually consumed a lot of time and effort. Is there an open source option with Firezone where I could try it out to have a head to head comparison (or if a comparison that already exists) or a guide that could be used for setting up one's own server and client apps for a self-hosted and self-managed solution using Firezone? Please recommend / respond with the opinion of whether the thought process is worth it? Thanks.

jamilbk 2y ago
We have a few intrepid users self-hosting the entire Firezone stack, but we don't have documentation to support it (yet), and wouldn't recommend it for production. It's something we'd like to write and maintain eventually, even if only for smaller / hobby deployments. We do have a self-hosted community support channel on Discord if you are feeling adventurous: https://discord.gg/DY8gxpSgep https://discord.gg/DY8gxpSgep I would recommend starting here with a local development cluster: https://github.com/firezone/firezone/blob/main/docs/CONTRIBUTING.md https://github.com/firezone/firezone/blob/main/docs/CONTRIBU...
- indianmouse 2y ago
  Thank you so much. Will check it out and probably create a pull request to add the documentation while I'm implementing it.

Terretta 2y ago

This comment sounds like a promo for Tailscale. It's actually a suggestion to Firezone to model after what Tailscale are getting right. We need competition in this space, but tooling non-SV businesses can leverage. Tailscale is pulling this off well. Tailscale is building a remarkable moat at extraordinary pace: capabilities real commercial use needs, on pricing that doesn't penalize the security-minded startup. One key difference with their platform is the recognition so often missed inside the HN bubble that most B2B and B2C are on M365 and Entra, not Google like 3 devs in a cafe. Tailscale seems to understand the difference, but rather than going "enterprise" brings the startup ways into the business context, letting a business be like a startup while still complying with "requirements" such as sound patterns for tying into legacy internal and third party systems and networks. A related difference is emphasis on "everything as code" from config to policy, enabling gitops of course, but also easier integration and automation. That said, Firezone's choice to let groups flow from IdP and map resources to groups, can be a competitive advantage, since the only thing better than everything as code is no-code, meaning, no moving parts. For instance, with Firezone, you can make systems automatically accessible to Microsoft Teams, team by team. Adding someone to a team or kicking them from a team, can give them access or remove their access. That's a massive security gain and overhead reduction. But the biggest differentiation seems to be solving corner cases that come up in real world use and rolling those out faster than firms can come up the curve in their own Zero Trust implementation. Tailscale must have an excellent forward-deployed product sensing practice, to either discover or listen to these problems from commercial users then tackle them and get it rolled out for all customers. Their docs are also use-case focused and self-service empowering: https://tailscale.com/kb/1300/production-best-practices https://tailscale.com/kb/1300/production-best-practices with a clear understanding of how devs spend their time https://tailscale.com/kb/1360/developer-tools https://tailscale.com/kb/1360/developer-tools and generally organized by the "Diataxis" systematic approach to technical documentation authoring: https://diataxis.fr/ https://diataxis.fr/ Finally, contrary to popular practice here, Tailscale don't have predatory pricing for SSO, no “SSO tax”. The $0 plan includes SSO. Even if you're a one person shop, there's no reason not to get SSO going for yourself, every future SaaS you integrate with, and every future onboarding/offboarding will thank you. Switching to this later is far more costly than adopting it early, and we should all be supporting one another to make SSO (or Oauth2+OIDC) the norm instead of an "Enterprise Call Us" pricing discriminator. It's great to see Firezone including OIDC in the starter plan, as that brings most of what anyone needs from "SSO", without most of the headaches. And this benefits Firezone too, they can't leak user passwords. "Zero Trust" (such a terrible name for a pattern that actually means "enable trust on everything that matters") is a big deal, and more focus on this space is huge. It's worth building in this ecosystem, and worth paying attention to what overachievers are getting right.