4 ms·

This is not correct. Wireguard establishes a tunnel between peer A and B, and its simplicity stops there. Tailscale does tons of complex networking, filtering,

by aborsy 2y ago

This is not correct. Wireguard establishes a tunnel between peer A and B, and its simplicity stops there. Tailscale does tons of complex networking, filtering, nat traversal, DNS, file sharing, etc. Wireguard is a small part of the codebase today, which has grown a lot. It’s a bit like saying Dropbox is just a GUI on top of TLS.

infinghxsg 2y ago
[dead]
homebrewer 2y ago
Most of this was successfully done 20 years ago by tinc, which is a project written by a couple of European guys in their free time. It even supports routing traffic through other peers and does peer discovery just like BitTorrent (but before BitTorrent even existed) — there is no need for a central server. What tailscale has over it is hype, lots and lots of hype. Also a much more well thought out, and arguably more secure VPN protocol underneath, which is why GP's comment is on point.
- RealityVoid 2y ago
  And ease of use, IMHO. That's a bit one with these kind of things. I will admit not having used tinc but I imagine it's not as polished. Polish costs effort and money and it also really truly saves time and makes for a better product. So that matters.
  - mikepurvis 2y ago
    It definitely matters. I used tinc extensively at a prior gig, and it not having a story for its own key distribution was exceedingly painful.
- tptacek 2y ago
  If it's hype, it's not hype the way you're thinking. I've shown Tailscale to a lot of people (this is less salient now, when pretty much everybody uses Tailscale) and the most common reaction I've gotten is "holy shit". It is spooky simple to get working, and it's spooky simple to go from a working installation to a VPN configuration that would take many many hours to replicate with pre-existing tools. There may be VPN nerds out there who think there's nothing special happening with Tailscale, but I submit those nerds haven't spent a lot of time dealing with the median, replacement-level VPN configuration prior to Tailscale. I'm a pentester, and so I have had that pleasure. Tailscale is revolutionary compared to what it replaced.
  - formerly_proven 2y ago
    My only technical complaint with Tailscale is that its hole punching doesn't seem to work with some common CGNATs/double NATs when both endpoints are using them, and then traffic ends up trickling through their public proxy servers, while running your own is kinda annoying and not recommended or documented.
    - password4321 2y ago
      > running your own [proxy servers] is kinda annoying and not recommended or documented ?? https://tailscale.com/kb/1118/custom-derp-servers https://tailscale.com/kb/1118/custom-derp-servers
  - candiddevmike 2y ago
    Because you're delegating the control plane to Tailscale. Somehow we went decades without this being a thing for security reasons, dealt with the management of VPN appliances, and now suddenly everyone is OK with Tailscale owning the control plane of their VPN for the sake of convenience.
    - panick21_ 2y ago
      [flagged]
      - deleted 2y ago
        [deleted]
    - eadmund 2y ago
      For a company this is probably okay: companies rely on other companies all the time, and can enforce contracts. I would gladly use tailscale at my company. For an individual, heck no. Fortunately, headscale exists for individuals to use.
- iieudydidh 2y ago
  [dead]
aqfamnzc 2y ago
> It’s a bit like saying Dropbox is just a GUI on top of TLS. Well, it is. After all, for a Linux user, you can already build such a system yourself quite trivially...
- eddieroger 2y ago
  It'll be a sad day when this reference is posted and understood for the last time.
  - tptacek 2y ago
    No it won't. The reference is universally misunderstood. https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=dropbox%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
    - radlad 2y ago
      I think the parent commenter used "understood" to mean "recognized." That said, I don't really understand the supposed misunderstanding you point out. It seems that dang argues that "the exchange was pleasant and successful." I've never seen someone claim otherwise. Rather, I've seen it used as an example of how technical users can fail to recognize the complexity inherent in their workflows, and therefore may also fail to see the real-world business value in creating (and selling) simpler interfaces. See also a SMOP: https://en.wikipedia.org/wiki/Small_matter_of_programming https://en.wikipedia.org/wiki/Small_matter_of_programming
      - tptacek 2y ago
        No, it's not that simple. This is an instance of context collapse; people dunk on that exchange because they believe it's an HN person belittling Dropbox as a product, when in fact it was an HN person helpfully offering notes on a YC application.
        2y ago
agentdrek 2y ago
Probably closer to say that Dropbox is a GUI on top of WebDAV
- iieudydidh 2y ago
  [dead]

by aborsy 2y ago

infinghxsg 2y ago

[dead]

homebrewer 2y ago

Most of this was successfully done 20 years ago by tinc, which is a project written by a couple of European guys in their free time. It even supports routing traffic through other peers and does peer discovery just like BitTorrent (but before BitTorrent even existed) — there is no need for a central server. What tailscale has over it is hype, lots and lots of hype. Also a much more well thought out, and arguably more secure VPN protocol underneath, which is why GP's comment is on point.

RealityVoid 2y ago
And ease of use, IMHO. That's a bit one with these kind of things. I will admit not having used tinc but I imagine it's not as polished. Polish costs effort and money and it also really truly saves time and makes for a better product. So that matters.
- mikepurvis 2y ago
  It definitely matters. I used tinc extensively at a prior gig, and it not having a story for its own key distribution was exceedingly painful.
tptacek 2y ago
If it's hype, it's not hype the way you're thinking. I've shown Tailscale to a lot of people (this is less salient now, when pretty much everybody uses Tailscale) and the most common reaction I've gotten is "holy shit". It is spooky simple to get working, and it's spooky simple to go from a working installation to a VPN configuration that would take many many hours to replicate with pre-existing tools. There may be VPN nerds out there who think there's nothing special happening with Tailscale, but I submit those nerds haven't spent a lot of time dealing with the median, replacement-level VPN configuration prior to Tailscale. I'm a pentester, and so I have had that pleasure. Tailscale is revolutionary compared to what it replaced.
- formerly_proven 2y ago
  My only technical complaint with Tailscale is that its hole punching doesn't seem to work with some common CGNATs/double NATs when both endpoints are using them, and then traffic ends up trickling through their public proxy servers, while running your own is kinda annoying and not recommended or documented.
  - password4321 2y ago
    > running your own [proxy servers] is kinda annoying and not recommended or documented ?? https://tailscale.com/kb/1118/custom-derp-servers https://tailscale.com/kb/1118/custom-derp-servers
- candiddevmike 2y ago
  Because you're delegating the control plane to Tailscale. Somehow we went decades without this being a thing for security reasons, dealt with the management of VPN appliances, and now suddenly everyone is OK with Tailscale owning the control plane of their VPN for the sake of convenience.
  - panick21_ 2y ago
    [flagged]
    - deleted 2y ago
      [deleted]
  - eadmund 2y ago
    For a company this is probably okay: companies rely on other companies all the time, and can enforce contracts. I would gladly use tailscale at my company. For an individual, heck no. Fortunately, headscale exists for individuals to use.
iieudydidh 2y ago
[dead]

aqfamnzc 2y ago

> It’s a bit like saying Dropbox is just a GUI on top of TLS. Well, it is. After all, for a Linux user, you can already build such a system yourself quite trivially...

eddieroger 2y ago
It'll be a sad day when this reference is posted and understood for the last time.
- tptacek 2y ago
  No it won't. The reference is universally misunderstood. https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=dropbox%20by%3Adang&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
  - radlad 2y ago
    I think the parent commenter used "understood" to mean "recognized." That said, I don't really understand the supposed misunderstanding you point out. It seems that dang argues that "the exchange was pleasant and successful." I've never seen someone claim otherwise. Rather, I've seen it used as an example of how technical users can fail to recognize the complexity inherent in their workflows, and therefore may also fail to see the real-world business value in creating (and selling) simpler interfaces. See also a SMOP: https://en.wikipedia.org/wiki/Small_matter_of_programming https://en.wikipedia.org/wiki/Small_matter_of_programming
    - tptacek 2y ago
      No, it's not that simple. This is an instance of context collapse; people dunk on that exchange because they believe it's an HN person belittling Dropbox as a product, when in fact it was an HN person helpfully offering notes on a YC application.
      - 2y ago

agentdrek 2y ago

Probably closer to say that Dropbox is a GUI on top of WebDAV

iieudydidh 2y ago
[dead]