5 ms·

How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, s

How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, sometimes it seems like I get rate limited on Tailscale. Has anyone had that experience? This usually happens with multiple SSH connections at the same time.

tiernano 8mo ago
It's free for up to 3 users. After that you need to start paying.
- criddell 8mo ago
  I have a family of 4 so I pay and it's still crazy cheap. I've wonder how sustainable it is.
prodigycorp 8mo ago
I love tailscale but you may be right, it's entering that acquisition zone that'll inevitably bum everyone out. Salesforce, stay away from it!
- politelemon 8mo ago
  Dearest Salesforce, Apple, Oracle, and IBM. Please look elsewhere for acquisitions to ruin for everyone. Cheers.
- tomxor 8mo ago
  I have the same fears. Last year they have publicly stated they are not interested in acquisition [0] > Pennarun confirmed the company had been approached by potential acquirers, but told BetaKit that the company intends to grow as a private company and work towards an initial public offering (IPO). > “Tailscale intends to remain independent and we are on a likely IPO track, although any IPO is several years out,” Pennarun said. “Meanwhile, we have an extremely efficient business model, rapid revenue acceleration, and a long runway that allows us to become profitable when needed, which means we can weather all kinds of economic storms.” Nothing is set in stone, after all it's VC backed. I have a strong aversion to becoming dependent upon proprietary services, however i have chosen to integrate TS into my infrastructure, because the value and simplicity it provides is worth it. I considered the various copy cat services and pure FOSS clones, but TS are the ones who started this space and are the ones continuously innovating in it, I'm onboard with their ethos and mission and have made use of apenwarrs previous work - In other words, they are the experts, they appear to be pretty dedicated to this space, so I'm putting my trust in them... I hope I'm right! [0] https://betakit.com/corporate-vpn-startup-tailscale-secures-230-million-cad-series-c-on-back-of-surprising-growth/ https://betakit.com/corporate-vpn-startup-tailscale-secures-...
  - nerdsniper 8mo ago
    Would be curious if a partial decompilation and short static analysis would yield any reliable info about what they might be collecting.
  - omnimus 8mo ago
    Just note i doubt Tailscale were first popular vpn manager as i remember many hobby users are Zerotier converts and also much older products like Hamachi. Tailscale have build great product around wireguard (which is quite young) and they have great marketing and docs. But they are hardly first VPN service - they might not even be the most popular one.
    - tomxor 8mo ago
      Yes, I ambiguously said "started this space"... and to be honest even in the most generous interpretation that's probably incorrect, maybe ZeroTier started "this space", in that it had NAT busting mesh networking first. As far as I understand Tailscale brought NAT busting mesh networking to wireguard + identity first access control, and reduced configuration complexity. I think they were the first to think about it from an end to end user perspective, and each feature they add definitely has this spin on it. It makes it feel effortless and transparent (in both the networking use sense and cryptography sense)... So i suppose that's what I mean by started, TS was when it first really clicked for a larger group of people, it felt right.
    - tietjens 8mo ago
      Might be time to learn me some Wireguard.
evmar 8mo ago
They wrote a blog post addressing this concern: https://tailscale.com/blog/free-plan https://tailscale.com/blog/free-plan
- riknos314 8mo ago
  The Tl;Dr here is that the cost to them of operating the free tier is lower than what they estimate their Customer Acquisition Cost would be without a free tier, so the free tier generates better leads/conversions to their paid products at a lower cost than traditional sales and marketing. As long as these economics continue to hold they'd be stupid to discontinue the free tier.
  - wat10000 8mo ago
    All it takes is for the decision-maker who gets the credit for cutting costs by removing the free tier to be a different person from the one who gets the blame for higher customer acquisition costs. Not saying it'll happen, just that it being a bad move isn't a guarantee.
  - eleventyseven 8mo ago
    But it isn't 'economics' as there is no actual data or science here, just a wild guess about what customer acquisition might currently cost. All it takes to rug pull is some exec speculating that 'the economics' have changed.
    - dagi3d 8mo ago
      Acquisition cost can definitely be calculated. I'm pretty sure they know how many customers do convert into paying users from their free tier and how much does it cost to get them through other channels
    - erikpukinskis 8mo ago
      Any mature SaaS company will have exact measurements of acquisition costs. This is advertising, sales staff, etc. This is one the the most fundamental components of SaaS accounting, it’s absolutely not a “wild guess”.
gz5 8mo ago
OpenZiti (Apache 2.0): https://github.com/openziti/ziti https://github.com/openziti/ziti
- bityard 8mo ago
  This is a secure mesh network, but it appears to be for embedding into applications, not a "private VPN" like Tailscale, or do I misunderstand?
  - PLG88 8mo ago
    Embedding is an option, but tunnelers - https://netfoundry.io/docs/openziti/reference/tunnelers/ https://netfoundry.io/docs/openziti/reference/tunnelers/ - and edge routers (which can front legacy services without modifying them) also exist. The difference is architectural; Tailscale is a mesh VPN, whereas OpenZiti is an identity-first, zero trust overlay network. This makes OpenZiti service-centric and deny-by-default, not network-centric. Instead of “join a private network,” you get access only to explicitly authorised services — with no ambient reachability at all. Its also 100% open source. If you want a simple productised, SaaS experience, NetFoundry, the company behind OpenZiti provides that.
- deleted 8mo ago
  [deleted]
nsbk 8mo ago
At this point Tailscale is working so well and I'm so happy with it that I'm afraid it's time to start migrating to Headscale [0] for my home network. The rag pull may just be too painful otherwise! [0]: https://headscale.net/ https://headscale.net/
- sureglymop 8mo ago
  I've been smoothly running headscale on a hetzner vps for many months now. Works without issues (note that it does lack some features still).
  - ErneX 8mo ago
    Same here.
vizzier 8mo ago
> Also, sometimes it seems like I get rate limited on Tailscale. As I understand it if everything is working properly you should end up with a peer to peer wireguard connection after initial connection using tailscales infrastructure. ie, there should be nothing to rate limit. There are exceptions depending on your network environment where you need one of the relays noted in this post. As for opensource alternatives: https://github.com/juanfont/headscale https://github.com/juanfont/headscale can replace tailscales initial coordination servers and https://netbird.io/ https://netbird.io/ seemed to be a rapidly developing full stack alternative.
- arsome 8mo ago
  Headscale also offers a relay server of its own.
- kkapelon 8mo ago
  There is also netmaker
eurg 8mo ago
Companies pay for it. And except for their DERP servers, free users don't cost them much.
Aurornis 8mo ago
Tailscale is a perfect example of using a free tier to become popular with developers, who then evangelize the product to their employers. The employers pay for business scale plans.
- zephen 8mo ago
  I wonder about this. The hoops you have to jump through to be on two different tailnets might dissuade some home users from even bringing it up at work.
  - baq 8mo ago
    Home users being on multiple tailnets is serious power user territory
    - zephen 8mo ago
      There are a lot of workarounds these days, such as tailnet switching, and, of course, if you're admin on both tailnets, you're practically golden with the "share" option. But even power users have to pick and choose their battles. If I had a nice tailnet home setup going I might be seriously miffed if I had to try to fit in some of my devices to a corporate tailnet I didn't control.
      - db48x 8mo ago
        True, but to be frank you shouldn’t be using personal devices for work purposes anyway.
        zephen 8mo ago
        Security is a series of trade-offs, which in the worst case disallows anybody from doing anything. In the simplest case, if a person has two different sets of systems they desire to access from a cellphone, and an unwillingness to carry two different cellphones around with them, then it becomes a business decision of whether that person is valuable and trustworthy enough to allow access to work systems and "other" systems from that cellphone. Who pays for the cellphone, and whether this extends to laptops or not, are questions of degree.
thecapybara 8mo ago
I self-host a few apps and use Tailscale to access them remotely. It's worked well, so I recommended it as a possible solution to allow employees at my company to remotely access some on-prem resources while remote, and that's being considered. If we go with that, then that'd be Tailscale making money from me using the free plan.
dimatura 8mo ago
Our company pays for the premium business plan, $18/mo/user. You have to pay for at least the lower tier plan once your team grows beyond a handful of people. And there's several quite useful features (though maybe not essential) on the premium plan like serve/funnel and SSH. On the other hand, I do wonder about zerotier. before tailscale we used zerotier for a few years, and during the first 3-4 years we paid nothing because as far as I can recall there was nothing extra that we needed that paying would've gotten us. Eventually we did upgrade to add more users, and it cost something like $5/mo (total, not per user).
- gpm 8mo ago
  I've used serve/funnel on the tailscale free tier... definitely agree that the team size limit seems like it would move companies to the paid plan though.
  - dimatura 8mo ago
    I think how it works usually is that they let you use the features from higher tier plans than the one you're on; once you use them enough they send you an email asking to upgrade. That's what happened to us and I've seen other users mention it. Not sure how I felt about it, OTOH maybe it was less friction than explicitly subscribing for some "2 weeks free trial" or whatever but OTOH it did feel weird and unexpected. Anyway, we felt the extra features were worth it so ended up paying.
    - gpm 8mo ago
      Hmm... Ok I checked the pricing page and funnel is available in the free tier (limited to 3 users) but not the $6/user/month tier - which you need for more than 6 users... strange pricing structure but I guess I see the logic. Any chance you were asked to upgrade from $6/user/month to $18/user/month and not free to $18/user/month? https://tailscale.com/pricing#application-networking https://tailscale.com/pricing#application-networking
      - dimatura 8mo ago
mrsssnake 8mo ago
Free personal tier is basically a cheap advertisement for them. You try Tailscale personally and get used to it, then it is very likely you would want to deploy it at your work seeing the benefits scaling even more with more people. And then they make money.
- QuercusMax 8mo ago
  1000%. Tailscale is the first VPN I've used that makes my life easier, and I'm using it for personal access to my selfhosted servers at home. I will definitely recommend it to companies I work for in the future.
Lammy 8mo ago
> How does Tailscale make money? They spy on your network behavior by default, so free users are still paying with their behavioral data. See https://tailscale.com/docs/features/logging https://tailscale.com/docs/features/logging “Each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.com). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.” They know what you're doing, when, from where, to where, on your supposedly “private” network. It's possible to opt out on Windows, on *nix systems, and when using the non-GUI client on macOS by enabling the FUD-named “TS_NO_LOGS_NO_SUPPORT” option: https://tailscale.com/docs/features/logging#opt-out-of-client-logging https://tailscale.com/docs/features/logging#opt-out-of-clien... It is not currently possible to opt out on iOS/Android clients: https://github.com/tailscale/tailscale/issues/13174 https://github.com/tailscale/tailscale/issues/13174 For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326 https://github.com/tailscale/tailscale/issues/15326
- nickburns 8mo ago
  Pretty much this. DNS, SNI, and otherwise plaintext traffic sniffing. That together with user/device 'fingerprinting' (a much more amorphous concept), and that's why such-and-such thing you were just talking about with so-and-so pops up on your screen/feed/whatever, sometimes only minutes later. I highly doubt any of this can actually be opted-out of. How else would they stay in business?
  - namtim 8mo ago
    The `TS_NO_LOGS_NO_SUPPORT` option opts out of all log collection, and says in the name why it is collected in the first place. Tailscale has support for all users, including free, and having access to logs has to be how they can provide free support. Having quick access to logs reduces the time it takes to handle tickets, so they can help more people quickly and don't need to limit support to only paying users. The core client code is open source, feel free to inspect it yourself.
zaphar 8mo ago
There are a number of features and teamsizes that they provide where you have to pay money. Most company users are going to end up paying them money. But also their emphasis on P2P connections means their costs are quite low. It doesn't add much overhead to have the smallish number of personal users out there. They've talked about how having the free tier helps to force them keep those costs down in useful ways.
dec0dedab0de 8mo ago
Wouldn't the FOSS alternative be to simply use wireguard?
- iso1631 8mo ago
  Most posters on HN barely know what a subnet is so it's not that simple There's two key features 1) Tunnel management Tailscale will configure your p2p tunnels itself - if you have 10 devices, to do that yourself you'd have to manage 90 tunnels. Add another device and that goes upto 100. Remove a device and you have 9 other devices to update. 2) Firewall punching They provide an orchestration system which allows two devices both behind a nat or stateful firewall to communicate with each other without having to open holes in the firewall (because most firewalls will allow "established" connections - including measuring established UDP as "packet went from ipa:porta to ipb:portb 'outbound', thus until a timeout period any traffic from ipb:portb to ipa:porta will be let through (and natted as appropriate)". The orchestration sends traffic from ipa to ipb and ipb to ipa on known ports at the same time so both firewalls think the traffic is established. For nats which do source-port scrambling it uses the birthday paradox to get a matching stream. I believe you can run a similar headend using "headscale" yourself.
- NoiseBert69 8mo ago
  Yes and no. It's much manual work to get WG to behave like Tailscale.
- newsoftheday 8mo ago
  I do, I use a VPS (at OCI free) to host Wireguard. My home systems (running my production web sites and email) are on my VPN and mine and my wife's phones. I hand configured it all but it wasn't difficult for me.
- nagaiaida 8mo ago
  a simpler setup with broad feature parity would probably look more similar to nebula than bare wireguard
Suffocate5100 8mo ago
Nebula is what we use. It's definitely not as convenient, but it's 100% self-ownable.
allthetime 8mo ago
Facilitating peer to peer connections is cheap. Just like cloudflare, a healthy free offering makes lots of happy/loyal users. Some of those users have business needs / use for the paid features and support.
allthetime 8mo ago
Facilitating peer to peer connections is cheap. Just like cloudflare, a healthy free offering makes lots of happy/loyal developer users. Some of those users have business needs / use for the paid features and support and will convince their managers to buy in.
pkulak 8mo ago
I pay $5 a month, and my company has a license for every employee.
fdefitte 8mo ago
[dead]
- batrat 8mo ago
  It happened to others but there are also some very good examples like Veeam community edition which, IMO, is the best backup software. They had lots of discussions and even pressure from management to terminated, but the numbers made a lot of sense and they kept it. Tailscale is in disadvantage here because they are in a very crowded market and it will be very easy to slip into one corner and let way for others like netbird, netmaker, nebula(?), wireguard (like u said), etc.
UltraSane 8mo ago
Companies pay per user for TailScale as an alternative to conventional VPNs like Cisco AnyConnect.
jacquesm 8mo ago
Through paying users like me.
resiros 8mo ago
I use netbird and can only recommend it
cbility 8mo ago
https://netbird.io/ https://netbird.io/ is open source, with a freemium hosted option. Works for us and I find it easier to configure than tailscale for routing rules.

tiernano 8mo ago

It's free for up to 3 users. After that you need to start paying.

criddell 8mo ago
I have a family of 4 so I pay and it's still crazy cheap. I've wonder how sustainable it is.

prodigycorp 8mo ago

I love tailscale but you may be right, it's entering that acquisition zone that'll inevitably bum everyone out. Salesforce, stay away from it!

politelemon 8mo ago
Dearest Salesforce, Apple, Oracle, and IBM. Please look elsewhere for acquisitions to ruin for everyone. Cheers.
tomxor 8mo ago
I have the same fears. Last year they have publicly stated they are not interested in acquisition [0] > Pennarun confirmed the company had been approached by potential acquirers, but told BetaKit that the company intends to grow as a private company and work towards an initial public offering (IPO). > “Tailscale intends to remain independent and we are on a likely IPO track, although any IPO is several years out,” Pennarun said. “Meanwhile, we have an extremely efficient business model, rapid revenue acceleration, and a long runway that allows us to become profitable when needed, which means we can weather all kinds of economic storms.” Nothing is set in stone, after all it's VC backed. I have a strong aversion to becoming dependent upon proprietary services, however i have chosen to integrate TS into my infrastructure, because the value and simplicity it provides is worth it. I considered the various copy cat services and pure FOSS clones, but TS are the ones who started this space and are the ones continuously innovating in it, I'm onboard with their ethos and mission and have made use of apenwarrs previous work - In other words, they are the experts, they appear to be pretty dedicated to this space, so I'm putting my trust in them... I hope I'm right! [0] https://betakit.com/corporate-vpn-startup-tailscale-secures-230-million-cad-series-c-on-back-of-surprising-growth/ https://betakit.com/corporate-vpn-startup-tailscale-secures-...
- nerdsniper 8mo ago
  Would be curious if a partial decompilation and short static analysis would yield any reliable info about what they might be collecting.
- omnimus 8mo ago
  Just note i doubt Tailscale were first popular vpn manager as i remember many hobby users are Zerotier converts and also much older products like Hamachi. Tailscale have build great product around wireguard (which is quite young) and they have great marketing and docs. But they are hardly first VPN service - they might not even be the most popular one.
  - tomxor 8mo ago
    Yes, I ambiguously said "started this space"... and to be honest even in the most generous interpretation that's probably incorrect, maybe ZeroTier started "this space", in that it had NAT busting mesh networking first. As far as I understand Tailscale brought NAT busting mesh networking to wireguard + identity first access control, and reduced configuration complexity. I think they were the first to think about it from an end to end user perspective, and each feature they add definitely has this spin on it. It makes it feel effortless and transparent (in both the networking use sense and cryptography sense)... So i suppose that's what I mean by started, TS was when it first really clicked for a larger group of people, it felt right.
  - tietjens 8mo ago
    Might be time to learn me some Wireguard.

evmar 8mo ago

They wrote a blog post addressing this concern: https://tailscale.com/blog/free-plan https://tailscale.com/blog/free-plan

riknos314 8mo ago
The Tl;Dr here is that the cost to them of operating the free tier is lower than what they estimate their Customer Acquisition Cost would be without a free tier, so the free tier generates better leads/conversions to their paid products at a lower cost than traditional sales and marketing. As long as these economics continue to hold they'd be stupid to discontinue the free tier.
- wat10000 8mo ago
  All it takes is for the decision-maker who gets the credit for cutting costs by removing the free tier to be a different person from the one who gets the blame for higher customer acquisition costs. Not saying it'll happen, just that it being a bad move isn't a guarantee.
- eleventyseven 8mo ago
  But it isn't 'economics' as there is no actual data or science here, just a wild guess about what customer acquisition might currently cost. All it takes to rug pull is some exec speculating that 'the economics' have changed.
  - dagi3d 8mo ago
    Acquisition cost can definitely be calculated. I'm pretty sure they know how many customers do convert into paying users from their free tier and how much does it cost to get them through other channels
  - erikpukinskis 8mo ago
    Any mature SaaS company will have exact measurements of acquisition costs. This is advertising, sales staff, etc. This is one the the most fundamental components of SaaS accounting, it’s absolutely not a “wild guess”.

gz5 8mo ago

OpenZiti (Apache 2.0): https://github.com/openziti/ziti https://github.com/openziti/ziti

bityard 8mo ago
This is a secure mesh network, but it appears to be for embedding into applications, not a "private VPN" like Tailscale, or do I misunderstand?
- PLG88 8mo ago
  Embedding is an option, but tunnelers - https://netfoundry.io/docs/openziti/reference/tunnelers/ https://netfoundry.io/docs/openziti/reference/tunnelers/ - and edge routers (which can front legacy services without modifying them) also exist. The difference is architectural; Tailscale is a mesh VPN, whereas OpenZiti is an identity-first, zero trust overlay network. This makes OpenZiti service-centric and deny-by-default, not network-centric. Instead of “join a private network,” you get access only to explicitly authorised services — with no ambient reachability at all. Its also 100% open source. If you want a simple productised, SaaS experience, NetFoundry, the company behind OpenZiti provides that.
deleted 8mo ago
[deleted]

nsbk 8mo ago

At this point Tailscale is working so well and I'm so happy with it that I'm afraid it's time to start migrating to Headscale [0] for my home network. The rag pull may just be too painful otherwise! [0]: https://headscale.net/ https://headscale.net/

sureglymop 8mo ago
I've been smoothly running headscale on a hetzner vps for many months now. Works without issues (note that it does lack some features still).
- ErneX 8mo ago
  Same here.

vizzier 8mo ago

> Also, sometimes it seems like I get rate limited on Tailscale. As I understand it if everything is working properly you should end up with a peer to peer wireguard connection after initial connection using tailscales infrastructure. ie, there should be nothing to rate limit. There are exceptions depending on your network environment where you need one of the relays noted in this post. As for opensource alternatives: https://github.com/juanfont/headscale https://github.com/juanfont/headscale can replace tailscales initial coordination servers and https://netbird.io/ https://netbird.io/ seemed to be a rapidly developing full stack alternative.

arsome 8mo ago
Headscale also offers a relay server of its own.
kkapelon 8mo ago
There is also netmaker

eurg 8mo ago

Companies pay for it. And except for their DERP servers, free users don't cost them much.

Aurornis 8mo ago

Tailscale is a perfect example of using a free tier to become popular with developers, who then evangelize the product to their employers. The employers pay for business scale plans.

zephen 8mo ago
I wonder about this. The hoops you have to jump through to be on two different tailnets might dissuade some home users from even bringing it up at work.
- baq 8mo ago
  Home users being on multiple tailnets is serious power user territory
  - zephen 8mo ago
    There are a lot of workarounds these days, such as tailnet switching, and, of course, if you're admin on both tailnets, you're practically golden with the "share" option. But even power users have to pick and choose their battles. If I had a nice tailnet home setup going I might be seriously miffed if I had to try to fit in some of my devices to a corporate tailnet I didn't control.
    - db48x 8mo ago
      True, but to be frank you shouldn’t be using personal devices for work purposes anyway.
      - zephen 8mo ago
        Security is a series of trade-offs, which in the worst case disallows anybody from doing anything. In the simplest case, if a person has two different sets of systems they desire to access from a cellphone, and an unwillingness to carry two different cellphones around with them, then it becomes a business decision of whether that person is valuable and trustworthy enough to allow access to work systems and "other" systems from that cellphone. Who pays for the cellphone, and whether this extends to laptops or not, are questions of degree.

thecapybara 8mo ago

I self-host a few apps and use Tailscale to access them remotely. It's worked well, so I recommended it as a possible solution to allow employees at my company to remotely access some on-prem resources while remote, and that's being considered. If we go with that, then that'd be Tailscale making money from me using the free plan.

dimatura 8mo ago

Our company pays for the premium business plan, $18/mo/user. You have to pay for at least the lower tier plan once your team grows beyond a handful of people. And there's several quite useful features (though maybe not essential) on the premium plan like serve/funnel and SSH. On the other hand, I do wonder about zerotier. before tailscale we used zerotier for a few years, and during the first 3-4 years we paid nothing because as far as I can recall there was nothing extra that we needed that paying would've gotten us. Eventually we did upgrade to add more users, and it cost something like $5/mo (total, not per user).

gpm 8mo ago
I've used serve/funnel on the tailscale free tier... definitely agree that the team size limit seems like it would move companies to the paid plan though.
- dimatura 8mo ago
  I think how it works usually is that they let you use the features from higher tier plans than the one you're on; once you use them enough they send you an email asking to upgrade. That's what happened to us and I've seen other users mention it. Not sure how I felt about it, OTOH maybe it was less friction than explicitly subscribing for some "2 weeks free trial" or whatever but OTOH it did feel weird and unexpected. Anyway, we felt the extra features were worth it so ended up paying.
  - gpm 8mo ago
    Hmm... Ok I checked the pricing page and funnel is available in the free tier (limited to 3 users) but not the $6/user/month tier - which you need for more than 6 users... strange pricing structure but I guess I see the logic. Any chance you were asked to upgrade from $6/user/month to $18/user/month and not free to $18/user/month? https://tailscale.com/pricing#application-networking https://tailscale.com/pricing#application-networking
    - dimatura 8mo ago

mrsssnake 8mo ago

Free personal tier is basically a cheap advertisement for them. You try Tailscale personally and get used to it, then it is very likely you would want to deploy it at your work seeing the benefits scaling even more with more people. And then they make money.

QuercusMax 8mo ago
1000%. Tailscale is the first VPN I've used that makes my life easier, and I'm using it for personal access to my selfhosted servers at home. I will definitely recommend it to companies I work for in the future.

Lammy 8mo ago

> How does Tailscale make money? They spy on your network behavior by default, so free users are still paying with their behavioral data. See https://tailscale.com/docs/features/logging https://tailscale.com/docs/features/logging “Each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.com). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.” They know what you're doing, when, from where, to where, on your supposedly “private” network. It's possible to opt out on Windows, on *nix systems, and when using the non-GUI client on macOS by enabling the FUD-named “TS_NO_LOGS_NO_SUPPORT” option: https://tailscale.com/docs/features/logging#opt-out-of-client-logging https://tailscale.com/docs/features/logging#opt-out-of-clien... It is not currently possible to opt out on iOS/Android clients: https://github.com/tailscale/tailscale/issues/13174 https://github.com/tailscale/tailscale/issues/13174 For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326 https://github.com/tailscale/tailscale/issues/15326

nickburns 8mo ago
Pretty much this. DNS, SNI, and otherwise plaintext traffic sniffing. That together with user/device 'fingerprinting' (a much more amorphous concept), and that's why such-and-such thing you were just talking about with so-and-so pops up on your screen/feed/whatever, sometimes only minutes later. I highly doubt any of this can actually be opted-out of. How else would they stay in business?
- namtim 8mo ago
  The `TS_NO_LOGS_NO_SUPPORT` option opts out of all log collection, and says in the name why it is collected in the first place. Tailscale has support for all users, including free, and having access to logs has to be how they can provide free support. Having quick access to logs reduces the time it takes to handle tickets, so they can help more people quickly and don't need to limit support to only paying users. The core client code is open source, feel free to inspect it yourself.

zaphar 8mo ago

There are a number of features and teamsizes that they provide where you have to pay money. Most company users are going to end up paying them money. But also their emphasis on P2P connections means their costs are quite low. It doesn't add much overhead to have the smallish number of personal users out there. They've talked about how having the free tier helps to force them keep those costs down in useful ways.

dec0dedab0de 8mo ago

Wouldn't the FOSS alternative be to simply use wireguard?

iso1631 8mo ago
Most posters on HN barely know what a subnet is so it's not that simple There's two key features 1) Tunnel management Tailscale will configure your p2p tunnels itself - if you have 10 devices, to do that yourself you'd have to manage 90 tunnels. Add another device and that goes upto 100. Remove a device and you have 9 other devices to update. 2) Firewall punching They provide an orchestration system which allows two devices both behind a nat or stateful firewall to communicate with each other without having to open holes in the firewall (because most firewalls will allow "established" connections - including measuring established UDP as "packet went from ipa:porta to ipb:portb 'outbound', thus until a timeout period any traffic from ipb:portb to ipa:porta will be let through (and natted as appropriate)". The orchestration sends traffic from ipa to ipb and ipb to ipa on known ports at the same time so both firewalls think the traffic is established. For nats which do source-port scrambling it uses the birthday paradox to get a matching stream. I believe you can run a similar headend using "headscale" yourself.
NoiseBert69 8mo ago
Yes and no. It's much manual work to get WG to behave like Tailscale.
newsoftheday 8mo ago
I do, I use a VPS (at OCI free) to host Wireguard. My home systems (running my production web sites and email) are on my VPN and mine and my wife's phones. I hand configured it all but it wasn't difficult for me.
nagaiaida 8mo ago
a simpler setup with broad feature parity would probably look more similar to nebula than bare wireguard

Suffocate5100 8mo ago

Nebula is what we use. It's definitely not as convenient, but it's 100% self-ownable.

allthetime 8mo ago

Facilitating peer to peer connections is cheap. Just like cloudflare, a healthy free offering makes lots of happy/loyal users. Some of those users have business needs / use for the paid features and support.

allthetime 8mo ago

Facilitating peer to peer connections is cheap. Just like cloudflare, a healthy free offering makes lots of happy/loyal developer users. Some of those users have business needs / use for the paid features and support and will convince their managers to buy in.

pkulak 8mo ago

I pay $5 a month, and my company has a license for every employee.

fdefitte 8mo ago

[dead]

batrat 8mo ago
It happened to others but there are also some very good examples like Veeam community edition which, IMO, is the best backup software. They had lots of discussions and even pressure from management to terminated, but the numbers made a lot of sense and they kept it. Tailscale is in disadvantage here because they are in a very crowded market and it will be very easy to slip into one corner and let way for others like netbird, netmaker, nebula(?), wireguard (like u said), etc.

UltraSane 8mo ago

Companies pay per user for TailScale as an alternative to conventional VPNs like Cisco AnyConnect.

jacquesm 8mo ago

Through paying users like me.

resiros 8mo ago

I use netbird and can only recommend it

cbility 8mo ago

https://netbird.io/ https://netbird.io/ is open source, with a freemium hosted option. Works for us and I find it easier to configure than tailscale for routing rules.