4 ms·

To me this sounds like tailscale - does anyone have any insight into how what this is doing is similar or different?

hazkoulia 4mo ago
My 5 second summary: Tailscale connects devices and Iroh connects applications.
forsalebypwner 4mo ago
Their use of addressing by keys instead of by IPs seems to be the main differentiator. Also the support for custom transports (BLE, LoRa, Tor) which appears to be in progress and not yet fully implemented. I love Tailscale, it's deployed on all my devices. But I might check this out for the transports part in particular.
- RationPhantoms 4mo ago
  Tailscale uses MagicDNS which allows one to auto-generate a semi-memorable private hostname as well. I'm in the networking industry so I'm not seeing anything truly groundbreaking or that isn't offered elsewhere.
  - forsalebypwner 4mo ago
    Yeah and my understanding of Iroh wasn't quite right either, it sounds like it's positioned to be more of a library to use in code, rather than a VPN solution like Tailscale. I love MagicDNS - A long time ago I wrote a stupid Python script to have it continually generate MagicDNS names until one of them contained a word I was looking for.
  - danudey 4mo ago
    The pitch here appears to be that this can allow communication between services without having to add them to a tailnet or such; e.g. if you wanted to let a friend or coworker access some service on your local network without making them join a tailnet, add a public external endpoint to forward traffic, set up a VPN, etc. IIUC you just send someone 'here is the connection information' and it just works automatically.
  - rklaehn 4mo ago
    It isn't meant to be groundbreaking. It is meant to be a rock solid building block that you can put into your application. That being said, I think our use of QUIC multipath is pretty novel. If you use tailscale or a VPN, your connection (TCP or QUIC or whatever) won't immediately notice when the underlying transport changes (e.g. relay to direct or vice versa). So there will be some delays as the congestion controller learns about the underlying transport. With the latest iroh using QUIC multipath, each path gets its own congestion controller, so switches of the underlying transport are more smooth. Also, multipath allows us to treat custom transports as just additional paths.
dignifiedquire 4mo ago
Tailscale is built to be global to your device, while iroh is built to be embedded into each application. This allows application developers and users a much more fine grained and bespoke setup, than having a single global bridge.
- kkapelon 4mo ago
  you can embed tailscale on the application level https://tailscale.com/docs/features/tsnet https://tailscale.com/docs/features/tsnet
  - nemothekid 4mo ago
    This isn't the same functionality - if I'm shipping a video conferencing application, tsnet would require all my customers be in my tailnet.
    - kkapelon 4mo ago
      but if I am shipping a video conferencing application (where I control both the client and the server) I don't need nat traversal anymore. My clients will have outgoing connections to whichever co-ordination server I choose. Tailscale is great for bringing devices/apps into a secure network when I cannot modify them in any way. If I have full access to the source code for everything, the story changes completely.
      - ranguna 4mo ago
        What if you build a p2p video conferencing app with user controlled co-ordinator "server". Server in quotes, because maybe iroh works through the browser?
      - nemothekid 4mo ago
        >My clients will have outgoing connections to whichever co-ordination server I choose. Then it's no longer p2p? If I wanted to avoid paying cloud egress costs, then I would need a p2p solution. >Tailscale is great for bringing devices/apps into a secure network when I cannot modify them in any way. If I have full access to the source code for everything, the story changes completely. Naturally, but this thread isn't about Tailscale, its about Iroh. You were the one that claimed Tailscale can already do what Iroh can. But I've pointed out a usecase where Tailscale wouldn't suffice that Iroh can accomplish.
rklaehn 4mo ago
I work on iroh. On the technical level, the biggest difference is probably that we build on QUIC whereas tailscale builds on wireguard. Iroh is a library that is made to embed into your application, whereas the tailscale offering started as a daemon. It allows embedding, but you are still carrying the baggage of a go runtime. Iroh is written in rust. Rust compiles to a native library and is therefore easier and more lightweight to embed in compiled programs (C, C++) and languages such as js and python. Another big internal difference is that we use relay URLs whereas tailscale is using relay IDs. The consequence is that every iroh endpoint, no matter if using self-hosted relays, the n0 public relays, or the n0 paid relays, can reach any other. In tailscale two nodes will only be able to talk if they use the same mapping from relay id to relay ip address, which usually means that they use the same coordination server. Last but not least, while we do have a commercial offering, everything you need to run iroh is open source, licensed MIT and Apache2. With tailscale the coordination server is closed source and operated by tailscale, and the only way to run your own tailnet is to use the headscale community project.

My 5 second summary: Tailscale connects devices and Iroh connects applications.

Their use of addressing by keys instead of by IPs seems to be the main differentiator. Also the support for custom transports (BLE, LoRa, Tor) which appears to be in progress and not yet fully implemented. I love Tailscale, it's deployed on all my devices. But I might check this out for the transports part in particular.

RationPhantoms 4mo ago
Tailscale uses MagicDNS which allows one to auto-generate a semi-memorable private hostname as well. I'm in the networking industry so I'm not seeing anything truly groundbreaking or that isn't offered elsewhere.
- forsalebypwner 4mo ago
  Yeah and my understanding of Iroh wasn't quite right either, it sounds like it's positioned to be more of a library to use in code, rather than a VPN solution like Tailscale. I love MagicDNS - A long time ago I wrote a stupid Python script to have it continually generate MagicDNS names until one of them contained a word I was looking for.
- danudey 4mo ago
  The pitch here appears to be that this can allow communication between services without having to add them to a tailnet or such; e.g. if you wanted to let a friend or coworker access some service on your local network without making them join a tailnet, add a public external endpoint to forward traffic, set up a VPN, etc. IIUC you just send someone 'here is the connection information' and it just works automatically.
- rklaehn 4mo ago
  It isn't meant to be groundbreaking. It is meant to be a rock solid building block that you can put into your application. That being said, I think our use of QUIC multipath is pretty novel. If you use tailscale or a VPN, your connection (TCP or QUIC or whatever) won't immediately notice when the underlying transport changes (e.g. relay to direct or vice versa). So there will be some delays as the congestion controller learns about the underlying transport. With the latest iroh using QUIC multipath, each path gets its own congestion controller, so switches of the underlying transport are more smooth. Also, multipath allows us to treat custom transports as just additional paths.

dignifiedquire 4mo ago

Tailscale is built to be global to your device, while iroh is built to be embedded into each application. This allows application developers and users a much more fine grained and bespoke setup, than having a single global bridge.

kkapelon 4mo ago
you can embed tailscale on the application level https://tailscale.com/docs/features/tsnet https://tailscale.com/docs/features/tsnet
- nemothekid 4mo ago
  This isn't the same functionality - if I'm shipping a video conferencing application, tsnet would require all my customers be in my tailnet.
  - kkapelon 4mo ago
    but if I am shipping a video conferencing application (where I control both the client and the server) I don't need nat traversal anymore. My clients will have outgoing connections to whichever co-ordination server I choose. Tailscale is great for bringing devices/apps into a secure network when I cannot modify them in any way. If I have full access to the source code for everything, the story changes completely.
    - ranguna 4mo ago
      What if you build a p2p video conferencing app with user controlled co-ordinator "server". Server in quotes, because maybe iroh works through the browser?
    - nemothekid 4mo ago
      >My clients will have outgoing connections to whichever co-ordination server I choose. Then it's no longer p2p? If I wanted to avoid paying cloud egress costs, then I would need a p2p solution. >Tailscale is great for bringing devices/apps into a secure network when I cannot modify them in any way. If I have full access to the source code for everything, the story changes completely. Naturally, but this thread isn't about Tailscale, its about Iroh. You were the one that claimed Tailscale can already do what Iroh can. But I've pointed out a usecase where Tailscale wouldn't suffice that Iroh can accomplish.

rklaehn 4mo ago

I work on iroh. On the technical level, the biggest difference is probably that we build on QUIC whereas tailscale builds on wireguard. Iroh is a library that is made to embed into your application, whereas the tailscale offering started as a daemon. It allows embedding, but you are still carrying the baggage of a go runtime. Iroh is written in rust. Rust compiles to a native library and is therefore easier and more lightweight to embed in compiled programs (C, C++) and languages such as js and python. Another big internal difference is that we use relay URLs whereas tailscale is using relay IDs. The consequence is that every iroh endpoint, no matter if using self-hosted relays, the n0 public relays, or the n0 paid relays, can reach any other. In tailscale two nodes will only be able to talk if they use the same mapping from relay id to relay ip address, which usually means that they use the same coordination server. Last but not least, while we do have a commercial offering, everything you need to run iroh is open source, licensed MIT and Apache2. With tailscale the coordination server is closed source and operated by tailscale, and the only way to run your own tailnet is to use the headscale community project.