5 ms·
Yeah, tailscale seems to have leadership with their head on right, I agree with the way they handle a lot of things.
by binhex 2mo ago
Yeah, tailscale seems to have leadership with their head on right, I agree with the way they handle a lot of things.
- devmor 2mo agoTheir CEO is a very nice and personable guy too. Has given me and others advice on random topics of his interest with no nonsense plenty of times.
- saghm 2mo agoYeah, this part also stuck out to me: > Because this wouldn’t be a quick or easy fix, we reached out to the SQLite developers for a professional support contract. This was a great decision. It gave us direct access to their deep expertise and experience, and we had many detailed technical conversations about our architecture and our incidents. They were willing to pay to get help solving the problem, and then pay again to make sure that the problem is easier to avoid in the future! That kind of long-term thinking seems pretty rare nowadays...
- jjordan 2mo agoProbably the most refreshing thing I've read in a while. Glad to support them moving forward if this is indeed their modus operandi.
- LoganDark 2mo agoTailscale is the best. It's infinitely better than Hamachi, ZeroTier, etc. My only gripe is that they have some really weird SSO requirements like GitHub, etc. and then that provider becomes a permanent part of your identity.
- felixg3 2mo agoI think their reasoning on not being an identify provider but acting solely downstream is very clever.
- jdjdjebeb 2mo agoY? What's wrong with providing username/password authentication
- LoganDark 2mo agoYou become responsible for keeping those credentials secure, among a whole host of other problems. (Abuse like credential stuffing (more), data breaches (more), account farms (more), and so on.)
- semiquaver 2mo agoBeing an identity provider for anything important is the freaking worst. Exposes you to a million problems. You need human support for login problems and lost MFA tokens, and you are an attack magnet.
- miki123211 2mo agoWhich is why you want magic links. Don't be the identity provider, have the email host be the identity provider (which it is anyway if you have a forgot password prompt). Agreed 100% that nobody should still be using passwords in 2026 though.
- l72 2mo agoAs a user, I really don't care for magic links. The whole, start the log-in process, switch context, wait for email (sometimes up to a minute), click on it, have it open a new tab in a different window than where I started is just a pain. I feel like I spend half my day logging in to services these days. The only time I like magic links is for services where I am "not really a user". For example, an appointment reminder for my doctor where I need to validate my insurance. Great, send me an email 24-hours before with the reminder and a magic link, as I don't want to think about an account there.
- efreak 2mo agoI detest magic links. I have probably 9-10 accounts with a certain service that uses magic links (I mostly use them to get an API key or download a file every few months and never visit directly otherwise) because 1. the only login method they support is magic link and login with Google/Facebook. There's no password field so my password manager can't fill out my login details for me. 2. I don't have a Facebook account, and I don't keep my Google account signed in. Even if I did, I don't want them using these as my primary email address. (I use a catch-all and don't give out the primary address; I give each service it's own address) 3. A bunch of newsletters and forums (hackaday, etc) mention them by name every few weeks, often in the subject field, making it hard to search for. They don't send me any newsletters themselves, and I don't participate in their forums so there's nothing from them directly. They can't do anything about this, but it makes things harder. 4. If you enter a new email address that they've never seen before, the process exactly the same until after you click the magic link you received. They don't tell you they've never seen it before until you verify the address. 5. As such, if I can't recall the exact address I used to sign in, I automatically create a new account and don't find out until after I click the magic link and I'm asked to enter a new username or use the existing username they've already created. Proceed to settings and create a new API key for a new account instead of just adding one to my existing account. This is an extreme case, yes, but I have similar issues with several services that only support magic links and GitHub login, and it's hard to configure services to use a new catch-all address when they harvest my address from GitHub login and won't let me change it. Magic links are a great tool, but they should _never_ be the only option. They should supplement existing login methods. Password managers exist for a reason. Several services that I have since stopped using for this reason have in the past decided that they should start sending emails to the addresses they harvested from login with other service. Two services have gotten my magic link address stuck in their system because it's not associated with an account (the account has been deleted) and thus I can't manage subscriptions.
- freeAgent 2mo agoYeah, I have my Tailscale tied to my Apple account, which just feels weird. I can add a Passkey account to my Tailnet and make it manager, etc., so that’s what I’ve done. The owner is my Apple account, but I actually do everything admin-wise with a Passkey account.
- artimaeis 2mo agoJust FYI - with Tailscale you can switch SSO providers by putting in a support ticket. I did it last year and it was a breeze.
- LoganDark 2mo agoOh, thank you! I might do that.
- saghm 2mo agoI've been a fan of Tailscale since encountering it for the first time at a previous job at a small startup. Someone asked if anyone had a Linux machine when we were all testing out something, and I mentioned I had a personal Linux desktop but wasn't sure how to connect it to the VPN for access, and it turned out that the solution was just literally running two commands in the terminal after installing tailscale from the repos. Compared to my first job where connecting to the VPN from Linux required hours of mucking around with openswan (or was it strongswan? so many swans...) and trial and error with various config files, it was unfathomably straightforward.
- graemep 2mo agoWith a desktop its usually possible from the network setting GUI? Worked like that last time I needed to use a VPN for access to a corporate network.
- throwway120385 2mo agoSome of the NetworkManager VPN plugins have weird side-effects. Like the one for OpenVPN force-disables split tunnel configurations and there's no way to turn that off, meaning that all traffic routes through the VPN even if you'd rather only send stuff for certain destination addresses through.
- saghm 2mo agoBased on the experience that I (and other coworkers, including on other distros) had, whatever configurations our VPN needed did not seem to work out of the box on network manager.
- miki123211 2mo agoA lot of this is just weird Linux on the desktop weirdness. On Windows and Mac, VPN config is usually just installing a client, signing in, and then it all basically works. Sometimes you don't even need the client and can set it up in settings.
- altairprime 2mo agoHow are the requirements weird? They support any OIDC endpoint whether your own or a vendor’s, and, while uninteresting to HN folks, they also now support passkeys for having no SSO provider at all.
- throwaway27448 2mo agoThis isn't exactly new; the other model is to just hire them directly. Unfortunately this has not generally led to open source outside of the enterprise world getting similar funding, but it is what it is.
- saghm 2mo agoWhat other examples of companies paying for something specific to be developed outside of their ongoing paid support contract can you point me to? I'm open to the possibility that this is more common than I realize, but I've yet to hear of another example of sponsoring development separately from support contracts.
- x0x0 2mo agoIt's common for databases. This is Percona's business model. They employ core pg/mysql developers and you can buy a support package from them. Same for enterprisedb. Pretty reasonably priced packages (like maybe $10k-ish/core IIRC) get you 24x7 support. I've only had to escalate issues once but inside 10 hours we got a pg core committer to debug some very strange vacuum behavior.
- saghm 2mo agoTo clarify, I'm not saying that support contracts are uncommon. I'm saying that going out of their way to then additionally sponsor development of a specific testing tool on top of the support contract is not something I've heard companies do before, and it's pretty awesome!
- SchemaLoad 2mo agoThey could have just spent $300,000 in tokens to AI slop rewrite SQLite in Rust.
- edoceo 2mo agoThat would be lame. Instead they spent less and improved the world for everyone who used SQLite (which is really a lot of people)
- packetlost 2mo agoAvery is one of the few people I have enough respect for to look up to.
- rcleveng 2mo agoAvery is amazing, reading his writings was one of the highlights of my time at Google. There were many talented and articulate people there, the level of discourse used to be amazing.
- garganzol 2mo agoIn real life, an imaginary "leadership" quickly evaporates upon the first hurdle of any kind until proven otherwise by real actions. If I was in your shoes, I would be very careful with blanket statements like these.
- fragmede 2mo agoThis would be the "proven otherwise by real actions" part. They've been around since 2017 and have had plenty of time to hit various hurdles. Past performance is no guarantee of future performance and it is within the realm of possibility for them to go of change course like Elon did. But who are you? Are your Internet comments some proenoucement of truth that can never ever be taken back? So you said something that, years later, turns out to be wrong. So what?
- AtlasBarfed 2mo agoI wish they'd buy the carcass of Keybase from Zoom. It seems very similar to Tailscale: immense utility from a free-tier product for the general public, which leads to trust and a large enterprise market.
- Corrado 2mo agoWow, that’s a great idea! I loved keybase back in the day and really thought it solved a real world problem in a unique and interesting way. Then Zoom bought it (for some reason) and left it to rot.
- snorremd 2mo agoYou might already know and used "for some reason" as sarcasm. For those that do not: Zoom did the usual aqui-hire. They needed to show their enterprise customers they were taking e2e encryption seriously, so they bought out the guys who did exactly that kind of encryption with Keybase. A shame really, because Keybase was kind of unique in the way the facilitated social proof of identity tied to cryptographic keys. A shame though that they never found a really sustainable business model. When they turned to crypto currency towards the end of their independent run I knew it probably wouldn't last.
- fodkodrasz 2mo agothe UX was so terrible that it was inevitable it won't stick. It was clunky and alien on every productivity platform, I attempted to work in a team leveraging it, and it was painful on windows and macos alike. I just deleted it as I noticed it was responsible of about 30% of active cpu (and battery drain) usage on my mac, while being logged out due to inactivity. Honestly: I never particularly liked it, and I could not feel the concept especially tempting, just went with the team.
- rglullis 2mo agoOr instead of buying Keybase, they could fund https://keyoxide.org/ https://keyoxide.org/?
- 2mo ago
- xyst 2mo agoAt least for now. All it takes is one greedy executive decision to stop supporting headscale. Given it’s an American company, it’s entirely possible.
- jkaplowitz 2mo agoTailscale is Canadian, headquartered in Toronto.