Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale raises $100M

tailscale.com

Post reply on HN
Print view View original

351–360 of 468 posts

Re: Tailscale raises $100M

#351

Post by shepherdjerred »

jjeaff wrote: post #293
shepherdjerred wrote: post #145

Earlier quoted context omitted.

I have a server at home with file syncing, personal media, and home automation. I want to be able to access it remotely, but I’d rather some of those things not be publicly accessible for security. I could always do HTTP auth with an nginx reverse proxy, but it’s not a very smooth workflow and it relies on me being able to configure my server/services correctly. Instead I can bind my services to Tailscales network in…

I don't think that is an anti-pattern. One well secured point of access is better than various http access points with varying levels of security and maintenance levels, all requiring frequent manual update to stay secure.

I meant that for larger organizations where security is a concern you'd want both -- your network should be secured and the individual applications should be as well. Again it's contextual advice and really doesn't matter for my internal site where there's not too much at stake.

Re: Tailscale raises $100M

#352

Post by naikrovek »

ncmncm wrote: post #338
naikrovek wrote: post #333

Earlier quoted context omitted.

you want a free service written, maintained, and hosted by others that they don't control . Am I understanding you?

No. I would be happy to pay for service, but they offer no choice but to rely on somebody else's authentication, regardless.

read harder next time. https://tailscale.com/kb/1119/sso-saml-oidc/

Re: Tailscale raises $100M

#353

Post by shepherdjerred »

samhw wrote: post #306
oicU00 wrote: post #165

Earlier quoted context omitted.

If they can do it it’s not impossible (they’re just people after all). With an open source implementation out there, anyone can do it merely pulling a Docker container, and without paying Tailscale. Regardless I manage a dozen users with no issue using Embarks container; once they’re setup I touch nothing. Paying people is not working with people; it’s working with a specific group. Open source is working with people…

If the open source implementation is equally good, I'm sure people will use that instead of Tailscale. That Tailscale exists makes me suspect that the open source implementation - as is usually the case with these "just use curlftpfs!" comments – is not equally good. The reality is that making software, like any other human endeavour, takes time and energy. Paying one another money is a rather well-established mechan…

It's the same argument as the famous Dropbox comment[0]. I'm generally going to prefer a polished service over a technical solution.

[0]: https://news.ycombinator.com/item?id=9224

Re: Tailscale raises $100M

#354

Post by nickysielicki »

polote wrote: post #327
nickysielicki wrote: post #111

Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it takes 15 minutes to get every device you own up and running and talking. This is the lowest friction personal VPN to ever exist, and once you see how easy it is for your own devices, you’ll wish you had it at work. The biggest risk that this company has is that…

> The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. The same thing is being said on HN about all kind of network software, but tell me one software that Cloudflare is really known for except its cdn ? None. HN is really a strong echo chamber and some people believe Cloudflare and Stripe ar…

I bring up cloudflare because the technologies involved with Tailscale are really cloudflare core competencies. Cloudflare runs 1.1.1.1/WARP which is a massive dns server and wireguard VPN, respectively. They already have Cloudflare Access. It’s a natural fit. It’s pretty easy to imagine that cloudflare is better positioned to steal customers from Tailscale than Cisco, F5, or Fortinet.

Cloudflare needs to solve two problems: they need to introduce a free tier of Access that doesn’t use the CDN and creates direct connections between endpoints (to basically remove all operating costs), and they need to make the onboarding process for hobbyists easier instead of having a “contact sales” link on their homepage for these products. That’s doable.

Re: Tailscale raises $100M

#355

Post by zepearl »

zellyn wrote: post #267
zepearl wrote: post #188

Earlier quoted context omitted.

So basically Wireguard with automated key setup/distribution/identity management? (btw. I love Wireguard - currenly using it to route traffic between my servers + transfer media between my home and my mother's mediacenter with both PCs being behind their own router - she loves it too as so far there were no problems hehe)

That, plus fanatically good NAT Traversal: https://tailscale.com/blog/how-nat-traversal-works/

But isn't that just part of Wireguard itself? In the end that's what's happening in my case when I exchange data through Wireguard between my flat and the one of my parents... .

Re: Tailscale raises $100M

#356

Post by SahAssar »

rhuber wrote: post #223
vgel wrote: post #222

Earlier quoted context omitted.

> People sometimes ask me to describe the differences between Nebula and Tailscale. One of the most important relates to performance and scale. Nebula can handle the amount of internal network traffic and scalability of nodes (100k+ nodes, constant churn) required on a large network like Slack's, but Tailscale cannot. Tailscale's performance is fine for many situations, but not suitable for infrastructure. It is just…

Another fair criticism. We will publish the benchmarks and make them repeatable (which most existing ones I've found don't bother to do). We hadn't done so because Tailscale isn't really seen as a direct competitor to what the Nebula project is doing, but if people want numbers, that's a thing we are happy to provide.

So "People sometimes ask me to describe the differences between Nebula and Tailscale" and the answer is "performance and scale", but you don't have clear comparisons for those numbers?

Re: Tailscale raises $100M

#357

Post by Spooky23 »

Sohcahtoa82 wrote: post #286
gzer0 wrote: post #137

Earlier quoted context omitted.

I am able to route traffic on my mobile device through my home network via the use of their "exit node" option. It allows one of my home devices to act as an exit node for my entire personal tailscale network. This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365

What other benefits are there? I use a PiHole to block ads on my phone already, but I do it via a PiHole installed on an EC2 instance that I also use as an IRC bouncer and other things.

It’s pretty similar as far as how it works for you.

It may be cheaper to VPN to home vs a cloud server, and you may avoid issues where sites block AWS. You can also securely forward other ports. Sometimes I print or access other services in my house that aren’t internet safe.

Re: Tailscale raises $100M

#359

Post by rhuber »

SahAssar wrote: post #356
rhuber wrote: post #223

Earlier quoted context omitted.

Another fair criticism. We will publish the benchmarks and make them repeatable (which most existing ones I've found don't bother to do). We hadn't done so because Tailscale isn't really seen as a direct competitor to what the Nebula project is doing, but if people want numbers, that's a thing we are happy to provide.

So "People sometimes ask me to describe the differences between Nebula and Tailscale" and the answer is "performance and scale", but you don't have clear comparisons for those numbers?

We have an automated set of ansible scripts that spin up large groups of hosts for Nebula performance regression testing, and a while back I added zerotier, tailscale, wireguard-userspace, wireguard, tinc, ipsec, and openvpn to that automation so I could get a sense of where things stand. I spent a lot of time optimizing each of the above options to make fair comparisons, but it was mostly for mine and the team's curiosity, and we weren't interested in playing benchmark-fight with similar softwares of the world.

Publishing repeatable benchmarks is hard, and when doing open source work, it just hasn't been a priority. As I replied above, if I'm going to say it I should prove it, and I promised to do just that.

And a counterpoint: tailscale does mention in the "Tailscale vs Nebula" article on their website that performance is just about the same but similarly provides no proof. This is motivation enough for me to show proof of the opposite, I guess.

Re: Tailscale raises $100M

#360

Post by JeremyNT »

discardedrefuse wrote: post #319
JeremyNT wrote: post #311

Earlier quoted context omitted.

It's easy to get started, but the issues come mostly from managing that "just a config file" over time. Have a bunch of new nodes? Replacing a lighthouse? Revoking and replacing certs? Here's a mistake that I made personally. Did you read the docs fully and realize that the default expiration for a CA is one year? The same is true for certificates. You need some kind of tooling to rotate certs every year, by default,…

Just FYI, when you create a CA cert or sign certs with nebula-cert you can specify a -duration. Which I know doesn't help you after the fact, but it might help someone going forward.

Very good to know! I did learn this and used 10 year certs/ca when my originals expired... as will presumably most of the other people who didn't fully grok the implications of the defaults :)
Post reply on HN