Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add ability to choose a custom coordination server

github.com

Post reply on HN
Print view View original

41–50 of 114 posts

Re: Add ability to choose a custom coordination server

#41

Post by jlkuester7 »

nicoburns wrote: post #26
dkjaudyeqooe wrote: post #25

Earlier quoted context omitted.

Earning large sums of money corrupts everything. Eventually people realise that being 'evil' is highly profitable.

I think it might be being a public company more than it is about earning large sums of money. The people who own public companies ultimately have control of the company, and typically care only about how much money is generated.

Yup, this what what I eventually grew to dislike the most about working for a public company. At the end of the day the stock price was the only thing that mattered. It would have been easier to stomach if the shareholders had a long-term vision of a healthy successful company whose value accumulates over time by making good long-term business decisions. But, quarterly returns were the name of the game. The executive compensation was tied to that performance and that cemented it into the basic strategy of all decisions.... (And this was for a large (20000+ employees), well established (40+ years old), corporation in a relatively stable sector (health care tech).

Re: Add ability to choose a custom coordination server

#42

Post by Shish2k »

n3t wrote: post #3

That's great! What about iOS?

I’m hoping for this too - for me I like self-hosting, and I also like throwing money at companies who produce good products. If there was like a $20-per-device tailscale-pro app which was identical except for allowing a custom server, I’d buy that without thinking twice...

Re: Add ability to choose a custom coordination server

#43

Post by candiddevmike »

CGamesPlay wrote: post #38
candiddevmike wrote: post #11

If you're looking for a tailscale alternative (ish), I built a plugin for HashiCorp Vault to manage Wireguard keys: https://github.com/candiddev/vault-plugin-secrets-wireguard It's a bit more involved than Tailscale with the benefit that it uses Vault's robust authentication options.

Does the vault read command produce a full mesh network? I’m assuming that’s what it does, but it isn’t spelled out in the readme.

Yea, reading the `/wg-quick` endpoint will produce a rendered config for a wg-quick interface that contains all of the peers in the group. Combined with the Vault agent example, it will update the node automatically as peers are added/deleted.

Re: Add ability to choose a custom coordination server

#44

Post by moontear »

GekkePrutser wrote: post #39
gruez wrote: post #28

Earlier quoted context omitted.

>I wonder if Headscale can also use internal credentials? As far as I remember with tailscale you had to log in with Google or Microsoft which is another total deal-breaker. But I haven't looked at it in ages as the hosted variety was a non starter anyway. from the project page: https://github.com/juanfont/headscale >Node registration > • Single-Sign-On (via Open ID Connect) > • Pre authenticated key

Hmm, the SSO is too cumbersome with me (I don't want to set up my own OpenID service just for this). The preauth key might work though. I'll try it out!

But don't you want your own OpenID service? I highly recomment Authelia - easy to set up and works for so many services that allow a custom OIDC service.

Re: Add ability to choose a custom coordination server

#45

Post by moontear »

stavros wrote: post #7

I love Tailscale but I am wary of allowing them access into my personal network. This way, I can use them for my stuff without my paranoia getting in the way, and I can recommend the hosted option for work, as it works perfectly.

"allowing them access into my personal network"

In what form? The private keys never leave the nodes, hence there shouldn't by any access per se (see https://tailscale.com/security/). Of course TS has insights into your networks, i.e. what servers it is installed on, what you connect to - so metadata.

Re: Add ability to choose a custom coordination server

#46

Post by bradfitz »

eddieroger wrote: post #19
madjam002 wrote: post #15

Earlier quoted context omitted.

Yep it doesn't work on iOS, hopefully the Tailscale team add a similar debug menu that they added on Android and make the login server URL configurable through there, or a working configuration through a .mobileconfig would also be fine!

I wonder why they don't open source the iOS client like they do Android. There is precedent for open source iOS apps still available on the App Store, so that's not a limitation. I would gladly dedicate some time to adding this as a PR (as I'm sure a million others would, too).

> I wonder why they don't open source the iOS client like they do Android.

Mostly because developing for iOS and macOS is terrible, especially when your app needs to have "entitlements". Tailscale uses a "Network Extension entitlement" which is linked to our corporate Apple account. Even onboarding new employees and getting them up to speed on xcode/macOS/iOS development is painful. It often requires a bunch of messing around with Keychain and random reboots (not just Xcode restarts!) because something in the macOS kernel gets confused. For some development we also need to disable System Integrity Protection. And make sure there aren't duplicate copies of certain files between /Applications and ~/Library/Developer/whatever.

And then once you get it all working, some cert or login or something in Xcode or Keychain expires in a few months and you have to re-learn the whole esoteric dance once again.

The whole process of developing Network Extensions is pretty terrible.

Even if we open sourced it, you couldn't just git clone it & hit play in Xcode. Even if you paid Apple $100/year, you still couldn't, because your Apple account isn't blessed enough with the right to use a Network Extension.

It's hard enough for us to support Apple platform development internally without helping the world learn Xcode/code signing/entitlements/Keychain.

I've been and remain a huge open source fanboy for about 25 years now. If I thought we or the community would benefit from it being open source, I'd argue for us open sourcing it. But it just doesn't seem worthwhile. Or maybe I'm just still angry at the platform.

Re: Add ability to choose a custom coordination server

#48

Post by stavros »

moontear wrote: post #45
stavros wrote: post #7

I love Tailscale but I am wary of allowing them access into my personal network. This way, I can use them for my stuff without my paranoia getting in the way, and I can recommend the hosted option for work, as it works perfectly.

"allowing them access into my personal network" In what form? The private keys never leave the nodes, hence there shouldn't by any access per se (see https://tailscale.com/security/ ). Of course TS has insights into your networks, i.e. what servers it is installed on, what you connect to - so metadata.

They can add a node and connect to whatever other node they want.

Re: Add ability to choose a custom coordination server

#49

Post by bombcar »

jlkuester7 wrote: post #41
nicoburns wrote: post #26

Earlier quoted context omitted.

I think it might be being a public company more than it is about earning large sums of money. The people who own public companies ultimately have control of the company, and typically care only about how much money is generated.

Yup, this what what I eventually grew to dislike the most about working for a public company. At the end of the day the stock price was the only thing that mattered. It would have been easier to stomach if the shareholders had a long-term vision of a healthy successful company whose value accumulates over time by making good long-term business decisions. But, quarterly returns were the name of the game. The executive…

The problem with public companies is they effectively have no shareholders; none that can actually do anything to affect the company. Which leaves the company to be run by the managers for the managers.

Bogle (the father of the index fund) talks about how the index fund and friends has warped the benefits of ownership to leave companies effectively "unowned".

Re: Add ability to choose a custom coordination server

#50

Post by nabakin »

aaronharnly wrote: post #21
itsjloh wrote: post #5

Its really impressive how much Tailscale care about the UX of the whole product all the way down to the level of not over complicating their menus. The whole Tailscale experience for an enduser (ie not Tailscale admin) is so much nicer than compared with something like OpenVPN in a place without MDM.

The solution of only showing menu opens if you repeatedly open and close the menu seems very bizarre to me though? Is there precedent for that?

I think the point is the users are very unlikely to do it. Tailscale's UI is designed to be used by as many people as possible and even a single additional menu hurts that goal
Post reply on HN