Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add ability to choose a custom coordination server

github.com

Post reply on HN
Print view View original

81–90 of 114 posts

Re: Add ability to choose a custom coordination server

#81

Post by soraminazuki »

stavros wrote: post #78
soraminazuki wrote: post #77

Earlier quoted context omitted.

You can mitigate potential risks by configuring your OS firewall to only allow independently encrypted and authenticated traffic through Tailscale. SSH and TLS covers most needs anyways, so it doesn't require additional work.

Eh, sure, but if I'm going to reimplement a VPN, why use Tailscale?

Not sure what you mean by reimplementing a VPN. I was talking about restricting the type of traffic that flows through Tailscale. Tailscale is still the only software responsible for handling external traffic in this scenario.

Re: Add ability to choose a custom coordination server

#82

Post by stavros »

soraminazuki wrote: post #81
stavros wrote: post #78

Earlier quoted context omitted.

Eh, sure, but if I'm going to reimplement a VPN, why use Tailscale?

Not sure what you mean by reimplementing a VPN. I was talking about restricting the type of traffic that flows through Tailscale. Tailscale is still the only software responsible for handling external traffic in this scenario.

I mean if I'm going to encrypt and authenticate my own traffic, it makes the VPN redundant. Is that what you meant? I might be confused.

Re: Add ability to choose a custom coordination server

#83

Post by jacooper »

nikolay wrote: post #55
geethree wrote: post #54

Earlier quoted context omitted.

Interested in these! Any chance you could drop a list of clones?

The recent ones I've seen are these: * NetBird ( https://netbird.io/ ) * Firezone ( https://www.firezone.dev/ )

But none of them as advanced as Head/Tailscale though.

No support for exit nodes for example, or DNS hostnames.

Re: Add ability to choose a custom coordination server

#85

Post by ec109685 »

stavros wrote: post #48
moontear wrote: post #45

Earlier quoted context omitted.

"allowing them access into my personal network" In what form? The private keys never leave the nodes, hence there shouldn't by any access per se (see https://tailscale.com/security/ ). Of course TS has insights into your networks, i.e. what servers it is installed on, what you connect to - so metadata.

They can add a node and connect to whatever other node they want.

This seems solvable. They talk about that here: https://tailscale.com/kb/1099/device-authorization/

But it still seems like they could flip that feature off if they got compromised. To remedy that, feels like they could support a preshared secret that they don't control / see being shared as a first step: https://tailscale.com/kb/1099/device-authorization/#generate...

Re: Add ability to choose a custom coordination server

#86

Post by stavros »

ec109685 wrote: post #85
stavros wrote: post #48

Earlier quoted context omitted.

They can add a node and connect to whatever other node they want.

This seems solvable. They talk about that here: https://tailscale.com/kb/1099/device-authorization/ But it still seems like they could flip that feature off if they got compromised. To remedy that, feels like they could support a preshared secret that they don't control / see being shared as a first step: https://tailscale.com/kb/1099/device-authorization/#generate...

Yeah, they control this setting so they can just disable it, or override it.

Since Headscale exists, though, this problem is solved quite neatly.

Re: Add ability to choose a custom coordination server

#87

Post by ec109685 »

stavros wrote: post #7

I love Tailscale but I am wary of allowing them access into my personal network. This way, I can use them for my stuff without my paranoia getting in the way, and I can recommend the hosted option for work, as it works perfectly.

For enterprises, they do offer self-hosted control servers, but for personal use, something like headscale will put you in more control: https://news.ycombinator.com/item?id=28574477

Re: Add ability to choose a custom coordination server

#88

Post by bombcar »

xxpor wrote: post #58
bombcar wrote: post #49

Earlier quoted context omitted.

The problem with public companies is they effectively have no shareholders; none that can actually do anything to affect the company. Which leaves the company to be run by the managers for the managers. Bogle (the father of the index fund) talks about how the index fund and friends has warped the benefits of ownership to leave companies effectively "unowned".

How is that any different from a typical private company?

A private company (and some public companies) have shareholders/owners that are large enough and active enough to control the company (Ford, famously).

Most just are kind of "managed", especially after a "star CEO" or similar moves on.

Re: Add ability to choose a custom coordination server

#89

Post by bombcar »

Analemma_ wrote: post #68
bombcar wrote: post #49

Earlier quoted context omitted.

The problem with public companies is they effectively have no shareholders; none that can actually do anything to affect the company. Which leaves the company to be run by the managers for the managers. Bogle (the father of the index fund) talks about how the index fund and friends has warped the benefits of ownership to leave companies effectively "unowned".

The alternatives to index funds are either that ordinary middle-class people can't participate in ownership of companies at all, or that they have to pay extortionate fees to fund managers. No thank you.

The choice isn't between index/active fund ownership - the question is how to make it so the company is not managed for the benefit of the managers, but actually for the benefit of the owners, however many or few there are.

Some companies in Europe have what might be part of the solution, with the union et al having board representation.

Re: Add ability to choose a custom coordination server

#90

Post by soraminazuki »

stavros wrote: post #82
soraminazuki wrote: post #81

Earlier quoted context omitted.

Not sure what you mean by reimplementing a VPN. I was talking about restricting the type of traffic that flows through Tailscale. Tailscale is still the only software responsible for handling external traffic in this scenario.

I mean if I'm going to encrypt and authenticate my own traffic, it makes the VPN redundant. Is that what you meant? I might be confused.

I use Tailscale as a reasonably secure and hassle-free entrypoint into my own network. I could alternatively just expose my SSH / HTTPS servers to the internet, but that would require much more effort to maintain. Not to mention that it would expose my network to even more attackers, not just theoretical ones.

I also believe that traffic inside homes should be secured regardless since routers can be hacked. So in my case, I didn't consider it a duplicated effort. I had my traffic already encrypted and authenticated when I started using Tailscale.

Post reply on HN