Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Add ability to choose a custom coordination server

github.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Add ability to choose a custom coordination server

#101

Post by dcow »

bradfitz wrote: post #46
eddieroger wrote: post #19

Earlier quoted context omitted.

I wonder why they don't open source the iOS client like they do Android. There is precedent for open source iOS apps still available on the App Store, so that's not a limitation. I would gladly dedicate some time to adding this as a PR (as I'm sure a million others would, too).

> I wonder why they don't open source the iOS client like they do Android. Mostly because developing for iOS and macOS is terrible, especially when your app needs to have "entitlements". Tailscale uses a "Network Extension entitlement" which is linked to our corporate Apple account. Even onboarding new employees and getting them up to speed on xcode/macOS/iOS development is painful. It often requires a bunch of messi…

Keep in mind that for security sensitive applications, being open source isn't necessarily solely about me wanting to build and run my own copy, it’s also about verifying the code yourself. I know that breaks down because without verified/reproducible binaries (impossible with app store distribution afaik) you could still publish malicious nonsense, but assuming that you publish what’s in the repo, being able to verify the code functions how you say it does is not nothing.

I have dealt with mac/iOS network extension BS before too so I feel you there. But, on that front, it also means I’d know a bit about what’s going on and find the code insightful.

Re: Add ability to choose a custom coordination server

#102

Post by vineyardmike »

dpatterbee wrote: post #37
pilif wrote: post #8

Earlier quoted context omitted.

> down to the level of not over complicating their menus to be fair, their mobile UX has plenty of warts and behaviors that don't match platform expectations and are confusing (like what happens when you tap on any of the listed machines that you have access to). This one seems to at least have been partially motivated by making sure that accessing tailscale without paying is not too visible. I'm saying this as a hug…

>> making sure that accessing tailscale without paying is not too visible. Not sure what this means, Tailscale is free for the vast majority of non-corporate users, and I would imagine that anyone who's using it so intensely that they need the "personal pro" plan is probably someone techie enough to dig around and find out about headscale. Also headscale isn't entirely free if you're paying for a VPS or other server…

You wouldn’t pay tailscale if you used headscale, you’d just be using the efforts they funded by using their app.

Re: Add ability to choose a custom coordination server

#103

Post by moontear »

stavros wrote: post #48
moontear wrote: post #45

Earlier quoted context omitted.

"allowing them access into my personal network" In what form? The private keys never leave the nodes, hence there shouldn't by any access per se (see https://tailscale.com/security/ ). Of course TS has insights into your networks, i.e. what servers it is installed on, what you connect to - so metadata.

They can add a node and connect to whatever other node they want.

Haven't thought about that and this should certainly be addressed - especially if I'd use Tailscale for business.

Re: Add ability to choose a custom coordination server

#104

Post by moontear »

ikiris wrote: post #65
moontear wrote: post #44

Earlier quoted context omitted.

But don't you want your own OpenID service? I highly recomment Authelia - easy to set up and works for so many services that allow a custom OIDC service.

with the red flag that they don't support registering multiple security keys via gui why im still using keycloak

I wouldn't consider this a red flag, but a missing feature.

But nothing against keycloak - keycloak is the gold standard. But compared to Authelia, Keycloak is really cumbersome to get up and running and also to maintain.

Re: Add ability to choose a custom coordination server

#105

Post by stavros »

yencabulator wrote: post #94
ec109685 wrote: post #85

Earlier quoted context omitted.

This seems solvable. They talk about that here: https://tailscale.com/kb/1099/device-authorization/ But it still seems like they could flip that feature off if they got compromised. To remedy that, feels like they could support a preshared secret that they don't control / see being shared as a first step: https://tailscale.com/kb/1099/device-authorization/#generate...

You can't generate a secret with a webapp they control without them controlling the secret too.

I assume the notion was that the nodes will all know the secret but the control server won't.

Re: Add ability to choose a custom coordination server

#106

Post by yepguy »

stavros wrote: post #100
yepguy wrote: post #99

Earlier quoted context omitted.

I don't really understand how self-hosting headscale is actually any more secure. The control server needs a stable IP address, so I'd need to run it on a VPS or something, which means I'm still trusting a third-party to not mess with my network.

My home machine has a static IP, so I run it there. Does it need a static IP, or just a hostname?

I guess it probably only needs a hostname. Although I'd still feel uneasy about running it at home, because I don't want any incoming connections to my home network unless it's over Tailscale, and headscale would need some kind of firewall exception.

Maybe headscale could run at home, served over a tunnel[1] to a VPS. But honestly, if I ever lost confidence in the trustworthiness of Tailscale the company, I would just connect my devices with some other overlay network like Yggdrasil[2] or Tor.

[1]: https://github.com/anderspitman/awesome-tunneling [2]: https://yggdrasil-network.github.io/

Re: Add ability to choose a custom coordination server

#107

Post by stavros »

yepguy wrote: post #106
stavros wrote: post #100

Earlier quoted context omitted.

My home machine has a static IP, so I run it there. Does it need a static IP, or just a hostname?

I guess it probably only needs a hostname. Although I'd still feel uneasy about running it at home, because I don't want any incoming connections to my home network unless it's over Tailscale, and headscale would need some kind of firewall exception. Maybe headscale could run at home, served over a tunnel[1] to a VPS. But honestly, if I ever lost confidence in the trustworthiness of Tailscale the company, I would jus…

I think Nebula is the current favorite, but it's not as plug and play as Tailscale.

Re: Add ability to choose a custom coordination server

#108

Post by yencabulator »

ec109685 wrote: post #85
stavros wrote: post #48

Earlier quoted context omitted.

They can add a node and connect to whatever other node they want.

This seems solvable. They talk about that here: https://tailscale.com/kb/1099/device-authorization/ But it still seems like they could flip that feature off if they got compromised. To remedy that, feels like they could support a preshared secret that they don't control / see being shared as a first step: https://tailscale.com/kb/1099/device-authorization/#generate...

I think the Tailscale part that actually knows what auth keys look like is proprietary, but at least for Headscale they seem to be just unguessable database row identifiers: https://github.com/juanfont/headscale/blob/ade4e23e149e7846b...

Nothing in the Tailscale design has ever pointed to features that would guard your infrastructure from them.

Re: Add ability to choose a custom coordination server

#109

Post by GekkePrutser »

moontear wrote: post #44
GekkePrutser wrote: post #39

Earlier quoted context omitted.

Hmm, the SSO is too cumbersome with me (I don't want to set up my own OpenID service just for this). The preauth key might work though. I'll try it out!

But don't you want your own OpenID service? I highly recomment Authelia - easy to set up and works for so many services that allow a custom OIDC service.

Thanks for your tips. If it's that easy then yeah maybe. I would like to do more with fido2. And keycloak is indeed complex.

I would need more security keys but it sounds like there is a non-gui method? That'd be fine for me.

Re: Add ability to choose a custom coordination server

#110

Post by nikolay »

jacooper wrote: post #83
nikolay wrote: post #55

Earlier quoted context omitted.

The recent ones I've seen are these: * NetBird ( https://netbird.io/ ) * Firezone ( https://www.firezone.dev/ )

But none of them as advanced as Head/Tailscale though. No support for exit nodes for example, or DNS hostnames.

I agree, but they will get there. They just looked more polished, but that's all at the moment.
Post reply on HN