Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Internet

tailscale.com

Post reply on HN
Print view View original

101–110 of 315 posts

Re: The New Internet

#101

Post by smolder »

throwaway211 wrote: post #94
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

[flagged]

This is a poor analogy. Historically there is a significant cost to making bad cars with frequent repair needs.

Re: The New Internet

#102

Post by Animats »

teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

And, worse, incentivized to require users to use a "coordination server" which helps with the NAT and firewall traversal problem by being something you can reach from outbound-only clients. There's a lot of verbiage there, but the general idea seems to be that Tailscale sits at the middle of this as the means by which machines find each other.

There are other ways to do that.

There are dynamic DNS schemes, so you can give your machine which only has a temporary IP address a permanent name. That's been around for decades, and seems to have a bad reputation.

There are schemes with multiple coordination nodes that know about each other, and published lists of such nodes. The list may be out of date, but as long as the published list has one live node, you can connect and get updated. That's how Kademlia, which underlies Etherium's network and some file sharing systems, works. That's about 20 years old, and sort of has a sketchy reputation.

It's possible to go only halfway, and separate discovery from transmission. Peertube does that. You find a file to stream via ordinary HTTP to a server you find by ordinary web search means. Anybody can set up such a server. The actual streaming, for files wanted by many clients, is distributed, with people currently watching also sending out blocks to other people watching. This scales well, in case your video goes viral. It's not used much, though.

So it's definitely possible to do this without someone in the middle able to cut off your air supply.

Re: The New Internet

#103

Post by sulandor »

teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

> The eternal problem with companies like

it's not a problem specific to any kind of corporation or corporations per se, but organizations or even broader, solutions.

though, do you really think that having a solution to a problem is worse than just having the problem?

Re: The New Internet

#104

Post by lockywolf »

My ISP deployed ipv6 via serving ULAs to clients behind the ISP box, and doing a NAT to a single dynamic public IP.

Another one just blocks all incoming connections on ipv6 entirely.

Re: The New Internet

#105

Post by sulandor »

smolder wrote: post #101
throwaway211 wrote: post #94

Earlier quoted context omitted.

[flagged]

This is a poor analogy. Historically there is a significant cost to making bad cars with frequent repair needs.

this is a poor statement. the cost is not in dispute, but the bearer of it.

historically car owners need to pay for repairs.

Re: The New Internet

#106

Post by lockywolf »

viraptor wrote: post #91
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

Zerotier does kind of that. It's a tunnel, but also the traffic is direct (unless double Nat is involved) and if you could route the traffic directly to the endpoint IPs, you can skip zt. The location service can be self-hosted if you want. You don't have to use them as a service if you don't want to. Apart from dnssec it's pretty much what you're asking for.

Double NAT is now almost everywhere in the world, except maybe USA.

Re: The New Internet

#107

Post by jmprspret »

password4321 wrote: post #81
jmprspret wrote: post #61

Earlier quoted context omitted.

You can self-host a Tailscale control sever with Headscale[1]. It's not quite at feature parity with Tailscale, but it supports most if not all the current feature set and its improving every day. One of the lead devs is even paid by Tailscale to work on it, IIRC. I run it for my personal self-hosted infra, and it works really well. Setting a custom control server URL is relatively easy (at least on Windows and Andro…

The question is: how long will Headscale be supported in the official clients - how long will the incentives of Tailscale's VC's align with the freeloaders? The official clients (most valuable: the polished mobile apps easily installed from the default app stores) are one auto-update away from cutting ties when push comes to shove, the same as all commercial VPNs with a free tier.

The clients are the open source part of Tailscale. They can be forked and built by someone else if required.

However I do not think Tailscale is going to remove the custom control URL feature from their mobile clients. For one, I think there are legitimate "Tailscale Enterprise" use-cases for the custom login server.

Additionally, I have heard that Tailscale has been supportive of the Headscale project, providing assistance to the devs.

Further, Tailscale seems fairly committed to keeping their clients open sourced, and engaging in the developer community. Of course as you can say this can change at any time.

Re: The New Internet

#108

Post by smolder »

sulandor wrote: post #105
smolder wrote: post #101

Earlier quoted context omitted.

This is a poor analogy. Historically there is a significant cost to making bad cars with frequent repair needs.

this is a poor statement. the cost is not in dispute, but the bearer of it. historically car owners need to pay for repairs.

Look at how the early 90s Ford Tempo resale value compared to Toyotas of the era. Trash cars don't keep their value. Toyota could then charge a premium because they were known for quality.

Re: The New Internet

#109

Post by dakiol »

One thing I don’t understand. The article claims that we need to pay rent to big corps like AWS, which is true only if you’re offering something on the internet (e.g., you have a saas). As a consumer I don’t pay to AWS, I only pay to my isp. Now, the article wants everyone (the ones who have something to offer, and the consumers) to switch to this new internet… so both producers and consumers (peers now) need to pay rent to tailscale (unless you selfhost, but selfhosting is like the first story tell tell in the article about asking your isp for a static ip address, opening ports and the like; self hosting is too much work).

Smells like more centralisation, not less.

Re: The New Internet

#110

Post by 1vuio0pswjnm7 »

genewitch wrote: post #85
HumanOstrich wrote: post #75

Earlier quoted context omitted.

What is the non-proprietary option you are referring to?

Not sure if parent means wireguard, but my GitHub page has a way to get around cgnat using wireguard for use with a Nintendo switch (or any wifi/etc device that doesn't run an editable OS)

Wireguard is L3 not L2.

re: GP comment. It really does not matter which non-properietary solution one chooses. It is personal preference. I know what I like but others might not like it. There are many options to choose from. And (I hope) there will continue to be more.

Post reply on HN