191–200 of 315 posts
The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…
I'm one of the people who actually use Tailscale for production systems where there are servers physically close to me, or at some other controlled locations, and then there are hundreds of users hundreds kilometers away, all working via Tailscale. I should say two things. Tailscale is amazing and I love it. The system could not exist without it, or I'd have to have at least ten more people in my team to manage all t…
Would you mind going into more detail about the 4-core Linux Laptop as a production server via Tailscale, please? I too use Tailscale and love it for self-hosting internal stuff but I never thought about using it for public facing production stuff. Now I'm really curious to hear more about your setup (if you're willing to share of course).
So that laptop was a "free server" we've had. It's now replaced by a much beefier miniPC.
Earlier quoted context omitted.
Would you mind going into more detail about the 4-core Linux Laptop as a production server via Tailscale, please? I too use Tailscale and love it for self-hosting internal stuff but I never thought about using it for public facing production stuff. Now I'm really curious to hear more about your setup (if you're willing to share of course).
Not the person you’ve asked but I regularly use it for backends for projects. Connect your database machine to your Tailscale network and have your code talk over the Tailscale IP to connect to it. I’ve served multiple Flask frontends that have talked to backends this way - works great! I use various cloud VMs to host the frontend, and they all talk to an Optiplex Micro box under my desk for their backends.
The new internet, an overlay network on top of the existing internet. Cool?
The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…
I never thought of this. Forces me to rethink every negative post people made against DNSSEC which shaped my opinion. I still think that IPv6 and DNSSEC do more harm in practice than what they solve. Maybe the SCW podcast can do a deepdive on this together with somebody who is militantly-pro DNSSEC. edit: maybe even invite 2 or 3 DNSSEC advocates @tptacek :)
If we could find a credible DNSSEC advocate (for our audience; that is: a cryptography engineer, vulnerability researcher, or an engineering leader at a major firm), we would absolutely invite them on.
'teddyh below gave you links to two pro-DNSSEC resources; fun note: the latter source (Geoff Huston, one of the world's more respected networking researchers) has since then written this:
I like Tailscale, but this reads as too self-aggrandizing. You have a mesh VPN product with some value-added services on top of it. That's great, but this idea isn't novel or unique. Why should your solution be the "new internet" instead of any of the alternatives? I wouldn't want to rely on a single company for all my internet infrastructure, anyway. So I'll stick with the traditional internet with all its complexit…
> Its major problems aren't technical but social, and no new technology will solve those. Really? Isn't the major problem of the current internet is inherent centralization of services because the initial promise of 100% decentralized network is simply too complex to realistically manage? I view that problem as deeply technical. Unless if by "social" you simply mean everyone should become an experienced sysadmin. (or…
You can now build Internet-scale distributed systems, with or without requiring centralized (eg. DNS, SSL certs, etc.).
In other words, massively distributed apps without any means for centralized authorities to stop them.
Earlier quoted context omitted.
And, worse, incentivized to require users to use a "coordination server" which helps with the NAT and firewall traversal problem by being something you can reach from outbound-only clients. There's a lot of verbiage there, but the general idea seems to be that Tailscale sits at the middle of this as the means by which machines find each other. There are other ways to do that. There are dynamic DNS schemes, so you can…
How is trusting a dynamic DNS provider different than trusting Tailscale's coordination nodes?
Earlier quoted context omitted.
> That is not ARP problem. Its called broadcast storm and its problem of stupid people and/or bad equipment. You can bring any network down with incompetence. It's a footgun. All footguns have ways to not trigger them, but saying you can't blow off a leg is also inaccurate. Reducing the number of footguns laying about is generally a good thing > Now take a look at ND tables exchaustion alone. No different than ARP ta…
It looks simpler to start with.. Aka PnP.. you just plugin in stuff, SLAC and later ND discovery kicks in and vioala, we have network up and running. But somehow I see it less managable and controlable. In Enterprise networks this is a serious issue. We need static IP, we need well known subnets, because we run FWs everywhere. And yeah.. soft LL in IPv4 is good idea. You can use it. In IPv6 you are forced to use it.…
Yes, and there are tools and procedures for that:
* https://datatracker.ietf.org/doc/html/rfc9099
But as the old saying goes: easy things should be simple, and hard things should be possible. I think IPv6 does that.
An incredibly long ramp up to complaining about centralised control by rent seekers (a very reasonable complaint!) which gets bogged down in some ostensibly unrelated shade about whether client-server computing makes sense (it does) or is itself somehow responsible for the rent seeking (it isn't; you can seek rent on proprietary peer to peer systems as well!) to then arrive at: > There’s going to be a new world of ha…
Agreed. We would all do well to learn about, and begin implementing, "Iceberg Articles":
Earlier quoted context omitted.
"...you can rent seek on proprietary peer to peer systems as well..." I still use a non-proprietary one that predates Tailscale and that is not OpenVPN. It is small and simple enough even I, a non-programmer, can make modifications. It's possible one ends up using client-server in order to achieve peer-to-peer because not everyone has an internet-reachable, non-firewalled IP address. Using some hosting company's serv…
What is the non-proprietary option you are referring to?
https://github.com/sshuttle/sshuttle
... which allows you to turn any system you have an ssh login on into a VPN endpoint.