Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Internet

tailscale.com

Post reply on HN
Print view View original

211–220 of 315 posts

Re: The New Internet

#211

Post by discardedrefuse »

teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

Yggdrasil is p2p ipv6 e2ee. https://yggdrasil-network.github.io/

Last I checked, it hasn't solved DNS yet (there are unofficial projects trying to do that). I tested a small private network with a few devices and it worked very well.

Re: The New Internet

#212

Post by zbentley »

Gormo wrote: post #207
api wrote: post #161

Earlier quoted context omitted.

There is another reason: the addresses are long and impossible to remember and hard to type. I always bring this up and it’s always dismissed because tech people continue to dismiss usability concerns. Even “small” usability differences can have a huge effect on adoption.

Also, NAT is desirable for security/network isolation reasons, and having no distinction between a local IP and a public IP has a lot of disadvantages. Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents.

> Yes, there are ways to configure IPv6 to isolate subnets, separate local traffic from internet traffic, set up firewalls and DMZs, run local DNS, etc., but they're all more complicated to configure and administer than their IPv4 equivalents.

Eh, I think that has hindsight bias. Setting up NAT manually, or customizing how things are NATed beyond the typical "one or two subnets/IP ranges behind a NAT gateway and maybe a DMZ" you see in businesses and residences is quite complicated! It's just that our control planes are really optimized to make that common case very easy. From router web UIs to pf presets to Windows'/NetworkManager's "share network" functionality to what articles/how-tos are available, that complexity is very effectively hidden but not removed.

As IPv6 becomes more entrenched (and more sites move to IPv6-only or public-IPv6-only deployments), the same thing that happened for the IPv4 world will happen for network segmentation configuration in the IPv6 world: it will get a lot easier and common defaults/conventions will emerge. I don't think the inherent complexity differences between IPv4 and IPv6 are that relevant here.

Re: The New Internet

#213

Post by zbentley »

teddyh wrote: post #162
ZhongXina wrote: post #150

Earlier quoted context omitted.

No, we definitely don't want "automatic IPSec" (especially IPSec!), or really any enforced encryption at the network level, even if it's something sane at this moment like WireGuard. Look at old VPN protocols or authentication schemes like RADIUS which have glaring security holes and are impossible to fix because of compatibility issues, and they're running at much smaller scales than the whole internet. Hell, the wa…

Your argument seems to be to never implement anything, because eventually it will become old and it will be hard to move away from it? This seems to be an argument against anything new, and it is therefore hard to take seriously.

Not GP, but I interpreted it as an argument to innovate/proliferate implementations early and often, but to standardize minimally and as late as possible.

Re: The New Internet

#214

Post by Animats »

hnarn wrote: post #124
teddyh wrote: post #57

The eternal problem with companies like Tailscale (and Cloudflare, Google, etc. etc.) is that, by solving a problem with the modern internet which the internet should have been designed to solve by itself, like simple end-to-end secure connectivity, Tailscale becomes incentivized to keep the problem . What the internet would need is something like IPv6 with automatic encryption via IPsec, with PKI provided by DNSSEC.…

This sounds like a reasonable point, but the more I think about it, the more it sounds like digital flagellation. IPv6 was released in 1998. It had been 21 (!) years since the release of IPv6 and still what you're describing had not been implemented when Tailscale was released in 2019. Who was stopping anyone from doing it then, and who is stopping anyone from doing it now? It's easy to paint companies as bad actors,…

> IPv6 was released in 1998. ... Who was stopping anyone from doing it then, and who is stopping anyone from doing it now?

Well, for a long time, IPv6 didn't work very well. We're past that, mostly. Google reports that 45% of their incoming connections worldwide are IPv6.[1] Growth rate has been close to linear, at 4%/year, since 2015. IPv6 should pass 50% some time in 2025.

Mobile is already 70%-90% IPv6. They need a lot of addresses.

Most of the delay comes from enterprise networks. They have limited connectivity to the outside world, and much of that limiting involves some kind of address translation. So a "corporate IPv6 strategy" is required.

[1] https://www.google.com/intl/en/ipv6/statistics.html

Re: The New Internet

#215

Post by TheFlyingFish »

rsync wrote: post #200
HumanOstrich wrote: post #75

Earlier quoted context omitted.

What is the non-proprietary option you are referring to?

Hopefully referring to the (excellent) sshuttle: https://github.com/sshuttle/sshuttle ... which allows you to turn any system you have an ssh login on into a VPN endpoint.

Wasn't sshuttle created by the now CEO of Tailscale?

Re: The New Internet

#216

Post by thr0w »

> Sure, Apple’s there selling popular laptops, but you could buy a different laptop or a different phone.

> But the liberation didn’t last long. If you deploy software, you probably pay rent to AWS.

There's no Azure? GCP? Hetzner? Digital Ocean?

> You pay exorbitant rents to cloud providers for their computing power because your own computer isn’t in the right place to be a decent server.

You do that because you don't know what port-forwarding is (vast majority of software people do not), or you don't have the place or infra in your dwelling to stash a laptop server running 24/7 without interruption.

Re: The New Internet

#217

Post by literallyroy »

thr0w wrote: post #216

> Sure, Apple’s there selling popular laptops, but you could buy a different laptop or a different phone. > But the liberation didn’t last long. If you deploy software, you probably pay rent to AWS. There's no Azure? GCP? Hetzner? Digital Ocean? > You pay exorbitant rents to cloud providers for their computing power because your own computer isn’t in the right place to be a decent server. You do that because you don'…

You probably also have a residential IP and need to pay some service (Ngrok?) to convert that into a static address that’s useful right?

Re: The New Internet

#218

Post by metadat »

skybrian wrote: post #87
metadat wrote: post #6

I really enjoy and appreciate the tailscale service, but this article didn't click for me. I love an inspiring CEO rally speech as much as the next early adopter, and agree that there is a ridiculous amount of developer friction and complexity in computing, but tailscale still has its own friction and isn't on track to solve the big picture issues _at all_. As a concrete example, a few weeks ago, I invited my dad to…

I don’t know if it’s the same issue, but the problem I ran into is that I misunderstood how it works for families who just use gmail addresses. It’s quite counter-intuitive. The organization stuff isn’t for you - instead each person creates their own tailnet and you connect them. See: https://github.com/tailscale/tailscale/issues/10731

If this was the source of issues, it's still a product failure. I hope they will address it.

If I can't figure it out, 99% of others won't either.

Re: The New Internet

#219

Post by jacooper »

sph wrote: post #96
yjftsjthsd-h wrote: post #56

Earlier quoted context omitted.

I think nebula is the obvious FOSS competitor? With the unfortunate exception of the Android client being closed source.

I use Nebula because its iOS client does not drain my battery. Tailscale has had that known bug for years and they never managed to fix it, which is a major deal breaker.

They have released a slew of updates recently to fix this, and they did a complete rewrite of the Android app

Re: The New Internet

#220

Post by mrbluecoat »

cpach wrote: post #64
jmprspret wrote: post #61

Earlier quoted context omitted.

You can self-host a Tailscale control sever with Headscale[1]. It's not quite at feature parity with Tailscale, but it supports most if not all the current feature set and its improving every day. One of the lead devs is even paid by Tailscale to work on it, IIRC. I run it for my personal self-hosted infra, and it works really well. Setting a custom control server URL is relatively easy (at least on Windows and Andro…

Cool! Any important features you miss when running Headscale?

DoH DNS support (beyond the single existing NextDNS option)
Post reply on HN