Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailnet Lock

tailscale.com

Post reply on HN
Print view View original

101–110 of 119 posts

Re: Tailnet Lock

#101

Post by jyrkesh »

sneak wrote: post #26
aborsy wrote: post #9

I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or in…

How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account? Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that. I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and…

I totally empathize. I waffled on Tailscale for a long time, and was convinced I'd roll my own for everything.

But goddamn if that spiffy web interface is not just the bees knees. I relented and put in a Google account that I don't use very often for identity--no idea if that makes it more or less like to be arbitrarily banned by Google--and accepted the fact that access to Tailscale wasn't so critical for me that I needed to be worried about it.

But in production, I totally get it. But I'd probably still just pay for Tailscale's SAML and use Okta or something...

Re: Tailnet Lock

#102

Post by nine_k »

dvzk wrote: post #100
akerl_ wrote: post #66

Earlier quoted context omitted.

I think y’all are talking about different things; the parent comment seems to be talking about injecting additional keys into the tailnet (basically, letting other devices communicate inside your Wireguard VPN).

That's actually the point of this feature. Before, the key distribution server could add unauthenticated Wireguard nodes to your peer list. Now, the tailnet administrator can tell Tailscale nodes to reject new peer public keys unless the key is cryptographically signed by a trusted node. If you don't trust the implementation, wait until it's audited, I guess.

I wonder if a third-party solution for the signature key distribution is feasible; I suppose it should be, because it's appears to be just a file.

This way, if you don't trust Tailscale to distribute these lock-controlling keys, you could run a different mechanism of your choosing that would effectively control what nodes are automatically admitted.

Re: Tailnet Lock

#103

Post by OrderlyTiamat »

altairprime wrote: post #13
xena wrote: post #5

Hey @dang can you update this to "Tailnet Lock"? This is about a feature named "tailnet lock", not a hiring freeze :)

“@dang” doesn’t do anything on HN. Emailing the mods using the footer Contact link is the fastest way – and the only certain way – to get the mod team’s attention (including but not limited to dang).

I think he does have a script checking for mentions because he does tend to reply to dang, which is fairly easy to set up even if no infra on hn itself supports it.

Re: Tailnet Lock

#104

Post by KleinPoes »

teaearlgraycold wrote: post #50
0x0000000 wrote: post #48

Earlier quoted context omitted.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?

Seedbox access without exposing it to the wider web.

Managing personal devices.

One day I had to go to the office and only then did I notice my keepass hadn't synced in months. My home PC was sleeping so I SSH'd to my Openwrt box, got the MAC for my PC and used etherwake to start it. From there I used RDP to login and get an updated password. All from my phone.

Re: Tailnet Lock

#105

Post by justsomehnguy »

unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

> Ie i could expose my IP via Dyn DNS

That works if your IP is globally reachable.

> For basic tunneling into home servers, is Tailnet.. overkill

It's a service. You just pay money and they take care of it, instead of running this all by yourself.

> thoughts on the best service to price ratio for my needs?

You can buy VPS for $14/3m = $4.66/m and configure Headscale or whatever on it. Fixed public IP, no need for DynDNS, no user/$ limit except CPU/RAM - you can have whatever you want on it.

EDIT: found out they even have a $11/3m plan = $3.66/m.

Re: Tailnet Lock

#106

Post by altairprime »

OrderlyTiamat wrote: post #103
altairprime wrote: post #13

Earlier quoted context omitted.

“@dang” doesn’t do anything on HN. Emailing the mods using the footer Contact link is the fastest way – and the only certain way – to get the mod team’s attention (including but not limited to dang).

I think he does have a script checking for mentions because he does tend to reply to dang, which is fairly easy to set up even if no infra on hn itself supports it.

There are more mods than just dang. Emailing the contact address notifies all of them, and lets them make more rapid fixes, than depending on one single person to write tooling for what you describe.

Re: Tailnet Lock

#107

Post by dvzk »

nine_k wrote: post #102
dvzk wrote: post #100

Earlier quoted context omitted.

That's actually the point of this feature. Before, the key distribution server could add unauthenticated Wireguard nodes to your peer list. Now, the tailnet administrator can tell Tailscale nodes to reject new peer public keys unless the key is cryptographically signed by a trusted node. If you don't trust the implementation, wait until it's audited, I guess.

I wonder if a third-party solution for the signature key distribution is feasible; I suppose it should be, because it's appears to be just a file. This way, if you don't trust Tailscale to distribute these lock-controlling keys, you could run a different mechanism of your choosing that would effectively control what nodes are automatically admitted.

Based on the article, the private keys for peer enrollment signing are generated locally on each Tailscale client and aren't distributed at all. I don't see why you couldn't write a custom client that approves or denies new peers based on your own criteria. Some of the internal Tailscale API may first need to be officially documented.

Re: Tailnet Lock

#108

Post by burnished »

teaearlgraycold wrote: post #45

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

I really like their engineering blog. They aren’t afraid to share they they actually did and what results they saw, even if the “common wisdom” was against it, like, IIRC, they were using SQLite as their database for a while.

Re: Tailnet Lock

#109

Post by zikduruqe »

jyrkesh wrote: post #101
sneak wrote: post #26

Earlier quoted context omitted.

How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account? Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that. I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and…

I totally empathize. I waffled on Tailscale for a long time, and was convinced I'd roll my own for everything. But goddamn if that spiffy web interface is not just the bees knees. I relented and put in a Google account that I don't use very often for identity--no idea if that makes it more or less like to be arbitrarily banned by Google--and accepted the fact that access to Tailscale wasn't so critical for me that I…

Or if you are a small org, use GitHub Organizations for up to 25 people.

https://tailscale.com/blog/community-github-pricing/

I have been using Tailscale since the beginning personally, and have been trying to sell it internally at work, and since we have a GitHub Community I have integrated various Tailscale machines into some of our playground environments for others to test out.

Re: Tailnet Lock

#110

Post by xena »

altairprime wrote: post #106
OrderlyTiamat wrote: post #103

Earlier quoted context omitted.

I think he does have a script checking for mentions because he does tend to reply to dang, which is fairly easy to set up even if no infra on hn itself supports it.

There are more mods than just dang. Emailing the contact address notifies all of them, and lets them make more rapid fixes, than depending on one single person to write tooling for what you describe.

If mentioning dang doesn't work, why did it work? :)
Post reply on HN