111–119 of 119 posts
At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.
I really like their engineering blog. They aren’t afraid to share they they actually did and what results they saw, even if the “common wisdom” was against it, like, IIRC, they were using SQLite as their database for a while.
Earlier quoted context omitted.
There are more mods than just dang. Emailing the contact address notifies all of them, and lets them make more rapid fixes, than depending on one single person to write tooling for what you describe.
If mentioning dang doesn't work, why did it work? :)
I’ve emailed the mods tens of times over the years to point out a thread that has a correction, or that I think dang may want to reply to, without saying that I’ve done so. Did I do so this time? (Y/N)
Assigning meaning to the timing is inappropriate, as it disregards the possibility of coincidence (he found the thread organically), unstated actions (someone emailed the mods), and/or human distraction (he was at lunch) by the however-notified dang.
I also view it as impolite to try using @dang to burden all mod duties onto one person rather than to a team of mods. Whether it works or not, it’s evidence of site users setting dang up in their minds as a single point of failure – either because they think it’s the only way, or for the convenience of not having to write a two sentence email to the mod team. That irks me, and so I occasionally post a reminder about the contact form, phrased to allow for the cases where the @ is just a learned behavior and they just don’t know about the contact link in the footer yet.
I found the blog post slightly confusing because it never explicitly spells out that endorsing a new node is a manual operation that the administrator has to perform from one of the trusted nodes. Of course this is what you'd want, anything automatic would ruin the purpose of tailnet lock. But still not seeing it mentioned, neither in the text nor in the pictures, made me wonder what I had missed, until I watched the…
Thanks for the feedback!! Writing the documentation for how this worked was a challenge, and its good to hear what pieces we need to call out more strongly in the future.
If you're interested in gory details around tailnet lock internals, we have the beginnings of a whitepaper here: https://tailscale.com/kb/1230/tailnet-lock-whitepaper/
I found the blog post slightly confusing because it never explicitly spells out that endorsing a new node is a manual operation that the administrator has to perform from one of the trusted nodes. Of course this is what you'd want, anything automatic would ruin the purpose of tailnet lock. But still not seeing it mentioned, neither in the text nor in the pictures, made me wonder what I had missed, until I watched the…
I had the same issue. I think the idea is that you build something yourself on a trusted node that decides whether or not to endorse a new node. Off the top of my head I'd do something dead simple like verify the user account matches our domain and then also query an inventory system to verify it is indeed a device we manage through MDM (though I'm not sure how this will work for mobile devices. We don't MDM those).…
If you're okay with trusting Tailscale's control plane, we have a feature for exactly this use case! Its called Device Authorization: https://tailscale.com/kb/1099/device-authorization/
You could also use tailnet lock in this fashion, by issuing a `tailscale lock sign` command for the new node once you've verified the provenance of the new device. Because it involves signatures with keys on your device it could never be as simple as a REST API, but maybe we could offer a more easy to automate command or better client library support (suggestions welcome!)
This solves the #1 concern I had with tailscale. Now I feel comfortable recommending this software to anybody.
It still makes me jittery how much stuff they've packed into the client. The RCE vulnerability in their windows client is pretty strong indicator that things are moving a bit too fast for comfort.
I have little to no idea what Tailscale does. Is it a VPN like Mullvad? What makes it so special? Ive heard a bit about tailscale networks connecting devices together easily. Is it for your own network only, or can other people access your tailscale devices directly as well? Ie, I host a minecraft server on my linux desktop. Can tailscale help me in the use case of providing an IP to people to connect to it? Or am I…
Tailscale is just fancy software that creates peer to peer encrypted tunnels between your devices using wireguard. You can think of it as a LAN for all your devices regardless of what network they’re physically connected to. The default use case of Tailscale is to have a private LAN, just for you, not your friends. This is changing now, though. Tailscale does as of recently have the ability to do what you’re saying f…
To answer the question in another thread, node sharing also works with UDP. (Funnel is TCP-only due to the vagaries of IP addresses and TLS certificates when facing the outside world, sigh.)
Earlier quoted context omitted.
I really like their engineering blog. They aren’t afraid to share they they actually did and what results they saw, even if the “common wisdom” was against it, like, IIRC, they were using SQLite as their database for a while.
SQLite is what they switched to , and still use.
Earlier quoted context omitted.
Can you use it like a VLAN for segmenting devices? I have eero’s and a firewalla but since my eero’s don’t support tagged vlan traffic I can’t segment my devices as much as I’d like to.
(not an expert here) but my understanding is: sort of. I believe the biggest difference is that VLAN operates at Layer 2 and Wireguard works at Layer 3.
Earlier quoted context omitted.
I totally empathize. I waffled on Tailscale for a long time, and was convinced I'd roll my own for everything. But goddamn if that spiffy web interface is not just the bees knees. I relented and put in a Google account that I don't use very often for identity--no idea if that makes it more or less like to be arbitrarily banned by Google--and accepted the fact that access to Tailscale wasn't so critical for me that I…
Or if you are a small org, use GitHub Organizations for up to 25 people. https://tailscale.com/blog/community-github-pricing/ I have been using Tailscale since the beginning personally, and have been trying to sell it internally at work, and since we have a GitHub Community I have integrated various Tailscale machines into some of our playground environments for others to test out.
You are like, the dream of all B2B SaaS startups.
But also, Tailscale is great, fight the good fight.