Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The New Internet

tailscale.com

Post reply on HN
Print view View original

111–120 of 315 posts

Re: The New Internet

#111

Post by sulandor »

metadat wrote: post #6

I really enjoy and appreciate the tailscale service, but this article didn't click for me. I love an inspiring CEO rally speech as much as the next early adopter, and agree that there is a ridiculous amount of developer friction and complexity in computing, but tailscale still has its own friction and isn't on track to solve the big picture issues _at all_. As a concrete example, a few weeks ago, I invited my dad to…

probably a new network interface gets created and either your dad or windows decided that it was not a "home/personal" i.e trusted connection where answering pings or rdp is a good idea.

teamviewer, anydesk et.al are made for the task

Re: The New Internet

#112

Post by zokier »

Borg3 wrote: post #99
wmf wrote: post #24

Earlier quoted context omitted.

Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.

Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IP…

The thing that you and all other ipv6 haters miss is that none of that matters. Ipv6 is happening, like it or not. And that had been the state already for 10-15 years.

Maybe in the 00s there was window when there might have been true doubt if ipv6 was going to happen. But after that, it was just question of "when", not "if".

Keeping on hating is simply not very productive. It's just much better to embrace ipv6, no matter it's possible flaws.

Re: The New Internet

#113

Post by viraptor »

lockywolf wrote: post #106
viraptor wrote: post #91

Earlier quoted context omitted.

Zerotier does kind of that. It's a tunnel, but also the traffic is direct (unless double Nat is involved) and if you could route the traffic directly to the endpoint IPs, you can skip zt. The location service can be self-hosted if you want. You don't have to use them as a service if you don't want to. Apart from dnssec it's pretty much what you're asking for.

Double NAT is now almost everywhere in the world, except maybe USA.

What kind of Nat though? You can use upnp, predictable mapping, etc. and still allow the traffic through. And that's only with ipv4, because you can run zerotier over IPv6.

Re: The New Internet

#114

Post by vwkd »

dakiol wrote: post #109

One thing I don’t understand. The article claims that we need to pay rent to big corps like AWS, which is true only if you’re offering something on the internet (e.g., you have a saas). As a consumer I don’t pay to AWS, I only pay to my isp. Now, the article wants everyone (the ones who have something to offer, and the consumers) to switch to this new internet… so both producers and consumers (peers now) need to pay…

As a buyer you also don't pay VAT to the government. You pay the seller a price that's marked up exactly by VAT, which the seller then pays to the government.

In summary, if you don't pay it directly doesn't mean you don't pay it indirectly.

Re: The New Internet

#115

Post by OJFord »

viraptor wrote: post #97
OJFord wrote: post #19

Earlier quoted context omitted.

Zerotier is I think the obvious answer? I haven't used it though; it's more proprietary, not less.

Kinda? It works great in practice. You can run your own controllers if you want which completely disconnects you from the proprietary service. But the code is BSL.

I didn't mean to suggest it doesn't work well, as I said I've not used it.

It's still proprietary if you self-host it, I was thinking in particular that tailscale uses Wireguard and Zerotier uses something custom, i.e. proprietary. Note that the context was:

> The internet succeeded because it was built on standards and was completely free. With Tailscale, I get wireguard is open source and we have things like Headscale. But [...]

to which the commenter I replied to asked of alternatives. So I wasn't saying tailscale great and open and standards compliant, and Zerotier not; I was saying it's the obvious competitor but if that's your problem with tailscale then it's if anything worse in that regard.

Re: The New Internet

#116

Post by growse »

Borg3 wrote: post #99
wmf wrote: post #24

Earlier quoted context omitted.

Apenwarr is kind of an IPv6 hater. He thinks it's not going to happen.

Because IPv6 is mistake. Thats why market does NOT want it. Unfortunately, we all start to feel the heat of IPv4 exhaustion. Anyway, remember IPv4 classes? Then they made it classless. IPv6 is not 128bit, its just 64bit with 64bit host address. So, first mistake. IPsec mandatory? pure stupidity. Crypto moves fast, every 10 years many protocols are obsoleted. How you will provide E2E connectivity with that? In 1997 IP…

> What IPng team should do, is just take IPv4, extended it to 64bit, call it IPv6 and we are done.

Tell me you've never had to seriously design and operate networks at scale without telling me etc...

This is a bit like Chesterton's fence - until you understand why (for example) ARP is a hilariously bad design and a major problem when trying to design networks at scale, then you can't understand why someone might want to replace it with something more effective. IPv6 doesn't get a lot of stuff right, but the motivation behind replacing v4 was much more than simply "more addresses pls".

IPv4 was the mistake, Vint Cerf is on the record as saying so. Should never have been let out of the lab.

Re: The New Internet

#117

Post by vwkd »

Bluecobra wrote: post #41

> Every device gets an IP address and a DNS name and end-to-end encryption and an identity, and safely bypasses firewalls. Tailscale can certainly be blocked on NGFW firewalls like Palo Alto. I am not a BOFH, but also can’t have random employees circumventing security policies by setting up tailscale and leaving permanent backdoors in my corporate network. I remember the good old days when everyone had a public IP on…

> can’t have random employees circumventing security policies by setting up tailscale and leaving permanent backdoors in my corporate network

Tailscale isn't exactly an open door. Only machines signed-in via SSO can access a Tailscale network.

If you don't trust your employees to safeguard their credentials and machines then how do you trust them at all? Keep them in an airtight underground bunker chained to their desks? Not sure what threat you're modeling for...

Re: The New Internet

#118

Post by throw0101d »

yjftsjthsd-h wrote: post #58
throw0101d wrote: post #48

Earlier quoted context omitted.

Here is a list of of proposals for what could have replaced IPv4: * https://www.rfc-editor.org/rfc/rfc1454.html Here are the technical criteria for choosing the (then-labelled) IPng: * https://datatracker.ietf.org/doc/html/rfc1726 And finally the evaluation of the available candidates and why the winner was chosen: * https://datatracker.ietf.org/doc/html/rfc1752 If someone doesn't want to use IPv6, then what they're…

> If someone doesn't want to use IPv6, then what they're effectively suggesting is that we create a new protocol, and role it out to every smartphone, tablet, laptop, desktop, server, (Wifi) router/CPE, ISP router, SMB router, enterprise switches, and IoT device. Meanwhile we've already effectively run out of IPv4 addresses (e.g., ARIN and RIPE pools are zero) and are just shuffling about whatever is left in auctions…

> […] I think the far more common view is rather that v4 is fine and its only problem is solved by NAT.

The only reason why NAT is "solving" the problem is because IPv6 is taking some of the pressure off. T-Mobile US has 120M subscribers:

* https://www.statista.com/statistics/219577/total-customers-o...

And they went to IPv6-only:

* https://www.youtube.com/watch?v=QGbxCKAqNUE

There's no way that would work in a no-IPv6 / IPv4-only world. Comcast ran out of 10/8 address space to manage their cable modems: how would that work without IPv6?

Google says India is 74% IPv6:

* https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

How would that work with only IPv4?

Even on smaller scales, without IPv6, supporting IPv4 with CG-NAT can get really expensive, real fast:

> We learned a very expensive lesson. 71% of the IPv4 traffic we were supporting was from ROKU devices. 9% coming from DishNetwork & DirectTV satellite tuners, 11% from HomeSecurity cameras and systems, and remaining 9% we replaced extremely outdated Point of Sale(POS) equipment. So we cut ROKU some slack three years ago by spending a little over $300k just to support their devices.

* https://community.roku.com/t5/Features-settings-updates/It-s...

* Discussion: https://news.ycombinator.com/item?id=35047624

Re: The New Internet

#119

Post by throw0101d »

metadat wrote: post #63
throw0101d wrote: post #43

Earlier quoted context omitted.

> Can anyone elighten me regarding what is different or special about 100.64.0.0/10 vs say, 192.168.0.0 or 10.0.0.0. A bit of context: if an ISP cannot get enough IPv4 addresses for the WAN-side of people's home routers, some problems exist: * something in 192.168/16 is generally used for the LAN-side of people's home routers, so that cannot be used on the WAN side * 10/8 is used for business/enterprise corporate net…

Interesting, I thought docker uses 172.*.

Yes, 172.18/16 by default.

And that actually was a problem at a previous job I was at: when COVID hit our VPN address range just happened to be set to be in that range, and so a bunch of developers were having issues. (IIRC, we re-configured the VPN appliance to use something else.)

Re: The New Internet

#120

Post by denton-scratch »

sfRattan wrote: post #18

As I've been deliberately moving toward self-hosted computing, under my control, on my home network , I've had a feeling more and more that we're on the cusp of something transformative... For those who want it and those who care. There's an ecosystem of mostly FOSS software now designed to run on a home network and replace big, centralized, cloud providers. That software is right on the edge of being easy enough for…

> But it is possible that every extended family will have at least one member who can run a server

That's as may be; but many, many people have no access to an "extended family". And extended families are not necessarily warm, safe spaces where everyone trusts everyone else; extended families are more likely to be "broken" than nuclear families.

Post reply on HN