Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

191–200 of 419 posts

Re: Tailscale is pretty useful

#191

Post by reubenmorais »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

> * Can it expand into the layman market?

Maybe it's more enthusiast than layman, and I guess it's also not much of a market, but in the video arrrchival space it's pretty widespread, with people running e.g. Jellyfin behind Tailscale.

Re: Tailscale is pretty useful

#192

Post by kortilla »

> But my old Raspberry Pi was too weak to run it, so I ended up uninstalling it, and unrelatedly my pet project grew out and has its place in the cloud now.

It’s incredible how shitty modern software is that a raspberry pi couldn’t run a basic VPN.

If any tailscale devs see this you should try to reproduce this issue and use it as an opportunity to clean up a bunch of dumb assumptions that likely hurt real users as well, just through less direct means like battery consumption and slower overall performance.

Re: Tailscale is pretty useful

#193

Post by epscylonb »

parasubvert wrote: post #179
hattmall wrote: post #170

Earlier quoted context omitted.

Do mainstream consumers really need a VPN?

Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were. I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer - So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something - watching streaming media from my home network when I’m…

The Magic DNS feature is super cool as well. I'm not sure exactly what the mainstream killer app would be. But I feel like Tailscale is poised to execute if/when it arises.

Perhaps the AI age makes everyone more data privacy conscious.

I've also long thought that eventually every household will eventually have a mini server for home automation and storing personal information. The rise of the cloud kinda slowed this down, but I don't think cloud and home server are mutually exclusive.

Re: Tailscale is pretty useful

#194

Post by import »

HPsquared wrote: post #97
Trumpi wrote: post #6

I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.

Alternative: OpenVPN server on your router.

10 times slower than Wireguard

Re: Tailscale is pretty useful

#195

Post by devilbunny »

hattmall wrote: post #170
epscylonb wrote: post #152

Earlier quoted context omitted.

Agree that they are on to something. I gave a tech talk about them a while ago at work and said that I think they are on the cusp of providing a consumer VPN product that appeals to mainstream consumers. The Apple of VPNs, everything "just works" and is easy to understand.

Do mainstream consumers really need a VPN?

Yes, although many won't realize it.

I use VPN (usually Tailscale, though I have the Proton subscription package that includes their VPN - mainly useful if for some reason my home internet is slow or out, otherwise I would just TS it) on all public WiFi. My work's remote access blocks logins from outside the US, so if I'm out of the country, my wife and I both need VPN to be able to log in.

Interestingly, while my work's network blocks Tailscale's initial authentication, it doesn't actually block the traffic. I can authenticate my iPad via cell phone tethering or just before I leave the house and it will work when I connect to their network. It's a personal device without any access to their internal network, and I'm using the guest network, so I'm not compromising security to actual work devices. But when I'm stuck up there and I want to stream a movie from my NAS at home, I can.

Re: Tailscale is pretty useful

#196

Post by SR2Z »

tass wrote: post #24
ydnaclementine wrote: post #11

> it’s no longer possible thanks to a cursed thing called CGNAT as someone who does publicly expose services that have auth, why does CGNAT make exposing ports publicly bad?

Other replies explained the why, though cgnat wouldn’t be a problem if you also had ipv6. Luckily for me I have a regular ip4 address but if that ever changed I’d be out of luck unless my isp (quantum fibre) implemented a proper ipv6 solution.

CGNAT isn't used with ipv6, right?

Re: Tailscale is pretty useful

#197

Post by amlib »

CharlesW wrote: post #92

Networking SmartFriends: Is port forwarding intrinsically a bad idea (as compared to using Tailscale Funnel) from a security perspective if I want to expose, say, a Plex server running on my NAS to the outside world?

The main question is weather you want to share something like a Plex server with other people and force/convince them to essentially install a VPN to do so (which usually mean other VPNs are out of the game. You can't, for example, have Tailscale work alongside an adblock VPN in Android). To me thats a deal breaker and quite a burden to the people who want to access it. You are better off putting all those services behind a reverse proxy with a cert from let's encrypt.

Re: Tailscale is pretty useful

#198

Post by bradfitz »

textlapse wrote: post #57

Also, their building up on top of a 'platform' is wonderful: funnel, exit nodes, sharing, ssh, drive etc. I wonder if they can figure out a way to distribute compute eventually via their network (not just clunky ssh): 'my' storage is already shared with 'my' nodes, why not 'my' compute? :) Seems like a great company/business.

That was actually something we debated launching before Tailscale SSH but ended up doing Tailscale SSH first because the state problem for compute was annoying and we'd seen the App Engine etc progression through the problem space and knew it could be a time suck.

I still want to do it and we continue to brainstorm on the problem of state management and how to do it in an HA way, so you can run services where the compute bounces around some node in a set that's up and reachable on the tailnet but the state is durable and in sync between the nodes. It's a fun problem.

Re: Tailscale is pretty useful

#199

Post by jychang »

frenchtoast8 wrote: post #189
thewebguyd wrote: post #148

Earlier quoted context omitted.

> * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are likely running with reduced security since that's a huge part of the appeal. This is exactly the situation BeyondCorps/Zero Trust was created to avoid. Tunneling services[0] are more of a Zero Trust approach, but they can't match the seamlessness of Tailscale…

> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host. Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date…

I don't think most users use those integrations, they're mostly just a feature bullet point.

Re: Tailscale is pretty useful

#200

Post by showerst »

sureglymop wrote: post #182
mbesto wrote: post #127

Earlier quoted context omitted.

The data sent from one node to another doesn't pass through TS's infra. I basically just see Tailscale as an auth paradigm for managing wireguard keys.

I don't really understand this though.. The key exchange is perhaps the most important aspect. Just hypothetically, what if an intelligence service records your encrypted traffic and also happened to get AWS to mitm your communication with the tailscale key distribution server? Doesn't really matter if most of your traffic doesn't use their infrastructure if the most important parts of it do.

If your threat model includes intelligence services and mitming AWS you should not be using tailscale, and you would hopefully already know that.
Post reply on HN