Cloudflare + Tailscale would be a super interesting combination for a business.
I wonder if Tailscale is an acquisition target.
Tailnet Lock
21–30 of 119 posts
Re: Tailnet Lock
#22Earlier quoted context omitted.
Agreed: I do feel the Windows client in particular is a little scary. In general, Tailscale clients feel reasonable, if light; but the Windows client is kind of iffy. There's a bug that I believe still exists where on some machines, it will crash on startup most of the time, seemingly the result of a race condition or other bug where GetLastError returns something unexpected, in a not-very-well maintained Win32 API w…
FWIW, we've recently taken over maintenance of those Go libraries because they seem to have been abandoned upstream. And we now have people working on Windows full-time. (Early on, the Tailscale team was all primarily Linux and macOS users so Windows was admittedly neglected for too long)
It amazes me how you're seemingly always on top of any concern I or others could have. Thanks for the information.
Re: Tailnet Lock
#23Why is there a post by tailscale on the front page every single day?
Tailscale are _the_ company pushing the state of the art in VPN's, and they write great, detailed technical articles and whitepapers about it. As someone who has worked on a different, more traditional, enterprise VPN product, this is extremely interesting to me. Most other companies have neither the cool tech (most haven't even switched from IPsec), nor the ability to put out anything other than marketing fluff, nor the focus to actually keep working on the core VPN tech instead of trying to check all boxes (monitoring/firewalling/device management/...) but not innovating anywhere. Tailscale also scales down to individual, private users, has a free plan, some open source code and an open source reimplementation, all of which appeals to the HN audience.
This article in particular is interesting because Tailscale inserting malicious nodes is the #1 concern I had around their product, and their solution (tailnet locks) is interesting and probably better than the solution I would have come up with (using Wireguard's support for additional symmetric secrets).
Re: Tailnet Lock
#24Earlier quoted context omitted.
Agreed: I do feel the Windows client in particular is a little scary. In general, Tailscale clients feel reasonable, if light; but the Windows client is kind of iffy. There's a bug that I believe still exists where on some machines, it will crash on startup most of the time, seemingly the result of a race condition or other bug where GetLastError returns something unexpected, in a not-very-well maintained Win32 API w…
Tailscalar here. There were a few things going on with that issue you mentioned; one of them is the way the wrapper library was written, the other was with some stuff in the GUI client that was happening on a background goroutine but shouldn't have been. That should be fixed in the current stable release. As for the Windows client in general, it is going to be receiving a lot of love over the next few months!
I see; I need to update the client on one of my machines. I appreciate the heads up, as it is quite frustrating to get it to start sometimes. Thanks!
I'll have to check out the bug sometime, but it sounds like it's just bad luck with goroutine scheduling and the order things execute in, in a goroutine that isn't locked to a thread. I can see it going unnoticed on older versions of Go (especially prior to weirder things like usermode preemption.)
Re: Tailnet Lock
#25Earlier quoted context omitted.
Tailscalar here. There were a few things going on with that issue you mentioned; one of them is the way the wrapper library was written, the other was with some stuff in the GUI client that was happening on a background goroutine but shouldn't have been. That should be fixed in the current stable release. As for the Windows client in general, it is going to be receiving a lot of love over the next few months!
I see; I need to update the client on one of my machines. I appreciate the heads up, as it is quite frustrating to get it to start sometimes. Thanks! I'll have to check out the bug sometime, but it sounds like it's just bad luck with goroutine scheduling and the order things execute in, in a goroutine that isn't locked to a thread. I can see it going unnoticed on older versions of Go (especially prior to weirder thin…
What bug are you thinking of? Got a GitHub issue link?
Re: Tailnet Lock
#26I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or in…
How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account?
Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that.
I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and it doesn't involve Google or Microsoft at any point.
Re: Tailnet Lock
#27I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or in…
How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account? Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that. I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and…
Tailscalar here.
IdP trust is on the list. There are some "easy" things we can do that help on the surface but make life harder for users. And there are some not-so-easy things we are researching. I hope to have answers in 2023.
Re: Tailnet Lock
#28Why is there a post by tailscale on the front page every single day?
Obviously "every single day" is hyperbole, but I agree with you that a much higher proportion of Tailscale blog posts end up on the front page than most corporate blogs.
Finally I think it comes down to this: Tailscale is full of the same kind of people who tend to hang out on Hackernews. HN loves Tailscale because Tailscale is HN's ingroup.
Fly.io is in a similar situation, and similarly sees a higher-than-average fraction of their blog posts getting traction on HN.
For an interesting counterexample, look at warp.dev. They have a lot of the same markers - tackling an interesting problem that affects many HNers daily (the limitations of the terminal), building things from the ground up in Rust, and writing highly technical blog posts about it - but at the same time, it's clear that as an organization, they don't quite get it. They can't understand, for instance, why putting telemetry in their terminal emulator is absolute suicide as far as HN is concerned, or why "moving the terminal to the cloud" is a phrase that will never make HN happy. Unlike Tailscale and Fly, they are not "of the race that knows Joseph", as it were.
That's not to say that there aren't individuals at Warp who are members of the HN ingroup. But at the organizational level, Warp just isn't quite it.
Re: Tailnet Lock
#29Earlier quoted context omitted.
I see; I need to update the client on one of my machines. I appreciate the heads up, as it is quite frustrating to get it to start sometimes. Thanks! I'll have to check out the bug sometime, but it sounds like it's just bad luck with goroutine scheduling and the order things execute in, in a goroutine that isn't locked to a thread. I can see it going unnoticed on older versions of Go (especially prior to weirder thin…
What bug are you thinking of? Got a GitHub issue link?
I believe it might be this one.
https://github.com/tailscale/tailscale/issues/4133
That said, I'm not near the computer where I have it occur right now to check.
Re: Tailnet Lock
#30I am one of those users who have asked, but how can I trust that the Tailscale coordination server will not inject hidden public keys to my network. This feature is a very good step forward in security. I will take a look and if the implementation is sound, I am going to use Tailscale (namely if the Tailscale is compromised, I will not be automatically compromised, unless I manually accept external public keys, or in…
One option is don't. Run tailscaled inside a container with host network access, that way you can connect to the host, but it doesn't have the ability (unless it escapes the container) to write (ssh) keys.