Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Peer Relays is now generally available

tailscale.com

Post reply on HN
Print view View original

241–250 of 267 posts

Re: Tailscale Peer Relays is now generally available

#241

Post by Lammy »

snailmailman wrote: post #181
nickburns wrote: post #47

Earlier quoted context omitted.

Pretty much this. DNS, SNI, and otherwise plaintext traffic sniffing. That together with user/device 'fingerprinting' (a much more amorphous concept), and that's why such-and-such thing you were just talking about with so-and-so pops up on your screen/feed/whatever, sometimes only minutes later. I highly doubt any of this can actually be opted-out of. How else would they stay in business?

They specifically avoid sending traffic through tailscale servers whenever possible. That’s how the free tier stays free. Most connections are direct, P2P. The traffic that does go through their servers is encrypted, and bandwidth limited on the free plan. Any snooping on client behavior would have to be done client side, and the clients are all open source. To some extent the coordination server might be able to ded…

> To some extent the coordination server might be able to deduce some metadata about connections; but definitely not snoop all plaintext traffic.

Metadata is as good as data for deducing your behavior. Think what conclusions can be drawn about a person's behavior from a log of their network connections, from each connection's timestamp, source, destination, and port. Think about the way each additional thing-which-makes-network-requests increases the surveillance value of all the others.

Straight away, many people's NTP client tells the network what OS they use: `time.windows.com`? Probably a Windows user. `time.apple.com`? Probably Mac or iOS. `time.google.com`? You get the idea. Yeah, anyone can configure an NTP client to use any of those hosts, but the vast vast majority of people are taking the default and probably don't even know what NTP is.

Add a metadata point: somebody makes a connection to one of the well-known Wi-Fi captive portal detection hosts around 4PM on a weekday? Maybe somebody just got home from school. Captive portal detection at 6PM on a weekday? Maybe somebody just got home from work. Your machines are all doing this any time they reconnect to a saved Wi-Fi network: https://en.wikipedia.org/wiki/Captive_portal#Detection

Add a metadata point: somebody makes a network connection to their OS's default weather-widget API right after the captive-portal test, and then another weather-API connection exactly $(DEFAULT_INTERVAL} minutes later? That person who got home is probably still home.

Required reading: https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

Re: Tailscale Peer Relays is now generally available

#242

Post by snailmailman »

nickburns wrote: post #221
snailmailman wrote: post #181

Earlier quoted context omitted.

They specifically avoid sending traffic through tailscale servers whenever possible. That’s how the free tier stays free. Most connections are direct, P2P. The traffic that does go through their servers is encrypted, and bandwidth limited on the free plan. Any snooping on client behavior would have to be done client side, and the clients are all open source. To some extent the coordination server might be able to ded…

This is pure misinformation. 'Most connections are direct, P2P' makes no sense to anyone versed in basic networking.

I don’t mean P2P in the same sense that BitTorrent or something is P2P. (Splitting one connection into many distributed ones) But more like how a game that does P2P multiplayer has the clients connect directly instead of through a centralized service.

Re: Tailscale Peer Relays is now generally available

#243

Post by 1shooner »

ZoomZoomZoom wrote: post #223
philipallstar wrote: post #218

Earlier quoted context omitted.

One feature is: it's a business and won't be abandoned due to OSS but out if it has a sustainable way to continue.

Healthy and not extremely niche Free Software projects don't disappear. My software stack I rely on daily mostly barely changed in 15 and more years. The amount of businesses closed, sold and products abandoned or swapped for the more controlled/exploitable ones is numerous, on the other hand.

>Healthy and not extremely niche Free Software projects don't disappear.

This sounds a lot like a circular definition.

Re: Tailscale Peer Relays is now generally available

#244

Post by db48x »

nickburns wrote: post #220
db48x wrote: post #209

Earlier quoted context omitted.

No, that’s not quite true. The wireguard tunnels that the Tailscale daemon creates only go to your own machines. Nothing going through those tunnels goes to or is seen by Tailscale the company. Sometimes those tunnels go through a proxy (especially when you’re afflicted by CGNAT), but the proxy sees only encrypted traffic.

So how does the proxy know where to proxy packets to?

The tailscale client on one of your computers tells it the address of your other computer.

Re: Tailscale Peer Relays is now generally available

#245

Post by dang »

samat wrote: post #205
clarabennett26 wrote: post #138

[dead]

Three AI-generated positive comments in the row from new (green) accounts, with some being answered by Tailscale employees looks like AI-assisted astroturfing PR in hackernews. It’s rampart on every major social network (Reddit especially), interesting to see it live first time on the HN. I am not anti advertising, I just think pushing AI into places were people interact is very bad behavior and should be punished.

I doubt that it's employees, but I agree that some of those accounts look like genAI and have banned them.

All:

(1) Generated comments aren't allowed on HN - this rule predates LLMs but obviously applies even more now: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

(2) If you see accounts that look like they're mostly posting genAI comments, please let us know at hn@ycombinator.com. That's how I found my way to these cases.

Re: Tailscale Peer Relays is now generally available

#246

Post by ZoomZoomZoom »

1shooner wrote: post #243
ZoomZoomZoom wrote: post #223

Earlier quoted context omitted.

Healthy and not extremely niche Free Software projects don't disappear. My software stack I rely on daily mostly barely changed in 15 and more years. The amount of businesses closed, sold and products abandoned or swapped for the more controlled/exploitable ones is numerous, on the other hand.

>Healthy and not extremely niche Free Software projects don't disappear. This sounds a lot like a circular definition.

Not really? One is the cause (bad management/tech debt/problematic architecture/no public interest, etc.), the second is the effect.

Re: Tailscale Peer Relays is now generally available

#247

Post by threecheese »

Edit: this is a ridiculous question, I know. Trying to eat my dogfood so to speak

Does Tailscale maintain an q&a agent, mcp, or llms.txt that anyone is aware of?

I’m trying to use Tailscale across my personal networks - without investing a lot of time - and so I’m throwing agents at it. It’s not going well, primarily because their tools/interfaces have been changing a lot, and so tool calls fail (ex ‘tailscale serve —xyz’ is now ‘tailscale funnel ABC’ and needs manual approval, and that’s not in the training set).

Re: Tailscale Peer Relays is now generally available

#248

Post by nagaiaida »

dec0dedab0de wrote: post #46
behnamoh wrote: post #3

How does Tailscale make money? I really like their service but I'm worried about a rug pull in the future. Has anyone tried alternative FOSS solutions? Also, sometimes it seems like I get rate limited on Tailscale. Has anyone had that experience? This usually happens with multiple SSH connections at the same time.

Wouldn't the FOSS alternative be to simply use wireguard?

a simpler setup with broad feature parity would probably look more similar to nebula than bare wireguard

Re: Tailscale Peer Relays is now generally available

#249

Post by solarisos »

alexktz wrote: post #115
solarisos wrote: post #114

The shift from managed DERP to decentralized Peer Relays is a massive win for self-hosters with difficult NAT situations. I’m curious if this significantly reduces Tailscale's own egress costs or if the primary goal was just improving latency for users who can't establish a direct WireGuard tunnel. Either way, removing the 'hassle' of setting up a custom DERP server is a great UX improvement.

Alex from Tailscale here... We’re users just like you, and we felt this pain point ourselves. The good news is that Peer Relays were able to build on a lot of the existing subnet router and exit node plumbing, so it wasn’t a huge engineering lift to bring to life. We also have plenty of customers running in restrictive NAT environments (AWS being a common example), where direct WireGuard tunnels just aren’t always po…

Thanks for the context, Alex. It’s interesting to hear that the engineering lift was lighter by leveraging the exit node/subnet router plumbing—that’s a clever use of existing primitives.

The point about AWS NAT restrictions is a big one. I think a lot of people underestimate how often 'enterprise-grade' networking actually becomes a bottleneck for direct P2P. Moving that burden away from custom DERP management makes the 'it just works' magic of Tailscale feel much more sustainable for small teams.

Re: Tailscale Peer Relays is now generally available

#250

Post by solarisos »

ghthor wrote: post #182
solarisos wrote: post #114

The shift from managed DERP to decentralized Peer Relays is a massive win for self-hosters with difficult NAT situations. I’m curious if this significantly reduces Tailscale's own egress costs or if the primary goal was just improving latency for users who can't establish a direct WireGuard tunnel. Either way, removing the 'hassle' of setting up a custom DERP server is a great UX improvement.

We’ve had issues with the centralized DERPs just blackholing traffic when we startup ephemeral nodes in CI. This is despite us ensuring that all important peers can establish direct connections to each other. But there is some bootstrapping that is happening before both peers negotiate. Having said this, it’s been almost a year since the last incident of this. It’s been rock solid the last months. Ok sure using these…

That ephemeral node bootstrap issue is a classic 'edge case' that becomes a nightmare in CI. It makes sense that centralized DERP might struggle with the sheer churn of nodes popping in and out of existence. Using a Peer Relay that lives permanently on your internal net as the 'anchor' for those CI nodes seems like it would solve that race condition entirely.
Post reply on HN