Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale Peer Relays is now generally available

tailscale.com

Post reply on HN
Print view View original

261–267 of 267 posts

Re: Tailscale Peer Relays is now generally available

#261

Post by db48x »

Lammy wrote: post #241
snailmailman wrote: post #181

Earlier quoted context omitted.

They specifically avoid sending traffic through tailscale servers whenever possible. That’s how the free tier stays free. Most connections are direct, P2P. The traffic that does go through their servers is encrypted, and bandwidth limited on the free plan. Any snooping on client behavior would have to be done client side, and the clients are all open source. To some extent the coordination server might be able to ded…

> To some extent the coordination server might be able to deduce some metadata about connections; but definitely not snoop all plaintext traffic. Metadata is as good as data for deducing your behavior. Think what conclusions can be drawn about a person's behavior from a log of their network connections, from each connection's timestamp, source, destination, and port. Think about the way each additional thing-which-ma…

True, but none of that metadata goes to Tailscale.

Re: Tailscale Peer Relays is now generally available

#262

Post by timwis »

bingo-bongo wrote: post #257
timwis wrote: post #116

I'm having a hard time understanding how this is different from a bastion server, where you're tunneling through an intermediary server that you've deployed in the target network. I guess the difference is the fact that the intermediary server doesn't need a port open (as standard nat punching will work)? Or are there other big differences?

We've setup and used peer-relays since it was first announced and they've been great, but they do solve a somewhat specific problem. Some of our users experienced fairly limited throughput from time to time. Under certain circumstances (eg. always ipv4 NAT/double-NAT, never for ipv6) their Tailscale client couldn't establish a direct connection to the Tailscale node in the datacenter, so data was relayed through Tail…

Thanks, that's a helpful example to put it into context!

Re: Tailscale Peer Relays is now generally available

#263

Post by _se »

velcrovan wrote: post #231
raggi wrote: post #204

Earlier quoted context omitted.

It's difficult for us to maintain documentation of exactly the kind you'd want there, though we do try to keep up with docs as best we can. In particular there is a fairly wide array of heuristics in the client to adapt to the environment that it's running in - and this is most true on Linux where there are far far too many different configuration patterns and duplicate subsystems (example: https://tailscale.com/blog…

> It's difficult for us to maintain documentation of exactly the kind you'd want there Suggestion: let an LLM maintain it for you. Alternate suggestion for OP: let an LLM generate the explanations you want from the code (when available).

LLM docs suck.

For technically complex things, they EXTRA suck.

This is a bad idea.

Re: Tailscale Peer Relays is now generally available

#265

Post by zephen »

db48x wrote: post #258
zephen wrote: post #166

Earlier quoted context omitted.

There are a lot of workarounds these days, such as tailnet switching, and, of course, if you're admin on both tailnets, you're practically golden with the "share" option. But even power users have to pick and choose their battles. If I had a nice tailnet home setup going I might be seriously miffed if I had to try to fit in some of my devices to a corporate tailnet I didn't control.

True, but to be frank you shouldn’t be using personal devices for work purposes anyway.

Security is a series of trade-offs, which in the worst case disallows anybody from doing anything.

In the simplest case, if a person has two different sets of systems they desire to access from a cellphone, and an unwillingness to carry two different cellphones around with them, then it becomes a business decision of whether that person is valuable and trustworthy enough to allow access to work systems and "other" systems from that cellphone.

Who pays for the cellphone, and whether this extends to laptops or not, are questions of degree.

Re: Tailscale Peer Relays is now generally available

#266

Post by philipallstar »

ZoomZoomZoom wrote: post #246
1shooner wrote: post #243

Earlier quoted context omitted.

>Healthy and not extremely niche Free Software projects don't disappear. This sounds a lot like a circular definition.

Not really? One is the cause (bad management/tech debt/problematic architecture/no public interest, etc.), the second is the effect.

It looks as though your definition of healthy is "survived"; i.e. projects that survived have survived.

Re: Tailscale Peer Relays is now generally available

#267

Post by nickburns »

eddyg wrote: post #225
nickburns wrote: post #49

Earlier quoted context omitted.

Things are much more unscrupulous than potentially ceasing to be free tomorrow. Nobody who values their privacy would ever route their network traffic through a 'free' service.

Tailscale is not marketed as an "anonymity VPN". You're still using the devices in your Tailnet. Tailsacle provides managed, policy-driven secure connectivity, where the network admin controls access, and where packet payloads are end-to-end encrypted between their nodes using device-to-device links that are WireGuard-based. Their TCP relay system (DERP) helps connectivity when direct peer-to-peer isn’t possible, but…

Thank you for the explanation. I was definitely unclear on the service that Tailscale apparently actually provides.
Post reply on HN