Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale raises $100M

tailscale.com

Post reply on HN
Print view View original

311–320 of 468 posts

Re: Tailscale raises $100M

#311

Post by JeremyNT »

FL410 wrote: post #285
discardedrefuse wrote: post #172

Earlier quoted context omitted.

Absolutely love nebula and really wanted it to win when I did my overlay network shootout (for personal use). But device on-boarding and management was overly complex for a lay person (I have a couple users that would require access). I settled on ZeroTier for now. Unfortunately, I don't think ZeroTier is my long term solution. Their self-hosted option comes with a plethora of caveats that make it basically unusable.…

I am curious what you found complex - was it the PKI? I was able to get Nebula up and running WAY faster than any of the others. It's two (well really only one) binaries and a config file - the simplicity is awesome.

It's easy to get started, but the issues come mostly from managing that "just a config file" over time.

Have a bunch of new nodes? Replacing a lighthouse? Revoking and replacing certs?

Here's a mistake that I made personally. Did you read the docs fully and realize that the default expiration for a CA is one year? The same is true for certificates. You need some kind of tooling to rotate certs every year, by default, or one day you'll find your entire overlay network disappears.

What about the ACL lists? Well, they're just stored in that same config file. What if you add a new service you didn't count on initially? Or you have a new class of clients?

What if your lighthouse needs to change its IP address? Or you need to retire and replace it outright?

And if you have hosts coming and going a lot, suddenly managing all those configuration files looks like quite a pain indeed...

None of this is unsolvable - assuming you have root on all the nodes you care about. You could even create tooling to automate these things with some kind of configuration management system (which indeed, if you are deploying to more than a handful of systems, you basically must do). But these pain points will eventually add up if you are just trying to connect to friends.

Re: Tailscale raises $100M

#312

Post by pkulak »

yeswecatan wrote: post #221
newaccount74 wrote: post #141

Earlier quoted context omitted.

I use it so I can connect to my work machine (dynamic IP on office wifi) from my laptop (dynamic IP, home Wifi). It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night. It's not necessary, but Tailscale makes a lot of things just easier.

> It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night. What's the difference between using Tailscale for this and just opening the port on your router?

Like a million times more secure.

Re: Tailscale raises $100M

#313

Post by [deleted] »

irq-1 wrote: post #260
throw0101a wrote: post #99

Earlier quoted context omitted.

> Even if everyone went IPv6 and gave every device a public IP address, pretty much every network would have a firewall that behaved just like NAT. No, they do not behave just like NAT. With NAT you have two problems: * figuring out your address * firewall hole punching With IPv6 you already know your address and just give it to the peer you are communicating with. You then tell your firewall to allow connections fro…

> With IPv6 you already know your address and just give it to the peer you are communicating with. You then tell your firewall to allow connections from the address(:port) that the peer tells you. No STUN, no TURN, no ICE. What about phone networks? (in the US providers block all incoming traffic.) Or other ISPs that block incoming traffic? NAT has been used to address a fundamental problem of what traffic can be tru…

[deleted]

Re: Tailscale raises $100M

#315

Post by throw0101a »

zinekeller wrote: post #138
throw0101a wrote: post #106

Earlier quoted context omitted.

> Yeah, no one is going to allow unsolicited inbound connections even without NAT so you still have to have something to hook up the two ends in a P2P setting. Sure they are. All home routers that I'm aware of allow for port forwarding so folks can self-host a service: perhaps a game server (e.g., Minecraft), web, e-mail, etc. It's just going forward you can set up a separate subnet to put your gear in (especially if…

... if your definition of "home routers" excludes ISP-provided ones, then I'll agree. Unfortunately, I'm pretty sure that either you are on an ISP that actually cared and found a good supplier or didn't check out what are the capabilities of ISP-provided routers.

With IPv4 I have to worry about UPnP/PCP working and TURN/STUN/etc non-sense when it comes to peer-to-peer protocols. With IPv6 I only have to worry about about UPnP/PCP working. In my books that's an improvement.

If I want to self-host something, then with IPv4 I have publish my IP and worry about the CPE supporting port forwarding. With IPv6 I have publish my IP and use UPnP/PCP to allow all connections. Is there any CPE gear that does not support UPnP/PCP?

Re: Tailscale raises $100M

#316

Post by anderspitman »

nickysielicki wrote: post #111

Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it takes 15 minutes to get every device you own up and running and talking. This is the lowest friction personal VPN to ever exist, and once you see how easy it is for your own devices, you’ll wish you had it at work. The biggest risk that this company has is that…

> Web3 happens when people can host stuff on their phones

This has essentially been the guiding principle of my side projects for the last two years. Folks shouldn't need to understand DNS, TLS, HTTPS, IP addresses, ports, NAT, CGNAT, etc in order to own their data. Self-hosting a small server for you and your friends shouldn't be any more difficult or less secure than installing an app on your phone.

Re: Tailscale raises $100M

#317

Post by discardedrefuse »

FL410 wrote: post #285
discardedrefuse wrote: post #172

Earlier quoted context omitted.

Absolutely love nebula and really wanted it to win when I did my overlay network shootout (for personal use). But device on-boarding and management was overly complex for a lay person (I have a couple users that would require access). I settled on ZeroTier for now. Unfortunately, I don't think ZeroTier is my long term solution. Their self-hosted option comes with a plethora of caveats that make it basically unusable.…

I am curious what you found complex - was it the PKI? I was able to get Nebula up and running WAY faster than any of the others. It's two (well really only one) binaries and a config file - the simplicity is awesome.

I found it too complex for a lay person. On a regular computer or server its not too bad. I can send someone a config file with the certs and keys already built in. That's easy enough. But on mobile it requires a back and forth exchange of keys over a different medium.

Compare that to ZeroTier where I can just tell someone, "install this app and punch in this Network ID". Also, ZT lets me control the entire network firewall from a centralized place. Where Nebula is doing it on a per-client basis and requires new certs if device groups change.

I don't want to talk up ZT too much though. Their self-hosted option is a joke. There is no webui. You have to do everything via the API...including the firewall rules; And you have to write those rules in the non-human readable format that their webui abstracts away. Worse still, their mobile apps won't work with the self-hosted option. I used them to get something up and running quickly, but I'll probably end up on Nebula anyways.

Re: Tailscale raises $100M

#318

Post by anderspitman »

nickysielicki wrote: post #164
karlshea wrote: post #162

Earlier quoted context omitted.

I can do that without Tailscale though by just using the WireGuard app. What is Tailscale adding to this?

NAT breaking, I can have a wireguard network with Tailscale where every device only has an RFC1918 address and a default route.

For more background on just how much Tailscale is doing for you with respect to NAT:

https://tailscale.com/blog/how-nat-traversal-works/

Re: Tailscale raises $100M

#319

Post by discardedrefuse »

JeremyNT wrote: post #311
FL410 wrote: post #285

Earlier quoted context omitted.

I am curious what you found complex - was it the PKI? I was able to get Nebula up and running WAY faster than any of the others. It's two (well really only one) binaries and a config file - the simplicity is awesome.

It's easy to get started, but the issues come mostly from managing that "just a config file" over time. Have a bunch of new nodes? Replacing a lighthouse? Revoking and replacing certs? Here's a mistake that I made personally. Did you read the docs fully and realize that the default expiration for a CA is one year? The same is true for certificates. You need some kind of tooling to rotate certs every year, by default,…

Just FYI, when you create a CA cert or sign certs with nebula-cert you can specify a -duration. Which I know doesn't help you after the fact, but it might help someone going forward.

Re: Tailscale raises $100M

#320

Post by anderspitman »

pkulak wrote: post #310
Sohcahtoa82 wrote: post #286

Earlier quoted context omitted.

What other benefits are there? I use a PiHole to block ads on my phone already, but I do it via a PiHole installed on an EC2 instance that I also use as an IRC bouncer and other things.

It means you can self host all kinds of things and never worry about opening a port on your router.

As long as you don't need to share any of your services with non-Tailscale users. Otherwise you'll need to set up some sort of public server.
Post reply on HN