Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

321–330 of 419 posts

Re: Tailscale is pretty useful

#321

Post by PLG88 »

wkat4242 wrote: post #154
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

Beyondcorp was mainly created to advocate cloud services and to minimise the (legit) worry off CIOs to see all their data in services connected to the entire internet. I still think VPN has a good usecase. It's great extra layer of defense and also a nice way to disclose access to devices at different locations. I don't use tailscale as it's too commercial for me but I use another VPN mesh service. Of course you stil…

Even Google admits BeyondCorp could not replace all their VPN needs... I wrote a Reddit post on it a while back - https://www.reddit.com/r/zerotrust/comments/1bfb7od/thoughts...

Re: Tailscale is pretty useful

#322

Post by PLG88 »

stego-tech wrote: post #49
iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Particularly as it does not include its own PKI, so E2EE is done by MITM your IdP (OICD/SAML etc) and therefore, under court order Tailscale can decrypt your traffic.

We took the opposite approach with NetFoundry. (1) We open sourced the code (https://openziti.io/), (2) we built in PKI with private keys generated at source and destination so that even if traversing NF hosted data plane, we CANNOT decrypt traffic, (3) mTLS everywhere, (4) ability to bring your own PKI, and more.

Re: Tailscale is pretty useful

#323

Post by PLG88 »

eddieroger wrote: post #130
haswell wrote: post #64

Earlier quoted context omitted.

What are the primary downsides of self-hosting this? The top issues that come to mind: 1. Maintaining high availability 2. Dealing with patches/upgrades But I'm also really curious how likely a self-hosted instance is to be an attack vector potentially more dangerous than using something like Tailscale.

> 1. Maintaining high availability In my experience as a poor sysadmin (as in, bad), you don't /need/ HA for Headscale because the clients are pretty resilient. I've had my instance go down for a little bit and it's fine. Stale and new connections aren't, obviously, but it will work well enough that you won't realize Headscale itself has gone down until a while after it did.

Probably fine for a home lab, I don't think its fine for a production organisation running critical services across the overlay.

Re: Tailscale is pretty useful

#324

Post by PLG88 »

tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

Check out OpenZiti - https://openziti.io/. It looks like Tailscale but is open source, takes zero trust principles to its logical conclusion, and includes a whole suite of SDKs (alongside host based tunnelers and VMs) making it super easy to embed private, obsfucated, secure connectivity directly into your apps. Heck, you don't even need listening ports on the host OS network, therefore you app cannot be found or attacked from network/IP. Here is a good blog using Go SDK as an example - https://blog.openziti.io/go-is-amazing-for-zero-trust

Re: Tailscale is pretty useful

#325

Post by PLG88 »

yjftsjthsd-h wrote: post #26
jaxtracks wrote: post #3

The features here seem to be fairly standard with most the WireGuard based VPNs these days. For example, I use Nord for my use-case which is very similar to the author's. This allows me to rsync my home directory between my laptop, tablet, phone's Termux env, and desktop (all running Linux) to maintain configuration parity and file locality regardless of where I turn these devices on, so long as they have internet. D…

What other VPNs do mesh networking? I only know of zerotier (proprietary) and nebula (FOSS except that the Android app is proprietary)

Check out OpenZiti. Its open source, and does zero trust principles better. I wrote a blog comparing it and Tailscale - https://netfoundry.io/vpns/tailscale-and-wireguard-versus-ne...

Re: Tailscale is pretty useful

#326

Post by ghoshbishakh »

high_byte wrote: post #55

tailscale to expose a port is such overkill. just use ngrok for that.

For simple problems use simple tools. I believe the simplest tunneling tool out there is https://pinggy.io . Tailscale is for a different use case. Not just exposing one port to the interenet.

Re: Tailscale is pretty useful

#327

Post by stampedbox »

jdolak wrote: post #145
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

On your first point, I've been using tailscale for a bit and its ACL feature addresses most of my concerns there. My laptop can ssh into any of my servers but not the other way around, and my servers cant talk to each other unless I set them to.

looking for this setup - please share if you could

Re: Tailscale is pretty useful

#328

Post by Dylan16807 »

hn_throwaway_99 wrote: post #287
Andrew_nenakhov wrote: post #285

Earlier quoted context omitted.

> I wonder if the average person will ever be willing to install a VPN app on all their devices. Of course the average person will be willing to install a VPN app: all it takes is a bit of internet censorship, blocking access to their favourite services, and some geofencing, where services limit access to them based on IP address. Just ask people from China, Russia, Ukraine, Turkey, UK, Germany, etc.

But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. When you use services like NordVPN, Mullvad, Surfshark, etc., you're just installing a VPN client , and you're basically just using them as a reverse proxy to hide your IP address (present it as coming from another country). That is the use case you are talking about.…

> But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is.

Does that matter? It still shows willingness to install.

Re: Tailscale is pretty useful

#329

Post by DictumMortuum »

Also check out zerotier. I've been using it because it has a lot more features that tailscale (although it's been 4-5 years that I have the zerotier network set up).

Pretty damn useful to connect to services in my internal network wherever I go. I have it set up on my router, so I don't need to install it on every single server in the house :D

Re: Tailscale is pretty useful

#330

Post by ekabod »

parasubvert wrote: post #179
hattmall wrote: post #170

Earlier quoted context omitted.

Do mainstream consumers really need a VPN?

Tailscale isn’t really a VPN, it’s an OSI layer 5 for the TCP/IP world. It makes connectivity as easy as 90s LAN parties were. I use Tailscale - so I can do remote tech support on my 81 year old mother’s computer - So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something - watching streaming media from my home network when I’m…

>So I can remote in to my desktop from anywhere with my mobile phone or iPad or Vision Pro or Steam Deck if I need a file or need to print something

What's app do you use to browse data on your desktop?

Post reply on HN