Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

351–360 of 419 posts

Re: Tailscale is pretty useful

#351

Post by nulbyte »

godelski wrote: post #248
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

> set up a private network between all your ~~Google-signed-in~~ devices. I've been doing something like this as a fun side project. Idea is to get everything to pass through piholes and have both clear and VPN exit nodes. So then I can send some pis to people and we can create an internal network to share things like files, movies, streaming services, whatever. It also can increase security, especially making it eas…

> So I can't just make a conditional in my config to go through TS instead of local network based on that

Tailscale can do hairpinning, so you may find you don't need a conditional config.

Re: Tailscale is pretty useful

#352

Post by p4bl0 »

When reading about this kind o use cases, I'm always really glad my ISP gets me static and dedicated IPv4 and IPv6 addresses along with a good fiber connection to the internet for less than 30€/mo.

Re: Tailscale is pretty useful

#353

Post by aborsy »

PLG88 wrote: post #349
aborsy wrote: post #341

Earlier quoted context omitted.

First of all, a node added to tailnet doesn’t not have the ability to decrypt the traffic in tailnet. All it can do to contact other nodes, decrypt traffic users sent to that hidden node, or modify settings in admin console. Furthermore, with tail lock, the coordination server should not be able to add nodes from outside. Can you clarify?

Comment edited due to an incorrect understand which has been rectified.

This is false information.

Even if an attacker such as the government runs the coordination and relay servers, and the IdP, they will not be able to decrypt any traffic in tailnet.

The secret keys remain on device, and traffic is end to end encrypted. There is no mechanism in the client agents to send out the secret keys. The coordination server receives the public keys and metadata.

Please clarify or revise your comment!

Re: Tailscale is pretty useful

#354

Post by unixhero »

stampedbox wrote: post #327
jdolak wrote: post #145

Earlier quoted context omitted.

On your first point, I've been using tailscale for a bit and its ACL feature addresses most of my concerns there. My laptop can ssh into any of my servers but not the other way around, and my servers cant talk to each other unless I set them to.

looking for this setup - please share if you could

There is no setup. Just use Tailscale

Re: Tailscale is pretty useful

#355

Post by PLG88 »

aborsy wrote: post #353
PLG88 wrote: post #349

Earlier quoted context omitted.

Comment edited due to an incorrect understand which has been rectified.

This is false information. Even if an attacker such as the government runs the coordination and relay servers, and the IdP, they will not be able to decrypt any traffic in tailnet. The secret keys remain on device, and traffic is end to end encrypted. There is no mechanism in the client agents to send out the secret keys. The coordination server receives the public keys and metadata. Please clarify or revise your com…

I see I did have a misunderstanding. I believe there is still the meta data angle, but yes, private keys on endpoints would ensure E2EE. I will update my comment.

Re: Tailscale is pretty useful

#357

Post by qudat »

apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

For prototyping web services I’ve been using https://tuns.sh which uses a managed version of dish. What’s great is there’s nothing to install locally since it uses ssh port forwarding to function.

Re: Tailscale is pretty useful

#358

Post by p_l »

hn_throwaway_99 wrote: post #287
Andrew_nenakhov wrote: post #285

Earlier quoted context omitted.

> I wonder if the average person will ever be willing to install a VPN app on all their devices. Of course the average person will be willing to install a VPN app: all it takes is a bit of internet censorship, blocking access to their favourite services, and some geofencing, where services limit access to them based on IP address. Just ask people from China, Russia, Ukraine, Turkey, UK, Germany, etc.

But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. When you use services like NordVPN, Mullvad, Surfshark, etc., you're just installing a VPN client , and you're basically just using them as a reverse proxy to hide your IP address (present it as coming from another country). That is the use case you are talking about.…

I pointed someone who, admittedly, has issues following complex computer setup instructions at Tailscale, they easily set up their own tailnet and use it to access home devices all the time to the point they barely remember it's there

Re: Tailscale is pretty useful

#359

Post by klabb3 »

yegle wrote: post #87
klabb3 wrote: post #74

Earlier quoted context omitted.

Easier than what? You mean it can in these special cases become like not having a CGNAT? > they also make the traffic within the CGNAT free So.. both data caps and breaking the principle of net neutrality?

Easier than asking family members to install a new software, then ask them to share their "node" to you. Imagine you can remote desktop connect to your parents' computer after their phone call. The data cap is on your cell service (the US also has that). Net neutrality is debatable given the traffic is between my own devices so presumably no one gets hurt (think of accessing and streaming from your NAS at home).

> Easier than asking family members to install a new software, then ask them to share their "node" to you.

Right, but not easier than static IP (or dyn dns), both of which require technical knowledge and procedure to set up. I really don’t see the great simplification here. Plus you’d still have firewalls and it’d stop working as soon as you (the client) leave your company’s garden (eg at work). To be fair, static IPs also wouldn’t work when your parents (the server) move their device.

> The data cap is on your cell service (the US also has that). Net neutrality is debatable given the traffic is between my own devices so presumably no one gets hurt (think of accessing and streaming from your NAS at home).

Fair enough. That I don’t mind. I really dislike configuring multiple devices for an ISP, that’s consumer lock in imo. The provider can simply implement hairpinning on their infrastructure and the traffic won’t leave their network anyway.

Re: Tailscale is pretty useful

#360

Post by infogulch »

PLG88 wrote: post #319
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are lit…

> - We don't build on Wireguard, which provides much more flexibility.

How does this choice affect performance and CPU utilization? Wireguard is known for providing good network performance with low resources.

Post reply on HN