Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailscale is pretty useful

blog.6nok.org

Post reply on HN
Print view View original

381–390 of 419 posts

Re: Tailscale is pretty useful

#381

Post by PLG88 »

infogulch wrote: post #360
PLG88 wrote: post #319

Earlier quoted context omitted.

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are lit…

> - We don't build on Wireguard, which provides much more flexibility. How does this choice affect performance and CPU utilization? Wireguard is known for providing good network performance with low resources.

We use very light weight libraries - https://openziti.io/docs/learn/core-concepts/security/connec... - incl. mbedTLS (from Arm) and ChaCha20-Poly1305 (same as Wireguard) by default. We have tons of use cases in constrained environments, both CPU and the network transport. This includes embedding our SW on military drones, into industrial FWs, and more.

Re: Tailscale is pretty useful

#382

Post by thomastjeffery »

sfRattan wrote: post #164
thomastjeffery wrote: post #40

In other words (they do get to this point right away), port forwarding is pretty useful, and most of us don't have it anymore. I'm sick and tired of the way ISPs treat us. It's literally written into my lease what company I will pay for internet, and how much I will pay them. It is not , however, written in my lease how fast the connection will be . Not only am I unable to forward ports, I can't even change my own Wi…

The authoritative bullshit isn't what society is running on, it's what society is giving as an excuse for enshittification that enriches interested parties. Your landlord (I'm guessing based on having seen it before) gets kickbacks from the ISP to force all tenants onto a specific (probably overpriced) Internet plan. The interest in keeping you from configuring your own router is in allowing the ISP's enshittifying f…

I'm not even confident they get kickbacks. They probably just believe that either negotiating service details or providing infrastructure for competitive options would require more work from them. They are probably right about that: I'm not hassling them over it. I'm really not in a good position to anyway. As much as I would like to attribute malice to this behavior, it's most likely to be no more than laziness.

If I moved into a house, I could get 1gbit symmetric from Google Fiber or UTOPIA at half the price. But that doesn't matter because I cannot remotely afford a mortgage.

The real problem is Monopoly. Not the market dominance kind: the no one gets to compete kind. We have it in real estate, where every piece of the market is overvalued so far that very few individual people can meaningfully participate. We have it with ISPs who get to literally own the last mile infrastructure, so their customers can't physically connect to a competitor.

Re: Tailscale is pretty useful

#383

Post by dovholuknf »

concerndc1tizen wrote: post #379
PLG88 wrote: post #346

Earlier quoted context omitted.

I will preface by saying I am not a Nebula expert, and it may have changed since I last looked. Similarities: - Fully open source, using CAs as strong identities (rather than relying on SSO from third parties), completely self-hosted (with 3rd party SaaS options), and providing scalable, performant overlay networking. Differences: - OpenZiti is focused on connecting services based on zero trust principles. In contras…

Sounds amazing and like it addresses my issues with Nebula. I know that Nebula/Defined Networks was/is working on better Kubernetes integration, but it seems unlikely to become generally available. Is that something you're supporting? i.e. as pod sidecar to authenticate services like nebula has ACL. What's your funding model? Are enterprises willing to sponsor the development? I think Nebula has a lot of trust solely…

Couple of additional small notes (maintainer here)

> In a similar sense, why should enterprises trust OpenZiti?

you don't have to. It's open source - so you go look at all the code and judge for yourself but perhaps better than that (well different anyway) is that OpenZiti allows you to use your own PKI for identities if youlike. With third-party CA support, you can make your own key/cert and deploy them to identities if you desire. https://openziti.io/docs/learn/core-concepts/pki/#third-part...

> If services do not use e2ee

with OpenZiti you basically get this by default between OpenZiti clients. (once offloaded from the OpenZiti overlay, it's up to the underlying transport protocol)

Re: Tailscale is pretty useful

#384

Post by hn_throwaway_99 »

Dylan16807 wrote: post #328
hn_throwaway_99 wrote: post #287

Earlier quoted context omitted.

But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. When you use services like NordVPN, Mullvad, Surfshark, etc., you're just installing a VPN client , and you're basically just using them as a reverse proxy to hide your IP address (present it as coming from another country). That is the use case you are talking about.…

> But what you're referring to as a "VPN app" is something very different than what the parent poster is referring to with respect to what Tailscale is. Does that matter? It still shows willingness to install.

I think it matters a lot because the use cases are so different.

Just look at the US - tons of people now install a VPN app like Nord or Mullvad to get around state-level porn blocks. In other countries it's to get around other types of censorship. And to install those apps on something like a phone or laptop is trivially easy.

The use cases for installing Tailscale (I need a home network and I need to be able to access these devices from the Internet) is, I would guess, ~5% compared to the other VPN use case. I'm a software developer, and I don't need it.

Re: Tailscale is pretty useful

#385

Post by bboreham »

9dev wrote: post #332
bboreham wrote: post #310

Earlier quoted context omitted.

Nit: the host is not picked at random, but according to the RFC3484 algorithm. Since people typically don’t believe me about this, here it is from someone who has done a lot of networking programming: https://daniel.haxx.se/blog/2012/01/03/getaddrinfo-with-roun...

Arghh. I want to love IPv6, but they really work hard against it, don't they. Thanks, I didn't know this!

Even better: although the reason for the algorithm is IPv6, all mainstream implementations do it on IPv4 also.

Re: Tailscale is pretty useful

#386

Post by apitman »

PLG88 wrote: post #319
apitman wrote: post #138

Tailscale is one of my favorite companies. They're clearly on to something. Here's a great post by their CTO explaining a lot of the motivation and vision behind it: https://crawshaw.io/blog/remembering-the-lan IMO the main outstanding questions/concerns are: * Is the VPN model really the way to go? If someone gets their hands on one of your Tailscale nodes, they can access every service on your tailnet, which are li…

Great insights, I think you will like OpenZiti, Anders, which is included in your list for both itself and zrok, which we built on top. Directly answering your concerns: - Deny by default and least privilege model means getting access to a node does not give you access to all services on the overlay. This includes SDKs so that only embedded apps are authorised, the apps have no listening ports on underlay and are lit…

I love what you're doing with OpenZiti. I've looked at it multiple times, and I always come away feeling like it's not a good fit for me, and indiehosters in general.

I think the concept of making a simple SDK for embedding tunneling in apps is unique and very compelling.

However, for me to commit to a platform like that, the most important question is: if upstream changes their license, runs out of money, or just generally takes things in a direction I don't like, what are my options?

Ideally, the platform would be so simple that I can just fork it myself or with a small team without too much effort. The best way to create a platform like this is to build around simple, open protocols. I've never gotten the feeling OpenZiti is designed this way. I've never found any documentation on the network protocol. Your platform also offers many features I don't need, which makes it even higher risk to consider forking.

Note that I'm not trying to say you're doing something wrong. I'm not aware of any tunneling platform that provides this, which is why I'm currently building one myself (a successor to boringproxy).

I get the feeling OpenZiti is rather enterprise focused. And that makes sense, it's almost certainly where all the money is. I really hope you guys are able to prove the value of app-embedded tunneling.

But I'm looking for a very simple consumer product/platform.

Re: Tailscale is pretty useful

#387

Post by kdmtctl »

devilbunny wrote: post #347
kdmtctl wrote: post #314

Earlier quoted context omitted.

It's easy to block the control plane because Tailscale has endpoints listing all current control and DERP servers. On Linux you can use a SOCKS proxy for control plane traffic, if connections still work. Some firewalls are really restrictive. I can understand the work network policy, someone could use Tailscale to leak data, but a residential ISP should not block it. I would rather bother their support for an incompl…

My residential ISP does not block it. My issue with work isn’t that they block it on employee WiFi, it’s that they block it on the guest network too. Our nanny software is rather extreme - blocks, for example, alcohol-related sites. Which in a sense is fine, because I don’t need to read up on whiskey at work, but it also often blocks restaurant sites.

Literally a bootleg content)

Re: Tailscale is pretty useful

#388

Post by sotix »

rainsford wrote: post #226
sotix wrote: post #217

I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term. Or is there more to it that I’m missing?

Wireguard is not an alternative to Tailscale, any more than FTP is an alternative to Dropbox. And not just because Tailscale actually uses Wireguard under the hood. Also if your comment is a sarcastic callback to the "why don't you just use FTP" comments when Dropbox came out, well done. Wireguard is a great VPN protocol, but what the basic protocol doesn't do is make it transparently easy to use in a wide variety of…

Ahh thanks for the example. That really clarifies it. I’m used to my NAS always being in one place, so I hadn’t encountered that scenario.

Re: Tailscale is pretty useful

#389

Post by sotix »

christina97 wrote: post #219
sotix wrote: post #217

I don’t understand why one would use Tailscale over WireGuard. Is it because it’s easier to setup sort of like how Dropbox was? I’m primarily wary of the rug being pulled out and Tailscale suddenly costing me a lot of money whereas my WireGuard setup seems more stable in the long term. Or is there more to it that I’m missing?

Yes: much easier to set up. It also provides a backup relay node system in case it can’t establish direct connection between your devices. When you set up wireguard you have to update every system’s config to add a new device, Tailscale does this for you. That’s the key thing.

Got it. That is very nice.

Re: Tailscale is pretty useful

#390

Post by concerndc1tizen »

PLG88 wrote: post #380
concerndc1tizen wrote: post #379

Earlier quoted context omitted.

Sounds amazing and like it addresses my issues with Nebula. I know that Nebula/Defined Networks was/is working on better Kubernetes integration, but it seems unlikely to become generally available. Is that something you're supporting? i.e. as pod sidecar to authenticate services like nebula has ACL. What's your funding model? Are enterprises willing to sponsor the development? I think Nebula has a lot of trust solely…

OpenZiti is developed and maintained by NetFoundry ( https://netfoundry.io/ ). We provide a productised version which is very easy to deploy, manage, operate, and monitor with high SLAs, support, legal/compliance, liability, security, updates, feature requests etc. We are not rolling our own crypto, we use well vetted open source standards/implementations - https://openziti.io/docs/learn/core-concepts/security/connec…

Sounds great. It puzzles me that Nebula hasn't done what you're doing with OpenZiti.

In my opinion, Kubernetes networking is flawed, in that service mesh authentication with mTLS has unnecessary overhead, Cilium network policies are clumsy using labels and work poorly with non-pod workloads (i.e. CIDR-based policies), multi-cluster is hacky, and external workloads are inconvenient to set up. So a simple plug-and-play solution that solves these problems would be great.

Post reply on HN