Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailnet Lock

tailscale.com

Post reply on HN
Print view View original

41–50 of 119 posts

Re: Tailnet Lock

#41

Post by yjftsjthsd-h »

slig wrote: post #33
ignoramous wrote: post #7

> ...by architecting our infrastructure with security and privacy in mind. The blog and the website loads in so many trackers (reasonable, given metrics are important when you're busy hyperscaling a venture-backed startup), that folks at Tailscale should seriously reconsider positioning themselves as some paragons of privacy. No offence (:

> website loads in so many trackers Not on my browser. Maybe you should consider a better browser and/or install some extensions.

The term for this is "victim blaming", and the answer is "no, that shouldn't be necessary".

Re: Tailnet Lock

#42

Post by yjftsjthsd-h »

cpach wrote: post #11
ignoramous wrote: post #7

> ...by architecting our infrastructure with security and privacy in mind. The blog and the website loads in so many trackers (reasonable, given metrics are important when you're busy hyperscaling a venture-backed startup), that folks at Tailscale should seriously reconsider positioning themselves as some paragons of privacy. No offence (:

Are you sure people who complain about such things are in Tailscale’s target demographic?

Well, if Tailscale is bothering to talk about "architecting our infrastructure with security and privacy in mind", they seem to think so.

Re: Tailnet Lock

#43

Post by TheFlyingFish »

unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

Depends on whether you're talking about stuff that you actually want to be "exposed to the public" (i.e. can receive traffic from any IP) or just "accessible from outside the LAN."

If the former, Tailscale isn't really a good fit since it only permits access to authenticated devices.

If the latter, Tailscale is perfect. It's a VPN in the original sense of the world, "private" being the operative term - your devices can communicate as if they were all on the same LAN, without worrying about their traffic being eavesdropped.

As for the pricing, I'm fairly confident that Tailscale won't mind if you're sharing a free plan (so single-user) across e.g. your laptop and your wife's, even though there are technically two "users" there. They've made it pretty clear that the divide they care about is "personal use free, company use paid."

Re: Tailnet Lock

#44

Post by mdeeks »

kerneis wrote: post #39

I found the blog post slightly confusing because it never explicitly spells out that endorsing a new node is a manual operation that the administrator has to perform from one of the trusted nodes. Of course this is what you'd want, anything automatic would ruin the purpose of tailnet lock. But still not seeing it mentioned, neither in the text nor in the pictures, made me wonder what I had missed, until I watched the…

I had the same issue. I think the idea is that you build something yourself on a trusted node that decides whether or not to endorse a new node.

Off the top of my head I'd do something dead simple like verify the user account matches our domain and then also query an inventory system to verify it is indeed a device we manage through MDM (though I'm not sure how this will work for mobile devices. We don't MDM those).

When a new device attempts to join you should have some data on it via the API (User, OS, Tailscale version, source IP, machine name). You could use that data to decide to endorse it or not.

Re: Tailnet Lock

#46

Post by 0x0000000 »

unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

Dynamic DNS with wireguard works great, especially for a small footprint (sounds like you only have one LAN you want to access remotely, not multiple sites). It'll be free, and you won't have any cloud centralized service you're dependant on.

Personally I host both of these services (dynamic DNS client, wireguard server) right on my WAN edge router, but you could also run it on a host (e.g., VM or raspberry pi) inside the LAN.

Re: Tailnet Lock

#47

Post by slig »

yjftsjthsd-h wrote: post #41
slig wrote: post #33

Earlier quoted context omitted.

> website loads in so many trackers Not on my browser. Maybe you should consider a better browser and/or install some extensions.

The term for this is "victim blaming", and the answer is "no, that shouldn't be necessary".

But that's the reality of the web. We can complain or we can block those things.

Re: Tailnet Lock

#48

Post by 0x0000000 »

teaearlgraycold wrote: post #45

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

It's a usability thing, IMO.

Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant.

Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing keys. Tailscale does a lot of that lifting for you, so you can easily and quickly get a working VPN, at a low cost, with good performance.

Personally I manage wireguard myself, but I also self-host my own VMs, storage server, applications, etc.

Tailscale is like taking your car in for an oil change instead of doing it yourself, plenty of people find that worth it.

Re: Tailnet Lock

#50

Post by teaearlgraycold »

0x0000000 wrote: post #48
teaearlgraycold wrote: post #45

At this point I have no idea why HN cares so much about a VPN company, but I’m too afraid to ask.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?
Post reply on HN