Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An open source, self-hosted implementation of the Tailscale control server

github.com

Post reply on HN
Print view View original

41–50 of 85 posts

Re: An open source, self-hosted implementation of the Tailscale control server

#41

Post by squiggleblaz »

notpushkin wrote: post #39
coconut08 wrote: post #14

Earlier quoted context omitted.

arent most of the the tailscale clients open source aside from the gui portion of the non open source os's?

I think the whole Windows client is closed. On macOS though you can use it from the command line just fine (apart from a couple quirks due to a completely different VPN implementation [1]). [1]: they have three : https://tailscale.com/kb/1065/macos-variants

From https://github.com/tailscale/tailscale

"This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code."

and

"The macOS, iOS, and Windows clients use the code in this repository but additionally include small GUI wrappers. The GUI wrappers on non-open source platforms are themselves not open source."

Moreover, there's https://github.com/tailscale/tailscale-chocolatey to aid the build process. I haven't built it or run it.

On the other hand, while I suppose the Windows app is probably reasonably straightforward to replicate, I guess it would be much harder to produce an iOS or Android app because of the vagaries of mobile programming.

Re: An open source, self-hosted implementation of the Tailscale control server

#42

Post by jacobtomlinson »

bingo-bongo wrote: post #28
nativeit wrote: post #19

Earlier quoted context omitted.

> Headscale seems to have nailed down the part of bypassing the firewall and doing fancy NAT-traversal Did they really roll-their-own for those functions? I thought this was just a control layer on top of Tailscale’s stock services on the backend, are they facilitating connections with novel methods? Apologies if I’m asking obvious questions, I use ZeroTier pretty regularly, but I am not too familiar with Tailscale.

They have a really great in-depth blog post describing how they do it: https://tailscale.com/blog/how-nat-traversal-works

This is a fascinating read!

Re: An open source, self-hosted implementation of the Tailscale control server

#43

Post by notpushkin »

squiggleblaz wrote: post #41
notpushkin wrote: post #39

Earlier quoted context omitted.

I think the whole Windows client is closed. On macOS though you can use it from the command line just fine (apart from a couple quirks due to a completely different VPN implementation [1]). [1]: they have three : https://tailscale.com/kb/1065/macos-variants

From https://github.com/tailscale/tailscale "This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code." and "The macOS, iOS, and…

Thanks, I stand corrected then!

Android client is open source (and you can get in from F-Droid, even), so that only leaves iOS I guess.

Re: An open source, self-hosted implementation of the Tailscale control server

#44

Post by xrd »

nativeit wrote: post #19
SuperShibe wrote: post #13

Every few months I come back to this repo to check if they finally got Tailnet lock running or if someone security audited them in the meanwhile. Unfortunately neither of these things seem to make any progress and thus, I’ve grown uncertain in how much I can trust this as a core part of my infrastructure. The entire premise of Tailscale SaaS builds on creating tunnels around your firewalls, then enabling the user to…

> Headscale seems to have nailed down the part of bypassing the firewall and doing fancy NAT-traversal Did they really roll-their-own for those functions? I thought this was just a control layer on top of Tailscale’s stock services on the backend, are they facilitating connections with novel methods? Apologies if I’m asking obvious questions, I use ZeroTier pretty regularly, but I am not too familiar with Tailscale.

Can you share why you use ZeroTier over Tailscale? I run several headscale control planes and it really is nice to self-host. But, I'm curious about other options.

Re: An open source, self-hosted implementation of the Tailscale control server

#45

Post by mrklol »

cassianoleal wrote: post #31
syntaxing wrote: post #4

Earlier quoted context omitted.

As in you rolled out an internal service for the whole company?!

As opposed to what? This seems pretty normal. We considered it as well but there was a feature missing that meant we couldn’t use it for one of our main requirements. Had that not been the case, we’d have rolled it out.

Mind sharing which feature?

Re: An open source, self-hosted implementation of the Tailscale control server

#46

Post by codethief »

bananapub wrote: post #34
SuperShibe wrote: post #13

Every few months I come back to this repo to check if they finally got Tailnet lock running or if someone security audited them in the meanwhile. Unfortunately neither of these things seem to make any progress and thus, I’ve grown uncertain in how much I can trust this as a core part of my infrastructure. The entire premise of Tailscale SaaS builds on creating tunnels around your firewalls, then enabling the user to…

tailnet lock seems way way less important for headscale than tailscale, given you personally control the headscale infra.

Depends on your threat model. Mine definitely includes one of my servers getting compromised. (Which, tbh, is probably more likely than Tailscale getting hacked.)

Re: An open source, self-hosted implementation of the Tailscale control server

#47

Post by sixothree »

pilif wrote: post #12

Keep in mind that for many use cases (mobile access, GUI on macOS), this relies on the official Tailscale clients keeping the ability to set the control server. The moment the inevitable enshitification will start at Tailscale, this feature will go away. I’m saying this as a currently super happy Tailscale customer who was burned multiple times in the past by other companies being sold or running out of VC money

Tailscale clients are the thing I am least happy about with Tailscale. Specifically mobile clients and battery usage.

The reason I can't use Tailscale at work is because it routes traffic through servers we can't control.

I would _love_ to use tailscale at work. It would solve so many problems. I am okay with being forced to open ports. But tunneling traffic through them is extremely worrysome.

Re: An open source, self-hosted implementation of the Tailscale control server

#48

Post by pilif »

squiggleblaz wrote: post #41
notpushkin wrote: post #39

Earlier quoted context omitted.

I think the whole Windows client is closed. On macOS though you can use it from the command line just fine (apart from a couple quirks due to a completely different VPN implementation [1]). [1]: they have three : https://tailscale.com/kb/1065/macos-variants

From https://github.com/tailscale/tailscale "This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code." and "The macOS, iOS, and…

> I guess it would be much harder to produce an iOS or Android app because of the vagaries of mobile programming.

on iOS you also need a special entitlement that's only available on specific request and only to known developers, so practically impossible for any open source project to acquire.

Re: An open source, self-hosted implementation of the Tailscale control server

#49

Post by SuperShibe »

bananapub wrote: post #34
SuperShibe wrote: post #13

Every few months I come back to this repo to check if they finally got Tailnet lock running or if someone security audited them in the meanwhile. Unfortunately neither of these things seem to make any progress and thus, I’ve grown uncertain in how much I can trust this as a core part of my infrastructure. The entire premise of Tailscale SaaS builds on creating tunnels around your firewalls, then enabling the user to…

tailnet lock seems way way less important for headscale than tailscale, given you personally control the headscale infra.

only until someone finds a zeroday in headscale (remember, it never got audited) or until the server running headscale itself gets compromised. Especially in countries where getting a dedicated public IPv4+IPv6 from your ISP is hard-impossible and you‘d have to rely on a server hosted externally (unless you’re large enough to make deals with the ISP) some company hosting your server still retains at minimum physical control over your headscale infra. For why this is a problem, see the recent Oracle cloud breach.
Post reply on HN