Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Tailscale Works

tailscale.com

Post reply on HN
Print view View original

71–80 of 82 posts

Re: How Tailscale Works

#71

Post by dang »

nif2ee wrote: post #52

When every Wireguard post gets immediately hijacked to become a promotion for this company, when at least 2 threads get to the HN frontpage each week then something is totally very fishy. I understand the founders are popular and have strong connections with many powerful people here. But at least this systematic promotion should be mentioned as promotion and not some innocent thread because it's totally organized an…

You said you would stop doing this, but instead you've done it even more. As I explained before, it's against the site guidelines. Therefore we've banned this account.

I haven't seen any evidence of manipulation to get Tailscale on HN, nor has it been on HN particularly much: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... As far as I can tell, HN readers are genuinely interested in it, partly because they know the founders, and partly because the people involved are experienced bloggers and good writers. This article, for example, seems unusually well put together. When the underlying topic is already of interest, that makes a big difference.

Re: How Tailscale Works

#72

Post by forgot_old_user »

crawshaw wrote: post #32
forgot_old_user wrote: post #27

Earlier quoted context omitted.

Interesting :) Follow up, trying to cement my understanding here. If two devices may talk to each other (as defined in the ACL), only then they get to know each other's public keys, right? If so, how would this ACL be negated later- do the devices forget eachother after this disallow?

Yes, you only get the public keys of machines you can talk to. Later the server asks the client to forget the key if they can no longer talk. Additionally, we rotate keys. For security sensitive users we can rotate these keys daily.

Thank you! Fascinating work. Easily readable, yet highly informative article. Hope you are the ones that kill off VPNs!

Re: How Tailscale Works

#73

Post by lonelappde »

crawshaw wrote: post #66
mrlambchop wrote: post #39

Earlier quoted context omitted.

Well, this just listed out my concerns pretty well and I spent the last hour installing this on my devices. Specifically, how do I explain to a fortune 500 IT department how this is secure in a few simple sentences?

Large companies that want to remove us from the trusted group should run the coordination server on-prem. We have considered other certification options, but so far they boil down to running a part of the coordination server on-prem. Still exploring the space though. (I work at Tailscale)

Are large companies your target market?

Re: How Tailscale Works

#74

Post by nif2ee »

dang wrote: post #71
nif2ee wrote: post #52

When every Wireguard post gets immediately hijacked to become a promotion for this company, when at least 2 threads get to the HN frontpage each week then something is totally very fishy. I understand the founders are popular and have strong connections with many powerful people here. But at least this systematic promotion should be mentioned as promotion and not some innocent thread because it's totally organized an…

You said you would stop doing this, but instead you've done it even more. As I explained before, it's against the site guidelines. Therefore we've banned this account. I haven't seen any evidence of manipulation to get Tailscale on HN, nor has it been on HN particularly much: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... . As far as I can tell, HN readers are genuinely interested in it, partly becau…

If I was your friend like them, I'd be millionaire but instead I am banned for exposing you. I always knew that life isn't fair but I am counting on coronavirus to make it a little fairer

Re: How Tailscale Works

#75

Post by atonse »

eps wrote: post #28

Add UDP relays and TCP hole punching and it'll finally be a better take on Hamachi :) https://swapped.cc/hamachi

Hamachi was amazing. Just amazing. What.. 15 years ago? I still miss it after LogMeIn bought them.

Re: How Tailscale Works

#76

Post by _8j50 »

This is a good post,answered most of my questions. Is it free though? It seems I can't find out the price without signing up.

My first concern was how it will be abused by malware and blocked by different networks. For example ngrok.io is classified as "proxy avoidance" which means if I use it and go to a client site that blocks it,it will create an awkward situation. But I think requiring 3rd party idP might solve this issue with tailscale.

Re: How Tailscale Works

#78

Post by zimbatm »

api wrote: post #58
zimbatm wrote: post #57

Earlier quoted context omitted.

I was coming here to say that it looks a lot like ZeroTier. The main differentiator as far as I know is the support for SSO and MFA. With ZeroTier, the client connects to the network using a private shared key and then needs to be approved on the control plane independently.

ZeroTier original (and still main) author here. Objectively speaking another difference is the ACL scheme which seems perhaps less powerful than our own rules engine but easier to use. The ACLs are closer to intents while ZT rules require some TCP/IP knowledge (like raw iptables or pf). We have plans to address this ourselves more with a higher level UI to build rules from intents and common patterns. Also have more…

Hi, thanks a lot for ZeroTier! I use it every day and it changed how I interact with my network of personal computers.

Re: How Tailscale Works

#79

Post by eps »

tprynn wrote: post #53
eps wrote: post #28

Add UDP relays and TCP hole punching and it'll finally be a better take on Hamachi :) https://swapped.cc/hamachi

If you read the article, it seems like it has both of those features, though I'm not sure what exactly you mean by "UDP relay".

It has neither.

Re: How Tailscale Works

#80

Post by eps »

dave_universetf wrote: post #69
eps wrote: post #28

Add UDP relays and TCP hole punching and it'll finally be a better take on Hamachi :) https://swapped.cc/hamachi

(Tailscale employee here) UDP relays - that's roughly our DERP relay network. It currently operates over HTTPS because that's the last-resort "most likely to work in hard networks" transport, but adding a UDP option for efficiency is in the books. TCP hole punching - I don't understand this, can you elaborate? By running Tailscale you can just talk to the machines on your Tailscale network, no hole punching required.…

Relays are helpful not only when UDP is blocked, but also when both nodes are behind NAT that does random port overloading and port prediction doesn't work.

TCP hole punching uses symmetrical TCP open trick to establish a proper TCP session between nodes each behind its own NAT. Roughly the same idea as with UDP h/p, but requires a coordinating server to make it work. Useful for cases when UDP punching doesn't work or when UDP is blocked completely.

Post reply on HN