Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tailnet Lock

tailscale.com

Post reply on HN
Print view View original

71–80 of 119 posts

Re: Tailnet Lock

#71

Post by mbesto »

teaearlgraycold wrote: post #50
0x0000000 wrote: post #48

Earlier quoted context omitted.

It's a usability thing, IMO. Historically you had enterprise-grade VPNs that cost a lot of money, or OpenVPN. Both ran over IPSec or SSL, and neither were super straightforward to config/maintain, nor were they particularly performant. Then came wireguard, which is awesome, but wireguard is just a transport. It doesn't have all the UX niceties built on top of it, like registering clients or generating / distributing…

What does everyone use it for?

A few use case:

- I have a SOHO setup at home: several PCs/ my work laptop, raspberry pi, synology and ubiquiti. It means I can access ubiquiti console and synology via network as opposed to be some janky proxy that those company's provide.

- taildrop is great for sending screenshots and files from my phone to (can't wait until they let me send URLs/links/txt like KDEConnect)

- I also have a raspberry pi setup in an ABNB in another country. When I'm traveling I can use my house as a proxy for US based services and the reverse is true - if I want my browsing to look like my IP address in another country I can.

Re: Tailnet Lock

#72

Post by infogulch »

unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

An interesting collab between cloudflare and tailscale could be to add cloudflare tunnel as a tailnet node to proxy public traffic into your private tailnet (with acls managed by your tailnet) as an alternative to opening ports on your firewall. This would give you true public access (if that's what you want) but also hide your ip and protect you from ddos etc. https://www.cloudflare.com/products/tunnel/

Re: Tailnet Lock

#73

Post by mbesto »

pyinstallwoes wrote: post #68
TkTech wrote: post #55

Earlier quoted context omitted.

I have it on all my personal and family servers and devices. I use it so that for both myself and my family all our internal stuff (unraid network shares, jellyfin, homepages, photo backups, etc, etc) "just works" for the less technical members of the family even when they're not at home. It seamlessly detects when the peer is local so it doesn't route out to the internet and back, has an easy ACL to segment things (…

Can you use it like a VLAN for segmenting devices? I have eero’s and a firewalla but since my eero’s don’t support tagged vlan traffic I can’t segment my devices as much as I’d like to.

(not an expert here) but my understanding is: sort of. I believe the biggest difference is that VLAN operates at Layer 2 and Wireguard works at Layer 3.

Re: Tailnet Lock

#74

Post by ignoramous »

slig wrote: post #47
yjftsjthsd-h wrote: post #41

Earlier quoted context omitted.

The term for this is "victim blaming", and the answer is "no, that shouldn't be necessary".

But that's the reality of the web. We can complain or we can block those things.

And we can call out things, just the same.

Re: Tailnet Lock

#75

Post by ignoramous »

fsociety wrote: post #8
ignoramous wrote: post #7

> ...by architecting our infrastructure with security and privacy in mind. The blog and the website loads in so many trackers (reasonable, given metrics are important when you're busy hyperscaling a venture-backed startup), that folks at Tailscale should seriously reconsider positioning themselves as some paragons of privacy. No offence (:

Why does a for-profit company have to practice perfect anonymity to sell a product which does have security/privacy in mind?

> Why does a for-profit company have to...

https://news.ycombinator.com/item?id=25457440

> ...practice perfect anonymity to sell a product which does have security/privacy in mind?

So are free users "the product?" No. If we're going to fix the Internet, there's no point only fixing it for big companies who can pay a lot. That misses the point of the whole adventure. The Internet is for everyone. We have to fix it for everyone, or why bother? We knew we had to design a business model and a technical architecture that removes any incentive to abuse your privacy. - CEO at Tailscale, https://archive.is/R7jqw

Re: Tailnet Lock

#76

Post by unshavedyak »

crawshaw wrote: post #27
sneak wrote: post #26

Earlier quoted context omitted.

How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account? Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that. I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and…

Tailscalar here. IdP trust is on the list. There are some "easy" things we can do that help on the surface but make life harder for users. And there are some not-so-easy things we are researching. I hope to have answers in 2023.

re: IdP, assuming that means signing up without Microsoft/Google (which really bother me too), would it be possible to migrate a Github account to .. whatever you all implement _(email signup/etc)_?

Re: Tailnet Lock

#77

Post by sureglymop »

bradfitz wrote: post #57
sureglymop wrote: post #37

Earlier quoted context omitted.

I recently read this blog [0] about how tailscale was thinking of open sourcing a small coordination server but headscale had already been created so that effort was put on hold. Is tailscale at this point in any way involved in headscale or contributing to it or are there plans to fork it to keep it maintained? Asking out of curiosity. [0]: https://tailscale.com/blog/opensource/

We hired one of the Headscale developers and let him work on it (as part of his job, not just moonlighting) and we help out when there are issues and give them a heads-up when protocol changes/etc are coming.

That's great news! Makes me confident to actually try out headscale+ tailscale! Thank you.

Re: Tailnet Lock

#78

Post by jchw »

ukd1 wrote: post #70
jchw wrote: post #52

Earlier quoted context omitted.

For personal stuff, it feels totally new. It's like having your own intranet. It's like being on LAN with all of your personal devices, plus any bridged into your tailnet, at all times, anywhere on earth. You can route your internet traffic through another machine, or not (default.) It has built-in basic file transfer, and a nice little SSH bridge. Technologically, it's based on Wireguard. Wireguard is fast; really f…

Did you ever use Zero Tier before?

I tried, but I couldn't get it to work at all. I don't really know what I was doing wrong, it just hung without connecting. It's been a while and I haven't tried since.

Re: Tailnet Lock

#79

Post by PhilippGille »

infogulch wrote: post #72
unshavedyak wrote: post #34

For basic tunneling into home servers, is Tailnet.. overkill? Ie i could expose my IP via Dyn DNS, or i could use something like Cloudflare or Tailnet to tunnel into the network. However.. i'm not sure what the right fit is. Would you recommend Tailnet for someone who just wants to expose some internal IPs to the public in a safe way? Tunneling compared to Dyn DNS at least has the advantage of more security via reduc…

An interesting collab between cloudflare and tailscale could be to add cloudflare tunnel as a tailnet node to proxy public traffic into your private tailnet (with acls managed by your tailnet) as an alternative to opening ports on your firewall. This would give you true public access (if that's what you want) but also hide your ip and protect you from ddos etc. https://www.cloudflare.com/products/tunnel/

Tailscale has an alpha version of a feature that does the same thing, without relying on CloudFlare: https://tailscale.com/kb/1223/tailscale-funnel/

Re: Tailnet Lock

#80

Post by atonse »

makeworld wrote: post #65
bradfitz wrote: post #57

Earlier quoted context omitted.

We hired one of the Headscale developers and let him work on it (as part of his job, not just moonlighting) and we help out when there are issues and give them a heads-up when protocol changes/etc are coming.

This is such an outstanding response to the existence of Headscale that I struggle to understand it. Why not just open source Tailscale's control server? Don't get me wrong though, what you guys are doing now is great. Edit: some explanation here: https://tailscale.com/blog/opensource/

My guess would have to be that their version is probably deeply integrated with the rest of the product and infra that it doesn’t make sense.

Plus there’s the added benefit to their paying customers to know that we have an out if needed. It reduces friction in starting to use the product.

Post reply on HN