Tailscale is pretty useful

Post by radlad » Wed, Mar 05, 2025, 8:57 PM UTC

yjftsjthsd-h wrote: post #59

radlad wrote: post #37

Earlier quoted context omitted.

Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ (proprietary managed Nebula networks.) Also, ZeroTier is "open-source ish." They use the BSL license for most of their code ( https://www.zerotier.com/blog/on-the-gpl-to-bsl-transition/ ) and I believe you can self-host ( https://docs.zerotier.com/selfhost/ )

> Shameless plug, but some of the Nebula team (including myself) works on https://www.defined.net/ (proprietary managed Nebula networks.) My one objection to Nebula is that its Android app is proprietary, and your response is to plug the even more proprietary way to run it? > Also, ZeroTier is "open-source ish." So it's not FOSS.

Post by b_fiive » Wed, Mar 05, 2025, 8:59 PM UTC

tsujamin wrote: post #35

The tailscale.com/tsnet package in Go [1] is really useful if you've not looked at it before: you can make single binary HTTP or whatever servers that are only exposed inside your tailnet. Their golink project [2] is a good example (and useful itself), but I've used it to build "peer to peer" comms for one application, and to host an API and Svelte SPA to control some other things in a tailnet. [1] https://pkg.go.dev…

Post by HPsquared » Wed, Mar 05, 2025, 9:00 PM UTC

stego-tech wrote: post #49

iamdamian wrote: post #38

I'm curious to hear well-informed reasons from this crowd for why we can trust Tailscale given the non-self-hosted part of the architecture? Does it come down to Tailnet locks [1], not worrying that Tailscale will be compromised, not worrying that your home network is worth compromising, or something else? [1]: https://tailscale.com/kb/1226/tailnet-lock

Call me Cappy Paranoid, but I fall into the camp of "You should never trust a service provider, ever ," and build infrastructure accordingly; I believe this falls into an extreme interpretation of "zero trust". So while also implementing Tailnet locks and other security measures to constrict traffic flow, I'd also consider going a step further by only permitting server or resource access based on client certificate v…

Post by HPsquared » Wed, Mar 05, 2025, 9:02 PM UTC

Trumpi wrote: post #6

I was once in South Africa and needed to look up my prescriptions in the CVS app. I had lost my pills and needed to show a local pharmacist what I needed. CVS geoblocked me. Luckily I had a TailScale exit node running at home, which solved the problem.

Post by yamrzou » Wed, Mar 05, 2025, 9:02 PM UTC

NexRebular wrote: post #79

yamrzou wrote: post #50

Is there an alternative to Tailscale with a lower memory footprint? I wanted to run Tailscale on a small router, but it failed due to out-of-memory (OOM) issues.

Maybe Nebula? You can do one yaml config file with all the certificates and firewall rules making it easy to script device provisioning too.