Hacker News Reader

Tailscale is a better VPN but it's still a VPN. Also, I have a feeling that organizations that can't migrate to BeyondCorp won't be able to "wireguard all the individual machines" either; they'd have to use Tailscale gateways which start to look like VPN servers.

View on HN

I guess the main issue with BeyondCorp-style architecture is that while they work well with apps that mainly use HTTP, but it can be a pain to get them working for plain TCP or UDP-based apps.

Afaik, Tailscale works very hard to P2P connections and uses the gateway either to punchhole through NATs, or proxy connections in case of hard NATs, or for authz/n.

I'm talking about what they calll "relay nodes" which could easily become a bottleneck: https://tailscale.com/kb/1019/subnets

Reply on news.ycombinator.com