Tailscale raises $100M
tailscale.com
tailscale.com
The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. Being based on open source wireguard, and being just a STUN/TURN server at its core… I’m sure that Tailscale will be the first but maybe not the best.
I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust.
Web3 happens when people can host stuff on their phones, and Tailscale is something that lets you host things on your phone.
Might want to check out Yggdrasil. It lets you can create a real mesh routed, E2E encrypted network. You can keep your network private, or connect it to the greater network and route others. There's no ring-of-trust (I can't imagine that as a viable solution at scale). But the config file has an AllowedPublicKeys section if you want to specify who can route through your node.
This is the kind of comment I love HN for!
What makes it realluy unique though is that it can actually be embedded inside the application via a suite of SDKs. Yes, private, zero trust connectivity inside an application! That provides the highest security and convenience as it can be completely transparent to the user!
Disclaimer, I work for the company who built and maintains OpenZiti so I am opinionated.
The same thing is being said on HN about all kind of network software, but tell me one software that Cloudflare is really known for except its cdn ? None.
HN is really a strong echo chamber and some people believe Cloudflare and Stripe are going to be the leader in all software areas. (Even though Cloudflare is not the leading CDN and Stripe is not the leading payment processor). They are both amazing companies but they won't fix all problems of the world. I would even argue that they won't even solve more than their current core domains
Cloudflare needs to solve two problems: they need to introduce a free tier of Access that doesn’t use the CDN and creates direct connections between endpoints (to basically remove all operating costs), and they need to make the onboarding process for hobbyists easier instead of having a “contact sales” link on their homepage for these products. That’s doable.
This has essentially been the guiding principle of my side projects for the last two years. Folks shouldn't need to understand DNS, TLS, HTTPS, IP addresses, ports, NAT, CGNAT, etc in order to own their data. Self-hosting a small server for you and your friends shouldn't be any more difficult or less secure than installing an app on your phone.
The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product like Tailscale seems to rely completely on centralized identity providers (you have to choose Google, Microsoft, or Github on sign-in).
Ultimately, if you want to maintain full control of your online identity and network, you'll probably need some of the decentralized (but economically aware) resources you seem to have issues with — or at the very least a means of transitioning authentication to private key methods with DIDs.
I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow.
With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today?
I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere.
edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.
This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated.
How many of your friends and family are "friends" with bots on Facebook?
My problem is the client doesn't support multiple servers, so I can't have a work vpn and a home vpn, not even with an easy toggle - you have to run tailscale with different conf options for both. Changing namespaces also isn't easy, so having friends and family segregated even on one server is also a pain point.
Unfortunately if I need to bring anyone into my mesh network who is non technical, this is now a non starter.
This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365
Instead I can bind my services to Tailscales network interface and access it anywhere that I’m connected to my Tailscale network. It’s like authentication for free.
As a side note I know this is an anti pattern since one intruder can access all of my services, but that’s not a vector I’m really concerned about since I’m not exactly a high value target.
It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night.
It's not necessary, but Tailscale makes a lot of things just easier.
Other things are seamless transition to local networks, and you can even have local network encryption.
Handheld Elden Ring is amazing :)
Though my use-case is extremely simple, and so I just use bare WireGuard
You can find information about it over at https://openziti.github.io/ you don't even need to trust the software itself. You can add a 3rd party certificate to the server and mint your own private keys/certs and deliver them to your friends and have 100% control over where and how and whom you trust. You control access down to individual services, not CIDR blocks, not IP addresses. You can embed the sdks into any of your own apps if you're into that sort of thing. :) you could setup a relay server in some cloud provider for the 'untrusted' traffic (hmmmm you make me wonder if we could integrate with tor somehow now too...)
Seems like it'd do most/much of the things you want it to. I'd be happy to help you out. We have a discourse you can post questions to.
I do have some nits though:
- It's kind of finicky on Android, especially with exit nodes enabled. Sometimes I lose connectivity completely after connecting to an exit node, until I flip my WiFi on and off, then everything starts working.
- Not being able to auto-update the desktop clients, or at least update remotely, is a bit of a pain, and potentially a security risk?
This is basically just `git pull` on steroids.
Cloudflare, please make a box I can buy and stick it in the closet with a WAN connection. Routers suck, it’s time to reinvent them. Also please don’t make them look like goddamn spaceships.
I like this assessment. "[J]ust a STUN/TURN server at its core." It gives me hope maybe more people are starting to learn how to look at peer-to-peer not as something that is unreasonably complex and off-limits to ordinary users. LAN-like connectivity is not just for offices and gamers.
Of course, following a STUN/TURN standard is just one approach to a rendezvous server. It isn't the first or last approach to have worked.
By "rendezvous server" I mean a program that accepts connections and saves each client's address and open port number and makes this data available to other connecting clients, thereby allowing one client to connect directly to another client without involving the rendezvous server. The server needs only to tell clients about IP addresses and port numbers, nothing more.^1 Thus it can be a relatively small, relatively simple program.^2
I hope that going forward there will be even more choice in small, open source rendezvous servers, not created for commercial purposes, that ordinary users can run on globally reachable IP addresses. Most users must "lease" these addresses from others. Because not every user has a globally reachable IP address available, the use of "hosting" and now what people today call "cloud" services has been necessary.
Enormous amounts of traffic are passing through these third party "cloud" providers. They are, to use a popular term, "gatekeepers". Business customers, including ones who already control globally reachable IPv4 address space, let alone individual customers without such resources, are effectively beholden to them if they want to be on the internet. Not only that, the services are generally expensive.
However no data needs to be sent to or received from a rendezvous server other than address and port information. If customers are charged based on ingress/egress, it could be affordable for users to run these small programs on a "cloud server" due to the smaller amount of data transfer. With less data being sent to these third party providers, the privacy concerns would arguably be reduced as well (cf. eliminated).
The ability to connect devices directly over a network, including the internet, should not be monopolised like so many other aspects of the computers and the internet today. It should be available for everyone. The only cost should be paying for the globally reachable IP address and a tiny amount of traffic required for running a rendezvous server.
1. The advantage here is that the program can be easier and quicker to compile and users may be more inclined to read the source code and, optionally, make edits and recompile. Non-commercial, not a complex program like a web browser that is prohibitively slow to compile that almost no one compiles for themselves, nor one that few people have both the aptitude and inclination to read, edit and improve its source code.
2. Yes, there can be exceptions. For example, in some cases two clients using the same ISP might not be able to reach other directly. But these cases are the exceptions, not the rule.
The network will coalesce around using a handful of hub nodes for the packet forwarding, and a malicious party need only to coopt that central cluster of nodes to unmask all web users.
The "blockchain bullshit" enables trusted decentralized interaction at scale.
I sincerely hope not, but there's so much bad precedent.
I wouldn't put them in the Dropbox bucket.
Also, I think the value Tailscale provides is fairly unique and far from obviously a platform feature like file storage and perhaps even password management.
I thought customers were complainingly loudly against their new direction of making 1Password an Electron app. Is that not the case?
Note: I'm not a 1Password customer.
I don’t necessarily blame them but think their decision was pushed along by the need for big money.
For example, I think they’d still be able to do the pay once model if they abstracted they storage to work with Dropbox/icloud/OneDrive/whatever.
There’s really no value add as a user for a monthly fee. Although lots of people don’t mind. I’d rather not pay for something as essential and simple as a synchronized, encrypted data blob. I literally replaced it with a Google doc and cutting and pasting more. A filter over Google docs does not require a monthly fee.
I have this problem with lots of SaaS products that could be software if they didn’t want or need lots of money.
I get why they don't but I often wish more SaaS companies had a bring your own computer & storage model. It doesn't make sense for 95% of customers and the 5% of us who might like it and have the tech chops to use it would just complain about having to pay more because we are outliers. But I wish it was offered!
Perhaps you refer to loss of local vaults? If so, they were never really a viable option for me - I needed the app syncing across multiple devices, including mobile, and doing so with a third party sync solution wasn't suitable.
why not?
More importantly why was it necessary to remove the local vaults feature (I don't need it to integrate with any particular 3rd party syncing solution, I can handle that myself without any features from them) entirely?
A fully native app will offer you no such protection. If a dependency used for styling or animations or whatever is compromised, it will have total access to the system and be able to exfiltrate at will to any location. In Electron, the equivalent dependencies can instead run inside the CSP sandbox, preventing them from doing any serious harm.
Supply chain vulnerabilities also aren't unique to npm. Any project that uses dependencies (in any language) has the same issue.
OK, but it's not. Now what? Do we just live without until the platform overlords provide it, or does someone build it on top of the platform?
What even is the "platform", when my Android phone is connecting to my iPad and my Windows laptop and Linux desktop and Amazon cloud server?
$100M = ~$0.20 / computer user in US and western Europe (wealthy countries in connected software markets)
I pay over $700/ yr for their business plan and would like to have better performance for it.
There are Docker containerized apps that manage Wireguard too
Maybe contribute to one and fret less about behavior of VC funded business and wondering if they’re actually respecting your privacy to accomplish finance goals
With an open source implementation out there, anyone can do it merely pulling a Docker container, and without paying Tailscale.
Regardless I manage a dozen users with no issue using Embarks container; once they’re setup I touch nothing.
Paying people is not working with people; it’s working with a specific group. Open source is working with people.
> Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. It enables encrypted point-to-point connections using the open source WireGuard protocol, which means only devices on your private network can communicate with each other.
It seems to take care of key distribution, nat-traversal, authentication etc etc
Neat! No sure how that is 'fixing internet' exactly, but really cool anyway
Avery Pennarun, its CTO, is somebody whose judgment I am used to trusting.
Then I learned that to use it, I would be dependent on authenticating using a login on one of the unaccountable internet behemoths who could take away my account for any random reason or no expressed reason at all.
No, thank you.
As far as threat models go, I can't really say I understand this one too much.
Just because a service you sign up for is not contentful, does not mean that they won't choose to boot you off for some reason completely unrelated to anything you control or anything you chose to do.
As far as paid services the possibility also is there that someday _you_ run out of money and have to stop paying them. They tend to shut down your access when that happens. Another financial threat you have to model.
These things don't happen when you use public key authentication.
Google will throw you on your ass in the blink of an eye.
I _could_ use my github account, but I don't trust them at all anymore. And I'm not going to setup an account with some other service just to use this. So that is a hard pass for personal use.
For a company it makes sense to have to use whatever sso provider you are already using i guess
Super annoying and borderline unacceptable.
Some people suggest trying Nebula instead.
David Crawshaw is CTO.
No, they do not behave just like NAT. With NAT you have two problems:
* figuring out your address
* firewall hole punching
With IPv6 you already know your address and just give it to the peer you are communicating with. You then tell your firewall to allow connections from the address(:port) that the peer tells you. No STUN, no TURN, no ICE.
* https://en.wikipedia.org/wiki/Hole_punching_(networking)
* https://en.wikipedia.org/wiki/Port_Control_Protocol
* https://en.wikipedia.org/wiki/Universal_Plug_and_Play
* http://www.upnp.org/resources/documents/AnnexA-IPv6_000.pdf
This helps immensely for residential connections since people (generally) control their gateways, and with more and more higher speed (fibre) connections being done, it could help in more self-hosted and peer-to-peer services.
What one is allowed to do at the office would be dictated by the policy(s) of your employer: they could allow PCP/uPNP opening via authenticated requests for example.
* ... and most that do get another router (usually because they have seen that their Wi-Fi on the "modem" is bad) don't turn on** bridge mode which will be a definite headache on both IPv4 (double NAT) and IPv6 (address conflict, especially if you're using an ISP like Comcast that would only allocate a /64 and no more.
** ... because you need to call up the ISP or even outright refused to bridge it (either because they're stupid but you don't have another ISP to switch or the equipment manufacturer of their garbage special router didn't program one).
But until deployment hits 100%, and until ISPs start caring about IPv6 reliability the way they do about IPv4, "just use IPv6" can't be your answer. It's lovely when it works, but you need to do something other than "give up" when it doesn't. (also, as long as the internet is dual-stacked, doing IPv6 right also implies figuring out if NAT64 is in play, and wielding it correctly; so arguably IPv6 adds more complexity to the overall story, for now :) )
(btw. I love Wireguard - currenly using it to route traffic between my servers + transfer media between my home and my mother's mediacenter with both PCs being behind their own router - she loves it too as so far there were no problems hehe)
If someone uses a rubber hose, you might be forced to communicate against your will, using the fixed Internet.
I've just setup tailscale in a few minutes, very smoothly. I'm impressed it scales down to this kind of simple use case nicely, and it seems it has nice features as my use cases might scale up.
- SSH'ing into a raspberry pi I have at home that does random IoT stuff.
- Accessing servers on my local dev machine from other devices for testing (i.e. a Windows box or phone)
- Giving access to production bastion devices without publicly exposing anything to the internet.
And best of all I don't have to fiddle with the usual networking stuff. It just works. Kudos on the raise!
Non-disclaimer: I have no relation to anyone on the team. Tailscale is just a delight to use.
It actually allows me to turn my iPad Pro into a proper development machine as long as I have access to the internet since I can write code locally via Textastic, push to my git repo and test via the VM connected to Tailscale. Of course this was possible with a box on DigitalOcean but I prefer not to pay monthly for a machine just for noodling around.
My only complaint is that if you use it on your phone (iphone 11) and forget to turn it off it drains the battery like crazy.
The Tailscale agent (thing that runs on your machine) changes the system routing table (at least on Linux) and uses policy-based routing (marks packets destined for the "Tailnet" specially) to build the overlay network. Since everything is done at L3 in the OSI model, iOS and Android clients (in the form of an app) are also available without needing root (jailbreaking).
There are some things it can't do owing to the whole thing operating at L3, but it's a really awesome implementation nevertheless. And just to add, they aren't the first to build a product like this, but they do it incredibly well and the time to value for most users is extremely short, made even better by the fact that the expectation is that the time to value will be long(ish) and painful.
These companies usually bring something really easy to use, let people onboard and modify their network/DNS/etc to hell until they get vendor stuck and then they squeeze every possible dollar out of their pockets. Once you're in, after days or weeks of fine tuning, after you managed to pollute your codebase with their configs and IP addresses, it's hard to get out.
I suspect those "free slots" will change soon ,but we won't see those types of graphs anywhere soon and be prepared to get charged for bandwidth and everything else possible.
Outside of say, Garry Tan and Leo Polovets, who could be considered regulars, it’s rare that an investor shows up in the HN comments. Hi!
Your comment is reassuring, but the reality is that other investors will look at their portfolio companies, review the competitive landscape, then decide that they no longer share the vision, in the not too distant future.
Seed investor in Tailscale since 2019.
Make the service usable without depending on some internet behemoth who might yank my authentication credentials anytime without notice, and we can talk.
I am wary of investors wrecking incentives for founders but that ship sails when you raise an A round. They've done an incredibly good job for me in that time, I think they'll keep on doing that.
Why would their free service change? They're going to make money off big companies. They're not going to make money off me with a bait-n-switch to capture my $10/mo personal budget.
I don't think this is true. They mostly demand growth over all else.
Massive growth just means you can dominate the market then have more flexibility on the price you'll charge.
I gave up and just setup wireguard directly instead, I don't trust Tailscale either if that's their attitude towards privacy, it's permanently marred my vision of their product.
https://tailscale.com/kb/1013/sso-providers/
> Tailscale works on top of the SSO/IDP/IAM identity provider you or your company already use.
> We don’t support sign-up with email addresses. By design, Tailscale is not an identity provider: there are no Tailscale passwords.
> Using an identity provider is not only more secure than email and password, but it allow us to automatically rotate connection encryption keys, follow security policies set by your team (e.g., 2FA), and more.
You can BYO SAML provider if you like, you'll just have to pay for it: https://tailscale.com/kb/1119/sso-saml-oidc
They don't even give the option to try to debug my own identity provider.
aka the BYO SAML feature does not exist for personal or small team/business users.
But maybe that's the point? TailScale's product is actually an identity integration layer for Wireguard? If you don't need an identity provider, Tailscale doesn't add value over Wireguard?
Their website makes it seem like you can do SSO/MFA with even the free personal plan though. If you cannot integrate with your SSO provider then that's just marketing bullshit.
What they should really put there is "Can only sign in with Google/Github/Microsoft account".
There also exists an open source implementation of the tailscale control server [1] that you could self host.
People sometimes ask me to describe the differences between Nebula and Tailscale. One of the most important relates to performance and scale. Nebula can handle the amount of internal network traffic and scalability of nodes (100k+ nodes, constant churn) required on a large network like Slack's, but Tailscale cannot. Tailscale's performance is fine for many situations, but not suitable for infrastructure. It is just a fundamentally different set of goals.
Nebula was created and open sourced before Tailscale was offering their product, but their architecture is similar to older offerings in the market, and is something we purposely avoided when creating Nebula.
Fwiw, I even recommend Tailscale to friends who want to do things like connect to their Plex server or Synology or [other thing] at home remotely. It simplifies this kind of thing greatly and doesn't require you to set up any infrastructure you control directly, which can be a headache for folks who just want to reach a handful of computers/devices.
First thanks for working on Nebula! It's great.
Nebula seems to be about 95% there. The functionality it actually does provide once set up is really great. It's just missing the 5% that is arguably the most important for a huge number of people: a simple way to do the configuration management bits such as device enrollment, revocations, key rotations, that sort of thing.
If you are a home user, with a small network, the overhead of doing things manually is low, but you need to be patient and technical enough to read the docs and do it right initially. If you're a big enough organization I guess you can write your own tooling. But for any small shop or any non-technical home user this is not going to fly and you will bounce off it.
I don't know if the plan is to create a commercial offering for this side of the house (it would make sense...) but as far as I'm concerned, this is the only reason that Tailscale is so successful and Nebula is lesser known (despite Nebula's advantages in other ways that may be more relevant to technical users).
That having been said, I also am wary of using Tailscale for the same reasons as above, I have to trust Tailscale and Github? I can maybe justify trusting Tailscale, but trusting GH/Microsoft/other SSO provider is a bridge too far.
Making broad claims like this without a source or links to benchmarks feels like FUD to me. For example Tailscale's comparison page on performance (https://tailscale.com/kb/1148/tailscale-vs-nebula/#performan...) doesn't mention a meaningful performance difference, so if you're claiming they're not telling the truth (by omission), I'd hope to see more to that than just a straight assertion, even just "We tried Tailscale in Slack's network and it wasn't able to keep up with our usage patterns".
I settled on ZeroTier for now. Unfortunately, I don't think ZeroTier is my long term solution. Their self-hosted option comes with a plethora of caveats that make it basically unusable. And I'm always scared companies that offer free versions of their paid product will eventually neuter the free tier.
I'll be keeping an eye on headscale. Hopefully they get their mobile client situation in order.
They wrote a bit about their thought process: Factors in authentication (2019), https://apenwarr.ca/log/20190114
> It seems to me that the above successful enrollment patterns all use one or more of the following techniques:
> A human authenticates you and issues you a token (usually in person).
> A short-distance, physical link (proximity-based authentication) like a biometric sensor, or USB or bluetooth connection.
> Delegation to an existing authenticator [SSO]...
> What people tend to miss... is that enrollment is necessary whether or not you send a push notification to the phone during login. The push notification is only secure if this specific browser instance is enrolled; but if this browser is enrolled, then the push notification adds no extra security... The enrollment was the security.
Fully expect them to ship u2f authenticators or sell them at tsCare shops!
In light of the recent incidence at Okta, the risk of the VPN company or the identity provider getting compromised, or provided with a gag order by the government, should be accounted for.
Our opinion of zero trust is that you should not have to trust us. Thats why we made is open source and with its own internal identity system. The only things you need to trust are the controller (which uses your CA/PKI) and the code (which you can audit).
Fun little thing we did with it: nobody can access the prod network without requesting access via a Slack bot (powered by https://indent.com/). So somebody requests access, another authorized person approves it, and the Tailscale ACLs are updated for X minutes and then reset.
Access to secure environments is super low friction but more secure (with fantastic audit trails) than ever.
(1) The old school castle and moat IT model that dominates at 99% of companies. If we can disrupt this then TS, ZT, and four other upstarts could all become billion dollar companies. Right now 1-2% of this market has been disrupted at most.
(2) The put everything in the cloud and everyone gets a thin client model. If that wins then all of us lose because there is no market for endpoint connectivity. We also lose all privacy, all data ownership, and all ability to experiment or innovate without paying for it by the instance-hour with TOS-enforcement bots looking over our shoulder.
Avery and the team at Tailscale are building a fantastic product and totally deserve the round and recognition, huge congratulations - we're super happy for them.
In many ways they're also an ice-breaker for the zero trust overlay network architecture, which means they've got the most work to do. As the current top comment on this thread correctly notes, with huge investment comes the obligation to eventually pay it back.
The market hasn't even come close yet to crossing the chasm and seeped into mainstream conscience to become the accepted norm - yet.
That said, we believe fiercely that networks should be simple to reason about, easy to use and safe to operate. That private connectivity should “just work”, and just work in exactly the same way, everywhere too. Flexible to change, simple to automate and only available to the right things at the right times.
When you think about it, building private networks is actually pretty complex right now and can be pretty insecure too. It's some unholy combination of spell casting meets a yak shaving contest to wrangle firewalls, VPNs, MTUs, and manage IPs, subnets, ACLs, NSGs, VPCs, NAT, routing, VLANs, certificates & secret keys, then hoping a zero-day doesn't show up that drops someone straight into the network via the VPN server, who then starts poking around the squishy centre.
Once you've used products like Enclave, Tailscale or ZeroTier and seen how simple private networks really can be - at a certain point you almost stop and ask the question, why would you not do it like this.
There will always be nay-sayers and people for whom this approach just isn't a fit, and that's fine - but I personally find it hard to imagine that this genie can be put back in the bottle.
- Founder @ https://enclave.io
But if we don't succeed in disrupting the actual competition everyone fails.
At least that's how I look at this market.
Of course I'm also a mostly-follower of the "ignore your market peers, focus on the customer" philosophy. Your greatest competition is always your own shortcomings.
I think the catch is that (at least at the free level) one must trust an identity providers. For many companies that's probably fair enough, but for high-security companies and private individuals one absolutely cannot trust anything running outside of one's physical control. Service providers can be suborned, either legally by corrupt regimes or illegally by employees. There is no way that I would permit Google, Microsoft or GitHub (their three supported options) to gate access to my private devices.
I think that one must also trust Tailscale themselves, although I could be wrong about that.
(Disclosure: I'm a (small) investor via Latacora's sibling fund, Lagomorphic.)
(That tweet I think was a teaser saying it was coming. I subsequently looked for it a few times and never found it, but maybe plans changed, or maybe I just failed to find it).
Also, it doesn't address the individual case, but that's fair enough: Tailscale isn't a charity.
> Tailscale raises $100M to do what any Hacker News reader could have done in a weekend [0]
[0] https://twitter.com/apenwarr/status/1521873453921583105?cxt=...
Never forget https://news.ycombinator.com/item?id=8863
Apparently, it's a VPN.
The home page is a pretty clear exposition of what TailScale is: https://tailscale.com/
A few years ago I discovered WireGuard and I was really amazed how easy it was to setup a tunnel. Especially if you've dealt with IPsec before. It felt as easy as creating an SSH tunnel between two servers, with only 4 or 5 lines of code in a config on both sides.
Then last year I discovered Tailscale and I was blown away! How did this even work[1] without opening ports in the firewall? And how cool is it that I no longer have overlapping addresses[2] from other networks. Within 15 minutes I had my own mesh network between my Mac, iPhone, Raspberry Pi and other servers. Fantastic!
I'm on the Personal/Free plan but if this would no longer be free, I would be happy to pay for this service (shut up and take my money).
Installed zerotier and it couldn't be simpler now.
That's such a broad "mission statement" that I wonder if it's effective at all. I mean, what SaaS wouldn't say that they fix something with the internet? That's to whole reason for online businesses solving one or another problem.
How could that statement help them guide their implementations of various solutions?
(Disclosure: I'm a (small) investor via Latacora's sibling fund, Lagomorphic.)
However, I just don't see much difference from my vanilla Wireguard setup. Granted, my use case is very simple, just connect a few devices at home and in the cloud into a single network and use one of them as an exit node, but I'm still not sure what would make me prefer Tailscale over Wireguard.
So far the biggest difference has been that it makes me use an external identity provider instead of having to manually exchange keys between devices, and I'm not sure I'm very comfortable with that.
But: Now that they have more money, I just wish they could spend some time making it enterprisey and not hobbyist-ey.
Things like: improve all the screens with high-density modes so we can filter thousands of devices, not hundreds. And make it integrate better with Windows Intune for hands-free deployment i.e. if we're a Hybrid 365 environment, please detect the users credentials from their Windows install and login automatically. Maybe release an installer for enterprise deployment that silently downloads and installs the latest version so that we can i.e. integrate it into a Windows Autopilot unboxing experience.
That's https://github.com/tailscale/tailscale/issues/1572 which we haven't given up on. It's just not done. We did it for macOS and we thought the same thing would've worked for iOS (they share ton of the same code) but it apparently didn't work.
The mobile apps have been a low priority thus far. We just recently hired some people to work on them, though.
The highest priority for them currently is fixing battery life (we do some dumb things when LTE + wifi are both available, and when using exit nodes, and some unnecessary heart beating that sucks on mobile) and then there's also a mobile app redesign (or just "design" coming).
We like Headscale and we're super glad that it exists. (they saved us some work by doing it first, as our control server wasn't in a releasable state) We keep Juan et al updated when there's protocol changes or things they can do. (e.g. recent https://github.com/juanfont/headscale/issues/552)
If this was about heart beating, I would expect that to only happen when the client is connected.
Also, in the battery stats, the background usage is there and tailscale is listed, but with - % of battery usage.
However, when I force quit tailscale, all of the background energy usage goes away.
But given the huge amount of money invested, pressure will go into other directions. I'm afraid my (aside of the iOS issues) beloved Tailscale is on a path to expensive enterprisey bloat, losing what made it so good (the JSON based ACLs, the external authentication provider reliance, etc - GitHub Auth is a killer-feature for me for example)
- Better iOS battery life, there have been many improvements but it’s still too much to leave running 24/7, I understand they’re making improvements here
- Their in built SSH server which seems to be in development
- Using Tailscale ACLs to control access to Kubernetes ingress resources, they recently released an nginx auth plugin so I imagine this is now possible if you attach a Tailscale sidecar to the nginx ingress controller
- Arbitrary ACLs which also seem to be in progress, it would be awesome to define in ACLs who has access to different parts of e.g a backoffice application
- Official support for DNS extra records, already using this with the Headscale self hosted control plane for personal projects but it would be great to use it on Tailscale too
- Kernel Wireguard for the data plane, I think this is on the roadmap?
Overall a fantastic piece of software which I use for both personal and professional projects.
> Still produces graphs without axis labels
$100M seems more than a small-scale operation or is $100M in tech actually small scale?
edit: Only the client is open source. See clarification below.
There is an open source alternative called headscale [0]. The main downside is that you'll need to run it.
The closed source centralised control server has other potential issues though, and it ends up being up to the user to decide what's the right balance of security vs convenience.
However this is the path that could move them towards being pressured to add a bunch of bloat, followed by acquisition pressure and a big payout that will likely eventually cause the product to stagnate after the founding team leaves and the buyers don't care.
I really hope they’re all already rich enough that they aren’t tempted by that. :-)
Update: altered content to add more speculative version.
If all tools were this reasonable, I'd be very happy.
Lately I have been migrating all my self-hosted stuff into a raspberry pi (instead of running a public instance in the cloud). It gives me a bit of piece of mind knowing that it adds an extra layer of security (to hit any of my endpoints/apps you would need to infiltrate my VPN). And it will save me a lot of money on hosting.
I don't need to expose my computers publicly or enable upnp or anything. It just works.
So why do people care about that?
Those all seem like positive things but they are in and of themselves, not value creating.
From this article and even their landing page ... I think they might need an explanation that makes more sense than IT/Networking Admin.
Even as a developer, I don't quite see the obvious benefit.
Instead of taking about 'what if you could have this tech that does ABC' - instead, talk about it in terms of problems 'what if you didn't have this problem or that one'. etc..
Compare that to the numerous audits a VPN like Mullvad has had - https://mullvad.net/en/blog/tag/audits/.
> Your personal information will be transferred ... to certain third parties that provide services on our behalf.
> We use service providers to provide services such as ... data analysis to better understand and improve product and website usage, and providing advertising and marketing services.
:/
Does this mean - instead of deploying a dashboard/ci to aws, I should host it "locally" on a single computer (macbook, raspberry pi) and then internal employees can access that site via Tailscale's network layer?
I'm waiting to deploy either Nebula, ZeroTier, or Tailscale, but we don't want to rely on third parties for auth or coordination.
Tailscale hosts all the auth and coordination stuff and uses SSO.
Zerotier lets you host an auth server, which also handles connections, but when required some already-established connections go through zerotier servers (encrypted).
We use the latter option at work
I see they are staying away from a16z ;)
> We don't want to put revenue ahead of quality, because our stats say quality is where all our growth comes from.
Dr. Deming shining through here [0], but really, even this 1986 article paints a neat little picture of how I presume tailscale's operating at the moment: https://hbr.org/1986/01/the-new-new-product-development-game
> How, Avery, on earth, are you all planning to spend one hundred million dollars?
Wireguard platinum sponsorship in 3, 2, 1...?
> Now I just tell people: We're here to fix the Internet. If we don't, who will?
I called this a year ago, as it was pretty evident to me even then (downvotes notwithstanding), but I'd not be surprised if tailscale became a ISP someday, given their holistic approach to product development: https://news.ycombinator.com/item?id=26249199 But hey, there are many more people working to fix the internet... including tailscale clones and other over-funded/under-funded developers, which brings me to...
> I mean, imagine. What if the Internet just worked like it was supposed to? [and goes on to list e2ee + Mobile IP + SSO + DDNS + NAT Traversal]
If you squint just enough, it reads like the MASQUE protocol (built atop QUIC) that Google, Apple, Cloudflare are working to standardize: https://ietf-wg-masque.github.io/
That said, in time, I see tailscale not only compete with Zscaler, but also with Tanium, Cloudflare, CrowdStrike, F5, Palo Alto Networks and the likes. Once they are embed in an enterprise' network, there's very little their product couldn't expand into to make other SaaS / solutions obsolete.
[0] Systems thinking and Deming, https://archive.is/tXJhw
There is an oss [2]coordination server that does let you totally self-host.
(Disclosure: I'm a (small) investor via Latacora's sibling fund, Lagomorphic.)
Not that they do it, but the possibility is there, and one has to account for risks.
I use it this way to access devices that can't run the tailscale software.
I also notice they have a careers page so I had a gander. A 6 stage interview process! Good lord tech companies really have gone down the shitter
A lot of that is Crypto related, but money seems to be absolutely flooding into tech at the moment despite all of the doom and gloom around
But, and I'm probably just shouting into the void at this point, relying upon your network being secured as a method of securing your office/product will only result in heartache.
If you're a company SEO or similar trying to protect your company from threats, your first assumption must be "the network is compromised" no matter whether it's on the internet, or VPN tunnels, or firewalled local network.
isn't that true with WireGuard/Tailscale too?
i rolled my own with a simple vps, a haproxy and ansible.
Full disclosure - there is little to no functionality yet, but the homepage is enough
"Zero config VPN. Installs on any device in minutes, manages firewall rules for you, and works from anywhere."
Okay... at first I said to myself, _no way_. But then I thought, "Any sufficiently advanced technology is indistinguishable from magic."
Sorry.
I really wish we could get some clear copy on what that means in a title.
Le sigh...
Let's make tech boring and demure again!
"Fixing the Internet" is not done by layering more private network garbage on top of it.
Their claim[0] that after you install Tailscale on all your devices: "This final configuration is called 'zero trust networking',” is pretty interesting. It seems this would be more like having a trusted internal network (sure it is overlaid on an untrusted network). A true zero-trust network would mean all of your clients and servers are secure in a manner that they can operate on the public Internet...like O365, Salesforce, etc. To say that you run a zero-trust network because you implement a fancy VPN is C-suite dreaming at its finest.
"get around a misbehaving corporate firewall" like newhouseb sings praises for is exactly the sort of thing that should be happening less, and the opposite of "fixing the Internet". Follow the policies of the network you are being allowed to use, or lobby for them the be fixed. Don't like ISPs messing with DNS traffic? Get rules/laws implemented that prohibit that, instead of garbage like hiding your DNS in DNS over HTTPS. (DNS over TLS seems more acceptable to me.)
Do you live in a place that doesn't regulate things?
For whatever reason, SYN flooding detection triggers when you do more than a few TCP connections per second which makes most TCP-based things super frustrating and their IT is clueless as to how to fix it.
You know this does not work in the real world right?
What if we all just had a static IP address, and a DNS name? …and the address migrated around the world with you? …and you could connect to any of your devices no matter where they were?
Does this not promote the destruction of anonymity on the Internet?
Will they be left out of this new internet?