Hacker News Reader

Comment by anderspitman | Hacker News Reader

Interesting. Authentication via IP could definitely simplify a lot of things. But how do you handle authorization/delegation for 3rd party access?

View on HN

Tailscale networks are private. The only way to access an IP is through a WireGuard tunnel. The only way to be in the WireGuard configuration file is to have linked your public key against your identity. Every packet has an identity attached.

So it sounds like Tailscale is designed for different use cases, ie providing access to 3rd party apps is outside the scope?

Probably a dumb question, but how do you envision connecting something like a networked printer? Front it with a cheap device?

I think that's the way to do it. Possibly a smart switch could do it.

> Every packet has an identity attached.

So, this part is super interesting to me, but I'm curious on how you envision that working inside applications.

For example, I have a tcp server that does

  ln, err := net.Listen("tcp", ":8080")
  conn, err := ln.Accept()

How do I get the identity for the connection? conn.RemoteAddr() will give me the ip address, but how do I know what the metadata associated with the identity is?

Same sort of idea for inbound http requests.. if I wanted to identify if a connection was from a user or an admin?

As I understand it, much of beyond corp type implementations rely on client certs or Identity Aware Proxies that include the user metadata along with the request.

Aside, why would you write 'err' instead of '_' if you aren't using the result?

Because hacker news is not a go compiler.

Reply on news.ycombinator.com