Hacker News Reader

Tunnels are created between any two devices that try to talk.

It scales great, not concentrating connections makes it easy. Tunnels are very lightweight and the only machines with lots of tunnels are servers that are already provisioned for talking to lots of machines.

(Tailscale co-founder)

View on HN

Interesting :) Follow up, trying to cement my understanding here. If two devices may talk to each other (as defined in the ACL), only then they get to know each other's public keys, right? If so, how would this ACL be negated later- do the devices forget eachother after this disallow?

Yes, you only get the public keys of machines you can talk to. Later the server asks the client to forget the key if they can no longer talk.

Additionally, we rotate keys. For security sensitive users we can rotate these keys daily.

Thank you! Fascinating work. Easily readable, yet highly informative article. Hope you are the ones that kill off VPNs!

Reply on news.ycombinator.com