Hacker News Reader

Comment by lazzlazzlazz | Hacker News Reader

> a direct ring of trust with friends

The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product like Tailscale seems to rely completely on centralized identity providers (you have to choose Google, Microsoft, or Github on sign-in).

Ultimately, if you want to maintain full control of your online identity and network, you'll probably need some of the decentralized (but economically aware) resources you seem to have issues with — or at the very least a means of transitioning authentication to private key methods with DIDs.

View on HN

I feel like people are so concerned about infinite scaling that nobody ever tries to scale to 5 anymore.

I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow.

With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today?

I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere.

edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.

> And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends.

This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated.

How many of your friends and family are "friends" with bots on Facebook?

Definitely stealing mom-technical. Though I do disagree somewhat with the conflation with blue-collar. I would almost argue white-collar folks are less likely to understand computers.

I self host headscale as my control node of my tailscale vpn so no sign ins required, I just give keys out to anyone I want in my vpn.

My problem is the client doesn't support multiple servers, so I can't have a work vpn and a home vpn, not even with an easy toggle - you have to run tailscale with different conf options for both. Changing namespaces also isn't easy, so having friends and family segregated even on one server is also a pain point.

Thanks the main objection I have with tailscale is that you can't self-host (and you need external identity providers). I had no idea there was a self host option. I'll investigate. I assume it's an unsupported community option?

op is talking about headscale [0] "An open source, self-hosted implementation of the Tailscale control server"

[0] https://github.com/juanfont/headscale

I'd love to try headscale, but a bit of research shows that the tailscale macOS client requires a CLI param to connect to a custom server, registry keys for Windows, Android client requires custom compile, and there's no iOS client at all.

Unfortunately if I need to bring anyone into my mesh network who is non technical, this is now a non starter.

fwiw, those on the Enterprise plan can bring their own IdP :) https://tailscale.com/kb/1119/sso-saml-oidc/

What are DIDs: Device IDs?

Decentralized Identifiers: https://www.w3.org/TR/did-core/

Very cool. Microsoft doing newish work on this, too! https://www.microsoft.com/en-us/security/business/identity-a...

Reply on news.ycombinator.com