I wrote a longer description of this phenomenon at https://news.ycombinator.com/item?id=30070287 (in the bottom third of the comment, starting with "Stripe succeeded on HN" - skip the tedious stuff before that).
There was also an entire thread about this a few weeks ago:
Ask HN: What's the Deal with Tailscale? - https://news.ycombinator.com/item?id=31957059 - July 2022 (47 comments)
In fact Xe's personal writings[1] are quite regularly on the frontpage as well. I'd post an HN domain listing link, but the domain recently changed.
[1]: https://xeiaso.net
I think a core set of high-karma people heavily promoted Tailscale on HN in early days (and until recently). Like, not just commenting on Tailscale’s posts, but actively advertising it on various social media. I think that was crucial.
I don’t think it works well if you are not connected to or supported by these people.
If you mean "actively advertising Tailscale HN submissions on social media", no, no way. It wouldn't even work. The watchword of people with long experience on HN and who care about submissions is "don't talk about submissions on social media"; it trips the voting ring detector, which nobody knows how it works, and it is incredibly embarrassing talking to Dan to ask "did the voting ring detector flag this post (or are we just not as cool as we think we are)".
On top of that: Tailscalers were notable for their technical blogging before Tailscale existed. Avery's posts have been doing well on HN for years.
Finally, there is, if not a formula, then a sort of base recipe, like of a French mother sauce, for a strong HN post. Tailscale reliably hits all the notes. Dan has posted some of them in his Launch HN advice, if you're interested. There's a good chance Tailscale would rank well even if the product wasn't universally beloved by everyone, just because they've got their writing tuned the right way.
Add all that up and it's surprising to me that Tailscale isn't on HN more than it is.
I do think the pedigree of the founders helps them a lot, but that's a different issue and also counts as completely organic. It's just harder to pull off if you haven't put in 20 years of hard work beforehand.
It's so soul- and bone-crushingly difficult for most startups to get attention on HN that I understand why it seems like these 'darling' successes must be pulling strings or knobs or levers, but it's really not like that. It's actually the other way around: if anyone does try to pull strings or knobs or levers, but without doing work and writing content that the community is genuinely excited by, the result would be a community backlash.
The other side is that the 'darling status' phenomenon is interesting and contains lessons for people who do hope to get attention for their work on HN.
It. Just. Works. And it uses WireGuard. It solved every issue I had with WireGuard, which was mainly access control, user provisioning/auth, and device clients.
I’ve said it before, I’d happily pay them more than I pay now for 10 users.
What’s their secret? A great product that people want to talk about.
Now imagine your workstation is on corp 1 network behind a NAT, and you are out at a corporate client with your laptop, behind another NAT, and need to access your workstation. With traditional wireguard, this situation would require negotiating port forwarding with one of the corps, or require using some form publically available bastion host.
With tailscale these things are not even a consideration. You will be able to access your workstation by name, without having to do anything extra.
Even where the corporate client has a crazy restrictive outbound firewall allowing only port 80 and port 443 to the public internet, you will be able to access your machine without having to do anything special. (In this case you would definitely be using tailscale’s Relay servers, so would have limited bandwidth, but it will still work seamlessly from your perspective.
And assuming the tailnet you are using is your companies (rather than you adding you workstation to a personal tailnet), you could access not just your workstation, but any other machine that has tailscale installed connected to the same tailnet that the tailscale ACLs allow access to. So for example, the corporate documentation file share server, perhaps the reporting database server, etc.
I know that Xe previously had a rather nice manual Wireguard configuration that is either completely ripped out, or is at least seldom used, because tailscale is just simpler.
That VPN needs to listen to a port. But with mesh VPN, that’s exchanged with a coordination and/or relay server that listen to a port and facilitate the connection, at a minimum in the initial phase. There are open ports in mesh VPNs too.
The advantage of the old school access VPN is that, 1) fewer third parties are to be trusted, 2) your VPS is likely going to be in your geographical area area, so if you are in a restrictive corporate network (considering that you emphasized this example), you get fast connection speeds vs potentially slow relays.
You may say, the access VPN may be far from the users. If you have a global business, sure, you need several VPS, which you may replace with several DERP nodes around the world in Tailscale, but for home users and some businesses, users are often in the same region.
Don’t get me wrong. I like mesh VPNs. They are convenient and useful, especially for small businesses. I tried Tailscale, it was simple and clean. But sometimes people make incorrect statements; just pointing this out.
There's also a bunch of people that want the convenience of being able to access things like their Synology NAS remotely. I'm almost certain that none of them want to set up a server in the cloud, or even understand what that means. Not everyone is super technically apt, and as a matter of policy we shouldn't try and make things with the assumption that everyone using them is a computing god already. People have to start from somewhere and it's perfectly okay for some people to not want to deep dive into the unrestrained horror of managing linux servers.
Things you don't have to do are easier than things you have to do.
Also, you absolutely need either port forwarding (or other forms of static NAT mapping) for the concentrator, or to run the concentrator outside of the NAT. (Which might be by running the software on the router that does NAT, or a seperate device with a routable address).
Setting up vpn concentration solutions that limit your network access to only specific devices depending on who you sign in as is often quite complicated, to the point where I rarely see it done well. Often if you are you are connected, you get full access to several corporate subnets, and you are mostly limited by things like router acls not allowing VPN connections direct access to the some production subnets.
I love WireGuard but the process was entirely manual. Generate the key, the config file, have the person install it, import config, etc.
Tailscale stood on the shoulders of the tallest giants.
Not everybody needs/wants to do things manually. It's literally the reason for the existence of paid services.
I don't see much value-add when I'm already going to be running servers anyway - wireguard is basically free as it's in-kernel everywhere. What's the argument for increasing my attack surface and introducing a centralized failure point and new recurring payment?
Yes and also I don't want another thing to maintain.
> but are non-technical people part of the customer base here?
Yes. I'm 100% sure that there are companies that use Tailscale that employ nontechnical people who need access to resources only available on the VPN.
> I'm just not convinced that the amount of work to set up wireguard is more than the amount of work to install and set up tailscale. Copy-paste IP and public key vs. download and login.
For you, maybe it's so simple it's not worth thinking about different options. For me, it doesn't make much sense. I've made a concerted effort to remove publicly accessible, self-managed infrastructure from my network. I just don't want to deal with it. I do not have a VPS to install a Wireguard server on, I'm not interested in setting one up, and I really don't need it in the first place (especially if Tailscale gets me into my home network).
> wireguard is basically free as it's in-kernel everywhere
Not everyone runs Linux. There is a time cost for user set up as well - even if I wanted to run my own wireguard server, I'm probably not going to hand out access to people to SSH in and do a self-service type signup. Therefore, it falls on me. With Tailscale, I (or somebody else) can just add a Github user to an org and the rest can be done by an end user. The majority of the people who I'd want on my Tailscale network are already in a Github org that I control, so I usually don't even need to do that.
> What's the argument for increasing my attack surface and introducing a centralized failure point and new recurring payment?
The same as it is for any other paid service: running this myself requires more time and effort than it's worth (not just setup -- end user support, maintenance, upgrades, etc factor in too) + I'm willing to let somebody else take care of it for me. For my uses, Tailscale is actually free but I'm thinking about switching away from the Github Community Plan to a paid plan specifically because the product is good enough that I want to pay for it.
Also: if you're more inclined to self-host your stuff, you can get the best of both worlds via https://github.com/juanfont/headscale
The one issue I have with Tailscale is that the on-demand/automatically activating VPN functions on iOS don't work correctly [0] [1]. Everything else about it, including the business model, makes me overjoyed. It's a great product.
I’m currently travelling and am staying in an area with terrible internet. Can now confirm that, in that situation, Tailscale battery use gets totally out of hand. In my case I only really had it on out of habit, so it’s easy to just not run it on my phone for the time being.
Caveat to say; I still love everything about Tailscale. I’ve switched to using Tailscale ssh for work and it’s an absolute joy.
that said tailscale is also just an awesome company with an awesome product
The deck you had back at the start of June was an expensed scalped version? LMAO.