Hacker News Reader

Comment by mike_d | Hacker News Reader

They are really trying to get booted out of enterprise environments. They were on thin ice adding remote management (SSH) out of nowhere to what was supposed to be a VPN replacement. Now sysadmins and security have to deal with users randomly shooting files around between devices.

I totally get that they are trying to appeal to tech startups and not big companies. But how jazzed would you be that a manager at your bank can zip your mortgage documents over to his cell phone to review them on the go?

View on HN

They have ACLs. You can use those. Then don't enable Taildrop on certain machines.

The enterprise option is nifty. I'm gonna use it for my next startup. I find it to be pretty freaking amazing. But if you're suggesting that having an open port on a secure connection is dangerous... well that's why you have a secure connection. So just use ACLs to restrict access to machines you shouldn't have access to. And you can do it by port. Is there something I'm missing?

> They were on thin ice adding remote management (SSH) out of nowhere to what was supposed to be a VPN replacement. Now sysadmins and security have to deal with users randomly shooting files around between devices.

historical note: Taildrop pre-dates Tailscale SSH by more than a year, so if you had concerns about Taildrop's functionality, those were valid way before ssh functionality was enabled.

Both Taildrop and Tailscale SSH are disabled the moment any ACL but the default (which allows everything to access anything which is what no enterprise runs with) is configured because their ACL feature allows only access but no denial, so if something isn't listed explicitly, it's denied.

Wait a sysadmin can't turn off a ssh server? you might want to fire him very quickly if they can't handle that.

Unfortunately, people don't like to hire sysadmins these days.

Of course this makes companies very fragile to things like this.

I'm just a regular dev who does a little sysadmin for home office situations for myself and friends and even I'm smart enough to do a scan for open ports and services. running on any new devices or software servers. and well read the docs a little bit.

The manager could already try emailing the files to herself and get fired for that. If she can set up Tailscale on her office PC, the sysadmins should be fired as well.

> Now sysadmins and security have to deal with users randomly shooting files around between devices.

Only if the feature is enabled, it is disabled by default.

Only because it is in alpha currently.

Are you a Tailscale employee familiar with the "go to market" plan for this feature? I'm curious how you know they are planning to enable it for all users by default once it reaches GA.

Are you? What is your source for it not being released as a feature to users?

I'm going off the documentation that says it is disabled by default because it is an alpha feature.

> zip your mortgage documents over to his cell phone to review them on the go?

If they’re using Tailscale they can already spin up a good old HTTP server over whatever open port and download from there, if said enterprise isn’t competent enough to configure proper access control.

> Now sysadmins and security have to deal with users randomly shooting files around between devices.

Well yeah if a user needs a file on their phone then that's the point of the app. Seems like a pretty conventional and valid use-case?

If you'd like to contact info@tailscale.com we can set up a time to talk.

I'll mention one more time: if you'd like to contact info@tailscale.com we can set up a time to talk about upcoming features and philosophy on releasing them.

Reply on news.ycombinator.com