Hacker News Reader

Comment by crawshaw | Hacker News Reader

thanks! we have a lot of work to do explaining tailscale. we’re working on it.

I am doing a company talk (we do them weekly) about network security and at least the way I was planning to explain tailscale to our staff was via a picture I still need to somehow build, but it goes something like this:

You have a crowd of people (like one of those massive crowds you see in Tokyo etc). And you are both at either sides of the crowd, and you each have a can with a string connecting you to each other – and I explain that the crowd is the public internet, and tailscale allows you to create that string across the whole crowd in a way that nobody in the crowd can ever listen to you guys talk, even though the string literally passes through/over tens of people in that crowd.

If someone has a photo like that, I'd gladly use it :)

That is just a vpn

Yep. And Tailscale is the only VPN (like a mesh network, not "let me watch BBC Channel 4 from the US") product I'm aware of that someone who mostly understands cans, strings, and crowds, can setup in half an hour (with maybe just a couple questions to a tech person).

I know enough about all the nuts and bolts under the hood with Tailscale and that makes it feel MORE magical to me, that with all those things to deal with, it still just works. And it's no compromise (uses wireguard, etc)

The last time I saw that level of magic was in a product called Hamachi. It Just Worked™ more than a decade ago. LogMeIn bought them and ruined it.

But with Hamachi I didn't know how it worked under the hood.

Stable diffusion it

“Make any device anywhere part of your own private, secure network.”

The challenge is that there's two kinds of VPN users (corporate and retail), and for corporate users, the thing you just described is simply a VPN.

We're a corporate user but to me it was "wireguard + SSO" and I was sold.

The Okta groups sync is a beautiful cherry on top.

I agree: for me at first the mind-blowing thing was seamless IdP integration. (Now I'd have ACLs neck-and-neck with the SSO stuff). But like, the extensible private network thing, that's what corporations use VPNs for. :)

The problem with a lot of the worse corporate VPN is all the other crap.

Like PulseSecure garbage that gets mad because you don’t have the right antivirus installed, when in reality your version is newer than the pulse client recognizes.

Just to further clarify as I've recently gone down the rabbit hole of Tailscale...but isn't the idea that I can make any part of the device running on a private, secure network? In other words, even if I'm connected to a node, I'm still running "on my network", whereas when I connect to a traditional VPN service it just kinda takes all of my traffic and puts it in that same network "space", the biggest difference meaning I no longer see a traffic hit when I'm reaching www.google.com because it doesn't mean all of that traffic has to get funneled through the VPN traffic.

As you can tell, not a network guy here! I could be totally wrong.

By default, and in the most common configuration, the Tailscale “idea” is to intercept all network requests made to a reserved IP range (100.x.x.x) that cannot have public services on it (similar to 192.168.x.x). Each of your devices gets a static IP and can reach any other of your devices using their static IP. All traffic will be encrypted, and it will work really really hard to get through all NAT gateways and firewalls in-between.

As those static IPs are in a reserved range, they will never clash with a public service like a website and Tailscale does not mess with your regular traffic.

You could make things more complicated by setting up exit nodes and exposing subnets, but that’s the general idea. So simple, it’s brilliant for their standard use-case.

"what's a network, how is it different from the internet, and why do i need to add a device to it?"

many people don't understand the implications of vpn'ing into their home devices. being able to access their network shares "over the internet" in a safe way. being able to access all of their random self hosted stuff without needing to be at home without needing a reverse proxy. all the while being easier to secure and safer than internet facing alternatives. these are things that people will actually understand that aren't just arbitrary abstract ideas.

Reply on news.ycombinator.com