Hacker News Reader

Comment by sneak | Hacker News Reader

How can I trust that I can log in and administer my network when Google kills my Google Account login or Microsoft kills my GitHub Account?

Big tech surveillance orgs being the SSO is an SPoF for the administration of the network. For something as critical as L3, I can't accept that.

I just use Nebula instead. It doesn't have a spiffy web interface or ssh auth chrome bolted on, but it works great for my purposes and it doesn't involve Google or Microsoft at any point.

View on HN

Tailscalar here.

IdP trust is on the list. There are some "easy" things we can do that help on the surface but make life harder for users. And there are some not-so-easy things we are researching. I hope to have answers in 2023.

I recently read this blog [0] about how tailscale was thinking of open sourcing a small coordination server but headscale had already been created so that effort was put on hold.

Is tailscale at this point in any way involved in headscale or contributing to it or are there plans to fork it to keep it maintained?

Asking out of curiosity.

[0]: https://tailscale.com/blog/opensource/

We hired one of the Headscale developers and let him work on it (as part of his job, not just moonlighting) and we help out when there are issues and give them a heads-up when protocol changes/etc are coming.

This is such an outstanding response to the existence of Headscale that I struggle to understand it. Why not just open source Tailscale's control server? Don't get me wrong though, what you guys are doing now is great.

Edit: some explanation here: https://tailscale.com/blog/opensource/

My guess would have to be that their version is probably deeply integrated with the rest of the product and infra that it doesn’t make sense.

Plus there’s the added benefit to their paying customers to know that we have an out if needed. It reduces friction in starting to use the product.

There’s another added benefit that they get two different implementations of the same protocol. When you have multiple implementations, you effectively have a double check on the protocol design. This should make the project as a whole significantly better engineered.

It’s quite clever from Tailscale.

Or their own server is too big for small use so not welcomed by selfhoster, like Bitwarten/Vaultwarden case.

Yeah, that's probably very true. Our main coordination server should probably get easier to run (for our on-prem customers and our various country-specific instances we run) but Headscale is far ahead of Tailscale's on just being easy to run.

That's great news! Makes me confident to actually try out headscale+ tailscale! Thank you.

re: IdP, assuming that means signing up without Microsoft/Google (which really bother me too), would it be possible to migrate a Github account to .. whatever you all implement _(email signup/etc)_?

I totally empathize. I waffled on Tailscale for a long time, and was convinced I'd roll my own for everything.

But goddamn if that spiffy web interface is not just the bees knees. I relented and put in a Google account that I don't use very often for identity--no idea if that makes it more or less like to be arbitrarily banned by Google--and accepted the fact that access to Tailscale wasn't so critical for me that I needed to be worried about it.

But in production, I totally get it. But I'd probably still just pay for Tailscale's SAML and use Okta or something...

Or if you are a small org, use GitHub Organizations for up to 25 people.

https://tailscale.com/blog/community-github-pricing/

I have been using Tailscale since the beginning personally, and have been trying to sell it internally at work, and since we have a GitHub Community I have integrated various Tailscale machines into some of our playground environments for others to test out.

> and have been trying to sell it internally at work

You are like, the dream of all B2B SaaS startups.

But also, Tailscale is great, fight the good fight.

Reply on news.ycombinator.com