Hacker News Reader

Comment by simonw | Hacker News Reader

> We funded the open-source SQLite VFS shim that helped isolate the race condition almost immediately, and will help track down similar bugs in the future.

Interesting example of a company funding open source - in this case paying for the development of a new and very specific debugging tool.

View on HN

Not only are they funding open source, they are actively allowing users to host their own control plane via headscale which is a libre implementation of the tailscale control protocol and developed by an engineer who works for Tailscale by day. This instantly made me trust and like them, even if at first I was cautious because I naturally mistrust anything that gets a lot of hype. I've been running headscale on NixOS, hosting my own tailnet since last year and everything just works out of the box. Tailscale lives up to the hype! <3

The only nit on my end is that you have to configure a few settings on client and server to avoid sending diagnostics to TS.

For macOS, you need to build the open source tailscale client. Or create file in esoteric file location to opt out using App Store.

For iOS I don’t even think it’s possible to opt out.

Oh? I thought we added that option on iOS recently. I'll go check.

Important features like App Connectors won't work with HeadScale.

Unfortunately, HeadScale is not a drop in replacement for TailScale. Most people don't realize this until they start self hosting.

Due to this, I had to migrate from Tailscale to NetBird, which is completely open source.

https://avilpage.com/2026/06/moving-from-tailscale-to-netbir...

Is this because HS hasn't implemented it yet (which is on the community), or because Tailscale does something to prevent them from working specifically?

it's a proposed and planned feature by the looks of it :

https://github.com/juanfont/headscale/issues/1651

Is it on the community, when TS have said that they won't open source their control plane because HS is good enough / easier to run?

Yeah, tailscale seems to have leadership with their head on right, I agree with the way they handle a lot of things.

Their CEO is a very nice and personable guy too. Has given me and others advice on random topics of his interest with no nonsense plenty of times.

Yeah, this part also stuck out to me:

> Because this wouldn’t be a quick or easy fix, we reached out to the SQLite developers for a professional support contract. This was a great decision. It gave us direct access to their deep expertise and experience, and we had many detailed technical conversations about our architecture and our incidents.

They were willing to pay to get help solving the problem, and then pay again to make sure that the problem is easier to avoid in the future! That kind of long-term thinking seems pretty rare nowadays...

Probably the most refreshing thing I've read in a while. Glad to support them moving forward if this is indeed their modus operandi.

Tailscale is the best. It's infinitely better than Hamachi, ZeroTier, etc. My only gripe is that they have some really weird SSO requirements like GitHub, etc. and then that provider becomes a permanent part of your identity.

I think their reasoning on not being an identify provider but acting solely downstream is very clever.

Y? What's wrong with providing username/password authentication

You become responsible for keeping those credentials secure, among a whole host of other problems. (Abuse like credential stuffing (more), data breaches (more), account farms (more), and so on.)

Being an identity provider for anything important is the freaking worst. Exposes you to a million problems. You need human support for login problems and lost MFA tokens, and you are an attack magnet.

Which is why you want magic links.

Don't be the identity provider, have the email host be the identity provider (which it is anyway if you have a forgot password prompt).

Agreed 100% that nobody should still be using passwords in 2026 though.

As a user, I really don't care for magic links. The whole, start the log-in process, switch context, wait for email (sometimes up to a minute), click on it, have it open a new tab in a different window than where I started is just a pain. I feel like I spend half my day logging in to services these days.

The only time I like magic links is for services where I am "not really a user". For example, an appointment reminder for my doctor where I need to validate my insurance. Great, send me an email 24-hours before with the reminder and a magic link, as I don't want to think about an account there.

I detest magic links. I have probably 9-10 accounts with a certain service that uses magic links (I mostly use them to get an API key or download a file every few months and never visit directly otherwise) because 1. the only login method they support is magic link and login with Google/Facebook. There's no password field so my password manager can't fill out my login details for me. 2. I don't have a Facebook account, and I don't keep my Google account signed in. Even if I did, I don't want them using these as my primary email address. (I use a catch-all and don't give out the primary address; I give each service it's own address) 3. A bunch of newsletters and forums (hackaday, etc) mention them by name every few weeks, often in the subject field, making it hard to search for. They don't send me any newsletters themselves, and I don't participate in their forums so there's nothing from them directly. They can't do anything about this, but it makes things harder. 4. If you enter a new email address that they've never seen before, the process exactly the same until after you click the magic link you received. They don't tell you they've never seen it before until you verify the address. 5. As such, if I can't recall the exact address I used to sign in, I automatically create a new account and don't find out until after I click the magic link and I'm asked to enter a new username or use the existing username they've already created. Proceed to settings and create a new API key for a new account instead of just adding one to my existing account.

This is an extreme case, yes, but I have similar issues with several services that only support magic links and GitHub login, and it's hard to configure services to use a new catch-all address when they harvest my address from GitHub login and won't let me change it. Magic links are a great tool, but they should _never_ be the only option. They should supplement existing login methods. Password managers exist for a reason. Several services that I have since stopped using for this reason have in the past decided that they should start sending emails to the addresses they harvested from login with other service. Two services have gotten my magic link address stuck in their system because it's not associated with an account (the account has been deleted) and thus I can't manage subscriptions.

One maybe non-obvious benefit I see in that from the individual Tailscale user perspective is that only having SSO rather than username/password keep the security of my login in the same bin as the larger customers where Tailscale makes their actual money.

A username/password would be perfectly fine for my use-case as an individual user using Tailscale for my homelab and personal devices. But I suspect the majority of real paying customers don't want a separate authentication flow just for Tailscale and would rather use the SSO they already have. I have confidence Tailscale wouldn't half-ass usernames and passwords is they offered it even if it was mostly just for non-paying hobbyist users, but I'm also sort of glad I get to bucket my account security risk with the people paying their bills.

Yeah, I have my Tailscale tied to my Apple account, which just feels weird. I can add a Passkey account to my Tailnet and make it manager, etc., so that’s what I’ve done. The owner is my Apple account, but I actually do everything admin-wise with a Passkey account.

Oh I had no idea they supported Apple. Maybe they didn't back when I signed up? I'm seemingly stuck with GitHub forever now though.

Should be possible to change, just not automated. You have to reach out to support.

Just FYI - with Tailscale you can switch SSO providers by putting in a support ticket. I did it last year and it was a breeze.

Oh, thank you! I might do that.

I've been a fan of Tailscale since encountering it for the first time at a previous job at a small startup. Someone asked if anyone had a Linux machine when we were all testing out something, and I mentioned I had a personal Linux desktop but wasn't sure how to connect it to the VPN for access, and it turned out that the solution was just literally running two commands in the terminal after installing tailscale from the repos. Compared to my first job where connecting to the VPN from Linux required hours of mucking around with openswan (or was it strongswan? so many swans...) and trial and error with various config files, it was unfathomably straightforward.

With a desktop its usually possible from the network setting GUI? Worked like that last time I needed to use a VPN for access to a corporate network.

Some of the NetworkManager VPN plugins have weird side-effects. Like the one for OpenVPN force-disables split tunnel configurations and there's no way to turn that off, meaning that all traffic routes through the VPN even if you'd rather only send stuff for certain destination addresses through.

Based on the experience that I (and other coworkers, including on other distros) had, whatever configurations our VPN needed did not seem to work out of the box on network manager.

A lot of this is just weird Linux on the desktop weirdness.

On Windows and Mac, VPN config is usually just installing a client, signing in, and then it all basically works. Sometimes you don't even need the client and can set it up in settings.

Those are pretty much all first-party clients though, right? I'm not sure that "some companies don't provide a Linux client for their software" is something I'd characterize as "Linux desktop weirdness". My point here is that Tailscale seems to have actually put time and effort into making a Linux client that's a breeze to use, whereas most of the other VPNs I've used for work have not.

That strongswan thing is the kind of design HN praises about open protocols by IRC (just the other day...) but in practice is so flexible it can't keep itself upright and it's unusable in practice.

Meanwhile tailscale or wireguard, by being actually opinionated, avoids needing much configuration at both ends.

Yes — configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies.

I have now mostly switched to Wireguard for this, which is much more sane [2].

[1] https://github.com/jawj/IKEv2-setup [2] https://github.com/jawj/wireguard-setup

How are the requirements weird? They support any OIDC endpoint whether your own or a vendor’s, and, while uninteresting to HN folks, they also now support passkeys for having no SSO provider at all.

This isn't exactly new; the other model is to just hire them directly. Unfortunately this has not generally led to open source outside of the enterprise world getting similar funding, but it is what it is.

What other examples of companies paying for something specific to be developed outside of their ongoing paid support contract can you point me to? I'm open to the possibility that this is more common than I realize, but I've yet to hear of another example of sponsoring development separately from support contracts.

It's common for databases.

This is Percona's business model. They employ core pg/mysql developers and you can buy a support package from them. Same for enterprisedb. Pretty reasonably priced packages (like maybe $10k-ish/core IIRC) get you 24x7 support. I've only had to escalate issues once but inside 10 hours we got a pg core committer to debug some very strange vacuum behavior.

To clarify, I'm not saying that support contracts are uncommon. I'm saying that going out of their way to then additionally sponsor development of a specific testing tool on top of the support contract is not something I've heard companies do before, and it's pretty awesome!

They could have just spent $300,000 in tokens to AI slop rewrite SQLite in Rust.

That would be lame. Instead they spent less and improved the world for everyone who used SQLite (which is really a lot of people)

Avery is one of the few people I have enough respect for to look up to.

Avery is amazing, reading his writings was one of the highlights of my time at Google. There were many talented and articulate people there, the level of discourse used to be amazing.

In real life, an imaginary "leadership" quickly evaporates upon the first hurdle of any kind until proven otherwise by real actions. If I was in your shoes, I would be very careful with blanket statements like these.

This would be the "proven otherwise by real actions" part. They've been around since 2017 and have had plenty of time to hit various hurdles. Past performance is no guarantee of future performance and it is within the realm of possibility for them to go of change course like Elon did. But who are you? Are your Internet comments some proenoucement of truth that can never ever be taken back? So you said something that, years later, turns out to be wrong. So what?

I wish they'd buy the carcass of Keybase from Zoom.

It seems very similar to Tailscale: immense utility from a free-tier product for the general public, which leads to trust and a large enterprise market.

Wow, that’s a great idea! I loved keybase back in the day and really thought it solved a real world problem in a unique and interesting way. Then Zoom bought it (for some reason) and left it to rot.

You might already know and used "for some reason" as sarcasm. For those that do not: Zoom did the usual aqui-hire. They needed to show their enterprise customers they were taking e2e encryption seriously, so they bought out the guys who did exactly that kind of encryption with Keybase.

A shame really, because Keybase was kind of unique in the way the facilitated social proof of identity tied to cryptographic keys. A shame though that they never found a really sustainable business model. When they turned to crypto currency towards the end of their independent run I knew it probably wouldn't last.

the UX was so terrible that it was inevitable it won't stick. It was clunky and alien on every productivity platform, I attempted to work in a team leveraging it, and it was painful on windows and macos alike.

I just deleted it as I noticed it was responsible of about 30% of active cpu (and battery drain) usage on my mac, while being logged out due to inactivity. Honestly: I never particularly liked it, and I could not feel the concept especially tempting, just went with the team.

Or instead of buying Keybase, they could fund https://keyoxide.org/?

Why would enterprises need Keybase's product?

We used it for dozens of things back at my old job. Send each other passwords. Informal credentials store fo one off projects and non production. Sensitive project documentation

Aren't there already lots of products that offer that, often more integrated with enterprises' existing systems than Keybase would be?

At least for now. All it takes is one greedy executive decision to stop supporting headscale. Given it’s an American company, it’s entirely possible.

Tailscale is Canadian, headquartered in Toronto.

That's actually SQLite revenue model.

https://sqlite.org/prosupport.html

Reading the article, it sounds more like they funded this by buying a SQLite support contract, and the SQLite developers created this in the process of helping them track down the issue.

Started using them like 2 weeks back, happy to see how they work.

New? The sqlite VSF shim is much older. Nice spin.

Spin?

Looks to me like this is the tool in question, added in January: https://github.com/sqlite/sqlite/commits/master/ext/misc/tms...

Reply on news.ycombinator.com