As for how it relates to our product, I agree this post doesn't go into the "how" we recreate this programming environment. We certainly don't ever take a "security be damned" attitude, it's most of what I think about.
The goal is to build a secure environment, to achieve the security we had in disconnected environments (LANs), while keeping the world connected. If the environment is secure, you can spend less time wiring security through your code.
...I fail to see how this is a good model for security.
To be clear: if you're going to share a google account, you should create a new empty google account to do it, and should assume everyone in your family is an admin.
Please let me know if you found something on our site that isn't clear about that.
- open source self-hosting
- hosted free to use for personal use
I used them for Remote Desktop to my AI training machine when I was still traveling around, and that worked nicely :)
It's not open source, at least not the current version. It's under their modified version of the Business Source License: https://github.com/zerotier/ZeroTierOne/blob/master/LICENSE....
This is, IMO, much better than the typical proprietary license, but it's still not open source, and the license itself says as much:
>The Business Source License (this document, or the "License") is not an Open Source license.
The important point for me isn't really if this is true Open Source or not, but that I usually want (even paid is OK) access to source code so that I can fix things myself, if I have to.
And yes, we do think of ourselves as a "modern Hamachi." Hamachi was great! (I'm from Tailscale)
/Techsupport side note. I have a Windows laptop, and for the life of it the client will not connect to the service. How do I troubleshoot this thing? Its almost too simple. Are there logs? https://i.imgur.com/QRLkQl1.png
/And is there any way to get to test the magic dns? Will there be better ways to set up relay nodes, and then SEE the design of the network? Can I set up a relay node on Windows, and only for specific IP addresses instead of entire subnets?
/On the topic of "security within the lan is just a nuisance" I do appreciate this being more of a unix philosophy like single tool than kitchen sink. I do think there would be a market for a companion piece of cloud software that acts as a firewall orchestrator between devices, surfaces logs, allows you to block or allow specific connections between specific devices, and to visualize the activity of the mesh. It would be beneficial to be able to super quickly design a "all the field ipads can get to the server, but not each other" type network, while at the same time giving pcs more LAN like access, or being able to designate "edge/guests/clients" that can only connect to "servers." The two types of networks shouldnt need to be mutually exclusive.
/On the topic of other markets and use cases, and maybe this isnt what Tailscale ever wants to be, I think there is a huge opportunity for a pure software client Wireguard SD-WAN a la Velocloud. If I have two ISPs plugged into my network, let me define BOTH gateways as acceptable places for traffic outflow, and build simultaneous tunnels out both. Maybe load balance traffic between them, watch for packet loss, congestion, jitter, and correct accordingly. That extra redundancy of being able to lose a link and keep the path would be extraordinary.
Magic DNS isn't available for testing yet, but coming soon!
Our network diagnostic logs are based on https://apenwarr.ca/log/20190216 and we do intend to surface those eventually to end users or at least network admins. Just need to work out the right API and security model for that.
As for access controls between devices, Tailscale already supports that but our docs are currently too vague. If you're using Tailscale, visit https://login.tailscale.com/admin/acls to explore. Security policies you edit in there are immediately enforced by all nodes right away, so you can give some users access only to central servers, etc.
MonitorDefaultRoutes: iphlpapi.GetIpInterfaceEntry: Element not found.
subprocess exited: exit status 1
Also I couldn't find an 'Exit' button anywhere. Is deinstallation really the only official way to close the application?
The centralized control plane and mesh data plane, to establish a backwards compatible IP Lan is very Hamachi.
My memory of Direct Connect was that the control plane was much more distributed and fault tolerant.
https://en.wikipedia.org/wiki/LogMeIn_Hamachi
https://vpn.net
Tailscale is very much a successor to Hamachi. Hamachi was already "the 90s as a world of mesh networks on top of today’s internet." Ive run into some client side issues with Tailscale on Windows, but when it works, it works great.
BUT, this blog post is the worst part of SEO. If you're going to blog with lots of keywords to build up google cred, communicate useful things, not just a weird nostalgia. I didnt find the story particularly compelling.
Also, and probably more importantly, the message of 'as long as the perimeter is secure, security within the lan is just a nuisance' is kind of odd. I dont know if that part of the 90s is the part worth reviving. Endpoints should not be trusted by default. (That isnt necessarily tailscales job, but dont market/sell the product as a "its super easy to connect EVERYTHING, security be damned." That is irresponsible to people who want to build connectivity but dont know what they are getting into. If this is an Apple like 'it just works' dont underplay the dangers.)