Might want to check out Yggdrasil. It lets you can create a real mesh routed, E2E encrypted network. You can keep your network private, or connect it to the greater network and route others. There's no ring-of-trust (I can't imagine that as a viable solution at scale). But the config file has an AllowedPublicKeys section if you want to specify who can route through your node.
This is the kind of comment I love HN for!
What makes it realluy unique though is that it can actually be embedded inside the application via a suite of SDKs. Yes, private, zero trust connectivity inside an application! That provides the highest security and convenience as it can be completely transparent to the user!
Disclaimer, I work for the company who built and maintains OpenZiti so I am opinionated.
The embedding inside an app sounds like a really cool discerning feature though. I'll have a look!
I should really read up on it. I know... I will soon!
Clint and Ken did a really good ZitiTV on Friday which covered many of the cool superpowers of OpenZiti - https://www.youtube.com/watch?v=4wOGvZqN6Co&ab_channel=OpenZ...
The same thing is being said on HN about all kind of network software, but tell me one software that Cloudflare is really known for except its cdn ? None.
HN is really a strong echo chamber and some people believe Cloudflare and Stripe are going to be the leader in all software areas. (Even though Cloudflare is not the leading CDN and Stripe is not the leading payment processor). They are both amazing companies but they won't fix all problems of the world. I would even argue that they won't even solve more than their current core domains
Cloudflare needs to solve two problems: they need to introduce a free tier of Access that doesn’t use the CDN and creates direct connections between endpoints (to basically remove all operating costs), and they need to make the onboarding process for hobbyists easier instead of having a “contact sales” link on their homepage for these products. That’s doable.
> If we're going to fix the Internet, there's no point only fixing it for big companies who can pay a lot. That misses the point of the whole adventure. The Internet is for everyone. We have to fix it for everyone, or why bother? We knew we had to design a business model and a technical architecture that removes any incentive to abuse your privacy. Providing an ever-expanding free tier is how we help as many people as possible.
> ...
> Tailscale's go-to-market strategy is what we call bottom-up growth, or product-led growth (PLG). An earlier name for this is "GTM 3.0", which is explained beautifully in a presentation by Adam Gross... To summarize: in GTM 3.0, you give away an unlimited free tier for individual use (Not a trial, a free tier; this is what makes it different from GTM 2.0). Then, for collaboration in small teams, you charge a bit. Then, for big company control and auditability, you charge even more. At each level, the value proposition is different, so that users use your tech differently and benefit differently from it. And at each level, the buyer is different, so the messaging is different.
From tailscale.com/blog: How our free plan stays free, https://archive.is/R7jqw
https://www.sophos.com/en-us/free-tools/sophos-xg-firewall-h...
This has essentially been the guiding principle of my side projects for the last two years. Folks shouldn't need to understand DNS, TLS, HTTPS, IP addresses, ports, NAT, CGNAT, etc in order to own their data. Self-hosting a small server for you and your friends shouldn't be any more difficult or less secure than installing an app on your phone.
The vision you outlined is great, except it doesn't work. The trust assumptions are too high, and even a great product like Tailscale seems to rely completely on centralized identity providers (you have to choose Google, Microsoft, or Github on sign-in).
Ultimately, if you want to maintain full control of your online identity and network, you'll probably need some of the decentralized (but economically aware) resources you seem to have issues with — or at the very least a means of transitioning authentication to private key methods with DIDs.
I have a big collection of movies, and I’d like my mom-technical blue collar friends to be able to watch them. I trust them, and I have trusted communication channels with them. We exchange keys somehow.
With the sort of routing I’m describing, they could watch my movies and I wouldn’t have to have a public IP address. And I wouldn’t mind if their friends (that aren’t my friends) watch my movies, either, by forwarding through my friends. What’s the catch? This could work for that. How could I do this today?
I don’t have any ideological or moral problem with blockchains, I just think they suck at solving problems where the requirements for trust are low or met elsewhere.
edit: mom-technical was a typo of non-technical but I’m leaving it because it’s more accurate.
This is the part that doesn't scale. Hell, this is extremely risky even at a small scale. You don't know who your friends' friends are, you will have friends that abuse this, and you will end up with a much larger network than you anticipated.
How many of your friends and family are "friends" with bots on Facebook?
My problem is the client doesn't support multiple servers, so I can't have a work vpn and a home vpn, not even with an easy toggle - you have to run tailscale with different conf options for both. Changing namespaces also isn't easy, so having friends and family segregated even on one server is also a pain point.
Unfortunately if I need to bring anyone into my mesh network who is non technical, this is now a non starter.
This serves multiple benefits: the main one being that I receive pi-hole filtered ad-free traffic on my mobile device via a Wireguard VPN with my home IP 24/7/365
Tailscale also provides a "magic DNS" service which lets you resolve your Tailscale device names without setting up unbound etc, and which can relay other requests through to your pi-hole or unbound or whatever, which can then listen only on the tailscale IP address, so no need to run an open resolver or deal with source IP filtering.
e: also, you can share devices between tailscale users without generating, managing, distributing wireguard secrets. You send your pal/partner/kid a link and they can access your fileserver or raspberry pi webserver or pihole server for themselves wherever they are.
I used that while I was in China as this allowed me to have my own personal VPN.
It may be cheaper to VPN to home vs a cloud server, and you may avoid issues where sites block AWS. You can also securely forward other ports. Sometimes I print or access other services in my house that aren’t internet safe.
At home on my desktop, I just use uBlock Origin in my browser.
And the EC2 instance I installed it on was already being used for other toy projects, so it's not like it cost me anything. The additional egress bandwidth is likely fractions of a penny.
You can connect one person on a free plan, but each person can have their own free plan that you share devices between.
Headscale [1] allows one to implement a self-hosted, open source alternative to the Tailscale control server.
[1] https://github.com/juanfont/headscale
Almost all of tailscale is opensourced at this point besides the GUI.
Instead I can bind my services to Tailscales network interface and access it anywhere that I’m connected to my Tailscale network. It’s like authentication for free.
As a side note I know this is an anti pattern since one intruder can access all of my services, but that’s not a vector I’m really concerned about since I’m not exactly a high value target.
It's also great to be able to just ssh into your laptop at home when you're at work and you forgot to push whatever you were working on last night.
It's not necessary, but Tailscale makes a lot of things just easier.
What's the difference between using Tailscale for this and just opening the port on your router?
Tailscale comes with a few other benefits that don't come on other VPN's. I have my home server setup as an 'exit node' which allows me to route my traffic through it when I'm travelling. Super handy sometimes like when I'm travelling and my bank decides not to let me log in.
Other things are seamless transition to local networks, and you can even have local network encryption.
Handheld Elden Ring is amazing :)
Though my use-case is extremely simple, and so I just use bare WireGuard
You can find information about it over at https://openziti.github.io/ you don't even need to trust the software itself. You can add a 3rd party certificate to the server and mint your own private keys/certs and deliver them to your friends and have 100% control over where and how and whom you trust. You control access down to individual services, not CIDR blocks, not IP addresses. You can embed the sdks into any of your own apps if you're into that sort of thing. :) you could setup a relay server in some cloud provider for the 'untrusted' traffic (hmmmm you make me wonder if we could integrate with tor somehow now too...)
Seems like it'd do most/much of the things you want it to. I'd be happy to help you out. We have a discourse you can post questions to.
Here are a couple of cool artciles on some we have already done: - Springboot framework: https://blogs.oracle.com/javamagazine/post/java-zero-trust-o... - Prometheus: https://openziti.github.io/articles/zitification/prometheus/...
I do have some nits though:
- It's kind of finicky on Android, especially with exit nodes enabled. Sometimes I lose connectivity completely after connecting to an exit node, until I flip my WiFi on and off, then everything starts working.
- Not being able to auto-update the desktop clients, or at least update remotely, is a bit of a pain, and potentially a security risk?
This is basically just `git pull` on steroids.
Cloudflare, please make a box I can buy and stick it in the closet with a WAN connection. Routers suck, it’s time to reinvent them. Also please don’t make them look like goddamn spaceships.
Remote devices would need a client installed on it to access the VPN, of course.
I like this assessment. "[J]ust a STUN/TURN server at its core." It gives me hope maybe more people are starting to learn how to look at peer-to-peer not as something that is unreasonably complex and off-limits to ordinary users. LAN-like connectivity is not just for offices and gamers.
Of course, following a STUN/TURN standard is just one approach to a rendezvous server. It isn't the first or last approach to have worked.
By "rendezvous server" I mean a program that accepts connections and saves each client's address and open port number and makes this data available to other connecting clients, thereby allowing one client to connect directly to another client without involving the rendezvous server. The server needs only to tell clients about IP addresses and port numbers, nothing more.^1 Thus it can be a relatively small, relatively simple program.^2
I hope that going forward there will be even more choice in small, open source rendezvous servers, not created for commercial purposes, that ordinary users can run on globally reachable IP addresses. Most users must "lease" these addresses from others. Because not every user has a globally reachable IP address available, the use of "hosting" and now what people today call "cloud" services has been necessary.
Enormous amounts of traffic are passing through these third party "cloud" providers. They are, to use a popular term, "gatekeepers". Business customers, including ones who already control globally reachable IPv4 address space, let alone individual customers without such resources, are effectively beholden to them if they want to be on the internet. Not only that, the services are generally expensive.
However no data needs to be sent to or received from a rendezvous server other than address and port information. If customers are charged based on ingress/egress, it could be affordable for users to run these small programs on a "cloud server" due to the smaller amount of data transfer. With less data being sent to these third party providers, the privacy concerns would arguably be reduced as well (cf. eliminated).
The ability to connect devices directly over a network, including the internet, should not be monopolised like so many other aspects of the computers and the internet today. It should be available for everyone. The only cost should be paying for the globally reachable IP address and a tiny amount of traffic required for running a rendezvous server.
1. The advantage here is that the program can be easier and quicker to compile and users may be more inclined to read the source code and, optionally, make edits and recompile. Non-commercial, not a complex program like a web browser that is prohibitively slow to compile that almost no one compiles for themselves, nor one that few people have both the aptitude and inclination to read, edit and improve its source code.
2. Yes, there can be exceptions. For example, in some cases two clients using the same ISP might not be able to reach other directly. But these cases are the exceptions, not the rule.
The network will coalesce around using a handful of hub nodes for the packet forwarding, and a malicious party need only to coopt that central cluster of nodes to unmask all web users.
The "blockchain bullshit" enables trusted decentralized interaction at scale.
The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. Being based on open source wireguard, and being just a STUN/TURN server at its core… I’m sure that Tailscale will be the first but maybe not the best.
I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust.
Web3 happens when people can host stuff on their phones, and Tailscale is something that lets you host things on your phone.