If Tailscale-the-product ever goes rogue or evil, I can always self-host wg or a full on tailscale-equivalent mesh myself. I sleep well knowing this.

If you were looking for an open source, self-hosted implementation of the Tailscale control server (as far as I know, that is the only portion of tailscale that tailscale keeps proprietary, and this is the best open source implementation of it).

Edit: wow, this project has really grown from when I last saw it. It is able to configure the vast majority of tailscales base featureset such as ACLs, magic DNS, taildrop file sharing, and so much more. Incredible.

I have no idea how the official clients will deal with that, though, but I've never used tailscale myself.

Could you please elaborate on this solution? I'm not sufficiently knowledgeable about OpenID to quite understand what you mean, but I'd like to avoid any of the mentioned SSO providers, as they're all blocked on my systems for personal use.

Added: Found these as per mention in your post:

[0] https://openid.net/connect/

[1] https://simpleid.org/

[2] https://www.keycloak.org/

... so I assume you mean that I could install one of [0-2] along with Headscale [3] to get the similar effect of installing Tailscael, just without those annoying SSO providers? I will see if I can find the time for examining that solution. Anything that can keep MS and Goog away is most welcome

[3] https://github.com/juanfont/headscale

Keycloak is quite a complicated system to configure, though, there are easier alternatives out there. If you're just trying to get anything up and running, something simple like Authelia may be better for your use case (disclaimer: I've never tried it, but it seems light weight and other people online seem to recommend it).

Edit: Oh no, indeed when you want to sign up you need an sso provider indeed! This is what they say:

Can I sign up with an email address?

We don’t support sign-up with email addresses. By design, Tailscale is not an identity provider: there are no Tailscale passwords.

Using an identity provider is not only more secure than email and password, but it allow us to automatically rotate connection encryption keys, follow security policies set by your team (e.g., 2FA), and more.

It's also a pretty effective way to limit the amount of tailnets a user can have.

Also the iOS client, which is hard-coded to only use the first-party control plane, so you can’t use headscale if you have iOS clients :(

If I didn't have the goal of buying a house in the Bay Area, I would totally try to find a job with Tailscale.

There's no "I'm free once I'm a home owner" thing.

I finally signed up to an account to HN to say emphatically that it's the opposite.

Owning a house is a huge responsibility that takes up the vast majority of my time, and it's a millstone around your neck if you ever think about moving somewhere else.

I seem to be an exception, but I have no need to define who I am by my housing, nor do I need the security of owning my own house. I have also lived on three continents, so I appreciate the ability to pull up stakes and move with very little fuss.

What in the world? This doesn't even come remotely close to passing the sniff test. Is your idea of homeownership like, constant remodeling or something?

I do zero hours of maintenance/upkeep per week, just like you with your rental.

Is your landlord now doing 10-20 hours of maintenance/upkeep per week for every apartment? Of course the answer is no.

In Sweden, homeownership vs apartments is quite a large difference.

The other side of keeping up with maintenance - if you don't have time nor want to, hire away. It will eat a significant chunk of change to hire all the professionals your landlord was hiring, the difference being you are hiring yourself versus being dependent on the landlord.

For the DIYer, tools acquisition is definitely a PITA. Hardware stores have a decent selection mostly of what you need, but it would be nice if there were preset of tool maintenance you could order, maybe even save you money over long term buying it all piecemeal.

I'd imagine the real time suck would be for planning/research for it all, if you are used to spending your time coding, playing games, or otherwise amusing yourself, yes for the first couple years you will not have any time for these things as you are acquiring your skillset(s).

But that could be said for going back to school, etc. I think it's pretty valuable to be able to maintain your own dwelling apparatus, personally. It means you'll never be without reasonable shelter, so long as you have some access to raw materials, tools.

Lawn maintenance is maybe one or two hours a week at most, and that is mainly because we like to keep it pretty tidy. Then again, we would have needed to do similar maintenance (in the UK) for a rental if we wanted to keep the same standard for the garden.

Houses like anything else have lifetimes, You don't get to be a 200 year old house without having major maintenance done at least a couple times. Buying a poorly maintained, or constructed, old house is a nightmare, if it's bad enough you've discovered why some houses are condemned.

Modern construction often has a longer lifespan and more readily accessible materials, older houses are a mixed bag - some gems that may last hundreds (thousands?) of years, lots of houses that need major repair. Some in the middle too...

Home ownership is as much a comfort as it is a fantasy. There are true perks, eg, you're mostly in control of the regular costs (rent vs mortgage) but it also has downsides, like... basically any hazard and everything location-related.

PS: I feel weirdly kinda honored that you created your account and replied to my comment. Anyway, I'm just being me ;)

> nothing changes once you own the house

Why? What does this mean and is it actually true? The monthly/yearly cost of owning a house is typically much lower than the mortgage payments. If buying a house in cash, the maintenance usually is low enough to consider lower paying jobs. Needing a high salary might enable remodeling but basic taxes and upkeep are very very different from sale price or the payments to a 30 year loan. In my experience something absolutely changes once you fully own the house.

As a renter, this overhead is baked into your lease. As a homeowner, I can simply tap into home equity to do a major repair at single-digit interest rates over a decade. Something you will never be able to do as a renter.

I mean, yes, if you do things yourself it can be significantly less expensive, but most of the housing stock in the bay area is atrocious - good bones and awful everything else. They were thrown up as quickly as possible in the 50s-70s and so there's always something that needs fixing.

$18k+ a year in taxes...

In the country-side that kind of money gets you a 12 bedroom mansion with a pool and a view...

I do a lot of DIY but there are times when you just want it done and done quickly and professionally. We work for a living and don't really have time to deal with a lot of the DIY incremental aspects that happen until you get very good at any given skill. I just redid one of our bathrooms, but I wasn't going to redo the sewer lines solo let alone mid-week while living in the place.

The problem with HCOL is that even if you own you're burning cash due to the lack of time and very, very high cost of services.

But you DO need a high salary in the first place.

And with that big salary, you will buy a NICE house, which will require a lot of maintenance (house keeping, gardening) and taxes.

I think you’re trying to say that an expensive house is more expensive to maintain than a cheap house. That’s true. But the salary required to buy any given house is higher than the salary required to maintain it, for the most part. I’m sure there are counter examples, but on the whole most people who pay off their mortgage experience a pay raise, effectively, which has been my own experience.

In general, I think it's kind of an interesting heuristic to think about every so often: right now, putting aside practicalities like my current job or where I live, what looks like a cool place to work, even if the specific role was just taking out the garbage.

Right now the answer is "tailscale" and "oxide" for me.

In the past I also liked sourcegraph, too. Not sure what they're up to nowadays.

Seems like a risky place to invest at this stage.

The way I usually treat it is: Can I pay off this mortgage in the event I don't want to sell the property?

Negative equity is a thing, sure, but if you were always happy to pay the price then the thing you're buying is worth the price, right?

Sometimes people think of things as having value only if they're relative to something else. But value is value, and value is the price that you're willing to pay.

Their sales team, when I asked about self-hosing a controller, said it's not necessary because they've never had all the hosted controllers go down, but when I asked about a tweet they sent in May 2020 about their controllers being down, I never got a reply. [1]

My plan was to put ZeroTier on all of our machines and use it as an overlay network that all traffic goes over. But I don't want to open the availability of our network to depending on an external service.

I've all but decided on Nebula, just need to get the deployment worked out. I'm playing with Tailscale right now, and am very impressed. It does have the ability to require MFA on logins that we would like for user VPNs, while still being able to have servers self-authenticate (we respin half of our dev/stg environment every night).

[1] https://twitter.com/ZeroTier/status/1389766385480372225?s=20

i can't say about that specific thing but i've been using this daily 24x7 for the last 2 years now. it connects my 20+ pcs and laptops which are geographically apart but because of zerotier, they are in a local lan.

it does not have SSO, relying on the admin accepting/rejecting connected devices by a single checkbox. this is in comparison to tailscale which uses Oath, meaning you have to create and maintain those accounts as well.

The execution of Tailscale is second to none. It’s pretty much a masterclass in making complex things seem simple. They’ve nailed onboarding, design, great documentation and just generally presenting an image of a company you want to do business with.

It does seem to be a near perfect solution for a few very specific problems, with almost no downsides and a user interface easy enough that you could do it without any knowledge of the underlying technologies

the idea that you'd pay a subscription fee greater than aws just to avoid a few hours of learning how to set something up is kinda disgusting in comparison.

FWIW I use both SSM Port Forwarding and Tailscale but Tailscale is easier for both tech and non-tech users IMO.

https://news.ycombinator.com/item?id=8863

'Installing the agent client side is no more or less tedious than installing the Tailscale client, IMO anyway.

I made two scripts, one in .Net with a GUI for non-devs to grep a server hostname or tag:name in AWS that resolves to an instance ID for SSH or RDP. And another python script doing the same but without the GUI for the dev team. Works a treat.

But you've already explained why it's a little tedious and now I've documented and understood why. Tailscale MagicDNS does all this nonsense for you. Yeah ok thanks for rubber ducking me I see your point now. :)'

At most you'd need to add some permissions to the instance's role, maybe.

Whereas they're saying that spending time setting up AWS is complicated (for them) and not worth their own personal effort in comparison.

I'm not sure where you read the ad-hominem.

It took me all of 3 seconds to fall in love with Tailscale, but I think I agree with your point. This is a place of knowledge and curiosity, so digging into stuff and setting it up yourself is definitely to be commended.

For me, I just want a solution that works and I simply don’t have the cycles to spend on this specific problem. Happy to outsource, nothing disgusting about that.

Seriously? What equivalents does it have for Route53 and tons of other services?

I can't tell if this is misleading or pointless.

Your comment is pointless and a straw-man argument.

https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste... https://docs.aws.amazon.com/systems-manager/latest/userguide...

`ssh aws-bastion` invokes a ProxyCommand that:

1) finds an actual bastion host by tag using ec2 describe-instances

2) generates a short-lived ssh key and adds it to the ssh agent

3) sends the temporary key to the bastion using ec2-instance-connect send-ssh-public-key

4) starts the SSM/ssh session using AWS-StartSSHSession

Since it's SSH, we can port forward, use multiplexing, etc. We use Google as the IdP, via AWS SSO. Bastions periodically sync users from a Google group.

[1] https://www.reddit.com/r/aws/comments/df6uip/ssm_tunnelling_...

https://aws.amazon.com/about-aws/whats-new/2022/05/aws-syste...

Also, intellij's built-in database tools support ssh tunneling, it 'just works' with the ProxyCommand method.

AWS Client VPN does not offer any means of unattended configuration or mass distribution. All they offer is a self service portal from which you can download the installable, the profile, and directions. Each use has to manually import the profile into their client.

I'm stunned they're missing this as it would prevent any sizable organization from adopting it.

It works but performance is awful. Slow connection times and pushing images has slow throughput.