Taildrop was kind of easy

https://tailscale.com/blog/2021-06-taildrop-was-easy/

by tptacek • 5 years ago

338 123 5 years ago

tailscale.com

vxNsr• 5 years ago

Seems like a great service if you’re already using tailscale.

wrs• 5 years ago

Indeed, the article did a good job of making me wonder how long it’ll be before we’re all using Tailscale.

maddyboo• 5 years ago

Seriously, give it a shot if you haven’t already. It’s dead simple to install and “just works.”

implying• 5 years ago

I've deployed it to my larger-than-average home network with great success. A device can roam outside of the network and still access intranet sites and services, and I can remotely access family devices for helpdesk tasks.

My only complaint is that there is no good alternative to authentication other than using Google for small deployments like this. I don't want to pay an auth provider, and none of them offer a simplified plan for 3-4 users.

e12e3• 5 years ago

Nice tool. I wonder if it supports resuming downloads?

Might have been better if they built on bonjour/zeroconf rather than make a "tailscale" api though... on the other hand, I guess bonjour/zeroconf works oob on tailscale anyway.

Which makes this more of a marketing for a new api/app platform?

dave_universetf3• 5 years ago

Not yet on resuming downloads. No principled reason, just haven't gotten to it yet.

LAN discovery is handled by Tailscale's network engine, a couple layers of abstraction below the file sending. We're going to add some mdns stuff in there at some point (similar to WebRTC's privacy-preserving LAN endpoint discovery), but the benefit of running this all over Tailscale's network engine is that file transfer works exactly the same whether you're on the same LAN as the target, or halfway across the internet. The only variable is how fast the file moves.

lilyball• 5 years ago

Wide-area DNS-SD exists too, it’s not just for mDNS, so if this was built on a DNS-SD infrastructure then supporting devices off the LAN would be as simple as just offering a wide-area service enumeration and browsing domain.

mercora2• 5 years ago

unless they do do something funky only unicast packets are routed in wireguard. bonjour/zerconf/mdns all use multicast or broadcasts for discovery. integrating some kind of service discovery relay would be possible though.

e12e3• 5 years ago

Hm, I thought I'd seen someone comment that mDNS worked for wireguard - but I haven't tried myself. I guess I can't move from ZeroTier for my home network yet.

apenwarr9• 5 years ago

Post author here. I'm happy to answer any questions / respond to any rants if you like.

supermatt• 5 years ago

Im still a bit confused about the "without the cloud" aspect. It seems that you still need NAT traversal, which means an external STUN server, and a relay for NATs that cannot be traversed - as well as a coordination/signalling broker. Surely those require some services "in the cloud"?

apenwarr9• 5 years ago

In Tailscale, much like in SDN or SD-WAN, we think of the network in two parts, the control plane and the data plane.

The data plane is how the bulk of your packets get sent from one place to another, which in Tailscale is peer-to-peer (as long as your network is not completely blocking NAT traversal for some reason). Even if NAT traversal is blocked and we have to relay your data through the cloud (through our DERP network) to make it work, the data plane is still end-to-end encrypted using private keys that only exist on each node. The private keys never leave each node. The DERP servers are just relaying opaque byte streams, like any IP router would do.

On the other hand, the Tailscale control plane uses a central coordination service. It's used to exchange public keys and STUN information between nodes, but this is a tiny amount of information updated rarely (and therefore reasonably cheap for us to handle at scale). These public keys are not enough for an attacker (us or anyone else) to be able to decrypt your data traffic.

So when we say taildrop never sends your files through the cloud, that's because taildrop exists entirely inside the data plane, sending data through e2e encrypted tunnels that have already been established with the help of the coordination service, STUN, etc.

Because the coordination service is cheap for us to run, we can have a really generous Tailscale free plan without losing all our money. The paid plans are intended to be for "corporate network" situations where people want more centralized controls, audit trails, and so on.

oezi3• 5 years ago

Does Tailscale include automatic client node updates in any way? How to ensure all clients are up to date at any time?

How do you assign devices to logical networks?

How many virtual networks can be run concurrently on a single device?

apenwarr9• 5 years ago

MacOS, iOS, and Linux clients can use your native OS updates. Windows needs to be updated by hand or with something like chocolatey or MDM. But more importantly, we have a policy of not breaking old clients if we can possibly avoid it. So far we have never deprecated old clients. We extend our protocols in a backward compatible way, because unilaterally breaking your network infrastructure… really sucks.

The way tailscale networks (tailnets) work is probably not how you’re used to thinking about them. Each node has its own view of the world, based on which nodes and services are shared with it in particular. We have security policy settings per domain, and a node sharing UI that lets you share any of your devices with anyone else.

The default model is that all devices belonging to someone in the same domain, say tailscale.com, can see each other. But we’re working on making that even more flexible since it doesn’t always do what you want for huge orgs (like universities).

ignoramous2• 5 years ago

re:localapi: Are these httpd instances? If so, are they run on-demand or are always running? Curious how this plays out on mobile devices with regards to power consumption?

re:whois: I presume this is in control of a central identity service. I see that the private tailscale network is (mostly) p2p and (always) e2e, so wondering if you envision a future where the tailscale network goes decentralized without a central control àla BitTorrent / LimeWire (despite [0])?

re:peerapi: Excuse my naivety, but couldn't this binary transport be used for file transfers too? Or, does http simply provide too many (file transfer) options [1] to not bother re-implementing it in a custom protocol?

Thanks.

[0] https://apenwarr.ca/log/20201227 (when's vol.2 out?)

[1] I can see screensharing up next, a keybase-like chat client, and even live video / event streaming?

apenwarr9• 5 years ago

The localapi is indeed an http server built into the tailscaled process, which is written in Go. Since we already had an http client in there, the net new code to add an http server is quite low. And it doesn’t take any battery unless it’s being queried. I think people underestimate how cheap http can be (once you’ve paid the up front cost, anyway).

You’ve correctly guessed that blog link [0] that explains the reason I don’t think we’d ever want to try making a distributed coordination service. Most importantly, corporate customers absolutely love having a single control and registration point for every corporate authorized device on their network (and thus, a way to instantly deauthorize stolen devices). What we’re going to do though is add private audit trails and tamper proofing, kind of like TLS certificate transparency, so that the central instructions can be validated in a decentralized way, if that makes sense. More on that later. :)

Re: peerapi, there are lots of ways to build app layer protocols once you have tailscale making the connection itself easier. We picked http since it was the fewest lines of code and it makes an easy example.

Re: live video, Jitsi already works fine on a tailscale network if you want to try that.

oarsinsync• 5 years ago

In a world moving towards "zero trust networking", this appears to be going in the opposite direction, where the network is now being implicitly trusted.

This enables unauthenticated file transfers between hosts on the same network.

Given the world we live in today is that RCE vulnerabilities are relatively common, what happens when host1 gets some malware and uses this to transfer itself onto host2?

I assume this has been considered, and it's been decided that the convenience of the feature outweighs the security and reputation risk considerations?

iso12104• 5 years ago

Isn't the tailscale work more to do with authenticating hosts than the network. You trust all communication decodable by a trusted public key.

That still allows malware on a trusted end device to connect to you, but then if you've got malware on the box chances are it will have access to the private keys, authentication cookies etc, anyway - at least currently.

carlosf• 5 years ago

I guess in an ideal world where everything in your org is behind MFA, app authentication and protected from denial of service, then solutions like tailscale would not be needed.

But my personal experience is that most software is completely hostile to good security practices and you end up having some perimeter security as well.

apenwarr9• 5 years ago

Someone else mentioned that basically malware on your machine is expected to bypass all security layers. So we’re basically saying “the ‘new’ network layer is now as trustworthy as the app layer” rather than claiming everything is perfect, you’re right.

This is one reason we limited taildrop to only transfer between devices owned by a single user for now, and only to drop files into controlled locations. Tailscale also has ACL policies for when you don’t trust all the endpoints to just do anything.

JacobiX2• 5 years ago

I use Tailscale every day I like the simplicity of setting up a new node. My problem is that I don’t know how to separate my nodes into isolated groups, so my question is does it support some form of multi-tenancy ?

ricardbejarano• 5 years ago

There is ACL support on the Admin console.

Lets you choose which users/machines/tags can talk to who. Tags are like groups.

ithkuil• 5 years ago

Awesome work, I wish I could use it. Unfortunately I use tailscale at work too and until https://github.com/tailscale/tailscale/issues/713 I'm turned off from using tailscale also for my personal stuff since I don't want to physically switch to a different set of machines for work and personal projects.

mwcampbell3• 5 years ago

I wrote our Windows Taildrop GUI. I reserve the right to make fun of it.

Is the GUI open source somewhere?

mwcampbell3• 5 years ago

Found the answer, in the headscale readme:

Everything in Tailscale is Open Source, except the GUI clients for proprietary OS (Windows and macOS/iOS), and the 'coordination/control server'.

Keeping the GUI clients for proprietary operating systems closed-source is certainly a valid business decision. It's just unfortunate that it means we don't get to fix any issues we find that may matter more to us than they currently do to the Tailscale team, e.g. accessibility.

Edit: Yes, I know, to be fully consistent on this point, I should run an open-source OS. But then, the proprietary operating systems have accessibility teams, while presumably Tailscale does not.

jd3• 5 years ago

This is really excellent work — congrats! I previously used upspin to securely move files between devices on my network, but I really love the simplicity and ease of use that taildrop now provides.

To give a concrete example, I had been dragging my feet on moving some old but useful keys/tokens between my Windows desktop and MacBook — using taildrop, the transfer was both easy and virtually instantaneous.

Historically, it's always been such a pain to either have to upload/download the file(s) from a cloud service (what if I need to move private keys? that adds another layer of complexity/annoyance because then I need to encrypt them) or find a usb drive, plug it in, copy the files, eject, find the adapter for my macbook, plug it in, copy the files, eject, etc. Taildrop completely fixes all of that — it's amazing!

zaroth• 5 years ago

So my immediate thought was, what if I want to use Tailscale as a backend fabric for enabling a new P2P application?

It doesn’t seem like a scenario / use case envisioned in their pricing page.

apenwarr9• 5 years ago

The idea is to get there eventually, and taildrop is the first example/experiment in that area.

In theory a bunch of individuals on the free plan should be able to build arbitrarily complex networks by using the (also free) node sharing feature: https://tailscale.com/kb/1084/sharing/

In practice, probably needs more stuff added before that's truly realistic. But we're always looking for feedback on how to make it easier.

kodablah• 5 years ago

This was my first thought as well. I wonder if what they refer to as the control plane[0] could be a DHT that contains keys instead. But as I thought more, I wonder what benefit a VPN-based fabric for P2P would have over protocol/application-level encrypted content. Granted the NAT busting features can help on their own, but otherwise I struggle to see the benefit assuming the protocol has encryption and P2P built in (I am probably just missing something).

0 - https://tailscale.com/blog/how-tailscale-works/

MorganGallant• 5 years ago

The really interesting idea here is that once you change the frame of reference, or start from a different technical basis, features like Taildrop become incredibly easy to build and design - it seems like it almost built itself. It seems like the same goes for interfaces or platforms… once you have a computer in your pocket capable of 11T operations per second, you get a lot of stuff “for free” right out of the box.

bsder• 5 years ago

Sure, once you "Bust a NAT" sharing is stupidly simple.

"Bust a NAT" is anything but easy, however.

bookofsand2• 5 years ago

Indeed. For those that started scratching their heads 'this is impossible', this deep dive from the Tailscale blog will be informative. Perhaps even entertaining, the birthday paradox may have a hand in it.

https://tailscale.com/blog/how-nat-traversal-works

eru3• 5 years ago

That reminds me of https://franklinchen.com/blog/2011/12/08/revisiting-knuth-an...

Basically, Knuth was writing a beautiful but excessively low level program. His challenger wrote a dozen lines of shell-script.

nindalf• 5 years ago

Codegolf page with solutions up to 30 times faster than the McIlroy shell script solution - https://codegolf.stackexchange.com/questions/188133/bentleys...

svat• 5 years ago

Not "his challenger"; it was not a contest. It would be more proper to say "his reviewer, the inventor of Unix pipes, using the review column to advertise UNIX®". See a previous discussion here: https://news.ycombinator.com/item?id=22406070

Incidentally, a couple of days after that thread, the current fastest submissions (which, like Knuth, all use tries) were posted at the question https://codegolf.stackexchange.com/questions/188133/bentleys... mentioned in a sibling comment. (AFAICT that comment should say "200 times faster", not "30 times faster", but anyway in light of the original context it's not meaningful to compare the two approaches either for efficiency or ease of implementation or anything else.)

colesantiago• 5 years ago

Is Tailscale / Taildrop fully open source? Such that I can set this up myself for my own purposes 1:1? Wanted to use Tailscale's service but saw this on the sign up page:

Sign up with your identity provider...

This frightened me enough not to use Tailscale, I don't want Google / Microsoft sharing any more of my data. Is this still the case?

judge20202• 5 years ago

Given you’d sign up with an email anyways, I don’t see how it’s sharing more data by using oauth versus a password.

iso12104• 5 years ago

If I share my email with tailscale that's sharing data between me and them, no third party involved.

If I use an OAuth integration I'm involving a third party

Some people use a third party email provider, but chances are they aren't supported (even if your mail provider offers oauth integration) -- the only support is with Google and Microsoft

Now that aside, I support the idea of tailscale not creating its own identify provider. BYOI is far better than yet another supplier to leak information and yet another password to manage.

If I were interested in integration with my company's SSO, I'm sure they'd be able to support our OAuth endpoint.

For personal use, chances are you have an identity with one of the providers, and the information leaking to that provider (that you use tailscale) is minimal and seems like a good solution.

bookofsand2• 5 years ago

Skimmed through their excellent design docs. The code is open source, but requires running a centralized control plane sever and may also require running a data plane relay server to cover some relatively common NAT configurations.

https://tailscale.com/blog/how-tailscale-works

sbierwagen• 5 years ago

Is Tailscale / Taildrop fully open source?

Why would it be? It's a commercial service.

Such that I can set this up myself for my own purposes 1:1?

I'm guessing both peers ping a central server in order to discover each other, which is why it's integrated with tailscale at all. If you're in the tiny segment of the population who is already paying for a server with a public IP, and have the technical ability to deploy services to it, I feel like it would be marginally less effort to just sftp the file to that server rather than try to clone the feature set of taildrop.

Tailscale could theoretically publish a docker container that contains the guts of this service, but it'd be rather a lot of work, for no money.

>Sign up with your identity provider...

I have not seen a lot of evidence that regular users care about identity provider privacy, seeing as how Facebook had 2.8 billion monthly active users last quarter. That customer segment (half of the world population) might be more interested in signing up for the free tier of tailscale and getting magic file sharing than they would be in administering their own linux server.

neolog• 5 years ago

Why would it be? It's a commercial service.

Open source is a good way to get community buy in, because it improves transparency and reduces lock-in. There are lots of open source commercial services, including the Tailscale client service.

viraptor3• 5 years ago

If you want an open version, ZeroTier provides a similar kind of seamless networking setup. I'm sure someone will implement an alternative to taildrop on top of it.

sneak• 5 years ago

ZeroTier isn't open source / free software, it's only source-available.

https://github.com/zerotier/ZeroTierOne/blob/master/LICENSE....

I'm personally really tired of fake open source projects like this.

apenwarr9• 5 years ago

There’s an open source project called headscale (not written by or officially supported by tailscale’s team, but we like it) which you can point tailscale’s clients at. Then your whole system is open source. You can also avoid using a central IdP that way, if that’s what you want. (I strongly recommend caution about that, if you want good security. I know it’s not popular to say so on HN, but most people running their own IdP will do it less securely than one of the big providers. It’s a very hard job, akin to running a root CA.)

inigojonesguy• 5 years ago

There’s an open source project called headscale

This? https://github.com/juanfont/headscale

ptman3• 5 years ago

Also check out https://github.com/tonarino/innernet

mikevm5• 5 years ago

Did Tailscale introduce any security measures to their Coordination Server? Last I checked the coordination server is basically controlled by them and they could easily just insert any of their own pubkeys and infiltrate your network.

Even supporting WireGuard's Share Secret feature would be a start.

As long as that's not addressed, not a chance in hell I'm going to deploy this.

iFreilicht• 5 years ago

You can host your own coordination server, right?

mikevm5• 5 years ago

Last I checked you cannot.

kawsper• 5 years ago

I have been looking for a more user-friendly setup for our company, we're currently using OpenVPN with Viscosity as a client.

Tailscale was on the list for services to check, but if what you say is true, then I will look elsewhere.

cpach• 5 years ago

It’s also possible to use Wireguard without Tailscale.

arthurcolle• 5 years ago

I highly recommend you check out ZeroTier. I've found WireGuard setup to be non-trivial and extremely error-prone, but with ZeroTier there's a web UI that you can add new services and machines from, all as one logical "network"

I believe that the free tier is capable of running clusters of up to 50 machines. Really nice to use + truly trivial to set up.

mananaysiempre2• 5 years ago

For a FOSS solution (now that ZeroTier no longer is one), there’s Nebula, but you’ll have to operate your own central node. That’s nothing compared to maintaining the hell that is IPsec or even OpenVPN, though.

Even bare Wireguard is a joy to set up, to my endless surprise, if you’re fine administering things as a traditional small-scale LAN, manual routing and all.

api3• 5 years ago

You can self host ZeroTier controllers, which are the things that control network access. See the controller subfolder of github.com/zerotier/ZeroTierOne.

Roots in ZeroTier are harder to self host right now (it’s getting easier in the future) but they are just dumb STUN/TURN equivalents. They have no power to grant access and can’t even see what networks you join or what you are doing.

gilbertbw• 5 years ago

For large deployments Tailscale does offer self hosting the coordination server, see https://forum.tailscale.com/t/secure-way-to-use-tailscale-wi...

ukj4• 5 years ago

Ahhh, the illusion of control. The fine line between prudence and paranoia.

Do you also manufacture your own silicon in fear of being owned by your hardware vendors?

Write all your own software?

In fear of being owned by zero days in open source?

antonvs• 5 years ago

Those aren't really comparable situations to an externally hosted "coordination server" which explicitly allows a third party to control access to your internal networks.

Security breaches happen every day, with serious consequences. These are real threats, and there are ways to mitigate against them.

A target like that coordination server is particularly risky because, as we saw with the massive Solarwinds attack, attackers will look for and expend effort to compromise the most attractive targets, and that's a particularly juicy one.

Dismissing such threats with false equivalences is a pretty good way to find yourself on the wrong side of a security breach.

abss• 5 years ago

For the taildrop author: I could see potential on this to be used in the enterprise blockchain area with a condition: make it easy to setup a virtual network in wich each member is manually approving public keys of the consortium members. Working with docker/kubernetes will also be good. Contact me (taildropfromhn at axiologic.net) if you want details. We will love to use such a VPN setup in a real blockchain project for pharma industry.

For others: therr others that will appreciate the better security offered by using public key cryptography while still having a lightwight but decentralised setup?

apenwarr9• 5 years ago

You might like the Tailscale Machine Key approval feature. If enabled for your domain, no device can join your tailscale network unless they’re manually approved by your network’s admin or the API.

tyingq3• 5 years ago

I wonder how uneasy this sort of nicely documented and packaged user-space networking and nat traversal is making IT admins. It seems like it's pretty easy to, for example, create an internet facing service that pulls from internal company data sources. With user-space tunnels that probably aren't very easy to find from the IT admin perspective.

I get that Tailscale didn't invent this capability, but they do a nice job of showing how it would work, some of the pieces (wireguard-go), and so on.

They do seem aware: https://github.com/tailscale/tailscale/issues/204

_joel• 5 years ago

I wish tailscale would offer auth that isn't tied to the big SSO providers.

ptman3• 5 years ago

Innernet is an open source alternative to tailscale https://github.com/tonarino/innernet . Since this feature was so easy I imagine someone could pretty easily add it as a PR

jokethrowaway• 5 years ago

Isn't this basically magic-wormhole?

You can also achieve something similar with WebRTC in any browser and "zero" dependencies.

psanford• 5 years ago

Not really. Magic-Wormhole's primary use case is for when you don't already have an existing secure channel between two computers. That's why Magic-Wormhole uses a PAKE, which gives you a way to easily authenticate and exchange keys without any other pre-existing trust between systems.

If you have tailscale installed on your machines you already have a secure communication channel available to you.

Taildrop was kind of easy

Related Stories