pot8n

The real raison d'etre with these new wave of commercial NoVPN products like this one and Tailscale is to build a high margin SaaS business without really having the infrastructure liabilities of SaaS businesses. The problem with these kinds of products is that they are, from a security perspective, a disaster. Not only your entire network is compromised if they get hacked or if even they want to get into your network whenever they want which is an unlimited power I've never seen in any SaaS product, also your network becomes prisoner to their services, so if their services go down for any reason, you and everyone in your network will be unable to connect to your network even if it's perfectly working.

At least Twingate doesn't try to do sanke oil advertising like Tailscale and sells itself as an "open source" (go have a look at their Github open issues, it's a complete disaster) while it is not. Also the other thing is, if you have a relatively small company of 50 people you will end up actually paying MORE than those seemingly overpriced yet established products like Zscaler ZPA.

For me, the only serious alternative to expensive products like ZPA are Zerotier and Pritunl. They are as transparent as open source yet still viable as businesses without being greedy or captive to VC money to extract every single dollar out of you.

Thank you for this addon. Google should have done this 20 years ago.

Don't forget Stackshare. One of the most disgusting tech spam websites of all time.

Usually job listing, SEO, web crawling, VPN and many other very low-barrier-to-entry companies are founded and run by the worst and most contemptible of all people. Dude, it's like a pattern!

You just made learning Zig on my todo list. Thanks :D

Rust is awesome and very eye opening and it's a great alternative for almost any Golang use case, I just hope they prioritize enhancing compilation times if possible.

I am sure I wouldn't use a service that can literally get into each and every device of my private network if they want to or worse, they get hacked. Each and every device in the network automatically accepts whatever public keys and endpoints that get advertised by their servers and automatically connect to them. It's not only an overpriced mediocre product. From a security perspective, it's the most dangerous SaaS service I've ever seen.

My biggest fear is once this company gets tied to WireGuard and the security disasters come out, WireGuard's fate will be tied to a mediocre commercial product that put money above engineering decisions.

eBPF

I was just going to post it. I am unable to work currently because of it.

Joe "Spotify doesn't make any sense" Rogan

HN trending expectations: how eBPF works

HN trending reality: How I make a zillion dollars a day with a yet another SEO/web scraping/reselling domains business

And I thought Coronavirus would end that kind of deals.

Golang didn't succeed because it is simple or powerful or any of the, I apologize, nonsense your hear from the Gophers. Golang succeeded because it was the only available relevant option and alternative to the aging Python and Java when the cloud took off in the early 2010s.

Keybase went from ranking 30,000 to 65,000 in 3 months. What happened here? It seems like Keybase has been falling in traffic already for the past 3 months and it's reputations has been tarnished in HN for months now.

https://www.alexa.com/siteinfo/keybase.io

I've already been using VSCode remote over SSH on cheap yet powerful Hetzner instances. You can do this on any cloud vendor and you can, if you want, put your home directory as a volume and resize up and down your machine as you want.

No, I haven't but your service is making it literally impossible to browse with Firefox and Tor (understandably because you're here to make money from your customers labeling people like me as a threat in their dashboards not to enable people to actually browse easily). Even reCAPTCHA doesn't do that.

It's way worse than Google's for me. I am using Firefox and I don't even try anymore whenever get exposed to it on any Cloudflare website.

Seriously who cares about i386 in 2020?

I am still amazed that anybody can still make any money in the very low barrier-to-entry business of SEO. Probably the quote of Einstein on human stupidity is literally correct after all. Especially after I fell for the click-baity failory posts again.

Isn't the multi-cloud problem mainly based on the CNI? if the CNI is encrypting the traffic between nodes then you can easily join the cluster from any vendor, correct?

I am not really sure you understand how it works. There is no hosted/not hosted versions of it. You must connect your "opensource" client/agent through their coordination servers hosted by them to host and publish the public key to the other devices in your network and you can not skip their service. So Tailscale is effectively as opensource as any commercial opensource VPN client. It's entirely useless when not used with their commercial service and users have zero control over the software unless when used with their servers. The "open source" thing is great from a marketing and business perspective because you basically benefit from the open source marketing and the community thing from the unsuspecting users and enthusiasts pros without giving away literally anything.

Yes, I think most DPIs and Firewalls these days terminate the connections after the ClientHello message which contains the SNI

I've been using Tmux for years now when sshing to servers and I still can't even make some copy-paste with my mouse.

Honestly that's the least of all problems and catastrophes of Tailscale. You must have 1000% of confidence in their own servers security, if the published public keys hosted on their servers have been tampered then the entire network is compromised. Also, if their service is down, you will be unable to connect to your network even if it is completely fine and working.

Replaced Wireguard with Tailscale

facepalm

So you replaced FOSS Wireguard with a rebranded yet paid Wireguard service? Also how is NodePort is considered "internal" service? The whole point of NodePort is to be accessed from outside the cluster which can be easily done with the real Wireguard.