Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Tool like this exposes big problem with the current shape of the Internet, I believe.

    Everything should be possible with just plain netcat and IP stack. Someone asks about NAT holepunching, encryption, static IDs, permissions, etc., yes this is what Internet lacks and why every P2P app reinvents it over and over again.

    by mrsssnake
  • notabug wontfix; that's the end-to-end principle in action. Bring your own all of that.
    by MajesticHobo2
  • This is smart. It's Magic Wormhole but for generalized connectivity, not just file transfer.
    by tptacek
  • Yes, though MW has the important distinction that it uses short human-readable session identifiers. This means MW supports file transfer where the out-of-band channel is just a phone call. This is also why it needs PAKE as opposed to the simpler cryptography used in tailcat
    by doomrobo
  • How much Tailscale is this still if the transport is based on wireguard, the control plane is something new with the keys based on the wireguard keys? Genuinely confused.
    by spockz
  • I think this is best described as a one-shot control plane, the single use address/key (same thing) is shared out of band, so it's far more minimal than the TS control plane.

    The examples show the concrete use cases... Basically giving you the wiregaurd + DERP quality tunnel but as a one shot point to point cli tool. Which is a nice upgrade from the alternative "in a pinch" tools.

    RE "how much tailscale" I guess it's the DERP bit + this minimal point to point control plane. Without which it's significantly more configuration to get the wiregaurd tunnel working, or impossible because of NAT, unless both machines are on the same ipv6 network.

    TS basically sell the full control plane with Auth and ACL style management etc as their product so this doesn't really compete.

    by tomxor
  • I dug into it a bit because I had the same question. The network layer here is wrapping around the Tailscale daemon's magicsock, which is the thing that does all the DERPing and NAT hole punching. Tailcat builds sort of a fake control plane that does a one way key exchange over DERP (the Meow message type) between client and server, then both sides do the normal CallMeMaybe dance to connect.
    by zrail
  • The Tor network and Onion protocols used to be used for this type of thing 10 or 15 years ago, exposing a home service with a .onion address and then gaining secure private access over the global internet infrastructure that way. But I haven't even seen any Tor related headlines for ages.
    by Schlagbohrer
  • Just yesterday I was complaining that I wanted to SSH back to my homenet while at the office, on my office (not home) tailnet. I wrote something based on Iroh to do this, but it's one shot (ie not particularly generalized). Might be able to throw it away or redesign it with some inspiration from this! Thanks.
    by aseipp
  • you could try rayfish.xyz, it is compatible with tailscale nowadays so you can run both tailscale and rayfish
    by dfish
  • you might be able to do it via iroh's dumbpipe
    by preisschild
  • why not try out some existing project already on top of iroh ?

    I see a bunch here on awesome-iroh page

    https://github.com/n0-computer/awesome-iroh

    by codegladiator
  • I solved this problem by building/running a custom tailscale client that connects to two tailnets at the same time (https://github.com/maisem/tailmix)
    by maisem
  • There's an example in the README how to do exactly that :)
    by bradfitz
  • I've spent time finally learning what tailscale is and how it works and I'm impressed. It's a rare thing in the technology world but I'm glad I finally took the time.

    I literally just figured out how tsnet fits into the picture (an in-process Go based entire network stack that gets the process to act as a node in the tailnet) and so that helps me understand this (everything in tsnet excepting the control plane). It's very impressive that they can do this in a reliable way.

    by stillpointlab
  • Peers might not want to use third party rendezvous servers or relay servers

    It appears that Tailscale attempts to persuade peers not to run own "DERP" servers (cf. encouraging peers to run own servers)

    "In general, you should not need to or want to run this code. The overwhelming majority of Tailscale users (both individuals and companies) do not."

    "Running your own DERP services requires exeprtise [sic] in multi-layer network and application diagnostics. As the DERP runs multiple protocols at multiple layers and is not a regular HTTP(s) server you will need expertise in correlative analysis to diagnose the most tricky problems. There is no "plain text" or "open" mode of operation for DERP."

    https://github.com/tailscale/tailscale/tree/main/cmd/derper

    Unclear why the company markets peer-to-peer networking but wants traffic going to their own third party servers

    In contrast, Nebula, another Go peer-to-peer project encourages peers to run their own rendezvous server ("lighthouse")

    https://github.com/slackhq/nebula

    "To set up a Nebula network, you'll need:

    2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse."

    The comparison to nc seems off. Original netcat has no required third party dependencies, no recommended third party dependencies, and not enough complexity to be linked to a company selling associated SaaS or consulting

    by 1vuio0pswjnm7
  • > Unclear why the company markets peer-to-peer networking but wants traffic going to their own third party servers

    At Tailscale, we do not _want_ traffic through our servers. What we do want is for Tailscale to Just Work without your needing to set up any infrastructure. That’s why we run the DERP relay network as a fallback of last resort, for when a direct connection is not possible. And the tailscaled client tries very hard to make that direct connection.

    If and only if you need to run your own infrastructure, then we provide peer relays which are significantly less onerous than running a DERP server: https://tailscale.com/docs/features/peer-relay

    This note exists in the README because people would assume that hosting a DERP server was a hard requirement for using Tailscale. Or they would assume that an production Tailscale network would eventually operate a DERP server. People who run their own DERP servers usually have data sovereignty or strict metadata requirements.

    by sfllaw
  • This is so cool! I mean, we really wouldn't need it if we had 100% ipv6 (no cgnat), but this is the next best thing. I think people underestimate the innovation that could happen if we had trivial p2p.
    by pbohun
  • It looks like a direct competitor for the recently launched bitbang-cli

    https://github.com/richlegrand/bitbang-cli

    by archietect
  • And IPv6.
    by fulafel
  • I enjoy that they supply a nix install/environment, similar to the main tailscale/tailscale repo. Is nix widespread or the standard dev environment at tailscale, or is it like a 10% option and most people just use Docker or whatever?
    by mikepurvis
  • I'd guess that there is an insignificant minority of people who strongly prefer nix over anything else.

    And it might be because it is easy to provide and maintain compared to a .deb package.

    by aerzen
  • When I was writing rust stuff a few years ago it seemed like nix was the hip cool thing all the up and coming rustaceans (mostly unemployed students trying to land faang jobs) were using. If you're not familiar with the rust community it's very different from other programming communities I've been in (python/go/ruby/etc). Almost felt like you'd be kicked out of their lunch table if you weren't using it, but I've only see it that ubiquitous there.

    A lot of them, instead of learning the usual linuxii you'll be using in containers at work dive headfirst into nix.

    by swozey
  • Loving this. Honestly I keep encouraging folks to just TRY native Nix for dev environments. So easy to set up and get value on day 1 that you'd be shocked. Also models/LLMs have made lightyear strides in the last few months to help with everything around it. We've been building up Nix based skill systems into our Flox skill and it's been super meaningful both on adoption and when we need to scale it up. (disclaimer I do Flox.dev which is Nix based and we do cool Nix stuff)
    by ronef
  • It's not our standard dev environment but some of us use Nix. We don't really use Docker much, though. Mostly just "go test" etc.
    by bradfitz
  • So this is somewhat similar to Iroh?

    https://github.com/n0-computer/iroh

    by megamorf
  • I'm a big fan of iroh, but I think iroh's holepunching algorithm is at least partly based on tailscale's, so it's not 100% accurate to say iroh got there first. (Just the "as a library without a control plane" bit.)
    by colinmarc
  • In particular:

    https://github.com/n0-computer/dumbpipe

    https://github.com/cablehead/pai-sho

    by genpfault
  • One fun use case: a coworker just whipped up this Minecraft mod using tailcat as its transport: https://github.com/tailscale/tailcat-for-minecraft

    (just a cute demo, not intended for release or ongoing maintenance)

    by bradfitz
  • It would be amazing to have something like this for bedrock so people with consoles without online subscriptions could join a self hosted bedrock mc server
    by awakeasleep