Selfhosted

Friendly reminder that Tailscale is VC-funded and driving towards IPO

You know what's to come.

The answer to the question is immediately. Or switch to OpenZiti or Pangolin even.

What's the benefit over just WG?

If I host headscale on a VPS, is that as seamless of an experience as Tailscale? And would I miss out on features, like the Tailscale dashboard? How does the experience change for me (an admin type) and my users (non-technical types)?

Am I totally off-base in thinking that MagicDNS and pluggable DNS nameserver overrides are a huge feature of tailscale?

I love that I can refer to my tailnet devices just via their machine name. I use it everywhere. And also that I can just slot in my NextDNS ID so that any device running tailscale now automatically uses that, and I don’t have to mess with my shared router settings or per device settings. Is all that actually really easy to set up outside of tailscale? Cuz if it is and I just somehow missed that when doing all my research, I’ll happily give plain wireguard or other mesh orchestrators like NetBird a go.

And I already know that mDNS is not the answer. That protocol is simply not reliable enough.

I'm not that worried as there are alternatives like Netbird. The underlying tech really isn't hard to replicate since Wireguard is pretty standard.

I think it would be cool if Tailscale made it into the enterprise arena.

I think a lot of companies view their free plan as recruiting/advertising

if you use TailScale personally and have a great experience then you'll bring in business by advocating for it at work.

Of course it could go either way, and I don't rely on TailScale (it's my "backup" VPN to my home network)... we'll see, I guess.

pre-emptive pikachu face strike

I've realized how easy it is to just actually run a network rather than half ass it with tailscale. I recommend this, it's fun.

They also had a major ass security issue that a security company should not be able to get away with the other day: assuming everyone with access to an email domain trusts each other unless it's a known-to-them freemail address. And it was by design "to reduce friction".

I don't think a security company where an intentional decision like that can pass through design, development and review can make security products that are fit for purpose. This extends to their published client tooling as used by Headscale, and to some extent the Headscale maintainer hours contributed by Tailscale (which are significant and probably also the first thing to go if the company falls down the usual IPO enshittification).