Tailscale raises $100M

Tailscale has a fantastic product, I’ve been extremely happy from day one. If you’re waiting for a weekend to have a few hours to try out Tailscale, don’t, it takes 15 minutes to get every device you own up and running and talking. This is the lowest friction personal VPN to ever exist, and once you see how easy it is for your own devices, you’ll wish you had it at work.<p>The biggest risk that this company has is that Cloudflare (in all reality) should just buy them or reimplement it. It’s the type of product cloudflare would make, that’s for sure. Being based on open source wireguard, and being just a STUN&#x2F;TURN server at its core… I’m sure that Tailscale will be the first but maybe not the best.<p>I’ve been dreaming lately of a tor-like network that’s based loosely on the idea of tailnets. Rather than blockchain bullshit, you’d have a direct ring of trust with friends, and then you could set up access policies to forward packets for people you don’t trust, but who know someone you do trust.<p>Web3 happens when people can host stuff on their phones, and Tailscale is something that lets you host things on your phone.

With such a huge investment comes the obligation to eventually pay it back. Is this another one of my favourite tools going the way of Dropbox, 1Password and all other companies that were formed around what should be a platform feature, which took on way too large investment sums and were eventually forced to become the everything, losing sight of their core values?<p>I sincerely hope not, but there&#x27;s so much bad precedent.

For anyone else who wonders wtf tailscale is:<p>&gt; Tailscale is a VPN service that makes the devices and applications you own accessible anywhere in the world, securely and effortlessly. It enables encrypted point-to-point connections using the open source WireGuard protocol, which means only devices on your private network can communicate with each other.<p>It seems to take care of key distribution, nat-traversal, authentication etc etc<p>Neat! No sure how that is &#x27;fixing internet&#x27; exactly, but really cool anyway

Tailscale is my favorite (product) discovery of 2022. I initially set it up to use as a VPN to get around a misbehaving corporate firewall and accidentally realized it solved a whole bunch of other problems I didn&#x27;t realize I had. Usually a new product doesn&#x27;t even live up to the intended use case and so TS is really anomalous IMHO in how good it is.<p>- SSH&#x27;ing into a raspberry pi I have at home that does random IoT stuff.<p>- Accessing servers on my local dev machine from other devices for testing (i.e. a Windows box or phone)<p>- Giving access to production bastion devices without publicly exposing anything to the internet.<p>And best of all I don&#x27;t have to fiddle with the usual networking stuff. It just works. Kudos on the raise!<p>Non-disclaimer: I have no relation to anyone on the team. Tailscale is just a delight to use.

Funding scares me. It bring sharks onboard who do not share the same vision. They will demand revenue and ROI above all else. I like Tailscale but I hate this business model down to the core (Netlify as an example). Tailscale was doing fine as it was, capable people there already. It quickly became an &quot;exit type of business&quot;, too quickly.<p>These companies usually bring something really easy to use, let people onboard and modify their network&#x2F;DNS&#x2F;etc to hell until they get vendor stuck and then they squeeze every possible dollar out of their pockets. Once you&#x27;re in, after days or weeks of fine tuning, after you managed to pollute your codebase with their configs and IP addresses, it&#x27;s hard to get out.<p>I suspect those &quot;free slots&quot; will change soon ,but we won&#x27;t see those types of graphs anywhere soon and be prepared to get charged for bandwidth and everything else possible.

I was going to try TailScale but then it seemed the only option to do so as an individual was to login with a 3rd party cloud provider, which I in no way want tied into my networks.<p>I gave up and just setup wireguard directly instead, I don&#x27;t trust Tailscale either if that&#x27;s their attitude towards privacy, it&#x27;s permanently marred my vision of their product.

We love Tailscale. Everyone employee has it, and we use it to provide access to dev, staging, and prod environments as well.<p>Fun little thing we did with it: nobody can access the prod network without requesting access via a Slack bot (powered by <a href="https:&#x2F;&#x2F;indent.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;indent.com&#x2F;</a>). So somebody requests access, another authorized person approves it, and the Tailscale ACLs are updated for X minutes and then reset.<p>Access to secure environments is super low friction but more secure (with fantastic audit trails) than ever.

As the founder of what some say is a competitor (ZeroTier) I&#x27;d like to congratulate the Tailscale team. We don&#x27;t really see Tailscale as the competition. We see the competition as:<p>(1) The old school castle and moat IT model that dominates at 99% of companies. If we can disrupt this then TS, ZT, and four other upstarts could all become billion dollar companies. Right now 1-2% of this market has been disrupted at most.<p>(2) The put everything in the cloud and everyone gets a thin client model. If that wins then <i>all</i> of us lose because there is no market for endpoint connectivity. We also lose all privacy, all data ownership, and all ability to experiment or innovate without paying for it by the instance-hour with TOS-enforcement bots looking over our shoulder.

&gt; For people who believe there’s a catch — and most still do — then I don’t know how to write a blog post or hire a marketing or sales team to change their minds.<p>I think the catch is that (at least at the free level) one must trust an identity providers. For many companies that&#x27;s probably fair enough, but for high-security companies and private individuals one absolutely cannot trust anything running outside of one&#x27;s physical control. Service providers can be suborned, either legally by corrupt regimes or illegally by employees. There is no way that I would permit Google, Microsoft or GitHub (their three supported options) to gate access to my private devices.<p>I <i>think</i> that one must also trust Tailscale themselves, although I could be wrong about that.

Tailscale&#x27;s CEO has been tweeting a series of &quot;rejected headlines&quot; for their fundraising announcement. They&#x27;re pretty funny. I thought the HN crowd would like this one:<p>&gt; Tailscale raises $100M to do what any Hacker News reader could have done in a weekend [0]<p>[0] <a href="https:&#x2F;&#x2F;twitter.com&#x2F;apenwarr&#x2F;status&#x2F;1521873453921583105?cxt=HHwWgoC-4fr1454qAAAA" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;apenwarr&#x2F;status&#x2F;1521873453921583105?cxt=...</a>

I read almost all of TFA (started to jump paragraphs near the end) and still couldn&#x27;t figure out what it was or did, even after being told, repeatedly, that they &quot;make easy things easy&quot;.<p>Apparently, it&#x27;s a VPN.

Nice charts without axes. I use those all the time. Especially in pitch decks.

For almost a decade I have worked with IPsec and OpenVPN solutions for both client and site-to-site VPN tunnels. On enterprise hardware, community&#x2F;proprietary software and at public cloud providers. I still work with these because today many vendors only support IPsec.<p>A few years ago I discovered WireGuard and I was really amazed how easy it was to setup a tunnel. Especially if you&#x27;ve dealt with IPsec before. It felt as easy as creating an SSH tunnel between two servers, with only 4 or 5 lines of code in a config on both sides.<p>Then last year I discovered Tailscale and I was blown away! How did this even work[1] without opening ports in the firewall? And how cool is it that I no longer have overlapping addresses[2] from other networks. Within 15 minutes I had my own mesh network between my Mac, iPhone, Raspberry Pi and other servers. Fantastic!<p>I&#x27;m on the Personal&#x2F;Free plan but if this would no longer be free, I would be happy to pay for this service (shut up and take my money).<p>[1] <a href="https:&#x2F;&#x2F;tailscale.com&#x2F;blog&#x2F;how-tailscale-works&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tailscale.com&#x2F;blog&#x2F;how-tailscale-works&#x2F;</a><p>[2] <a href="https:&#x2F;&#x2F;tailscale.com&#x2F;kb&#x2F;1015&#x2F;100.x-addresses&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tailscale.com&#x2F;kb&#x2F;1015&#x2F;100.x-addresses&#x2F;</a>

There is another interesting company in this space- Netmaker[0]. It&#x27;s been getting a lot of traction in the homelab space- namely because it takes advantage of kernel wireguard, which is more performant than the userspace wireguard that tailscale uses.<p>[0] - <a href="https:&#x2F;&#x2F;www.netmaker.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.netmaker.org&#x2F;</a>

&gt; We’re here to fix the Internet<p>That&#x27;s such a broad &quot;mission statement&quot; that I wonder if it&#x27;s effective at all. I mean, what SaaS wouldn&#x27;t say that they fix something with the internet? That&#x27;s to whole reason for online businesses solving one or another problem.<p>How could that statement help them guide their implementations of various solutions?

There exists ZeroTier too, which can be self-hosted.<p>[1]: <a href="https:&#x2F;&#x2F;www.zerotier.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.zerotier.com&#x2F;</a>

If you run a Kubernetes cluster for self-hosting software or development I highly recommend setting up a Tailscale subnet router [1]. This will allow you to access any IP (pods or services) in your cluster from any of your Tailscale-connected computers. You can even configure Tailscale DNS to point to the DNS server in your cluster to connect using the service names directly ie. <a href="http:&#x2F;&#x2F;my-service.namespace.svc.cluster.local" rel="nofollow">http:&#x2F;&#x2F;my-service.namespace.svc.cluster.local</a><p>[1] <a href="https:&#x2F;&#x2F;tailscale.com&#x2F;kb&#x2F;1185&#x2F;kubernetes&#x2F;#subnet-router" rel="nofollow">https:&#x2F;&#x2F;tailscale.com&#x2F;kb&#x2F;1185&#x2F;kubernetes&#x2F;#subnet-router</a>

I&#x27;ve tried Tailscale recently after reading all the raving reviews here on HN. The service is very easy to install and the apps are nice to use, everything is just very well done.<p>However, I just don&#x27;t see much difference from my vanilla Wireguard setup. Granted, my use case is very simple, just connect a few devices at home and in the cloud into a single network and use one of them as an exit node, but I&#x27;m still not sure what would make me prefer Tailscale over Wireguard.<p>So far the biggest difference has been that it makes me use an external identity provider instead of having to manually exchange keys between devices, and I&#x27;m not sure I&#x27;m very comfortable with that.

Started using Tailscale the other week and it just blew my mind.<p>But: Now that they have more money, I just wish they could spend some time making it enterprisey and not hobbyist-ey.<p>Things like: improve all the screens with high-density modes so we can filter thousands of devices, not hundreds. And make it integrate better with Windows Intune for hands-free deployment i.e. if we&#x27;re a Hybrid 365 environment, please detect the users credentials from their Windows install and login automatically. Maybe release an installer for enterprise deployment that silently downloads and installs the latest version so that we can i.e. integrate it into a Windows Autopilot unboxing experience.

Unfortunately despite claiming that they would, they&#x27;ve never allowed their iOS application to allow configuration of the control server (every other client they have released does). Maybe some more funding will allow them to focus on the client quality.

&quot;To paraphrase Larry Wall, Tailscale makes easy things easy&quot; .. Indeed, I run multiple devices via two regionally separated homes and two cheap VPS&#x27;s .. RaspberryPi, Linux, MacOS and an iPhone all able to communicate effortlessly thanks to TS

Things I’m really looking forward to seeing from Tailscale &#x2F; projects I’d like to tinker with:<p>- Better iOS battery life, there have been many improvements but it’s still too much to leave running 24&#x2F;7, I understand they’re making improvements here<p>- Their in built SSH server which seems to be in development<p>- Using Tailscale ACLs to control access to Kubernetes ingress resources, they recently released an nginx auth plugin so I imagine this is now possible if you attach a Tailscale sidecar to the nginx ingress controller<p>- Arbitrary ACLs which also seem to be in progress, it would be awesome to define in ACLs who has access to different parts of e.g a backoffice application<p>- Official support for DNS extra records, already using this with the Headscale self hosted control plane for personal projects but it would be great to use it on Tailscale too<p>- Kernel Wireguard for the data plane, I think this is on the roadmap?<p>Overall a fantastic piece of software which I use for both personal and professional projects.

&gt; Gets $100M investment<p>&gt; Still produces graphs without axis labels

I know it was supposed to be a funny throwaway line, but I am irked by the &quot;with $100 million you could interrupt the Super Bowl for 7 full minutes.&quot; That&#x27;s not how sports advertising runs works. You are bidding on a limited amount of space determined by the game. I think there is also a non-linear cost.

Excuse my ignorance but this is something I have been longing to ask for. Do these services compromise security? Wouldn&#x27;t you put too much trust on these services, like 1Password. If that service is compromised in someway aren&#x27;t you exposed? Is these a good article debate on this topic. Thanks.

I remember reading a previous HN post about Tailscale and a certain commenter said that Tailscale is ideologically driven, small-scale operation and they prefer an alternative like NetMaker which has more backing.<p>$100M seems more than a small-scale operation or is $100M in tech actually small scale?

Congratulations to Tailscale. Imagine how many times you can migrate to a new novel database architecture with that kind of money.

Tailscale is absolutely amazing for accessing local first platforms (like home assistant and jellyfin). Sure, I can set up wireguard, but Tailscale is plug in play. Biggest gripe is that it messes with my DNS like nextDNS on iOS.

They are open source too: <a href="https:&#x2F;&#x2F;github.com&#x2F;tailscale&#x2F;tailscale" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tailscale&#x2F;tailscale</a><p>edit: Only the client is open source. See clarification below.

I guess their biggest competitor will be Cloudflare Tunnels with Access, which does the same thing and more, for free.

As I’ve said in a past thread for another product (oxide), I LOVE Tailscale and am really happy for the team for their well earned growth and success.<p>However this is the path that could move them towards being pressured to add a bunch of bloat, followed by acquisition pressure and a big payout that will likely eventually cause the product to stagnate after the founding team leaves and the buyers don&#x27;t care.<p>I really hope they’re all already rich enough that they aren’t tempted by that. :-)<p>Update: altered content to add more speculative version.

Great product. One of the very few that &quot;just works&quot; and &quot;gets better all the time&quot;.

Tailscale is one of the products I most love. It does what I want it to do. I don&#x27;t have to think about it after that.<p>If all tools were this reasonable, I&#x27;d be very happy.

I love tailscale.<p>Lately I have been migrating all my self-hosted stuff into a raspberry pi (instead of running a public instance in the cloud). It gives me a bit of piece of mind knowing that it adds an extra layer of security (to hit any of my endpoints&#x2F;apps you would need to infiltrate my VPN). And it will save me a lot of money on hosting.<p>I don&#x27;t need to expose my computers publicly or enable upnp or anything. It just works.

&quot; What if we all just had a static IP address, and a DNS name? …and the address migrated around the world with you? …and you could connect to any of your devices no matter where they were? …and it was always encrypted? …and there was always a correctly configured firewall? …and you never had to worry about certificates? …and every device in your organization was tied to a user identity and SSO and MFA? …and all this just happened automatically? &quot;<p>So why do people care about that?<p>Those all seem like positive things but they are in and of themselves, not value creating.<p>From this article and even their landing page ... I think they might need an explanation that makes more sense than IT&#x2F;Networking Admin.<p>Even as a developer, I don&#x27;t quite see the obvious benefit.<p>Instead of taking about &#x27;what if you could have this tech that does ABC&#x27; - instead, talk about it in terms of problems &#x27;what if you didn&#x27;t have this problem or that one&#x27;. etc..

I couldn&#x27;t readily find any mention of any third-party security audits.<p>Compare that to the numerous audits a VPN like Mullvad has had - <a href="https:&#x2F;&#x2F;mullvad.net&#x2F;en&#x2F;blog&#x2F;tag&#x2F;audits&#x2F;" rel="nofollow">https:&#x2F;&#x2F;mullvad.net&#x2F;en&#x2F;blog&#x2F;tag&#x2F;audits&#x2F;</a>.

From their privacy policy: &gt; The personal information we collect, use, and disclose includes business contact information such as names, job titles, and company email addresses, as well as information about individual devices (such as device hardware and operating system) and aggregated usage statistics (such as amount of data transmitted in a period of time).<p>&gt; Your personal information will be transferred ... to certain third parties that provide services on our behalf.<p>&gt; We use service providers to provide services such as ... data analysis to better understand and improve product and website usage, and providing advertising and marketing services.<p>:&#x2F;

I&#x27;m trying to connect Tailscale&#x27;s product with their goal &quot;The internal dashboard and CI system that will never need to be public-facing. The HR database that will always have far less than a thousand queries per second. The dozens or hundreds of devs that ssh or RDP into servers, not the millions of users being served.&quot;<p>Does this mean - instead of deploying a dashboard&#x2F;ci to aws, I should host it &quot;locally&quot; on a single computer (macbook, raspberry pi) and then internal employees can access that site via Tailscale&#x27;s network layer?

What&#x27;s the state of affairs when it comes to self-hosting?<p>I&#x27;m waiting to deploy either Nebula, ZeroTier, or Tailscale, but we don&#x27;t want to rely on third parties for auth or coordination.

&gt; <i>We&#x27;ve raised $100M in a Series B financing led by CRV and Insight Partners</i><p>I see they are staying away from a16z ;)<p>&gt; <i>We don&#x27;t want to put revenue ahead of quality, because our stats say quality is where all our growth comes from.</i><p>Dr. Deming shining through here [0], but really, even this 1986 article paints a neat little picture of how I presume tailscale&#x27;s operating at the moment: <a href="https:&#x2F;&#x2F;hbr.org&#x2F;1986&#x2F;01&#x2F;the-new-new-product-development-game" rel="nofollow">https:&#x2F;&#x2F;hbr.org&#x2F;1986&#x2F;01&#x2F;the-new-new-product-development-game</a><p>&gt; <i>How, Avery, on earth, are you all planning to spend one hundred million dollars?</i><p>Wireguard platinum sponsorship in 3, 2, 1...?<p>&gt; <i>Now I just tell people: We&#x27;re here to fix the Internet. If we don&#x27;t, who will?</i><p>I called this a year ago, as it was pretty evident to me even then (downvotes notwithstanding), but I&#x27;d not be surprised if tailscale became a ISP someday, given their holistic approach to product development: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26249199" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=26249199</a> But hey, there are many more people working to <i>fix the internet</i>... including tailscale clones and other over-funded&#x2F;under-funded developers, which brings me to...<p>&gt; <i>I mean, imagine. What if the Internet just worked like it was supposed to? [and goes on to list e2ee + Mobile IP + SSO + DDNS + NAT Traversal]</i><p>If you squint just enough, it reads like the <i>MASQUE</i> protocol (built atop <i>QUIC</i>) that Google, Apple, Cloudflare are working to standardize: <a href="https:&#x2F;&#x2F;ietf-wg-masque.github.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ietf-wg-masque.github.io&#x2F;</a><p>That said, in time, I see tailscale not only compete with Zscaler, but also with Tanium, Cloudflare, CrowdStrike, F5, Palo Alto Networks and the likes. Once they are embed in an enterprise&#x27; network, there&#x27;s very little their product couldn&#x27;t expand into to make other SaaS &#x2F; solutions obsolete.<p>[0] <i>Systems thinking and Deming</i>, <a href="https:&#x2F;&#x2F;archive.is&#x2F;tXJhw" rel="nofollow">https:&#x2F;&#x2F;archive.is&#x2F;tXJhw</a>

Am I the only one that has an issue with a VPN that I can&#x27;t self host? Presumably if Tailscale get&#x27;s PWN&#x27;d or subpoenaed then your network is breached no?

Every time I&#x27;ve looked at setting up distributed VPN I&#x27;ve wanted layer 2, I haven&#x27;t used WireGuard yet but apparently it&#x27;s layer 3. I would love to be able to connect remotely and have my newly connected machine act like just another machine on the LAN. That in turn makes all kinds of other network-related operations simpler and homogeneous, in that the remote property of the connected machine(s) is abstracted away.

How does it work for something like a security DVR where you can’t access the system itself? Is there an equivalent way to just access the network like a VPN?

It sounds similar to what hamachi <i>could</i> have been if it was really invested in product management &amp; enterprise features.

Ive been using Tailscale for my local machines for a month or so now. don&#x27;t really have any complaints about them.

Crazy how people can raise these sums of money, it&#x27;s all about who you know.<p>I also notice they have a careers page so I had a gander. A 6 stage interview process! Good lord tech companies really have gone down the shitter

Every time I refresh my feed I read about another company raising tens of $millions.<p>A lot of that is Crypto related, but money seems to be absolutely flooding into tech at the moment despite all of the doom and gloom around

Avery is an incredible founder. Met him just once in 2013 (maybe? He was at Google I think), had him mentioned perhaps a dozen times by various folks in the industry, always in absolutely fantastic terms.

I&#x27;m a huge fan of Tailscale and the team I work with uses it daily, for free, to connect to our servers and each other&#x27;s computers. Thanks!

First - congratulations! I like the idea behind your product. Easily configured VPN tunnels are something I enjoy having.<p>But, and I&#x27;m probably just shouting into the void at this point, relying upon your network being secured as a method of securing your office&#x2F;product will only result in heartache.<p>If you&#x27;re a company SEO or similar trying to protect your company from threats, your first assumption <i>must</i> be &quot;the network is compromised&quot; no matter whether it&#x27;s on the internet, or VPN tunnels, or firewalled local network.

&gt;To put the market in perspective, there are VPNs that only work if [...] UDP isn’t blocked<p>isn&#x27;t that true with WireGuard&#x2F;Tailscale too?

Netskope &#x2F; Zavala’s &#x2F; Cisco Umbrella DNS proxy server VPN with a free personal level?

Congrats1 solid productg, good interface, great positioning towards the enterpise

The fact that money got involved in this means it&#x27;s already a privacy risk.

Would love to work for Tailscale but the openings are limited to US and Canada.

i wanted to to use tailscale really bad, but since you cannot login without the given choices they provide, i am not sure any security minded person would mind using it.<p>i rolled my own with a simple vps, a haproxy and ansible.

Crap... is this literally the product I&#x27;ve been MVPing the past few weeks? (<a href="https:&#x2F;&#x2F;kurynt.com" rel="nofollow">https:&#x2F;&#x2F;kurynt.com</a>) - or do I still have a chance?<p>Full disclosure - there is little to no functionality yet, but the homepage is enough

If I was Cloudflare, I&#x27;d have bought Tailscale long ago!

I bet they will get acquired by Cloudflare. If they reject their offer then Cloudflare will kill them.<p>Sorry.

“To fix the internet”<p>I really wish we could get some clear copy on what that means in a title.

So it&#x27;s a way around any firewall and security? Interesting.

Another day, another overly hyperbolic press rele.... er, blog post<p>Le sigh...<p>Let&#x27;s make tech boring and demure again!

I have heard of but never really looked in to Tailscale until today. I&#x27;m not impressed.<p>&quot;Fixing the Internet&quot; is not done by layering more private network garbage on top of it.<p>Their claim[0] that after you install Tailscale on all your devices: &quot;This final configuration is called &#x27;zero trust networking&#x27;,” is pretty interesting. It seems this would be more like having a trusted internal network (sure it is overlaid on an untrusted network). A true zero-trust network would mean all of your clients and servers are secure in a manner that they can operate on the public Internet...like O365, Salesforce, etc. To say that you run a zero-trust network because you implement a fancy VPN is C-suite dreaming at its finest.<p>&quot;get around a misbehaving corporate firewall&quot; like newhouseb sings praises for is exactly the sort of thing that should be happening less, and the opposite of &quot;fixing the Internet&quot;. Follow the policies of the network you are being allowed to use, or lobby for them the be fixed. Don&#x27;t like ISPs messing with DNS traffic? Get rules&#x2F;laws implemented that prohibit that, instead of garbage like hiding your DNS in DNS over HTTPS. (DNS over TLS seems more acceptable to me.)<p>[0] <a href="https:&#x2F;&#x2F;tailscale.com&#x2F;blog&#x2F;how-tailscale-works&#x2F;" rel="nofollow">https:&#x2F;&#x2F;tailscale.com&#x2F;blog&#x2F;how-tailscale-works&#x2F;</a>

This sounds just creepy that they are suggesting no more anonymity on the internet... as a &quot;fix&quot;.