It would be amazing to have something like this for bedrock so people with consoles without online subscriptions could join a self hosted bedrock mc server
Maybe bc it completely sidesteps the question? I have a nephew who is 7yrs old who only has an iPad and i can play with him due to geysermc, which is the correct answer.
I run Bedrock even though we have hardware and licenses for everyone in the house - because I can use my iPad Pro with a controller, and my kids can do the same, and they play in the car all the time.
It has roughly the same features, much worse moddability, and better performance.
At some point it was a weaker clone, but it developed into a very high quality clone, and has graduated into being a co-production with the Java version.
Get a refund from wherever you got your facts.
I'll give you half a point for "iPad kids" since that term implies a lot of incorrect things but it does run on iPads.
When bedrock was announced I was sure Microsoft had won the os arms race and had everything they needed to make an impenetrable monopoly:
* They could make bedrock moddable using .net, and make it so basically every kid interested in programming learned .net
* They could then drop the Java version and get more control over the game with it being harder to mod in un-sanctioned ways while still enabling the content most people want from mods
* And gain a powerful platform they can use to treat Windows/Xbox players better.
* With everyone writing .net it makes more sense to use Windows to develop, effectively reducing the number of fresh developers with posix experience. Stopping the mass exodus to posix since the 2010s MacBook air sublime text nodejs days.
But alas. Microsoft are incompetent. Minecraft was THE tool to turn the future in their favour and they completely overlooked it.
Bedrock exists to make more money. They don't like the Java free modding. They want a marketplace. They want to make money off all content in the game. They want to sell DLC. Make no mistake, they aren't platforming modders to make money because they are charitable. It is because they want to profit, and they can profit at scale by outsourcing the work.
That is in my opinion why most people are against bedrock, including myself. Bedrock is capitalist Minecraft. Enshittified Minecraft, with much more enshittification potential not yet realized. Java version is the only thing protecting bedrock from not being milked further, because it is competition.
They know most people prefer Java. Content creators mostly use Java. But it sells bedrock, and bedrock makes money. And if they can get enough people over, they can kill Java and finally milk bedrock
Java edition is also proprietary, and I don't see what stops them from milking it. They did DCMA-takedown Bukkit and lock a ton of paid accounts out of the game, but nothing further. Like they could drop Mac/Linux support, and I'm surprised/relieved they didn't. Despite it being mostly Java, it does rely on some natives, but even if it didn't...
Its proprietary, but trivially decompileable. Sure, maybe if the game was released today they would try obfuscating better, but the thing is that modding culture had already basically torn the game apart by the time Microsoft came around. I don't think they had a choice but to accept the status quo.
There are mods to disable unwanted Microsoft-pushed features like chat signing, for example. Microsoft doesn't want this, but it is so trivial to do with the Java edition they don't really have a choice but to either accept it or legal it.
I am also surprised they didn't drop mac/linux support, but as long as maintaining it is free I don't think they will. They have lost a lot of market share to mac after all - that's a lot of customers to miss out on.
Ok I had to look this up because last time I did MC modding was when I was in high school... It used to be obfuscated. Someone used to manually map those to human-readable names (didn't know this back then and thought the names were somehow hidden in the bytecode). But recently MS has started deliberately shipping unobfuscated builds.
So I'm getting the feeling they actually want JE to be moddable. Which makes sense because they're already successfully pushing Bedrock on a majority who don't care about modding, especially on locked down platforms, and the remaining JE players are a different segment. But that could change just as easily as their leadership changes.
But also just realized, if this changed, rather than locking down JE, they'd probably just kill it and maaybe release Bedrock for Mac/Linux to keep those players. Possibly not.
For anyone confused about timelines, they started releasing un-obfuscated builds in 2025.
In 2019 they started releasing Obfuscation mappings.
Before that it was all Minecraft wizards with excellent tooling.
Sorry for the long wait, I wasn't ignoring you, just busy.
Yes, symbols were obfuscated, but Java software with obfuscated symbols is trivial to reverse, at least compared to its native counterparts. My understanding is that the biggest change when releasing symbols was that the MCP team no longer had to manually update symbols for every update. Java also has great reflection features that make it a lot easier to make mods - you don't need to patch binaries like you do with native code.
I think you are right in that Bedrock and JE players are different segments. I think the main goal of Bedrock is to target the casual market, maybe not by intention but by the fact that the community itself is mostly stuck on JE. I still think the long term wish is to get everyone over and kill Java, as Java inherently is less suited for the microtransaction model I am sure they want.
Then again with the rise of LLM-based RE, I guess the largest hurdle for modding bedrock is somewhat lower now, as you can automate a lot of the skill-heavy but not difficult work required.
> But also just realized, if this changed, rather than locking down JE, they'd probably just kill it and maaybe release Bedrock for Mac/Linux to keep those players. Possibly not.
none of the rust-based minecraft server have enough functionality implemented to use them for survival, maybe for some minigames but that's about it. Pumpkin has gotten far out of the many[1] but there's still lots to be done.
These game servers are really the perfect use case for agents. Would anyone really care that much about code quality if the server works fast and reliably?
The number of implementations and the lack of success suggest that it is a genuinely hard problem for humans, and "agents" are not going to magically make it simpler. Unlikely that humans abandoned their projects (or failed to band together) solely because of their desire for code quality.
https://github.com/n0-computer/pigeons offers the same but with SSH.
I use it in my homelab extensivelly for access, tunneling smb, postgres and some other minor bits.
I'm a big fan of iroh, but I think iroh's holepunching algorithm is at least partly based on tailscale's, so it's not 100% accurate to say iroh got there first. (Just the "as a library without a control plane" bit.)
I enjoy that they supply a nix install/environment, similar to the main tailscale/tailscale repo. Is nix widespread or the standard dev environment at tailscale, or is it like a 10% option and most people just use Docker or whatever?
Maintaining and providing a deb is pretty easy too; the real killer for a nix flake I think it's how dirt simple it is to provide infinite testing builds for different branches.
Well, for .deb there is the dependency problem. Even if your deb is just a release of a project, you can only use versions of dependencies that are in debian repository. Or include it all in your .deb, which becomes hard to maintain.
By "infinite branches" you probably mean that a nix derivation / flake is a recipe that can build any version of the project?
Yeah, Nix flakes can be a static URL path, but they inherit your VCS refs directly, so
nix run github:tailscale/tailcat
Gets you the default branch. Tailcat doesn't yet have any tags, but if you want a build of the main tailscale repo at a particular tag, it's just:
nix build github:tailscale/tailscale/v1.102.3
But because this can be any ref, you can specify an arbitrary branch or tag, so like if you're trying to get a colleague to check out your work it's as easy as:
nix run github:tailscale/tailcat/my-fancy-branch
And obviously a flake can reference other flakes with the same flexibility, so your home manager config or your company's private app flakes can transparently pull the not-yet-merged version of a change you're proposing upstream without having to make special internal "patched" releases with tortured 1.2.3~actually.1.4.6 type version numbers like in Debian. And of course that same flake reference policy applies all the way down, so you also don't need to worry about the private apt repo as a big piece of shared state that's going rev forward and break your older code branches or Dockerfiles, since each branch of your app flake has its own flake.nix and accompanying lockfile controlling which deps it is pinned to.
It really is an awfully nice system, and shockingly modern in its sensibilities considering how old the Nix fundamentals are.
When I was writing rust stuff a few years ago it seemed like nix was the hip cool thing all the up and coming rustaceans (mostly unemployed students trying to land faang jobs) were using. If you're not familiar with the rust community it's very different from other programming communities I've been in (python/go/ruby/etc). Almost felt like you'd be kicked out of their lunch table if you weren't using it, but I've only see it that ubiquitous there.
A lot of them, instead of learning the usual linuxii you'll be using in containers at work dive headfirst into nix.
Always makes me chuckle when there's this uncountably large group of people, and someone meets a handful of them and then decides they can make broad, sweeping statements about the entire group, despite having not met 99.99...% of them XD
I suspect some of this goes the other way too, that the people who see the value in Nix and/or are willing to tolerate its idiosyncrasies in exchange for what is on offer there are are a lot of the same kinds of folks likely to take an interest in rust, ocaml, elixir/gleam, etc.
Loving this. Honestly I keep encouraging folks to just TRY native Nix for dev environments. So easy to set up and get value on day 1 that you'd be shocked. Also models/LLMs have made lightyear strides in the last few months to help with everything around it. We've been building up Nix based skill systems into our Flox skill and it's been super meaningful both on adoption and when we need to scale it up. (disclaimer I do Flox.dev which is Nix based and we do cool Nix stuff)
Peers might not want to use third party rendezvous servers or relay servers
It appears that Tailscale attempts to persuade peers not to run own "DERP" servers (cf. encouraging peers to run own servers)
"In general, you should not need to or want to run this code. The overwhelming majority of Tailscale users (both individuals and companies) do not."
"Running your own DERP services requires exeprtise [sic] in multi-layer network and application diagnostics. As the DERP runs multiple protocols at multiple layers and is not a regular HTTP(s) server you will need expertise in correlative analysis to diagnose the most tricky problems. There is no "plain text" or "open" mode of operation for DERP."
2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse."
The comparison to nc seems off. Original netcat has no required third party dependencies, no recommended third party dependencies, and not enough complexity to be linked to a company selling associated SaaS or consulting
> Unclear why the company markets peer-to-peer networking but wants traffic going to their own third party servers
At Tailscale, we do not _want_ traffic through our servers. What we do want is for Tailscale to Just Work without your needing to set up any infrastructure. That’s why we run the DERP relay network as a fallback of last resort, for when a direct connection is not possible. And the tailscaled client tries very hard to make that direct connection.
If and only if you need to run your own infrastructure, then we provide peer relays which are significantly less onerous than running a DERP server: https://tailscale.com/docs/features/peer-relay
This note exists in the README because people would assume that hosting a DERP server was a hard requirement for using Tailscale. Or they would assume that an production Tailscale network would eventually operate a DERP server. People who run their own DERP servers usually have data sovereignty or strict metadata requirements.
This is so cool! I mean, we really wouldn't need it if we had 100% ipv6 (no cgnat), but this is the next best thing. I think people underestimate the innovation that could happen if we had trivial p2p.
I've spent time finally learning what tailscale is and how it works and I'm impressed. It's a rare thing in the technology world but I'm glad I finally took the time.
I literally just figured out how tsnet fits into the picture (an in-process Go based entire network stack that gets the process to act as a node in the tailnet) and so that helps me understand this (everything in tsnet excepting the control plane). It's very impressive that they can do this in a reliable way.
The Tor network and Onion protocols used to be used for this type of thing 10 or 15 years ago, exposing a home service with a .onion address and then gaining secure private access over the global internet infrastructure that way. But I haven't even seen any Tor related headlines for ages.
Just yesterday I was complaining that I wanted to SSH back to my homenet while at the office, on my office (not home) tailnet. I wrote something based on Iroh to do this, but it's one shot (ie not particularly generalized). Might be able to throw it away or redesign it with some inspiration from this! Thanks.
I was just wondering yesterday if it'd be possible to have a tailscale client, or multiple tailscale clients in their own network namespaces, that could connect to multiple networks.
The slightly tricky part would be managing a local NAT that blends the two networks, and also does MagicDNS to answer on those NATed IPs. If routes conflicted, I guess you'd have to pick one?
yeah that's kinda what it does. It sets up two tsnet servers connected to two different tailnets and exposes them through a shared TUN device. It does the magic of allocating safe IPs to each host so that they don't overlap and does some leasing so that IPs aren't accidentally reassigned. It also does the MagicDNS thing so that DNS returns the "effective IP".
I wanted it to work on macOS so couldn't rely on network namespaces.
How much Tailscale is this still if the transport is based on wireguard, the control plane is something new with the keys based on the wireguard keys? Genuinely confused.
I dug into it a bit because I had the same question. The network layer here is wrapping around the Tailscale daemon's magicsock, which is the thing that does all the DERPing and NAT hole punching. Tailcat builds sort of a fake control plane that does a one way key exchange over DERP (the Meow message type) between client and server, then both sides do the normal CallMeMaybe dance to connect.
I think this is best described as a one-shot control plane, the single use address/key (same thing) is shared out of band, so it's far more minimal than the TS control plane.
The examples show the concrete use cases... Basically giving you the wiregaurd + DERP quality tunnel but as a one shot point to point cli tool. Which is a nice upgrade from the alternative "in a pinch" tools.
RE "how much tailscale" I guess it's the DERP bit + this minimal point to point control plane. Without which it's significantly more configuration to get the wiregaurd tunnel working, or impossible because of NAT, unless both machines are on the same ipv6 network.
TS basically sell the full control plane with Auth and ACL style management etc as their product so this doesn't really compete.
Hello, i am building a open client-based platfrom that really fun, the whole system(js for now) once start then you can pick the target(friends?) to trust(oneway/equal), then users will sync inside the trust network, to make your app and eveyrthing up to date autoly, but the problem is the P2P isnt a way for 4G/5G user, i plugged IPFS stuff inside for, to let user can share their life like video just like internet but not a signle server, so i see Tailcat today i am thinking if i plug this inside, is that evil to you guys? you know i'am asian, our internet is going to Terminator skynet, i have finish a free,open, for everyone's working pure serverless system(but NAT problem)
Yes, though MW has the important distinction that it uses short human-readable session identifiers. This means MW supports file transfer where the out-of-band channel is just a phone call. This is also why it needs PAKE as opposed to the simpler cryptography used in tailcat
Not a huge lift to stick a PAKE in this protocol, though I'm dubious that it'd be much of a win. The PAKE + nameplate system in Wormhole makes a lot of sense, because you're doing one very specific thing with that system (moving a file from point A to point B). Here you're booting up servers; you're almost always going to have a non-voice channel to set up with.
You also don't want adversaries to be able to disrupt long-lived streams with bad password guesses, since I think part of Wormhole's security model is it will terminate the session if the other side gets it wrong.
Tool like this exposes big problem with the current shape of the Internet, I believe.
Everything should be possible with just plain netcat and IP stack. Someone asks about NAT holepunching, encryption, static IDs, permissions, etc., yes this is what Internet lacks and why every P2P app reinvents it over and over again.
A bit off topic: it’s just insane how I used to watch this guy’s http2 in Go yt video 10 years ago, and he’s still very relevant to this day!
Cheers Brad!
Is NAT traversal actually that big of a feature? The category of people that would use a tool like this already knows many ways to do it without NAT getting in the way.
Unless you have some kind of dynamic DNS with a background daemon, you'll be bothered by NAT eventually. And even then it's hardly as convenient. With Tailscale, I can sit on a rooftop bar in the Medina of Marrakech, connect my phone to the public WIFI, and access my laptop in the hotel WIFI across town. Or production infrastructure on a highly secured server somewhere on the other side of the planet. All without compromising security, and all devices involved just pick the shortest physical link to each other.
It's not a given that you always have some server without NAT in the way. Even if you do, it might bottleneck or add latency to the two ends trying to talk. I've been there.
If you ever connect over a mobile hotspot, then you need NAT traversal. And if you want something that "just works" across various network environments, you need NAT traversal.
WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc.
Idk? I found it pretty easy to configure by blindly following the tutorials and copy-pasting keys. The only footgun is the keepalive setting, which will screw up the tunnel if one end is behind NAT, that tripped me hard, but besides this, no issues at all.
IPSec may be a pain... but WireGuard is as simple as it gets in my opinion. Yeah, you may need to know basic IP concepts, like MTU...
NAT traversal is a different topic, WG won't help in that, and that can actually be a pain. I guess we should be using IPv6 already, and this tool would be largely redundant already. (not completely, encrypted access to isolated networks is a valid use case)
Even without NAT, the same hole punching techniques must be used for IPv6 since there is usually a firewall blocking inbound traffic. Only in CGNAT type scenarios where the network behind NAT is still "WAN" will be helped by IPv6.
WG is totally fine for home labs etc. But pushing configs to the server or networm when onboarding a new peer, making sure the new peer IP doesn't collide with someone else, etc. Can be quite annoying sometimes.
NAT is honestly smaller of an issue and rarely encountered, but it's useful for example to expose services on my laptop to my phone, kind of like ngrok. That can be quite hard on vanilla wireguard.
For me the biggest thing tailscale/netbird solves is still the automatic handling of the peers, acls, or in other words automating fireguard config.
always have! our darwin and windows clients are closed source, but they wrap the oss implementation in github.com/tailscale/tailscale and you can see and even use all the same hooks yourself.
the control plane is closed source, but headscale is an open source alternative that we embrace and encourage people to use if it meets their needs/desires
Looks dope, though I'm surprised, is Tailscale fine with their DERP servers being used by non-customers like this? (Yes, it's a Tailscale project, but doesn't require login.) I vaguely assumed there was an auth step before you could use one as a relay. They mention a rate limit, but still
being built a iroh based distributed notes app for myself use
and see tailcat come out, trying to replace iroh with this to do some experiment because i really love how tailscale works and invest much time to the stack
True appriciated of open source this, combine the tailscale open source client core with this, i think it can unlock more stuffs
I do use Tailscale myself to connect many of my devices. So I am a bit confused, what does this add over regular Tailscale? Excuse my lack of knowledge in this area.
I just set up Tailscale as I've been hosting more personal apps off a small Hetzner VM and wanted a really simple personal networking solution. Works great, would recommend.
It's really excellent. I've been using Tailscale for a number of years, just for my home network and with a single user, and the service is excellent, and the free tier is incredibly generous.
I'm hoping that my Mullvad subscription (through Tailscale) contributes a little bit at least. Two excellent companies.
I like that there is Headscale as an open-source offering too. I don't use it, but the fact that it exists makes me a lot more comfortable (similar to Bitwarden etc).
I've been making a mesh vpn like radmin vpn or hamachi that does not need a central authority server and most importantly, can run on all major OS thanks to wireguard-go.
Netbird is the more mature version of this: fully open-source, self-sufficient, works like a charm, supports reverse proxying out-of-the-box, and much more. No reason to ever return to the Tail family.
Half of the Software offering nowadays seems to be selling vendor lock-in at no added value and then making a profit.
Sure there's always some negligible added value, and then they reinvent a whole stack for their ecosystem. In the case of tailscale the added value seems to be avoiding going into your router and activating port forwarding? It looks like negative added value to me. Someone that tells you "don't do NAT traversal, just open a port" would be highly valuable, but saying no doesn't seem to be trendy, and is certainly not an easy sell.
There's no vendor lock-in here and no payment or account required. If Tailscale as a company fails, tailcat keeps working if you run your own DERP server. It's just open source code, not a hosted service.
Fwiw, I don't think vendor lock-in is a bad thing, but being open source doesn't mean there's no vendor-lock in. If a client builds their system on top of an open source technology, then switching away from that dependency would have a cost, even if that cost is engineering man-hours.
If tailscale does not work out of the box with netcat, and requires a custom additional dependency to work, it raises the question that tailscale will not work out of the box with other tools like tcpdump or stunnel and apache, and I will need to install other custom dependencies like taildump, tailtunned, tailapache.
When compared to other solutions that integrate without additional effort, installing vendor-specific dependency forks/clones means that there is an additional vendor lock-in.
This isn't due to tailscale not supporting or working with netcat; you can nc to an address on your tailnet just fine.
This is using the infrastructure tailscale set up for a different purpose. Rather than requiring a tailnet or even an account anywhere, you can tailcat between any two endpoint. Tailscale is there because it runs the DERP relays which get the client's pubkey to the server, brokers the connection, and coordinates holepunching.
It's a pattern that occurs in commercial software yes, but Open Source has its own version of building mirror ecosystems. Collaborating to bleeding edge issues on robust infrastructure is very hard, so junior engineers that want to collaborate in open source (often for reputation building) can do so in these mirror ecosystems, it's an added bonus if they believe that they are contributing to the bleeding edge instead of rebuilding an enantiomer tech stack.
He worked at Google for 12+ years. He created memcached, WebSub (PubSubHubbub), OpenID, and Perkeep (Camlistore). He's a late-stage co-founder of Tailscale.
If he's a junior engineer, then I have no idea what a senior engineer is.
> In the case of tailscale the added value seems to be avoiding going into your router and activating port forwarding?
Well, ignoring the tone... kinda yeah? I mean, if port forwarding works for you, and you have public IPv4, and you have no CGNAT, and you need a connection only between 2 hosts, then port forwarding is actually a half-decent idea. However, it's not what Tailscale excels at.
You make it sound like both options are equally valid, and as if port-forwarding were some esoteric technology. It's not, one is good, the other is bad.
5 years ago I had a similarly bland position, live and let live, I'd go to a client that was using a Ddns (zapto.org) for production loads serving thousands of customers. 5 Years later, I see them constantly facing SSL issues, and network issues, and even if they weren't it's still the wrong way to do things.
We have to stand for something, get an IP address, get a domain. If you don't have either of those, raise funds, get a budget, speak to people, you can't tech your way out of some things, I know we are hackers, but sometimes the solution is not hacking. Yes we should develop the power to do things even without approval from institutions and without collaboration from the central NIC, or the domain holder, etc... But we should refrain from using that power and actually integrate with domain holders, actually get IPv4/IPv6 blocks.
There's many reasons why you would use a ddns or similar tech, lack of budget, lack of main domain holder approval, lack of NIC approval, lack of ISP approval. In all cases, you are way better off by actually going the other way instead of using a ddns.
1- no budget: Get a budget, a domain is like 15$/yr. a 1024 IPv4 block leased from a NIC is like 600-2500$/year, so the cost of a Host or ISP is 0.6$ to 2.5$, maybe they charge you a margin and you end up paying 5$ to 50$/yr? If this is an issue, maybe your project should die, how much is your time worth? Fund your projects accordingly, or let them die. If this is someone elses project, they cannot afford you.
2- ISP: Call your ISP, if they can't help you access your router, or port forward or whatever, hang up, call again. If your solution is to use a ddns instead of picking up the phone, you have overtrained your hard tech skills and need to work on your soft skills. Speak to a human, you won't get very far if you never speak to humans. This is not a niche thing, we call it port-forwarding but it's how TCP and IP work in general, this is the stuff of the internet, if you can't do something as basic as that, you are never gonna make it, sorry.
3- Domain holder: If you work for a client, and they have a domain, but you don't know who holds it, or where the passwords are. Don't jump to a ddns or buying another domain, integrate, investigate, do an inventory. At the very least buy another domain, a ddns is just cheap to the point of being unprofessional, see 1.
There's a 4th excuse that I'll handle as well:
4- I'm just testing, this is just a throwaway project: Even if it is, you are still underfunding your bets if you don't even have a domain and standalone non-firewalled IP, even if reusing an existing domain and host, we are talking about like 5$ per month. Imagine a professional of any class that cannot afford a tool worth 5$, even a plumber has a toolkit with a screwdriver in it.
Even if you share a link to your project to a friend, if it says hsabhsabdsa.tailscale.net or bjsdbsajdbsa.vercel.app , you are already neutering your project. You can skip this 'phase', it's not necessary for a project to go through all phases, especially if a vendor is trying to convinve you that you should go through this phase, skip it, tell them no, build it right even for your day 1 demo, it's better than having a pre-day 1 demo that has low quality and does things wrong.
One fun use case: a coworker just whipped up this Minecraft mod using tailcat as its transport: https://github.com/tailscale/tailcat-for-minecraft
(just a cute demo, not intended for release or ongoing maintenance)
It would be amazing to have something like this for bedrock so people with consoles without online subscriptions could join a self hosted bedrock mc server
They can! They just need a real computer, the real Minecraft game (Java), and then they can! it's so easy when you don't play the shitty mobile clone.
Why is this downvoted? Bedrock is literally dog shit clone for iPad kids. This is not even controversial, it's just fact.
You're defending a video game written in Java.
It's almost like it should run on an iPad out of the box.
Minecraft RAM Edition
Maybe bc it completely sidesteps the question? I have a nephew who is 7yrs old who only has an iPad and i can play with him due to geysermc, which is the correct answer.
Yep. It's like someone asking "How can we make cycling in [city] safer?" and answering it with "Drive a car."
What's wrong with using https://www.minecraft.net/en-us/download/server/bedrock ? I get that consoles require subscriptions for any kind of online connectivity, but didn't think the iPad had that limitation.
You might be right, i set this up quite some time ago. I don’t think I saw bedrock dedicated servers before.
Yaaaa get those 9 year olds good stupid plebs can't even buy their own computer, you really gottem
The irony is it's more like 35 year olds who don't care about modding realistic nuclear reactors into the game and just want to play with their kids
Exactly this.
I run Bedrock even though we have hardware and licenses for everyone in the house - because I can use my iPad Pro with a controller, and my kids can do the same, and they play in the car all the time.
It has roughly the same features, much worse moddability, and better performance.
At some point it was a weaker clone, but it developed into a very high quality clone, and has graduated into being a co-production with the Java version.
Get a refund from wherever you got your facts.
I'll give you half a point for "iPad kids" since that term implies a lot of incorrect things but it does run on iPads.
When bedrock was announced I was sure Microsoft had won the os arms race and had everything they needed to make an impenetrable monopoly:
* They could make bedrock moddable using .net, and make it so basically every kid interested in programming learned .net
* They could then drop the Java version and get more control over the game with it being harder to mod in un-sanctioned ways while still enabling the content most people want from mods
* And gain a powerful platform they can use to treat Windows/Xbox players better.
* With everyone writing .net it makes more sense to use Windows to develop, effectively reducing the number of fresh developers with posix experience. Stopping the mass exodus to posix since the 2010s MacBook air sublime text nodejs days.
But alas. Microsoft are incompetent. Minecraft was THE tool to turn the future in their favour and they completely overlooked it.
Bedrock exists to make more money. They don't like the Java free modding. They want a marketplace. They want to make money off all content in the game. They want to sell DLC. Make no mistake, they aren't platforming modders to make money because they are charitable. It is because they want to profit, and they can profit at scale by outsourcing the work.
That is in my opinion why most people are against bedrock, including myself. Bedrock is capitalist Minecraft. Enshittified Minecraft, with much more enshittification potential not yet realized. Java version is the only thing protecting bedrock from not being milked further, because it is competition.
They know most people prefer Java. Content creators mostly use Java. But it sells bedrock, and bedrock makes money. And if they can get enough people over, they can kill Java and finally milk bedrock
Java edition is also proprietary, and I don't see what stops them from milking it. They did DCMA-takedown Bukkit and lock a ton of paid accounts out of the game, but nothing further. Like they could drop Mac/Linux support, and I'm surprised/relieved they didn't. Despite it being mostly Java, it does rely on some natives, but even if it didn't...
Its proprietary, but trivially decompileable. Sure, maybe if the game was released today they would try obfuscating better, but the thing is that modding culture had already basically torn the game apart by the time Microsoft came around. I don't think they had a choice but to accept the status quo.
There are mods to disable unwanted Microsoft-pushed features like chat signing, for example. Microsoft doesn't want this, but it is so trivial to do with the Java edition they don't really have a choice but to either accept it or legal it.
I am also surprised they didn't drop mac/linux support, but as long as maintaining it is free I don't think they will. They have lost a lot of market share to mac after all - that's a lot of customers to miss out on.
Ok I had to look this up because last time I did MC modding was when I was in high school... It used to be obfuscated. Someone used to manually map those to human-readable names (didn't know this back then and thought the names were somehow hidden in the bytecode). But recently MS has started deliberately shipping unobfuscated builds.
So I'm getting the feeling they actually want JE to be moddable. Which makes sense because they're already successfully pushing Bedrock on a majority who don't care about modding, especially on locked down platforms, and the remaining JE players are a different segment. But that could change just as easily as their leadership changes.
But also just realized, if this changed, rather than locking down JE, they'd probably just kill it and maaybe release Bedrock for Mac/Linux to keep those players. Possibly not.
For anyone confused about timelines, they started releasing un-obfuscated builds in 2025. In 2019 they started releasing Obfuscation mappings. Before that it was all Minecraft wizards with excellent tooling.
Sorry for the long wait, I wasn't ignoring you, just busy.
Yes, symbols were obfuscated, but Java software with obfuscated symbols is trivial to reverse, at least compared to its native counterparts. My understanding is that the biggest change when releasing symbols was that the MCP team no longer had to manually update symbols for every update. Java also has great reflection features that make it a lot easier to make mods - you don't need to patch binaries like you do with native code.
I think you are right in that Bedrock and JE players are different segments. I think the main goal of Bedrock is to target the casual market, maybe not by intention but by the fact that the community itself is mostly stuck on JE. I still think the long term wish is to get everyone over and kill Java, as Java inherently is less suited for the microtransaction model I am sure they want.
Then again with the rise of LLM-based RE, I guess the largest hurdle for modding bedrock is somewhat lower now, as you can automate a lot of the skill-heavy but not difficult work required.
> But also just realized, if this changed, rather than locking down JE, they'd probably just kill it and maaybe release Bedrock for Mac/Linux to keep those players. Possibly not.
I think this is a good instinct.
No need to apologize. I agree the Java version is easier to reverse-engineer even if they tried to make it harder.
Idk where it says this. Never played Bedrock though cause that doesn't work on Mac.
https://geysermc.org/
https://pumpkinmc.org/
none of the rust-based minecraft server have enough functionality implemented to use them for survival, maybe for some minigames but that's about it. Pumpkin has gotten far out of the many[1] but there's still lots to be done.
1: https://dayssincelastrustmcserver.com/
These game servers are really the perfect use case for agents. Would anyone really care that much about code quality if the server works fast and reliably?
The number of implementations and the lack of success suggest that it is a genuinely hard problem for humans, and "agents" are not going to magically make it simpler. Unlikely that humans abandoned their projects (or failed to band together) solely because of their desire for code quality.
Software is genuinely hard for humans, and agents have made it simpler, not magically, but they cut complexity like butter.
Whoa, Coral is memory-safe!
So this is somewhat similar to Iroh?
https://github.com/n0-computer/iroh
In particular:
https://github.com/n0-computer/dumbpipe
https://github.com/cablehead/pai-sho
https://github.com/n0-computer/pigeons offers the same but with SSH. I use it in my homelab extensivelly for access, tunneling smb, postgres and some other minor bits.
I'm a big fan of iroh, but I think iroh's holepunching algorithm is at least partly based on tailscale's, so it's not 100% accurate to say iroh got there first. (Just the "as a library without a control plane" bit.)
It's all just knockoffs of Skype and BitTorrent :)
I'm glad there's a competing Rust and Go implementation now. I like Iroh as a Rust user and having tailcat around doesn't hurt me
I enjoy that they supply a nix install/environment, similar to the main tailscale/tailscale repo. Is nix widespread or the standard dev environment at tailscale, or is it like a 10% option and most people just use Docker or whatever?
It's not our standard dev environment but some of us use Nix. We don't really use Docker much, though. Mostly just "go test" etc.
How do you guys deal with nix & go cache? i hate when nix cold starts builds, tests without go cache.
I'd guess that there is an insignificant minority of people who strongly prefer nix over anything else.
And it might be because it is easy to provide and maintain compared to a .deb package.
Maintaining and providing a deb is pretty easy too; the real killer for a nix flake I think it's how dirt simple it is to provide infinite testing builds for different branches.
Well, for .deb there is the dependency problem. Even if your deb is just a release of a project, you can only use versions of dependencies that are in debian repository. Or include it all in your .deb, which becomes hard to maintain.
By "infinite branches" you probably mean that a nix derivation / flake is a recipe that can build any version of the project?
Yeah, Nix flakes can be a static URL path, but they inherit your VCS refs directly, so
Gets you the default branch. Tailcat doesn't yet have any tags, but if you want a build of the main tailscale repo at a particular tag, it's just:
But because this can be any ref, you can specify an arbitrary branch or tag, so like if you're trying to get a colleague to check out your work it's as easy as:
And obviously a flake can reference other flakes with the same flexibility, so your home manager config or your company's private app flakes can transparently pull the not-yet-merged version of a change you're proposing upstream without having to make special internal "patched" releases with tortured 1.2.3~actually.1.4.6 type version numbers like in Debian. And of course that same flake reference policy applies all the way down, so you also don't need to worry about the private apt repo as a big piece of shared state that's going rev forward and break your older code branches or Dockerfiles, since each branch of your app flake has its own flake.nix and accompanying lockfile controlling which deps it is pinned to.
It really is an awfully nice system, and shockingly modern in its sensibilities considering how old the Nix fundamentals are.
When I was writing rust stuff a few years ago it seemed like nix was the hip cool thing all the up and coming rustaceans (mostly unemployed students trying to land faang jobs) were using. If you're not familiar with the rust community it's very different from other programming communities I've been in (python/go/ruby/etc). Almost felt like you'd be kicked out of their lunch table if you weren't using it, but I've only see it that ubiquitous there.
A lot of them, instead of learning the usual linuxii you'll be using in containers at work dive headfirst into nix.
Always makes me chuckle when there's this uncountably large group of people, and someone meets a handful of them and then decides they can make broad, sweeping statements about the entire group, despite having not met 99.99...% of them XD
I suspect some of this goes the other way too, that the people who see the value in Nix and/or are willing to tolerate its idiosyncrasies in exchange for what is on offer there are are a lot of the same kinds of folks likely to take an interest in rust, ocaml, elixir/gleam, etc.
Loving this. Honestly I keep encouraging folks to just TRY native Nix for dev environments. So easy to set up and get value on day 1 that you'd be shocked. Also models/LLMs have made lightyear strides in the last few months to help with everything around it. We've been building up Nix based skill systems into our Flox skill and it's been super meaningful both on adoption and when we need to scale it up. (disclaimer I do Flox.dev which is Nix based and we do cool Nix stuff)
It looks like a direct competitor for the recently launched bitbang-cli
https://github.com/richlegrand/bitbang-cli
And IPv6.
Peers might not want to use third party rendezvous servers or relay servers
It appears that Tailscale attempts to persuade peers not to run own "DERP" servers (cf. encouraging peers to run own servers)
"In general, you should not need to or want to run this code. The overwhelming majority of Tailscale users (both individuals and companies) do not."
"Running your own DERP services requires exeprtise [sic] in multi-layer network and application diagnostics. As the DERP runs multiple protocols at multiple layers and is not a regular HTTP(s) server you will need expertise in correlative analysis to diagnose the most tricky problems. There is no "plain text" or "open" mode of operation for DERP."
https://github.com/tailscale/tailscale/tree/main/cmd/derper
Unclear why the company markets peer-to-peer networking but wants traffic going to their own third party servers
In contrast, Nebula, another Go peer-to-peer project encourages peers to run their own rendezvous server ("lighthouse")
https://github.com/slackhq/nebula
"To set up a Nebula network, you'll need:
2. (Optional, but you really should..) At least one discovery node with a routable IP address, which we call a lighthouse."
The comparison to nc seems off. Original netcat has no required third party dependencies, no recommended third party dependencies, and not enough complexity to be linked to a company selling associated SaaS or consulting
> Unclear why the company markets peer-to-peer networking but wants traffic going to their own third party servers
At Tailscale, we do not _want_ traffic through our servers. What we do want is for Tailscale to Just Work without your needing to set up any infrastructure. That’s why we run the DERP relay network as a fallback of last resort, for when a direct connection is not possible. And the tailscaled client tries very hard to make that direct connection.
If and only if you need to run your own infrastructure, then we provide peer relays which are significantly less onerous than running a DERP server: https://tailscale.com/docs/features/peer-relay
This note exists in the README because people would assume that hosting a DERP server was a hard requirement for using Tailscale. Or they would assume that an production Tailscale network would eventually operate a DERP server. People who run their own DERP servers usually have data sovereignty or strict metadata requirements.
This is so cool! I mean, we really wouldn't need it if we had 100% ipv6 (no cgnat), but this is the next best thing. I think people underestimate the innovation that could happen if we had trivial p2p.
I've spent time finally learning what tailscale is and how it works and I'm impressed. It's a rare thing in the technology world but I'm glad I finally took the time.
I literally just figured out how tsnet fits into the picture (an in-process Go based entire network stack that gets the process to act as a node in the tailnet) and so that helps me understand this (everything in tsnet excepting the control plane). It's very impressive that they can do this in a reliable way.
The Tor network and Onion protocols used to be used for this type of thing 10 or 15 years ago, exposing a home service with a .onion address and then gaining secure private access over the global internet infrastructure that way. But I haven't even seen any Tor related headlines for ages.
Just yesterday I was complaining that I wanted to SSH back to my homenet while at the office, on my office (not home) tailnet. I wrote something based on Iroh to do this, but it's one shot (ie not particularly generalized). Might be able to throw it away or redesign it with some inspiration from this! Thanks.
There's an example in the README how to do exactly that :)
why not try out some existing project already on top of iroh ?
I see a bunch here on awesome-iroh page
https://github.com/n0-computer/awesome-iroh
you could try rayfish.xyz, it is compatible with tailscale nowadays so you can run both tailscale and rayfish
I solved this problem by building/running a custom tailscale client that connects to two tailnets at the same time (https://github.com/maisem/tailmix)
I was just wondering yesterday if it'd be possible to have a tailscale client, or multiple tailscale clients in their own network namespaces, that could connect to multiple networks.
The slightly tricky part would be managing a local NAT that blends the two networks, and also does MagicDNS to answer on those NATed IPs. If routes conflicted, I guess you'd have to pick one?
Seems very doable though.
@bradfitz: Steal this idea ^^^ ;-)
yeah that's kinda what it does. It sets up two tsnet servers connected to two different tailnets and exposes them through a shared TUN device. It does the magic of allocating safe IPs to each host so that they don't overlap and does some leasing so that IPs aren't accidentally reassigned. It also does the MagicDNS thing so that DNS returns the "effective IP".
I wanted it to work on macOS so couldn't rely on network namespaces.
That deserves it's own top-level discussion, for sure! https://news.ycombinator.com/item?id=49457539
you might be able to do it via iroh's dumbpipe
How much Tailscale is this still if the transport is based on wireguard, the control plane is something new with the keys based on the wireguard keys? Genuinely confused.
I dug into it a bit because I had the same question. The network layer here is wrapping around the Tailscale daemon's magicsock, which is the thing that does all the DERPing and NAT hole punching. Tailcat builds sort of a fake control plane that does a one way key exchange over DERP (the Meow message type) between client and server, then both sides do the normal CallMeMaybe dance to connect.
I think this is best described as a one-shot control plane, the single use address/key (same thing) is shared out of band, so it's far more minimal than the TS control plane.
The examples show the concrete use cases... Basically giving you the wiregaurd + DERP quality tunnel but as a one shot point to point cli tool. Which is a nice upgrade from the alternative "in a pinch" tools.
RE "how much tailscale" I guess it's the DERP bit + this minimal point to point control plane. Without which it's significantly more configuration to get the wiregaurd tunnel working, or impossible because of NAT, unless both machines are on the same ipv6 network.
TS basically sell the full control plane with Auth and ACL style management etc as their product so this doesn't really compete.
Hello, i am building a open client-based platfrom that really fun, the whole system(js for now) once start then you can pick the target(friends?) to trust(oneway/equal), then users will sync inside the trust network, to make your app and eveyrthing up to date autoly, but the problem is the P2P isnt a way for 4G/5G user, i plugged IPFS stuff inside for, to let user can share their life like video just like internet but not a signle server, so i see Tailcat today i am thinking if i plug this inside, is that evil to you guys? you know i'am asian, our internet is going to Terminator skynet, i have finish a free,open, for everyone's working pure serverless system(but NAT problem)
This is smart. It's Magic Wormhole but for generalized connectivity, not just file transfer.
Yes, though MW has the important distinction that it uses short human-readable session identifiers. This means MW supports file transfer where the out-of-band channel is just a phone call. This is also why it needs PAKE as opposed to the simpler cryptography used in tailcat
Not a huge lift to stick a PAKE in this protocol, though I'm dubious that it'd be much of a win. The PAKE + nameplate system in Wormhole makes a lot of sense, because you're doing one very specific thing with that system (moving a file from point A to point B). Here you're booting up servers; you're almost always going to have a non-voice channel to set up with.
You also don't want adversaries to be able to disrupt long-lived streams with bad password guesses, since I think part of Wormhole's security model is it will terminate the session if the other side gets it wrong.
> This is also why it needs PAKE as opposed to the simpler cryptography used in tailcat
May be my idea of simpler cryptography is incorrect, but PAKEs like CPace do seem simpler than public key primitives in Noise.
A PAKE is more complicated than Noise. Noise is fussy (for good reasons) but relatively simple.
Tool like this exposes big problem with the current shape of the Internet, I believe.
Everything should be possible with just plain netcat and IP stack. Someone asks about NAT holepunching, encryption, static IDs, permissions, etc., yes this is what Internet lacks and why every P2P app reinvents it over and over again.
notabug wontfix; that's the end-to-end (E2E) principle in action. Bring your own all of that.
A bit off topic: it’s just insane how I used to watch this guy’s http2 in Go yt video 10 years ago, and he’s still very relevant to this day! Cheers Brad!
Also created memcached, livejournal... Brad has a long list of impressive work.
I wish his perkeep project was mature and stable.
Same.
But Tailscale keeps sucking me in with new stuff to do. :(
Oh, wow. I had no idea. I've gotten a ton of use out of memcached over the years. Thanks for all your efforts, Brad!
Still working on Go's http2 10 years later :)
Recently: https://github.com/golang/go/commit/128a36cf0367c46daff2528d...
https://github.com/golang/go/commit/3c0665e551be23e62167f625...
Interesting. I thought about doing this immediately after reading their old blog[1] post on punching through NAT some time ago.
Just a combo of never getting around to it and friends talking me out of it b/c of existing alternatives such as wormhole[2].
[1] https://tailscale.com/blog/how-nat-traversal-works
[2] https://github.com/magic-wormhole/magic-wormhole
Wush was already doing something similar (using tailscale under the hood)
https://github.com/coder/wush
I did the homemade version of this for years just with SSH forwarding and nginx reverse proxy
but without nat traversal...
Is NAT traversal actually that big of a feature? The category of people that would use a tool like this already knows many ways to do it without NAT getting in the way.
Unless you have some kind of dynamic DNS with a background daemon, you'll be bothered by NAT eventually. And even then it's hardly as convenient. With Tailscale, I can sit on a rooftop bar in the Medina of Marrakech, connect my phone to the public WIFI, and access my laptop in the hotel WIFI across town. Or production infrastructure on a highly secured server somewhere on the other side of the planet. All without compromising security, and all devices involved just pick the shortest physical link to each other.
It's really pretty cool.
It's not a given that you always have some server without NAT in the way. Even if you do, it might bottleneck or add latency to the two ends trying to talk. I've been there.
If you ever connect over a mobile hotspot, then you need NAT traversal. And if you want something that "just works" across various network environments, you need NAT traversal.
As 'cattail' is not officially taken, I have to assume they are oblivious to having a little fun.
Keeps with the tradition of netcat alternatives like powercat, socat, cryptcat.
i like that it removes tailscale proprietary.
if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty?
like netbird, openziti, zerotier, etc.
(Author here)
The DERP server is already open source and tailcat can use any DERP server you run: https://github.com/tailscale/tailscale/tree/main/cmd/derper#...
We just provide some default ones (https://tailcat.dev/derpmap.json) to get started if you're not bandwidth-sensitive. But you don't have to use them.
Update: I added more explicit docs about this to https://github.com/tailscale/tailcat#bring-your-own-derp-rel...
Or just use wireguard directly. I get it that it's a pain in the ass to configure it, but there are plenty of open source config generators
(Author here)
WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc.
> pain in the ass to configure it
Idk? I found it pretty easy to configure by blindly following the tutorials and copy-pasting keys. The only footgun is the keepalive setting, which will screw up the tunnel if one end is behind NAT, that tripped me hard, but besides this, no issues at all.
> it's a pain in the ass to configure it
Public/private key pairs are hard? It's no more terrible than other projects that require configs.
For me the complicated part was understanding the IP assignment for peers and how to set that up correctly
IPSec may be a pain... but WireGuard is as simple as it gets in my opinion. Yeah, you may need to know basic IP concepts, like MTU...
NAT traversal is a different topic, WG won't help in that, and that can actually be a pain. I guess we should be using IPv6 already, and this tool would be largely redundant already. (not completely, encrypted access to isolated networks is a valid use case)
Even without NAT, the same hole punching techniques must be used for IPv6 since there is usually a firewall blocking inbound traffic. Only in CGNAT type scenarios where the network behind NAT is still "WAN" will be helped by IPv6.
This point applied to normal NAT as well as CGNAT specifically.
And hole punching gets a lot simpler when you’re behind NAT since you don’t need any kind of rendezvous server to determine port mappings.
In other words, IPv6 does help substantially—the same hole punching techniques are not needed.
WG is totally fine for home labs etc. But pushing configs to the server or networm when onboarding a new peer, making sure the new peer IP doesn't collide with someone else, etc. Can be quite annoying sometimes.
NAT is honestly smaller of an issue and rarely encountered, but it's useful for example to expose services on my laptop to my phone, kind of like ngrok. That can be quite hard on vanilla wireguard.
For me the biggest thing tailscale/netbird solves is still the automatic handling of the peers, acls, or in other words automating fireguard config.
Umm, we have a full opensource Tailscale stack now?
always have! our darwin and windows clients are closed source, but they wrap the oss implementation in github.com/tailscale/tailscale and you can see and even use all the same hooks yourself.
the control plane is closed source, but headscale is an open source alternative that we embrace and encourage people to use if it meets their needs/desires
Looks dope, though I'm surprised, is Tailscale fine with their DERP servers being used by non-customers like this? (Yes, it's a Tailscale project, but doesn't require login.) I vaguely assumed there was an auth step before you could use one as a relay. They mention a rate limit, but still
Repo suggests that they're running their own (rate-limited) DERP servers.
edit:
Which are probably tailscale's, as it's under tailscale/ github org?
Yes, it's been our CEO Avery's position for ~6.5 years now that we should run DERP servers on the internet for the public good. (rate-limited)
But these are a separate fleet (https://tailcat.dev/derpmap.json) separate from our usual ones, and not using "tailscale.com" in DNS or SNI anywhere.
Fair enough. Thank you!
being built a iroh based distributed notes app for myself use
and see tailcat come out, trying to replace iroh with this to do some experiment because i really love how tailscale works and invest much time to the stack
True appriciated of open source this, combine the tailscale open source client core with this, i think it can unlock more stuffs
I do use Tailscale myself to connect many of my devices. So I am a bit confused, what does this add over regular Tailscale? Excuse my lack of knowledge in this area.
I use mosh over WebSockets to have a long lived connection to my home network.
I bet I could simplify out the WebSocket-to-UDP proxy by leaning into tailcat's dataplane and just speak straight UDP.
I just set up Tailscale as I've been hosting more personal apps off a small Hetzner VM and wanted a really simple personal networking solution. Works great, would recommend.
It's really excellent. I've been using Tailscale for a number of years, just for my home network and with a single user, and the service is excellent, and the free tier is incredibly generous.
I'm hoping that my Mullvad subscription (through Tailscale) contributes a little bit at least. Two excellent companies.
I like that there is Headscale as an open-source offering too. I don't use it, but the fact that it exists makes me a lot more comfortable (similar to Bitwarden etc).
Woah this is cool!
I've been making a mesh vpn like radmin vpn or hamachi that does not need a central authority server and most importantly, can run on all major OS thanks to wireguard-go.
Looks like a Wireguard stunnel replacement, which is very useful!
What's the risk of malware using this for C&C or otherwise? Hackers love communication channels that are difficult to take down individually.
They say it's rate-limited, so at least it probably won't scale to large botnets or similar...
That's how I dreamed, Thanks tailscale
super sick, already setup a derp server.
dns node key for fun on one
and two machines that connect, with systemd to keep tailcat serving ssh running
I have a really dumb ignorant question.
What is a data plane? What is a control plane? I don’t genuinely understand what these words mean :(
Does this help? This is what I read on the topic a few weeks ago: https://tailscale.com/docs/concepts/control-data-planes
Neat idea in its core but its still tailscale underneath
The only thing that convinces me that tailscale isn't a CIA op is how badly it works for real uses
Netbird is the more mature version of this: fully open-source, self-sufficient, works like a charm, supports reverse proxying out-of-the-box, and much more. No reason to ever return to the Tail family.
Links: https://netbird.io/ https://github.com/netbirdio/netbird
Except the public relays are paywalled...
>"like netcat, but over Tailscale's data plane"
Half of the Software offering nowadays seems to be selling vendor lock-in at no added value and then making a profit.
Sure there's always some negligible added value, and then they reinvent a whole stack for their ecosystem. In the case of tailscale the added value seems to be avoiding going into your router and activating port forwarding? It looks like negative added value to me. Someone that tells you "don't do NAT traversal, just open a port" would be highly valuable, but saying no doesn't seem to be trendy, and is certainly not an easy sell.
(Author here)
There's no vendor lock-in here and no payment or account required. If Tailscale as a company fails, tailcat keeps working if you run your own DERP server. It's just open source code, not a hosted service.
It's an official tailscale product no?
Fwiw, I don't think vendor lock-in is a bad thing, but being open source doesn't mean there's no vendor-lock in. If a client builds their system on top of an open source technology, then switching away from that dependency would have a cost, even if that cost is engineering man-hours.
If tailscale does not work out of the box with netcat, and requires a custom additional dependency to work, it raises the question that tailscale will not work out of the box with other tools like tcpdump or stunnel and apache, and I will need to install other custom dependencies like taildump, tailtunned, tailapache.
When compared to other solutions that integrate without additional effort, installing vendor-specific dependency forks/clones means that there is an additional vendor lock-in.
This isn't due to tailscale not supporting or working with netcat; you can nc to an address on your tailnet just fine.
This is using the infrastructure tailscale set up for a different purpose. Rather than requiring a tailnet or even an account anywhere, you can tailcat between any two endpoint. Tailscale is there because it runs the DERP relays which get the client's pubkey to the server, brokers the connection, and coordinates holepunching.
...this is a github repo. Pointing to an open source project. That is not forced to use any vendor-specific systems to function.
It's a pattern that occurs in commercial software yes, but Open Source has its own version of building mirror ecosystems. Collaborating to bleeding edge issues on robust infrastructure is very hard, so junior engineers that want to collaborate in open source (often for reputation building) can do so in these mirror ecosystems, it's an added bonus if they believe that they are contributing to the bleeding edge instead of rebuilding an enantiomer tech stack.
The author is Brad Fitzpatrick.
He worked at Google for 12+ years. He created memcached, WebSub (PubSubHubbub), OpenID, and Perkeep (Camlistore). He's a late-stage co-founder of Tailscale.
If he's a junior engineer, then I have no idea what a senior engineer is.
> In the case of tailscale the added value seems to be avoiding going into your router and activating port forwarding?
Well, ignoring the tone... kinda yeah? I mean, if port forwarding works for you, and you have public IPv4, and you have no CGNAT, and you need a connection only between 2 hosts, then port forwarding is actually a half-decent idea. However, it's not what Tailscale excels at.
> if port forwarding works for you
> port forwarding is actually a half-decent idea
You make it sound like both options are equally valid, and as if port-forwarding were some esoteric technology. It's not, one is good, the other is bad.
5 years ago I had a similarly bland position, live and let live, I'd go to a client that was using a Ddns (zapto.org) for production loads serving thousands of customers. 5 Years later, I see them constantly facing SSL issues, and network issues, and even if they weren't it's still the wrong way to do things.
We have to stand for something, get an IP address, get a domain. If you don't have either of those, raise funds, get a budget, speak to people, you can't tech your way out of some things, I know we are hackers, but sometimes the solution is not hacking. Yes we should develop the power to do things even without approval from institutions and without collaboration from the central NIC, or the domain holder, etc... But we should refrain from using that power and actually integrate with domain holders, actually get IPv4/IPv6 blocks.
There's many reasons why you would use a ddns or similar tech, lack of budget, lack of main domain holder approval, lack of NIC approval, lack of ISP approval. In all cases, you are way better off by actually going the other way instead of using a ddns.
1- no budget: Get a budget, a domain is like 15$/yr. a 1024 IPv4 block leased from a NIC is like 600-2500$/year, so the cost of a Host or ISP is 0.6$ to 2.5$, maybe they charge you a margin and you end up paying 5$ to 50$/yr? If this is an issue, maybe your project should die, how much is your time worth? Fund your projects accordingly, or let them die. If this is someone elses project, they cannot afford you.
2- ISP: Call your ISP, if they can't help you access your router, or port forward or whatever, hang up, call again. If your solution is to use a ddns instead of picking up the phone, you have overtrained your hard tech skills and need to work on your soft skills. Speak to a human, you won't get very far if you never speak to humans. This is not a niche thing, we call it port-forwarding but it's how TCP and IP work in general, this is the stuff of the internet, if you can't do something as basic as that, you are never gonna make it, sorry.
3- Domain holder: If you work for a client, and they have a domain, but you don't know who holds it, or where the passwords are. Don't jump to a ddns or buying another domain, integrate, investigate, do an inventory. At the very least buy another domain, a ddns is just cheap to the point of being unprofessional, see 1.
There's a 4th excuse that I'll handle as well:
4- I'm just testing, this is just a throwaway project: Even if it is, you are still underfunding your bets if you don't even have a domain and standalone non-firewalled IP, even if reusing an existing domain and host, we are talking about like 5$ per month. Imagine a professional of any class that cannot afford a tool worth 5$, even a plumber has a toolkit with a screwdriver in it.
Even if you share a link to your project to a friend, if it says hsabhsabdsa.tailscale.net or bjsdbsajdbsa.vercel.app , you are already neutering your project. You can skip this 'phase', it's not necessary for a project to go through all phases, especially if a vendor is trying to convinve you that you should go through this phase, skip it, tell them no, build it right even for your day 1 demo, it's better than having a pre-day 1 demo that has low quality and does things wrong.