Tailcat

(github.com)

165 points | by nderjung 1 hour ago

12 comments

  • mikepurvis 2 minutes ago
    I enjoy that they supply a nix install/environment, similar to the main tailscale/tailscale repo. Is nix widespread or the standard dev environment at tailscale, or is it like a 10% option and most people just use Docker or whatever?
  • megamorf 29 minutes ago
    So this is somewhat similar to Iroh?

    https://github.com/n0-computer/iroh

  • archietect 46 minutes ago
    It looks like a direct competitor for the recently launched bitbang-cli

    https://github.com/richlegrand/bitbang-cli

  • rugma 33 minutes ago
    Wush was already doing something similar (using tailscale under the hood)

    https://github.com/coder/wush

  • MrDrMcCoy 31 minutes ago
    Looks like a Wireguard stunnel replacement, which is very useful!
  • tptacek 20 minutes ago
    This is smart. It's Magic Wormhole but for generalized connectivity, not just file transfer.
  • cpuguy83 1 hour ago
    Interesting. I thought about doing this immediately after reading their old blog[1] post on punching through NAT some time ago.

    Just a combo of never getting around to it and friends talking me out of it b/c of existing alternatives such as wormhole[2].

    [1] https://tailscale.com/blog/how-nat-traversal-works

    [2] https://github.com/magic-wormhole/magic-wormhole

  • petcat 1 hour ago
    I did the homemade version of this for years just with SSH forwarding and nginx reverse proxy
    • nateguchi 56 minutes ago
      but without nat traversal...
      • petcat 6 minutes ago
        Is NAT traversal actually that big of a feature? The category of people that would use a tool like this already knows many ways to do it without NAT getting in the way.
  • codruterdei 51 minutes ago
    A bit off topic: it’s just insane how I used to watch this guy’s http2 in Go yt video 10 years ago, and he’s still very relevant to this day! Cheers Brad!
  • LoganDark 8 minutes ago
    What's the risk of malware using this for C&C or otherwise? Hackers love communication channels that are difficult to take down individually.
  • gz5 1 hour ago
    i like that it removes tailscale proprietary.

    if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty?

    like netbird, openziti, zerotier, etc.

    • bradfitz 1 hour ago
      (Author here)

      The DERP server is already open source and tailcat can use any DERP server you run: https://github.com/tailscale/tailscale/tree/main/cmd/derper#...

      We just provide some default ones (https://tailcat.dev/derpmap.json) to get started if you're not bandwidth-sensitive. But you don't have to use them.

      Update: I added more explicit docs about this to https://github.com/tailscale/tailcat#bring-your-own-derp-rel...

    • gonzalohm 58 minutes ago
      Or just use wireguard directly. I get it that it's a pain in the ass to configure it, but there are plenty of open source config generators
      • bradfitz 56 minutes ago
        (Author here)

        WireGuard doesn't do NAT traversal. That's the main thing this adds. And this also adds a CLI tool + library to do streams over WireGuard w/o installing kernel routings, requiring root, etc.

      • mystifyingpoi 47 minutes ago
        > pain in the ass to configure it

        Idk? I found it pretty easy to configure by blindly following the tutorials and copy-pasting keys. The only footgun is the keepalive setting, which will screw up the tunnel if one end is behind NAT, that tripped me hard, but besides this, no issues at all.

    • aitchnyu 6 minutes ago
      Umm, we have a full opensource Tailscale stack now?
  • TZubiri 1 hour ago
    >"like netcat, but over Tailscale's data plane"

    Half of the Software offering nowadays seems to be selling vendor lock-in at no added value and then making a profit.

    Sure there's always some negligible added value, and then they reinvent a whole stack for their ecosystem. In the case of tailscale the added value seems to be avoiding going into your router and activating port forwarding? It looks like negative added value to me. Someone that tells you "don't do NAT traversal, just open a port" would be highly valuable, but saying no doesn't seem to be trendy, and is certainly not an easy sell.

    • bradfitz 58 minutes ago
      (Author here)

      There's no vendor lock-in here and no payment or account required. If Tailscale as a company fails, tailcat keeps working if you run your own DERP server. It's just open source code, not a hosted service.

    • mystifyingpoi 37 minutes ago
      > In the case of tailscale the added value seems to be avoiding going into your router and activating port forwarding?

      Well, ignoring the tone... kinda yeah? I mean, if port forwarding works for you, and you have public IPv4, and you have no CGNAT, and you need a connection only between 2 hosts, then port forwarding is actually a half-decent idea. However, it's not what Tailscale excels at.

    • MattCruikshank 58 minutes ago
      ...this is a github repo. Pointing to an open source project. That is not forced to use any vendor-specific systems to function.
      • TZubiri 1 minute ago
        It's a pattern that occurs in commercial software yes, but Open Source has its own version of building mirror ecosystems. Collaborating to bleeding edge issues on robust infrastructure is very hard, so junior engineers that want to collaborate in open source (often for reputation building) can do so in these mirror ecosystems, it's an added bonus if they believe that they are contributing to the bleeding edge instead of rebuilding an enantiomer tech stack.