upvote

points

by kkapelon4 hours ago |
comments
upvoteby dmantis4 hours ago|
next
[-]
That only works for the infrastructure of one entity. It doesn't establish direct connection to my friend's device by a key pair if he is outside of the particular organisation tailscale VPN.

p2p apps need direct connections.

reply
upvoteby moritzruth4 hours ago|
prev|
[-]
Those are intended to solve the problem at the OS layer, while Iroh (being a library) does it at the application layer.
reply
upvoteby kkapelon4 hours ago|
parent|
[-]
Like https://tailscale.com/docs/features/tsnet ?
reply
upvoteby apitman33 minutes ago|
parent|
next
[-]
Similar on the technical level (though QUIC vs WireGuard), but that would make your app dependent on Tailscale, and require your users to have Tailscale accounts. You'd also be limited to Golang currently.

In theory you could run Headscale, but you're really working against Tailscale's intended design at that point, and Iroh was built for this from the ground up, so what is Tailscale buying you?

reply
upvoteby szmarczak25 minutes ago|
parent|
[-]
You don't need tailscale accounts to access tsnet (via funnel).
reply
upvoteby ben-schaaf3 hours ago|
parent|
prev|
[-]
From reading that, it lets you establish connections within your tailscale vpn. Iroh let's you establish connections between devices regardless of their network.
reply
upvoteby 9dev2 hours ago|
parent|
next
[-]
There might be a misunderstanding of what Tailscale offers here. There is no "VPN" in the classic "virtual network" way. With Tailscale, you can - as with Iroh, IIUC - connect arbitrary nodes to each other, where a node can be a device or an application (via tsnet). All nodes get CGNAT IPs and an addressable hostname, so there is one giant "network" of all your nodes with automatic DNS resolution baked in.
reply
upvoteby kbenson2 hours ago|
parent|
[-]
Doesn't tailscale require those all be administered and approved by one account?

> there is one giant "network" of all your nodes

From what I understand they're saying, the point is that you get easy connections to things that aren't "your" nodes, sort of like allowing me to connect one of my tailscale nodes ad-hoc to one of your tailscale nodes, when our accounts are not related in any way prior to us doing that, and without me having to allow your node onto my network or you allow one of mine onto your network and have to deal with the specialized ACLs for that, since it's just a direct connection between two nodes.

reply
upvoteby 9dev1 hours ago|
parent|
[-]
Yeah, I figured that in the mean time. It just didn’t occur to me because my use case is literally the opposite—having a secure company network where strict ACLs are the core value, not a nuisance. But if easy ad-hoc connections are your goal, Iroh sure looks like the better choice then.
reply
upvoteby __float3 hours ago|
parent|
prev|
[-]
I think everyone in this thread agrees on that part already.

The similarities are in an application lib to connect, and that tail net IPs correspond to device keys like in Iroh. The service using the Go library has its own Tailscale identity.

reply