Tailscale is the best. It's infinitely better than Hamachi, ZeroTier, etc. My only gripe is that they have some really weird SSO requirements like GitHub, etc. and then that provider becomes a permanent part of your identity.
I've been a fan of Tailscale since encountering it for the first time at a previous job at a small startup. Someone asked if anyone had a Linux machine when we were all testing out something, and I mentioned I had a personal Linux desktop but wasn't sure how to connect it to the VPN for access, and it turned out that the solution was just literally running two commands in the terminal after installing tailscale from the repos. Compared to my first job where connecting to the VPN from Linux required hours of mucking around with openswan (or was it strongswan? so many swans...) and trial and error with various config files, it was unfathomably straightforward.
That strongswan thing is the kind of design HN praises about open protocols by IRC (just the other day...) but in practice is so flexible it can't keep itself upright and it's unusable in practice.
Meanwhile tailscale or wireguard, by being actually opinionated, avoids needing much configuration at both ends.
Yes — configuring strongSwan as a bog-standard VPN server was so hard to fathom I made GitHub repo for it [1]. To be fair, some of the complexity comes from OS support that seems specifically designed to make secure setups difficult, presumably at the behest of various Three Letter Agencies.
I have now mostly switched to Wireguard for this, which is much more sane [2].
Some of the NetworkManager VPN plugins have weird side-effects. Like the one for OpenVPN force-disables split tunnel configurations and there's no way to turn that off, meaning that all traffic routes through the VPN even if you'd rather only send stuff for certain destination addresses through.
Based on the experience that I (and other coworkers, including on other distros) had, whatever configurations our VPN needed did not seem to work out of the box on network manager.
A lot of this is just weird Linux on the desktop weirdness.
On Windows and Mac, VPN config is usually just installing a client, signing in, and then it all basically works. Sometimes you don't even need the client and can set it up in settings.
Those are pretty much all first-party clients though, right? I'm not sure that "some companies don't provide a Linux client for their software" is something I'd characterize as "Linux desktop weirdness". My point here is that Tailscale seems to have actually put time and effort into making a Linux client that's a breeze to use, whereas most of the other VPNs I've used for work have not.
Being an identity provider for anything important is the freaking worst. Exposes you to a million problems. You need human support for login problems and lost MFA tokens, and you are an attack magnet.
As a user, I really don't care for magic links. The whole, start the log-in process, switch context, wait for email (sometimes up to a minute), click on it, have it open a new tab in a different window than where I started is just a pain. I feel like I spend half my day logging in to services these days.
The only time I like magic links is for services where I am "not really a user". For example, an appointment reminder for my doctor where I need to validate my insurance. Great, send me an email 24-hours before with the reminder and a magic link, as I don't want to think about an account there.
I detest magic links. I have probably 9-10 accounts with a certain service that uses magic links (I mostly use them to get an API key or download a file every few months and never visit directly otherwise) because
1. the only login method they support is magic link and login with Google/Facebook. There's no password field so my password manager can't fill out my login details for me.
2. I don't have a Facebook account, and I don't keep my Google account signed in. Even if I did, I don't want them using these as my primary email address. (I use a catch-all and don't give out the primary address; I give each service it's own address)
3. A bunch of newsletters and forums (hackaday, etc) mention them by name every few weeks, often in the subject field, making it hard to search for. They don't send me any newsletters themselves, and I don't participate in their forums so there's nothing from them directly. They can't do anything about this, but it makes things harder.
4. If you enter a new email address that they've never seen before, the process exactly the same until after you click the magic link you received. They don't tell you they've never seen it before until you verify the address.
5. As such, if I can't recall the exact address I used to sign in, I automatically create a new account and don't find out until after I click the magic link and I'm asked to enter a new username or use the existing username they've already created. Proceed to settings and create a new API key for a new account instead of just adding one to my existing account.
This is an extreme case, yes, but I have similar issues with several services that only support magic links and GitHub login, and it's hard to configure services to use a new catch-all address when they harvest my address from GitHub login and won't let me change it. Magic links are a great tool, but they should _never_ be the only option. They should supplement existing login methods. Password managers exist for a reason. Several services that I have since stopped using for this reason have in the past decided that they should start sending emails to the addresses they harvested from login with other service. Two services have gotten my magic link address stuck in their system because it's not associated with an account (the account has been deleted) and thus I can't manage subscriptions.
One maybe non-obvious benefit I see in that from the individual Tailscale user perspective is that only having SSO rather than username/password keep the security of my login in the same bin as the larger customers where Tailscale makes their actual money.
A username/password would be perfectly fine for my use-case as an individual user using Tailscale for my homelab and personal devices. But I suspect the majority of real paying customers don't want a separate authentication flow just for Tailscale and would rather use the SSO they already have. I have confidence Tailscale wouldn't half-ass usernames and passwords is they offered it even if it was mostly just for non-paying hobbyist users, but I'm also sort of glad I get to bucket my account security risk with the people paying their bills.
You become responsible for keeping those credentials secure, among a whole host of other problems. (Abuse like credential stuffing (more), data breaches (more), account farms (more), and so on.)
How are the requirements weird? They support any OIDC endpoint whether your own or a vendor’s, and, while uninteresting to HN folks, they also now support passkeys for having no SSO provider at all.
Yeah, I have my Tailscale tied to my Apple account, which just feels weird. I can add a Passkey account to my Tailnet and make it manager, etc., so that’s what I’ve done. The owner is my Apple account, but I actually do everything admin-wise with a Passkey account.
