September 2021 Summaries

The September 2021 Tailscale newsletter highlights several new features and community contributions, including HTTPS certificate support, GitHub Marketplace integration, and free pricing for open-source GitHub organizations. It emphasizes the importance of upgrading to Tailscale 1.14.4 or later for Windows users to maintain connectivity. The newsletter showcases various community projects utilizing Tailscale, such as secure remote access setups and Docker images for custom DERP servers, alongside guides for integrating Tailscale with tools like CircleCI and Home Assistant. It also introduces new features like MagicDNS for private DNS setups and the ability to provision Let's Encrypt TLS certificates for internal services, aiming to enhance security and connectivity within Tailscale networks. Additionally, Tailscale 1.16 is anticipated to bring further improvements, including Taildrop support for older Android versions.

Users running Tailscale on Windows 10 or Windows 11 need to upgrade to Tailscale version 1.14.4 or later before performing a Windows Update to avoid losing connectivity to their tailnet. This issue arises because previous Tailscale versions stored critical state information in a directory that Windows updates can wipe, resulting in the loss of essential files, including machine keys. This necessitates re-registering and re-authenticating machines to regain network access. Tailscale 1.14.4 has addressed this by changing the storage location to a more stable directory, and affected users can verify their machines through the admin console or contact support for assistance if connectivity issues arise post-update.

Tailscale, built on WireGuard, provides secure end-to-end encryption for connections between nodes on its network, known as a tailnet, but browsers require TLS certificates to verify the authenticity of HTTPS URLs. To address this, Tailscale now facilitates the provisioning of TLS certificates for internal services within a tailnet using Let's Encrypt, allowing users to avoid browser warnings about unsecure connections despite the underlying encryption. This feature is implemented by generating a certificate private key and a Let's Encrypt account private key on each node, with the Tailscale client handling the DNS-01 challenges through API calls. Users can enable this feature on Tailscale v1.14 or later by configuring settings in the admin console and executing specific commands on nodes needing certificates, effectively streamlining the process of validating internal services with TLS certificates.

Tailscale has introduced a free plan for GitHub organizations that are involved in open source projects, providing up to 25 users, 5 devices per user, and community support, along with features like subnet routers and unique users in ACL policies. This initiative aims to ease the development and collaboration processes for open source projects by leveraging GitHub's organizational structure, while also offering similar benefits to families and friends using GitHub organization accounts. Additionally, Tailscale extends a 50% discount to charities, non-profits, and educational institutions and reassures users that their Personal plan will remain free, allowing personal use for connecting to various personal servers and devices. The company encourages users to upgrade their GitHub organizations to the new Community on GitHub plan through the admin console, emphasizing its commitment to support open source endeavors.

David Crawshaw reflects on the decline of the Unix sockets API's utility in contemporary network programming, attributing it to the rise of the internet and its associated security challenges. While Unix sockets once offered a simple and reliable interface for network communication, issues such as addressing asymmetry, lack of robust authorization, and the need for end-to-end encryption have made them less practical. Crawshaw critiques the cumbersome layers of technology required for secure network communication today, suggesting that beginners face steep learning curves and that the joy of simple socket programming is lost amidst complex security measures. He highlights Tailscale as a promising project to simplify network programming by providing secure, user-friendly connections through the OS sockets API, potentially reshaping the future of network programming by making it more accessible and secure.

MagicDNS, a feature of Tailscale, offers secure private DNS by allowing nodes on a tailnet to be accessed by name rather than IP addresses, enhancing DNS security by preventing name lookup information from leaving the device and upgrading non-Tailscale DNS queries. Traditionally, DNS has been insecure due to unencrypted and unauthenticated early protocols, but MagicDNS improves this by using a built-in DNS server on each node that handles queries locally. This setup prevents unencrypted queries from leaving the device and eliminates the need for caching, enabling immediate propagation of network changes. The system supports multiple DNS protocols, including DNS over TLS (DoT) and DNS over HTTP (DoH), ensuring encrypted communication with upstream DNS servers. MagicDNS is still in beta, and future enhancements include additional features like custom record additions and broader support for arbitrary DoT and DoH resolvers. To enable MagicDNS, users can configure it through the Tailscale admin console, allowing for tailored DNS settings and enhanced privacy across the network.

GitHub has released a new GitHub Action that facilitates connecting to the Tailscale network, now available in the GitHub marketplace. This action allows users to generate an ephemeral authentication key to connect to Tailscale, perform necessary tasks, and then automatically clean up the connection state after completion, ensuring no persistent network linkage remains. The integration of the Connect Tailscale action enables users to securely deploy applications to internal servers, access private test runners, connect to databases without exposing them online, and reach internal deployment monitoring tools, enhancing the security and flexibility of various workflows.