April 2023 Summaries

Tailscale has introduced network flow logs in beta as a part of its commitment to enhancing network security and reliability. These logs provide detailed metadata about network traffic, allowing users to detect threats, investigate incidents, maintain compliance, and troubleshoot issues without compromising the end-to-end encryption of data. Administrators can enable and access these logs through the admin console, with options for streaming to SIEM systems like Splunk and ELK for comprehensive monitoring and alert setups. The feature is available on Tailscale's Premium and Enterprise plans, with log streaming specifically offered to Enterprise users, and the company is working on expanding integration with additional SIEM partners.

Tailscale has introduced support for custom OpenID Connect (OIDC) providers, currently in beta, to accommodate organizations with unique identity management needs that extend beyond its existing integrations with major identity providers like Google and Microsoft Azure AD. This update allows businesses to authenticate users using any OIDC-compliant provider, enhancing security and user experience by enabling single sign-on and multi-factor authentication without additional passwords. Organizations can leverage free or self-hosted providers on the Starter plan, and advanced options on Premium and Enterprise plans, with the flexibility to use custom OIDC providers for up to three users on the Free plan. Tailscale is actively validating and documenting popular identity providers, including integrations with Ory and ZITADEL, which are designed to enhance security and user management in line with compliance and access control requirements. Additionally, Tailscale supports free and open-source identity solutions for non-critical uses or personal projects, and offers detailed documentation for setting up custom OIDC, while encouraging feedback for potential new integrations.

Tailscale has announced the launch of Tailscale Enterprise, an offering designed for organizations with advanced compliance, security, and support needs, building on its existing success with companies like Instacart and Duolingo. Tailscale operates on the principles of Zero Trust Networking, using its private networks as overlays on existing infrastructure to ensure encrypted and authenticated traffic. The enterprise version introduces features such as network flow logging, user and group provisioning using SCIM, and the use of custom OpenID Connect (OIDC) providers, allowing organizations to integrate Tailscale with their established security processes. Additionally, the "tailnet lock" feature gives customers more control over device authorization, while usage-based billing ensures companies pay only for their active users. The new enterprise features aim to simplify network management while enhancing security, making it easier for teams to focus on critical projects without the burden of complex configurations.

Tailscale has introduced its third generation of pricing plans, expanding the Free plan to include three users and implementing usage-based billing for monthly paid plans to charge only for active users. These changes aim to reduce friction in transitioning from single-user to multi-user tailnets, a key growth point identified by Tailscale. The new structure is expected to lower costs for most users, with existing annual and enterprise plans remaining unaffected unless users opt into the new pricing. By focusing on user activation and retention, Tailscale aligns its incentives with customer success, ensuring they only pay for users actively benefiting from the service. Additionally, Tailscale has removed certain usage limits, such as those on subnet routers and admin accounts, to improve user experience and accommodate increased node creation. The company also outlines safeguards against unexpectedly high bills under the new usage-based billing model and continues to offer flexible billing options for different business needs.

Tailscale has implemented a series of performance enhancements to the wireguard-go userspace WireGuard implementation, resulting in improved client throughput on Linux, surpassing 10Gb/s on bare metal Linux and outperforming the in-kernel WireGuard implementation. These improvements, achieved through UDP segmentation offload, UDP generic receive offload, and checksum optimizations, are included in the unstable Tailscale client release and the upcoming Tailscale v1.40. The modifications allow Tailscale to join the 10Gb/s club by optimizing packet processing, thus reducing CPU cycles per byte and enhancing overall throughput. Testing was conducted on various systems, including AWS instances and bare metal servers, showing significant improvements in network performance, with some hardware configurations benefiting from hardware UDP segmentation offload. The post emphasizes that while benchmark results may vary, the optimizations have generally increased throughput by up to 35% and nearly doubled it in some cases, marking a significant milestone in network performance for Tailscale.

David Anderson's blog post humorously chronicles his experience of enhancing a Dreametech Z10 Pro robot vacuum cleaner with Tailscale, transforming it from a cloud-dependent IoT device into a more secure, independent system. Initially purchased to manage cat hair, the vacuum was found to be part of the Xiaomi Smart Home ecosystem, which raised concerns over privacy and security due to its cloud-based control. To regain control, Anderson jailbroke the device using Valetudo, an open-source platform that allows for cloud-free operation. He then implemented Tailscale to securely access and manage the vacuum's functions over a peer-to-peer network, addressing initial limitations like the lack of HTTPS through innovative solutions. Anderson also highlighted the option to use Headscale for those wary of any cloud involvement, emphasizing the learning experience and the quirky success of his project, which left his cats unimpressed but his vacuum cleaner notably more autonomous.

Tailscale Up, the inaugural community conference by Tailscale, is set to take place on May 31 at Dogpatch Studios in San Francisco, offering a day filled with talks, networking, and social events. Attendees will have the opportunity to connect with open source maintainers, hardware enthusiasts, and fellow Tailscale users, while enjoying presentations from notable speakers like Amye Scavarda Perrin, Justin Garrison, Emily Trau, and Corey Quinn, who will explore innovative uses of Tailscale in various domains. The event emphasizes a respectful and inclusive environment, adhering to a strict Code of Conduct, and will implement COVID-19 safety measures, including mask-wearing and on-site testing. Tickets are available on the developer community site, with early bird pricing ending on April 28. Attendees are encouraged to explore potential partnership opportunities and follow updates via social media to stay informed about the conference.

The blog post, originally an April Fool's joke from tailscale.dev, humorously explores the concept of using Tailscale's networking capabilities without relying on its SaaS control plane, instead employing Headscale, a self-hostable version of Tailscale's control plane. It describes an intricate setup involving the use of Funnel, a Tailscale feature that exposes services to the internet, to circumvent the traditional use of Tailscale, employing various virtual machine setups and configurations, such as NixOS and waifud, to achieve this. The narrative is laced with playful and surreal commentary, highlighting the absurdity of the endeavor while acknowledging the technical complexity involved. Despite the humorous and satirical tone, the piece offers a glimpse into the possibilities of reverse engineering and alternative uses of technology, albeit with a disclaimer on the potential instability and impracticality of the setup.