{"slug": "tailscale", "name": "Tailscale", "category": "networking", "category_name": "Networking and VPN", "description": "Mesh VPN built on WireGuard that connects devices into a private network.", "recommenders": 97, "commenters": 190, "warners": 9, "score": 99.213, "rising": 16.71, "first": "2025-11-03", "latest": "2026-10-30", "why": "HN commenters like Tailscale for near-trivial setup, secure remote access to home servers, media and dev machines without opening ports, and easier mesh management and NAT traversal than plain WireGuard.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 99, "neutral": 77, "compare": 16, "warn": 10}, "spark": [3, 4, 14, 9, 7, 8, 3, 5, 10, 10, 11, 15], "listed": true, "loved": ["Easy setup", "Remote dev access"], "caveat": "Security concerns", "short_quote": "I use Tailscale for exactly those reasons, plus the easy SSL certificates and clients for Android and iOS.", "icon": true, "domain": "tailscale.com", "github_repo": null, "official_url": "https://tailscale.com", "pricing": "freemium", "aliases": ["Tailscale"], "verdict": [{"text": "HN commenters like Tailscale for near-trivial setup", "cites": [{"id": 804077649, "item_id": 50254853, "url": "https://news.ycombinator.com/item?id=50254853", "by": "knowaveragejoe", "date": "2026-10-27", "stance": "recommend", "quote": "I use jellyfin remotely with tailscale. It was trivial to set up.", "excerpt": "I use jellyfin remotely with tailscale. It was trivial to set up. There's probably a dozen other holepunching mesh VPN approaches that would also work. Not to mention Iroh is in the mix now too.", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Disney Raising Prices Days After Confirming Ads Will Now Show Up on Every Tier"}, {"id": 800274240, "item_id": 50017140, "url": "https://news.ycombinator.com/item?id=50017140", "by": "t1ll", "date": "2026-10-09", "stance": "recommend", "quote": "Setup is simple with Tailscale", "excerpt": "I use my VPS mainly for development tasks. Moving from working locally to having the work done on a permanently running machine on the web was a real unlock for me. Setup is simple with Tailscale, so I can sleep better, and Podium ADE, which is my development tool of choice", "context": "", "use_case": "remote dev VPS access", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 802576112, "item_id": 50161007, "url": "https://news.ycombinator.com/item?id=50161007", "by": "clundin22", "date": "2026-10-20", "stance": "recommend", "quote": "Tailscale is low touch", "excerpt": "I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Plex vulnerabilities being exploited in the wild to drop a cryptominer"}, {"id": 791026416, "item_id": 49439151, "url": "https://news.ycombinator.com/item?id=49439151", "by": "geophile", "date": "2026-08-25", "stance": "recommend", "quote": "Tailscale is wonderful magic. Free (for my usage), so easy to set up", "excerpt": "Slightly off-topic: I decided to go with a Mac Mini to start playing with AI. My daily driver is a Linux laptop (with a negligible GPU). I also have a few Raspberry Pi machines for backup, and a low-end AWS server. I was always cobbling together ad hoc network access, to get from one machine to another. Access to my Mac Mini while traveling was a pain. Bringing it with me is ridiculous, and network access was a PITA.", "context": "Linux laptop daily driver, Mac Mini for AI", "use_case": "remote access to Mac Mini", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}]}, {"text": ", secure remote access to home servers, media and dev machines without opening ports", "cites": [{"id": 792230416, "item_id": 49514401, "url": "https://news.ycombinator.com/item?id=49514401", "by": "CrimsonCape", "date": "2026-08-31", "stance": "recommend", "quote": "I've been running a home server and Tailscale is magic.", "excerpt": "I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join. I use it in 3 ways: 1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a s", "context": "runs a home server", "use_case": "remote access to home server", "switched_from": "", "story": "Internet centralization and the original sin of NAT"}, {"id": 788945664, "item_id": 49309104, "url": "https://news.ycombinator.com/item?id=49309104", "by": "hn_throw2025", "date": "2026-08-15", "stance": "recommend", "quote": "I ssh in via Tailscale.", "excerpt": "I agree with you. I\u2019m reading this thread and wondering if I\u2019m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban. I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass b", "context": "runs a cloud VPS", "use_case": "SSH access to cloud VPS", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 793706145, "item_id": 49606634, "url": "https://news.ycombinator.com/item?id=49606634", "by": "vulkoingim", "date": "2026-09-08", "stance": "recommend", "quote": "coupled with Tailscale I can access everything on my Nas everywhere", "excerpt": "Yeaah, second that! I use it on the AppleTV and across the rest of my devices! Works like a charm, and coupled with Tailscale I can access everything on my Nas everywhere :) I have it configured to use Jellyfin as the source, runing on said nas", "context": "", "use_case": "remote access to NAS", "switched_from": "", "story": "Jellyfin 12.0"}, {"id": 798377202, "item_id": 49898575, "url": "https://news.ycombinator.com/item?id=49898575", "by": "simlevesque", "date": "2026-09-29", "stance": "recommend", "quote": "I use Claude Code + eternal terminal + tailscale + tmux", "excerpt": "I use Claude Code + eternal terminal + tailscale + tmux + some custom skills to get notifications through nfty.sh. I get the same UX on every platform, works perfectly on very low bandwith environments such as in a cabin, in the subway or in the middle of nowhere. I tried using other harness such as Pi and opencode but I did not like them. If Claude Code gets weird I can swap in an instant. You just need to follow th", "context": "", "use_case": "remote access", "switched_from": "", "story": "GPT 6.1 Sol: Near-Astra intelligence for a fifth of the price"}]}, {"text": ", and easier mesh management and NAT traversal than plain WireGuard.", "cites": [{"id": 800335984, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "recommend", "quote": "Today I use Tailscale (with Headscale as the control plane) for all users", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "home lab mesh VPN", "switched_from": "WireGuard", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 782669600, "item_id": 48916850, "url": "https://news.ycombinator.com/item?id=48916850", "by": "MobiusHorizons", "date": "2026-07-14", "stance": "recommend", "quote": "the main reason I use it over self hosting wireguard is the NAT busting it does", "excerpt": "I think Tailscale is popular because of how plug and play it is for most people. Although the main reason I use it over self hosting wireguard is the NAT busting it does, which has so far worked flawlessly for me with no setup aside from installing on both devices. There is nothing wrong with self hosting wireguard, but it doesn't actually do the same job as tailscale.", "context": "", "use_case": "NAT traversal between devices", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}, {"id": 800409493, "item_id": 50025593, "url": "https://news.ycombinator.com/item?id=50025593", "by": "MayeulC", "date": "2026-10-09", "stance": "recommend", "quote": "Tailscale is much easier to manage for full mesh and just adding personal devices.", "excerpt": "Well, I have a VPS, plus multiple physical servers in different locations (parents, etc). The VPS is useful for: - sending e-mails (hard to improve your reputation on residential IPs and get a reverse DNS record) - Unifi controller, though I appreciate Unifi less and less. - Uptime monitoring / status page - I think I'll move my headscale node there, since it has the highest availability -- Internet was out for a wee", "context": "", "use_case": "mesh VPN for personal devices", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}]}, {"text": " The most common caveat is distrust of its large feature surface and concern that it has not been formally security audited", "cites": [{"id": 804248192, "item_id": 50265512, "url": "https://news.ycombinator.com/item?id=50265512", "by": "aborsy", "date": "2026-10-27", "stance": "warn", "quote": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it", "excerpt": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set. I use it extensively, and I would rather pay them a fee if they could review thr code. A possibility is a lock down mode, disabling risky features. I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node shari", "context": "", "use_case": "VPN connectivity", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 786048672, "item_id": 49128042, "url": "https://news.ycombinator.com/item?id=49128042", "by": "traceroute66", "date": "2026-07-31", "stance": "warn", "quote": "But for a security tool they need to up their game seriously.", "excerpt": "> I can \"trust\" that they know what they're doing I wish I could say the same. At $work we use Tailscale but only bare minimum and at arms length and only because we have to (people were having NAT issues with standard Wireguard). None of their code has had a security audit, let alone regular ones. Yes they make a big song and dance about SOC2/ISO27001 but that is NOT the same thing, that's just shiny tick-boxes for ", "context": "uses it at work only because they have to", "use_case": "VPN at work", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 782700992, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "warn", "quote": "But we don't trust Tailscale.", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "works at a company using it via hardened bastion hosts", "use_case": "VPN behind bastion hosts", "switched_from": "WireGuard", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}]}, {"text": ", with smaller complaints about pricing tiers, iPhone battery drain and client logging.", "cites": [{"id": 796149025, "item_id": 49759314, "url": "https://news.ycombinator.com/item?id=49759314", "by": "drcongo", "date": "2026-09-18", "stance": "warn", "quote": "I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers", "excerpt": "I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.", "context": "", "use_case": "SSH access", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796173568, "item_id": 49760848, "url": "https://news.ycombinator.com/item?id=49760848", "by": "girvo", "date": "2026-09-18", "stance": "recommend", "quote": "I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now", "excerpt": "I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now", "context": "", "use_case": "private networking", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 785501936, "item_id": 49093871, "url": "https://news.ycombinator.com/item?id=49093871", "by": "Lammy", "date": "2026-07-28", "stance": "warn", "quote": "Otherwise Tailscale (the company) will be collecting your behavioral metadata every time you use your Kindle", "excerpt": "You will probably also want to add `--no-logs-no-support` (don't mind the FUD-y argument name) to the scripted invocation of `tailscaled` here: https://github.com/victoria-riley-barnett/koreader-tailscale/blob/993642a/bin/start_tailscale.sh#L23 Otherwise Tailscale (the company) will be collecting your behavioral metadata every time you use your Kindle (what other hosts it connects to, on what ports, connection open a", "context": "", "use_case": "VPN on Kindle", "switched_from": "", "story": "More Tailscale tricks for your jailbroken Kindle"}]}], "praise": [{"label": "Easy setup", "summary": "Commenters describe it as trivial, low-touch and simple to set up.", "quotes": [{"id": 804077649, "item_id": 50254853, "url": "https://news.ycombinator.com/item?id=50254853", "by": "knowaveragejoe", "date": "2026-10-27", "stance": "recommend", "quote": "I use jellyfin remotely with tailscale. It was trivial to set up.", "excerpt": "I use jellyfin remotely with tailscale. It was trivial to set up. There's probably a dozen other holepunching mesh VPN approaches that would also work. Not to mention Iroh is in the mix now too.", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Disney Raising Prices Days After Confirming Ads Will Now Show Up on Every Tier"}, {"id": 802576112, "item_id": 50161007, "url": "https://news.ycombinator.com/item?id=50161007", "by": "clundin22", "date": "2026-10-20", "stance": "recommend", "quote": "Tailscale is low touch", "excerpt": "I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Plex vulnerabilities being exploited in the wild to drop a cryptominer"}, {"id": 791026416, "item_id": 49439151, "url": "https://news.ycombinator.com/item?id=49439151", "by": "geophile", "date": "2026-08-25", "stance": "recommend", "quote": "Tailscale is wonderful magic. Free (for my usage), so easy to set up", "excerpt": "Slightly off-topic: I decided to go with a Mac Mini to start playing with AI. My daily driver is a Linux laptop (with a negligible GPU). I also have a few Raspberry Pi machines for backup, and a low-end AWS server. I was always cobbling together ad hoc network access, to get from one machine to another. Access to my Mac Mini while traveling was a pain. Bringing it with me is ridiculous, and network access was a PITA.", "context": "Linux laptop daily driver, Mac Mini for AI", "use_case": "remote access to Mac Mini", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}]}, {"label": "Remote dev access", "summary": "Used to reach work machines, VPSes and coding agents from laptops and phones.", "quotes": [{"id": 798377202, "item_id": 49898575, "url": "https://news.ycombinator.com/item?id=49898575", "by": "simlevesque", "date": "2026-09-29", "stance": "recommend", "quote": "I use Claude Code + eternal terminal + tailscale + tmux", "excerpt": "I use Claude Code + eternal terminal + tailscale + tmux + some custom skills to get notifications through nfty.sh. I get the same UX on every platform, works perfectly on very low bandwith environments such as in a cabin, in the subway or in the middle of nowhere. I tried using other harness such as Pi and opencode but I did not like them. If Claude Code gets weird I can swap in an instant. You just need to follow th", "context": "", "use_case": "remote access", "switched_from": "", "story": "GPT 6.1 Sol: Near-Astra intelligence for a fifth of the price"}, {"id": 803820161, "item_id": 50238760, "url": "https://news.ycombinator.com/item?id=50238760", "by": "bilalq", "date": "2026-10-26", "stance": "recommend", "quote": "The built-in terminal app also works nicely with herdr and Tailscale to let me connect to my work machine.", "excerpt": "I love my Pixel 10 Fold and can't imagine ever going back to a non-foldable now. The larger screen is great for productivity. Reviewing PRs on the larger screen is way more comfortable than a normal phone size. The built-in terminal app also works nicely with herdr and Tailscale to let me connect to my work machine. I can interact with my agents and get real work done on the go. I also have saved split views so I can", "context": "mobile app developer", "use_case": "connect to work machine", "switched_from": "", "story": "iPhone Duo Teardown"}, {"id": 779574512, "item_id": 48723407, "url": "https://news.ycombinator.com/item?id=48723407", "by": "zdragnar", "date": "2026-06-29", "stance": "recommend", "quote": "Tailscale lets me use it from my ultrabook / lightweight laptop, no burning lap or crazy fan noises.", "excerpt": "I got mine at the same price point, and I've been pretty pleased with it. Tailscale lets me use it from my ultrabook / lightweight laptop, no burning lap or crazy fan noises. Desktops with the amd ai+ 395 are still fairly affordable for what they can do. I haven't tried it with https://lemonade-server.ai/ yet but I just might give it a shot.", "context": "owns an AMD Strix Halo desktop", "use_case": "remote access to home desktop", "switched_from": "", "story": "Qwen 3.6 27B is the sweet spot for local development"}]}, {"label": "Home server access", "summary": "Lets people reach self-hosted media, NAS and files behind NAT while away.", "quotes": [{"id": 792230416, "item_id": 49514401, "url": "https://news.ycombinator.com/item?id=49514401", "by": "CrimsonCape", "date": "2026-08-31", "stance": "recommend", "quote": "I've been running a home server and Tailscale is magic.", "excerpt": "I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join. I use it in 3 ways: 1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a s", "context": "runs a home server", "use_case": "remote access to home server", "switched_from": "", "story": "Internet centralization and the original sin of NAT"}, {"id": 793706145, "item_id": 49606634, "url": "https://news.ycombinator.com/item?id=49606634", "by": "vulkoingim", "date": "2026-09-08", "stance": "recommend", "quote": "coupled with Tailscale I can access everything on my Nas everywhere", "excerpt": "Yeaah, second that! I use it on the AppleTV and across the rest of my devices! Works like a charm, and coupled with Tailscale I can access everything on my Nas everywhere :) I have it configured to use Jellyfin as the source, runing on said nas", "context": "", "use_case": "remote access to NAS", "switched_from": "", "story": "Jellyfin 12.0"}, {"id": 784593344, "item_id": 49037084, "url": "https://news.ycombinator.com/item?id=49037084", "by": "austin-cheney", "date": "2026-07-24", "stance": "recommend", "quote": "I use the free tier of TailScale to expose my home network to specific devices in the public world.", "excerpt": "I am on budget hardware. Do not let this stop you. I bought a really crappy cheap box for $300 before hardware prices went crazy. My hard drives don't even fit in the case. As for NAT I use the free tier of TailScale to expose my home network to specific devices in the public world. This way I can play my media or access my files, that are behind NAT, from across the country when traveling. If you would like to talk ", "context": "self-hoster on budget hardware", "use_case": "access home network behind NAT", "switched_from": "", "story": "Ask HN: Share Your Eccentric Hobby"}]}, {"label": "Security posture", "summary": "Lets users keep firewalls closed and reach services only over the tailnet.", "quotes": [{"id": 792230416, "item_id": 49514401, "url": "https://news.ycombinator.com/item?id=49514401", "by": "CrimsonCape", "date": "2026-08-31", "stance": "recommend", "quote": "I've been running a home server and Tailscale is magic.", "excerpt": "I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join. I use it in 3 ways: 1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a s", "context": "runs a home server", "use_case": "remote access to home server", "switched_from": "", "story": "Internet centralization and the original sin of NAT"}, {"id": 788945664, "item_id": 49309104, "url": "https://news.ycombinator.com/item?id=49309104", "by": "hn_throw2025", "date": "2026-08-15", "stance": "recommend", "quote": "I ssh in via Tailscale.", "excerpt": "I agree with you. I\u2019m reading this thread and wondering if I\u2019m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban. I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass b", "context": "runs a cloud VPS", "use_case": "SSH access to cloud VPS", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 799415312, "item_id": 49963457, "url": "https://news.ycombinator.com/item?id=49963457", "by": "DuncanCoffee", "date": "2026-10-05", "stance": "recommend", "quote": "the foundation of my entire approach to security is Tailscale", "excerpt": "it's a vnc port, it'd also require the router to have it opened. Reading the article I think the user opened it themselves. It does get opened automagically on the mac side when screen sharing is turned on. > The problem is that for my particular use case \u2014 a headless, always-on Mac Mini that I primarily access from other computers and my phone through the ChatGPT and Claude apps \u2014 macOS is incredibly hostile > As no", "context": "headless always-on Mac Mini user", "use_case": "securing remote access to Mac Mini", "switched_from": "", "story": "Apple and a hacker's future"}]}, {"label": "Beats WireGuard", "summary": "Preferred over self-managed WireGuard for many devices and for NAT busting.", "quotes": [{"id": 800335984, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "recommend", "quote": "Today I use Tailscale (with Headscale as the control plane) for all users", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "home lab mesh VPN", "switched_from": "WireGuard", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 782669600, "item_id": 48916850, "url": "https://news.ycombinator.com/item?id=48916850", "by": "MobiusHorizons", "date": "2026-07-14", "stance": "recommend", "quote": "the main reason I use it over self hosting wireguard is the NAT busting it does", "excerpt": "I think Tailscale is popular because of how plug and play it is for most people. Although the main reason I use it over self hosting wireguard is the NAT busting it does, which has so far worked flawlessly for me with no setup aside from installing on both devices. There is nothing wrong with self hosting wireguard, but it doesn't actually do the same job as tailscale.", "context": "", "use_case": "NAT traversal between devices", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}, {"id": 783707329, "item_id": 48981708, "url": "https://news.ycombinator.com/item?id=48981708", "by": "dpoloncsak", "date": "2026-07-20", "stance": "recommend", "quote": "Before I moved to Tailscale, my self-hosted Wireguard setup was pretty shaky", "excerpt": "Steam Link creates an RDP session (I assume their own protocol but for lack of a better term for it) that lets me control my Desktop from my phone. Once I'm remote on the desktop, I can access my home-lab locally instead of via VPN. Before I moved to Tailscale, my self-hosted Wireguard setup was pretty shaky, and was running on an old Pi that had seen better days. It's basically just using Steam to jump-box to my LAN", "context": "has a home-lab", "use_case": "home-lab access", "switched_from": "WireGuard", "story": "Moonshine: Lets you stream games from your PC to any device running Moonlight"}]}, {"label": "Free tier", "summary": "Several users say the free tier covers their usage well.", "quotes": [{"id": 794963248, "item_id": 49685203, "url": "https://news.ycombinator.com/item?id=49685203", "by": "austin-cheney", "date": "2026-09-13", "stance": "recommend", "quote": "I use TailScale's free tier and its great.", "excerpt": "For strictly personal stuff, like my home network, isolate behind a router to block all outside traffic. Then install a VPN on your home server so that you can remote in via a tunnel. I use TailScale's free tier and its great. If that is not good enough then do the same as above but lock everything behind PKI certificate access and make all your home services accessible only via mTLS. This is huge pain in the ass, bu", "context": "", "use_case": "remote access to home network", "switched_from": "", "story": "Ask HN: Should we start airgapping our personal devices?"}, {"id": 791026416, "item_id": 49439151, "url": "https://news.ycombinator.com/item?id=49439151", "by": "geophile", "date": "2026-08-25", "stance": "recommend", "quote": "Tailscale is wonderful magic. Free (for my usage), so easy to set up", "excerpt": "Slightly off-topic: I decided to go with a Mac Mini to start playing with AI. My daily driver is a Linux laptop (with a negligible GPU). I also have a few Raspberry Pi machines for backup, and a low-end AWS server. I was always cobbling together ad hoc network access, to get from one machine to another. Access to my Mac Mini while traveling was a pain. Bringing it with me is ridiculous, and network access was a PITA.", "context": "Linux laptop daily driver, Mac Mini for AI", "use_case": "remote access to Mac Mini", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}, {"id": 800477936, "item_id": 50029871, "url": "https://news.ycombinator.com/item?id=50029871", "by": "hebetude", "date": "2026-10-10", "stance": "recommend", "quote": "Tailscale >>> wireguard.", "excerpt": "Public IP because I\u2019m on cell home Internet. It started for hosting \u201cLinux isos\u201d but has morphed into dozen or so hobby projects. Tailscale >>> wireguard. I have no idea why my usage is still free. I use it a lot", "context": "", "use_case": "VPS networking", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}]}], "caveats": [{"label": "Security concerns", "summary": "Some worry about its large attack surface and lack of formal security audits.", "quotes": [{"id": 804248192, "item_id": 50265512, "url": "https://news.ycombinator.com/item?id=50265512", "by": "aborsy", "date": "2026-10-27", "stance": "warn", "quote": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it", "excerpt": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set. I use it extensively, and I would rather pay them a fee if they could review thr code. A possibility is a lock down mode, disabling risky features. I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node shari", "context": "", "use_case": "VPN connectivity", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 786048672, "item_id": 49128042, "url": "https://news.ycombinator.com/item?id=49128042", "by": "traceroute66", "date": "2026-07-31", "stance": "warn", "quote": "But for a security tool they need to up their game seriously.", "excerpt": "> I can \"trust\" that they know what they're doing I wish I could say the same. At $work we use Tailscale but only bare minimum and at arms length and only because we have to (people were having NAT issues with standard Wireguard). None of their code has had a security audit, let alone regular ones. Yes they make a big song and dance about SOC2/ISO27001 but that is NOT the same thing, that's just shiny tick-boxes for ", "context": "uses it at work only because they have to", "use_case": "VPN at work", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 782700992, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "warn", "quote": "But we don't trust Tailscale.", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "works at a company using it via hardened bastion hosts", "use_case": "VPN behind bastion hosts", "switched_from": "WireGuard", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}]}, {"label": "ACL gaps", "summary": "Taildrop can let untagged nodes send files despite deny-by-default ACLs.", "quotes": [{"id": 804305408, "item_id": 50269088, "url": "https://news.ycombinator.com/item?id=50269088", "by": "aborsy", "date": "2026-10-28", "stance": "warn", "quote": "But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable.", "excerpt": "Tailnet owner may not trust all their devices to the same extent. Here is a concrete example. I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don'", "context": "", "use_case": "connect VPS and laptop", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804248192, "item_id": 50265512, "url": "https://news.ycombinator.com/item?id=50265512", "by": "aborsy", "date": "2026-10-27", "stance": "warn", "quote": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it", "excerpt": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set. I use it extensively, and I would rather pay them a fee if they could review thr code. A possibility is a lock down mode, disabling risky features. I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node shari", "context": "", "use_case": "VPN connectivity", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}]}, {"label": "Pricing tiers", "summary": "One user left because the first paid tier lacked SSH features.", "quotes": [{"id": 796149025, "item_id": 49759314, "url": "https://news.ycombinator.com/item?id=49759314", "by": "drcongo", "date": "2026-09-18", "stance": "warn", "quote": "I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers", "excerpt": "I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.", "context": "", "use_case": "SSH access", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"label": "iPhone battery", "summary": "One user stopped using it on iPhone due to heavy battery drain.", "quotes": [{"id": 796173568, "item_id": 49760848, "url": "https://news.ycombinator.com/item?id=49760848", "by": "girvo", "date": "2026-09-18", "stance": "recommend", "quote": "I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now", "excerpt": "I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now", "context": "", "use_case": "private networking", "switched_from": "", "story": "Cloudflare Quick Tunnels"}]}, {"label": "Client logging", "summary": "The client sends connection metadata to Tailscale unless logging is disabled.", "quotes": [{"id": 785501936, "item_id": 49093871, "url": "https://news.ycombinator.com/item?id=49093871", "by": "Lammy", "date": "2026-07-28", "stance": "warn", "quote": "Otherwise Tailscale (the company) will be collecting your behavioral metadata every time you use your Kindle", "excerpt": "You will probably also want to add `--no-logs-no-support` (don't mind the FUD-y argument name) to the scripted invocation of `tailscaled` here: https://github.com/victoria-riley-barnett/koreader-tailscale/blob/993642a/bin/start_tailscale.sh#L23 Otherwise Tailscale (the company) will be collecting your behavioral metadata every time you use your Kindle (what other hosts it connects to, on what ports, connection open a", "context": "", "use_case": "VPN on Kindle", "switched_from": "", "story": "More Tailscale tricks for your jailbroken Kindle"}]}, {"label": "Reliability", "summary": "One user reports the Tailscale server periodically becomes unreachable until reinstalled.", "quotes": [{"id": 783936754, "item_id": 48996047, "url": "https://news.ycombinator.com/item?id=48996047", "by": "IAmBroom", "date": "2026-07-21", "stance": "warn", "quote": "periodically my system will refuse to see the Tailscale server", "excerpt": "I'd prefer to be exclusively on Jellyfin. It simply has more features that I use - specifically, collections are great non-hierarchical groupings. But periodically my system will refuse to see the Tailscale server, and I'll have to do some black magic tech operation like reinstalling to get it back. Additionally, guiding a friend remotely through installing both Jellyfin and Tailscale is far more effort than saying, ", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Jellyfin founder Andrew leaves team"}]}], "who": [{"by": "mark_l_watson", "context": "uses multiple Macs", "url": "https://news.ycombinator.com/item?id=50299335", "date": "2026-10-30"}, {"by": "orangeboats", "context": "on CGNATed residential internet in South East Asia", "url": "https://news.ycombinator.com/item?id=50288937", "date": "2026-10-29"}, {"by": "brightball", "context": "runs a conference", "url": "https://news.ycombinator.com/item?id=50260895", "date": "2026-10-27"}, {"by": "bilalq", "context": "mobile app developer", "url": "https://news.ycombinator.com/item?id=50238760", "date": "2026-10-26"}, {"by": "austin-cheney", "context": "self-hosts on a home server", "url": "https://news.ycombinator.com/item?id=50110135", "date": "2026-10-15"}, {"by": "AlexAltea", "context": "home lab with 10+ devices", "url": "https://news.ycombinator.com/item?id=50020999", "date": "2026-10-09"}, {"by": "mrngld", "context": "runs on a Raspberry Pi", "url": "https://news.ycombinator.com/item?id=50020170", "date": "2026-10-09"}, {"by": "wraptile", "context": "self-hosts on refurbished laptops", "url": "https://news.ycombinator.com/item?id=50017667", "date": "2026-10-09"}, {"by": "bananadonkey", "context": "shares network with friends, family and colleagues", "url": "https://news.ycombinator.com/item?id=50016574", "date": "2026-10-09"}, {"by": "agnishom", "context": "no router access", "url": "https://news.ycombinator.com/item?id=50015048", "date": "2026-10-09"}, {"by": "mceleri", "context": "developer", "url": "https://news.ycombinator.com/item?id=50012420", "date": "2026-10-08"}, {"by": "DuncanCoffee", "context": "headless always-on Mac Mini user", "url": "https://news.ycombinator.com/item?id=49963457", "date": "2026-10-05"}], "tags": ["for homelabs", "for remote coding", "for media streaming", "self-hostable via Headscale", "for sharing with family"], "use_cases": ["vpn", "remote access", "networking", "mesh vpn", "private network access", "remote access to jellyfin"], "compared": [{"slug": "wireguard", "name": "WireGuard", "co": 25, "switched_from": 4, "switched_to": 1}, {"slug": "headscale", "name": "Headscale", "co": 17, "switched_from": 0, "switched_to": 0}, {"slug": "netbird", "name": "NetBird", "co": 11, "switched_from": 0, "switched_to": 2}, {"slug": "tmux", "name": "tmux", "co": 12, "switched_from": 0, "switched_to": 0}, {"slug": "claude-code", "name": "Claude Code", "co": 12, "switched_from": 0, "switched_to": 0}, {"slug": "jellyfin", "name": "Jellyfin", "co": 12, "switched_from": 0, "switched_to": 0}, {"slug": "iroh", "name": "Iroh", "co": 10, "switched_from": 0, "switched_to": 0}, {"slug": "cloudflare-tunnel", "name": "Cloudflare Tunnel", "co": 7, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 786054832, "item_id": 49128427, "url": "https://news.ycombinator.com/item?id=49128427", "by": "apenwarr", "date": "2026-07-31", "stance": "recommend", "quote": "The problems that are found internally, or via security reviews and pentests we pay for, are ones that we fix before releasing.", "excerpt": "(Tailscale CEO) I don't know what to tell you. The problems that are found internally, or via security reviews and pentests we pay for, are ones that we fix before releasing. They don't need bulletins. Bugs that are found by other people are found, by definition, after release. They are therefore more likely to need a bulletin.", "context": "Tailscale CEO", "use_case": "VPN / networking", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 756105793, "item_id": 47256612, "url": "https://news.ycombinator.com/item?id=47256612", "by": "valattailscale", "date": "2026-03-04", "stance": "recommend", "quote": "We love to see people's creativity with Tailscale! - Val @ Tailscale", "excerpt": "This is so cool! We are nerding out about this project. We love to see people's creativity with Tailscale! - Val @ Tailscale", "context": "works at Tailscale", "use_case": "", "switched_from": "", "story": "Show HN: Tspages \u2013 static site hosting platform for your Tailscale network"}, {"id": 753143936, "item_id": 47071496, "url": "https://news.ycombinator.com/item?id=47071496", "by": "raggi", "date": "2026-02-19", "stance": "recommend", "quote": "We integrate with systemd-resolved _by preference_ on Linux if it is present", "excerpt": "It's difficult for us to maintain documentation of exactly the kind you'd want there, though we do try to keep up with docs as best we can. In particular there is a fairly wide array of heuristics in the client to adapt to the environment that it's running in - and this is most true on Linux where there are far far too many different configuration patterns and duplicate subsystems (example: https://tailscale.com/blog", "context": "Tailscale team member", "use_case": "VPN networking", "switched_from": "", "story": "Tailscale Peer Relays is now generally available"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49985548", "title": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?", "mentions": 11}, {"url": "https://news.ycombinator.com/item?id=50264857", "title": "Tailscale SSH: Investigation and remediation update", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=49127306", "title": "Tailscale didn't stop the Hugging Face intrusion", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=49754785", "title": "Cloudflare Quick Tunnels", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=47592462", "title": "I traced my traffic through a home Tailscale exit node", "mentions": 5}, {"url": "https://news.ycombinator.com/item?id=46844870", "title": "Netbird a German Tailscale alternative (P2P WireGuard-based overlay network)", "mentions": 5}], "sentiment_by_month": {"2025-11": {"recommend": 3, "neutral": 2}, "2025-12": {"neutral": 4, "recommend": 4}, "2026-01": {"recommend": 14, "compare": 2, "neutral": 2, "warn": 1}, "2026-02": {"neutral": 4, "recommend": 9}, "2026-03": {"recommend": 7, "compare": 2, "neutral": 1}, "2026-04": {"recommend": 8, "neutral": 3, "compare": 2}, "2026-05": {"neutral": 3, "recommend": 3}, "2026-06": {"neutral": 11, "warn": 1, "recommend": 5, "compare": 1}, "2026-07": {"neutral": 12, "recommend": 10, "warn": 4, "compare": 2}, "2026-08": {"recommend": 10, "compare": 2, "neutral": 7, "warn": 2}, "2026-09": {"neutral": 13, "recommend": 11, "compare": 1, "warn": 1}, "2026-10": {"compare": 4, "recommend": 15, "neutral": 15, "warn": 1}}, "quotes": [{"id": 804925044, "item_id": 50307815, "url": "https://news.ycombinator.com/item?id=50307815", "by": "sybhn", "date": "2026-10-30", "stance": "neutral", "quote": "I run this on a Tailscale network.", "excerpt": "If you run a bunch of coding agents in parallel (Claude Code, Codex and Copilot in my case), on different projects, you've probably noticed that it only works for so long until you run into coordination problems. I tried relying on GitHub primitives and conventions only: PRs, issues, labels. It works in long-lived interactive sessions, but with short-lived bots things fall through the cracks: reviews aren't always ac", "context": "", "use_case": "networking local machines", "switched_from": "", "story": "Show HN: Bot_board \u2013 A message board for code harnesses collaboration"}, {"id": 804831665, "item_id": 50301979, "url": "https://news.ycombinator.com/item?id=50301979", "by": "wallst07", "date": "2026-10-30", "stance": "neutral", "quote": "I use it only with tailscale.", "excerpt": "I use https://github.com/0cv/herdr-mobile-relay I use it only with tailscale.", "context": "", "use_case": "networking", "switched_from": "", "story": "Herdr has released native app"}, {"id": 804800961, "item_id": 50300060, "url": "https://news.ycombinator.com/item?id=50300060", "by": "77ko", "date": "2026-10-30", "stance": "recommend", "quote": "For a single person with herdr+tailscale, you can make your own evolving software thingamajig across all the possible computers u have access to", "excerpt": "Herdr is truly awesome. Game changing almost. If you think of all the overly complex agent setups[1] and overly complex software factories[2] to write code... herdr and a pick-your-coding-agent replaces all that with a very simple one thing which just works. There are many ways to do what herdr does, like tmux, and rex, but in a nutshell: You launch cli things (claude code, cli tools etc) anywhere inside a herdr proc", "context": "", "use_case": "connecting machines", "switched_from": "", "story": "Herdr has released native app"}, {"id": 804789362, "item_id": 50299335, "url": "https://news.ycombinator.com/item?id=50299335", "by": "mark_l_watson", "date": "2026-10-30", "stance": "neutral", "quote": "I use multiple Macs with Tailscale connections", "excerpt": "Nice! I have been using herdr for a few months, love it and for me it is a step up from years using tmux. The new native Herdr app is yet another step up. I use multiple Macs with Tailscale connections and the Herdr app makes jumping around to different projects and different machines easier.", "context": "uses multiple Macs", "use_case": "connecting multiple Macs", "switched_from": "", "story": "Herdr has released native app"}, {"id": 804622993, "item_id": 50288937, "url": "https://news.ycombinator.com/item?id=50288937", "by": "orangeboats", "date": "2026-10-29", "stance": "neutral", "quote": "relying on a centralized service like Zerotier and Tailscale", "excerpt": "That explains a lot of the sentiments I've seen on HN then... I, unfortunately, have been on CGNATed residential internet since 2016, though I used to still get a public IP on request (they stopped doing that though.) I live in South East Asia, for context. Without IPv6 my only choice would have been relying on a centralized service like Zerotier and Tailscale.", "context": "on CGNATed residential internet in South East Asia", "use_case": "workaround for CGNAT", "switched_from": "", "story": "If IPv4 were land"}, {"id": 804305408, "item_id": 50269088, "url": "https://news.ycombinator.com/item?id=50269088", "by": "aborsy", "date": "2026-10-28", "stance": "warn", "quote": "But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable.", "excerpt": "Tailnet owner may not trust all their devices to the same extent. Here is a concrete example. I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don'", "context": "", "use_case": "connect VPS and laptop", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804295488, "item_id": 50268468, "url": "https://news.ycombinator.com/item?id=50268468", "by": "kccqzy", "date": "2026-10-28", "stance": "neutral", "quote": "I make my sshd only listen on the Tailscale IP.", "excerpt": "I make my sshd only listen on the Tailscale IP. Then I don\u2019t even bother setting up SSH keys. I use password authentication, except on mobile where my password is too difficult to type with an onscreen keyboard.", "context": "", "use_case": "private network for SSH", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804269473, "item_id": 50266842, "url": "https://news.ycombinator.com/item?id=50266842", "by": "LeBit", "date": "2026-10-27", "stance": "compare", "quote": "it does not scale as well as tailscale.", "excerpt": "I used Nebula extensively. I really liked it. I like the idea of embedding firewall rules in a certificate. But , like you observed, it does not scale as well as tailscale.", "context": "", "use_case": "overlay networking", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804266736, "item_id": 50266671, "url": "https://news.ycombinator.com/item?id=50266671", "by": "scoodah", "date": "2026-10-27", "stance": "neutral", "quote": "just use regular old ssh over the tailnet, not tailscale ssh", "excerpt": "I\u2019ve used tailscale in quite a few jobs now and not one have we used tailscale ssh. Call us old school or whatever but at my current place of employment we provision ssh keys on a box with ansible and just use regular old ssh over the tailnet, not tailscale ssh", "context": "", "use_case": "private network for SSH", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804266448, "item_id": 50266653, "url": "https://news.ycombinator.com/item?id=50266653", "by": "lifeisloving", "date": "2026-10-27", "stance": "neutral", "quote": "I use tailnet as a vpn and ssh into my server via the tailnet, but I dont use tailscale ssh the product.", "excerpt": "I use tailnet as a vpn and ssh into my server via the tailnet, but I dont use tailscale ssh the product. I think most people fall into this bucket. Of course it should be taken seriously, but this topic is also piggy backing off of 7 days straight of non stop viral engagement farming on X after php2shell, where people we're farming likes by just posting stuff like \"YoU ThInK PhP2ShELl iS BaD JuST WaIt unTiL TaIlScAlE", "context": "", "use_case": "VPN to server", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804248192, "item_id": 50265512, "url": "https://news.ycombinator.com/item?id=50265512", "by": "aborsy", "date": "2026-10-27", "stance": "warn", "quote": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it", "excerpt": "There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set. I use it extensively, and I would rather pay them a fee if they could review thr code. A possibility is a lock down mode, disabling risky features. I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node shari", "context": "", "use_case": "VPN connectivity", "switched_from": "", "story": "Tailscale SSH: Investigation and remediation update"}, {"id": 804174320, "item_id": 50260895, "url": "https://news.ycombinator.com/item?id=50260895", "by": "brightball", "date": "2026-10-27", "stance": "recommend", "quote": "it sent me a temporary authorization link via Tailscale, connected to the machine and restarted the stuck process for me.", "excerpt": "A lot of things. The UX for non-code related activities is excellent. They've removed the friction from setting things up by giving each agent their own machine which can give you remote desktop. The process of creating and working with each agent is as simple as naming it and then explaining it's job. You can keep feeding them information, ask them to train themselves, etc. They can access anything you can, whether ", "context": "runs a conference", "use_case": "remote access to machines", "switched_from": "", "story": "Anthropic S-1"}, {"id": 804077649, "item_id": 50254853, "url": "https://news.ycombinator.com/item?id=50254853", "by": "knowaveragejoe", "date": "2026-10-27", "stance": "recommend", "quote": "I use jellyfin remotely with tailscale. It was trivial to set up.", "excerpt": "I use jellyfin remotely with tailscale. It was trivial to set up. There's probably a dozen other holepunching mesh VPN approaches that would also work. Not to mention Iroh is in the mix now too.", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Disney Raising Prices Days After Confirming Ads Will Now Show Up on Every Tier"}, {"id": 803820161, "item_id": 50238760, "url": "https://news.ycombinator.com/item?id=50238760", "by": "bilalq", "date": "2026-10-26", "stance": "recommend", "quote": "The built-in terminal app also works nicely with herdr and Tailscale to let me connect to my work machine.", "excerpt": "I love my Pixel 10 Fold and can't imagine ever going back to a non-foldable now. The larger screen is great for productivity. Reviewing PRs on the larger screen is way more comfortable than a normal phone size. The built-in terminal app also works nicely with herdr and Tailscale to let me connect to my work machine. I can interact with my agents and get real work done on the go. I also have saved split views so I can", "context": "mobile app developer", "use_case": "connect to work machine", "switched_from": "", "story": "iPhone Duo Teardown"}, {"id": 802614226, "item_id": 50163389, "url": "https://news.ycombinator.com/item?id=50163389", "by": "aurmc", "date": "2026-10-20", "stance": "neutral", "quote": "search for another app called Tailscale and now log in with my credentials", "excerpt": "Me. Or I did back when I used it. Now I\u2019m on Jellyfin but the point is the same. I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. \u201cInstall an app called Jellyfin on your smart TV\u201d is complicated enough for most people. \u201cAlso search for another app called Tailscale and now log in with my credentials, yes it\u2019s going to ask for control over your devic", "context": "", "use_case": "private access for non-technical users", "switched_from": "", "story": "Plex vulnerabilities being exploited in the wild to drop a cryptominer"}, {"id": 802576112, "item_id": 50161007, "url": "https://news.ycombinator.com/item?id=50161007", "by": "clundin22", "date": "2026-10-20", "stance": "recommend", "quote": "Tailscale is low touch", "excerpt": "I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.", "context": "", "use_case": "remote access to Jellyfin", "switched_from": "", "story": "Plex vulnerabilities being exploited in the wild to drop a cryptominer"}, {"id": 802415169, "item_id": 50150948, "url": "https://news.ycombinator.com/item?id=50150948", "by": "StepBroBD", "date": "2026-10-19", "stance": "compare", "quote": "similar to Tailscale and other existing solutions", "excerpt": "I answered some questions on lobsters and wanted to share them here as well: > I'm pretty dissatisfied with all the mesh VPNs options Me too! Especially so if you want to play with overlay network _intensively_ > From this I infer your project is some sort of alternative to the various mesh VPNs Yes. Not only this, I want ranet3 to interact nicely with other RFC compliant VPN (say any other ipsec apps on your phone o", "context": "", "use_case": "mesh VPN", "switched_from": "", "story": "Show HN: Ranet3 \u2013 High performance policy routed IPsec mesh SD-WAN"}, {"id": 801911618, "item_id": 50119476, "url": "https://news.ycombinator.com/item?id=50119476", "by": "Hikikomori", "date": "2026-10-16", "stance": "recommend", "quote": "Then you can use tailscale for remote access", "excerpt": "I would install latest ubuntu server. I use dockge that provides a simple web interface to manage docker compose files, most projects provide a ready to use compose file that you can copy paste. Then you can use tailscale for remote access, expose to the internet via your router, or expose services with Cloudflared tunnel if you have your own domain, I use cloudflare zero trust just to avoid exposing the service dire", "context": "", "use_case": "remote access", "switched_from": "", "story": "What I self-host"}, {"id": 801864114, "item_id": 50116507, "url": "https://news.ycombinator.com/item?id=50116507", "by": "bengalister", "date": "2026-10-16", "stance": "neutral", "quote": "I use tailscale (outside the k8s cluster) for connectivity.", "excerpt": "So far it is ok. I even have a usb zigbee dongle receiver in usb passthrough and the container in privileged mode. I am moving to the Apple ecosystem and I managed to have homekit bridge connected to Apple home. I had to use an avahi relay on the NixOS host for the discovery protocol to work. The home assistant is not the same network as my devices. The homekit bridge allows to configure the advertised IP. I use tail", "context": "", "use_case": "remote connectivity", "switched_from": "", "story": "What I self-host"}, {"id": 801762160, "item_id": 50110135, "url": "https://news.ycombinator.com/item?id=50110135", "by": "austin-cheney", "date": "2026-10-15", "stance": "neutral", "quote": "Right now everybody seems to be centering on vendor solutions like TailScale for this.", "excerpt": "People twist themselves into a knot talking about AI as the future. Its more of a bubble waiting to pop. Self hosting is the real disruptive future. The hardware to accomplish most things that we rely on from cloud vendors is absolutely trivial. My own home server is a used super cheap and tiny machine. The hard disks don't even fit in the box and yet it has plenty of CPU and memory to spare. The software is getting ", "context": "self-hosts on a home server", "use_case": "private network access", "switched_from": "", "story": "What I self-host"}, {"id": 801010353, "item_id": 50063147, "url": "https://news.ycombinator.com/item?id=50063147", "by": "flurly", "date": "2026-10-12", "stance": "compare", "quote": "the networking is very similar to tailscale", "excerpt": "the networking is very similar to tailscale, but the main use case is being able to spin up coding agents across your machines from a website. for example, i love being able to kick off agents from my phone when i\u2019m out and about.", "context": "", "use_case": "networking", "switched_from": "", "story": "Show HN: Runway.sh \u2013 one place to access all your machines, from anywhere"}, {"id": 800477936, "item_id": 50029871, "url": "https://news.ycombinator.com/item?id=50029871", "by": "hebetude", "date": "2026-10-10", "stance": "recommend", "quote": "Tailscale >>> wireguard.", "excerpt": "Public IP because I\u2019m on cell home Internet. It started for hosting \u201cLinux isos\u201d but has morphed into dozen or so hobby projects. Tailscale >>> wireguard. I have no idea why my usage is still free. I use it a lot", "context": "", "use_case": "VPS networking", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800460498, "item_id": 50028781, "url": "https://news.ycombinator.com/item?id=50028781", "by": "toppa33", "date": "2026-10-10", "stance": "neutral", "quote": "another MCP for other actions over Tailscale", "excerpt": "I use Notion too. Claude suggested a MCP in front of Notion with rules about how to update Notion pages, and another MCP for other actions over Tailscale.", "context": "", "use_case": "MCP access", "switched_from": "", "story": "Show HN: Edi Life OS \u2013 self-hosted life dashboard with an MCP server for AI"}, {"id": 800409493, "item_id": 50025593, "url": "https://news.ycombinator.com/item?id=50025593", "by": "MayeulC", "date": "2026-10-09", "stance": "recommend", "quote": "Tailscale is much easier to manage for full mesh and just adding personal devices.", "excerpt": "Well, I have a VPS, plus multiple physical servers in different locations (parents, etc). The VPS is useful for: - sending e-mails (hard to improve your reputation on residential IPs and get a reverse DNS record) - Unifi controller, though I appreciate Unifi less and less. - Uptime monitoring / status page - I think I'll move my headscale node there, since it has the highest availability -- Internet was out for a wee", "context": "", "use_case": "mesh VPN for personal devices", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800387154, "item_id": 50024197, "url": "https://news.ycombinator.com/item?id=50024197", "by": "sixdimensional", "date": "2026-10-09", "stance": "neutral", "quote": "route work to my local AI inference server through tailscale", "excerpt": "One thing in particular is bifrost[1] as an AI router, and it has worked really well and feels pretty solid. I can route across OpenRouter, native AI providers directly, and even route work to my local AI inference server through tailscale. It makes it very easy to work across providers and platforms. [1] https://github.com/maximhq/bifrost", "context": "", "use_case": "reaching local inference server", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800335984, "item_id": 50020999, "url": "https://news.ycombinator.com/item?id=50020999", "by": "AlexAltea", "date": "2026-10-09", "stance": "recommend", "quote": "Today I use Tailscale (with Headscale as the control plane) for all users", "excerpt": "Once you get to N = >10 devices, and expect some degree of decentralized communication between them you find yourself maintaining N^2 entries. Every change to the set of public keys, require you updating N entries. Things get worse once you want consistent rules on what-device-should-access-what. I initially used WireGuard, but as my home lab scaled, it became unwieldy. Some people could work around these limitations", "context": "home lab with 10+ devices", "use_case": "home lab mesh VPN", "switched_from": "WireGuard", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800322722, "item_id": 50020170, "url": "https://news.ycombinator.com/item?id=50020170", "by": "mrngld", "date": "2026-10-09", "stance": "recommend", "quote": "Codex/Claude Code alongside things like Cloudflare and Tailscale make self hosting far easier", "excerpt": "I use a Raspberry Pi, not a VPS -- as others state, Codex/Claude Code alongside things like Cloudflare and Tailscale make self hosting far easier. People have commented a lot already, but one thing I do that I haven't seen others already doing yet is I run a news summarization pipeline with Miniflux and Flatnotes. All my feeds are in one of two categories; Summarize and NoSummarize. Once a day, a script fires at ever", "context": "runs on a Raspberry Pi", "use_case": "exposing self-hosted services", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800282672, "item_id": 50017667, "url": "https://news.ycombinator.com/item?id=50017667", "by": "wraptile", "date": "2026-10-09", "stance": "recommend", "quote": "self-hosting over tailscale and cloudflare tunnels", "excerpt": "These VPS no longer make much sense for self-hosting imo. I have two refurbished 32gb ram Lenovo k14 laptops (250$ each) that I use for self-hosting over tailscale and cloudflare tunnels. This is a lot of compute and very little power use. One for personal self-hosted projects: languagetool, nextcloud, hister, syncthing, restic backups, vaultwarden, windmill. Another for public facing web apps I host through cloudfla", "context": "self-hosts on refurbished laptops", "use_case": "private access to self-hosted services", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800274240, "item_id": 50017140, "url": "https://news.ycombinator.com/item?id=50017140", "by": "t1ll", "date": "2026-10-09", "stance": "recommend", "quote": "Setup is simple with Tailscale", "excerpt": "I use my VPS mainly for development tasks. Moving from working locally to having the work done on a permanently running machine on the web was a real unlock for me. Setup is simple with Tailscale, so I can sleep better, and Podium ADE, which is my development tool of choice", "context": "", "use_case": "remote dev VPS access", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800265184, "item_id": 50016574, "url": "https://news.ycombinator.com/item?id=50016574", "by": "bananadonkey", "date": "2026-10-09", "stance": "recommend", "quote": "ACLs are super simple and work well, just dig into them.", "excerpt": "ACLs are super simple and work well, just dig into them. I use groups as rbac (one group per role), and share parts of my network with friends/family (game servers), and colleagues (work collab stuff, such as live coding). Toggling users on/off also works great, and disabled users don't count towards the limit.", "context": "shares network with friends, family and colleagues", "use_case": "private network access control", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800253056, "item_id": 50015816, "url": "https://news.ycombinator.com/item?id=50015816", "by": "agnishom", "date": "2026-10-09", "stance": "recommend", "quote": "I like putting it on everything I can. It is pretty easy to use.", "excerpt": "I use the VPS mainly to route traffic from my in-house server. I am sure there is a way to avoid tailscale, but I like putting it on everything I can. It is pretty easy to use.", "context": "", "use_case": "routing traffic to home server", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800240768, "item_id": 50015048, "url": "https://news.ycombinator.com/item?id=50015048", "by": "agnishom", "date": "2026-10-09", "stance": "neutral", "quote": "You can do this using tailscale or even rathole.", "excerpt": "I use such a computer to expose services from my home server. You can do this using tailscale or even rathole. (Sadly, I don't have access to the router to port forward packets to my home server directly.) Things I like to host: Jellyfin, Audiobookshelf, Karakeep, Deluge, Tailscale (for exit nodes, among other things) Other stuff I want to host but not yet: Immich, Vaultwarden, Hister, Archibebox, CopyParty", "context": "no router access", "use_case": "exposing home server services", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 800198720, "item_id": 50012420, "url": "https://news.ycombinator.com/item?id=50012420", "by": "mceleri", "date": "2026-10-08", "stance": "neutral", "quote": "Dev guy here, so tailscale + Antigravity (+ GitHub).", "excerpt": "Dev guy here, so tailscale + Antigravity (+ GitHub). I use it to vibecode from my smartphone", "context": "developer", "use_case": "vibecoding from smartphone", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 799415312, "item_id": 49963457, "url": "https://news.ycombinator.com/item?id=49963457", "by": "DuncanCoffee", "date": "2026-10-05", "stance": "recommend", "quote": "the foundation of my entire approach to security is Tailscale", "excerpt": "it's a vnc port, it'd also require the router to have it opened. Reading the article I think the user opened it themselves. It does get opened automagically on the mac side when screen sharing is turned on. > The problem is that for my particular use case \u2014 a headless, always-on Mac Mini that I primarily access from other computers and my phone through the ChatGPT and Claude apps \u2014 macOS is incredibly hostile > As no", "context": "headless always-on Mac Mini user", "use_case": "securing remote access to Mac Mini", "switched_from": "", "story": "Apple and a hacker's future"}, {"id": 799341889, "item_id": 49958868, "url": "https://news.ycombinator.com/item?id=49958868", "by": "aliasxneo", "date": "2026-10-04", "stance": "neutral", "quote": "The SaaS providers (Tailscale, Cloudflare, etc.) have done a good job making it really easy on their infra", "excerpt": "This is one of the core things I've been working towards with DNTLS [1]. I love the idea of tunnels, especially for sharing between private parties. The SaaS providers (Tailscale, Cloudflare, etc.) have done a good job making it really easy on their infra, but it really blurs the line of \"self-hosted\" to me. Ideally we end up with solutions like this that can be run entirely without an intermediary. [1]: https://dntl", "context": "", "use_case": "tunnels", "switched_from": "", "story": "Self-hosted HTTP tunnels with SSH and Nginx"}, {"id": 799220096, "item_id": 49951256, "url": "https://news.ycombinator.com/item?id=49951256", "by": "tomjen3", "date": "2026-10-04", "stance": "recommend", "quote": "I would immediately go with Tailscale for a business; I know it and I use it.", "excerpt": "You are correct; however, you're also putting a lot of faith in people's ability to make decisions. Another thing (that does not really apply at AWS anymore), is that todays's enthusiasts are going to be the future CTOs, and the easiest time to recruit them to your service is when they are still an enthusiast who gets to make decisions on their own because there's exactly one decision maker you have to appeal to and ", "context": "", "use_case": "", "switched_from": "", "story": "We're going to need default hard budget caps on pretty much everything"}, {"id": 799109474, "item_id": 49944342, "url": "https://news.ycombinator.com/item?id=49944342", "by": "weightedreply", "date": "2026-10-03", "stance": "compare", "quote": "I could also move everything into something like tailscale. Then at least the domains are private.", "excerpt": "The feature I don't want to pay for but would be nice to have: deeper level proxied wildcards. > If you want to proxy a wildcard DNS record on a deeper level like .www.mycoolwebpage.xyz you can subscribe to Cloudflare Advanced Certificate Manager and get a certificate that is covering that wildcard \u00b9 \u00b2 When building out services in my smart home, I started with something like 'home.domain.com'. I used Let's Encrypt f", "context": "smart home self-hoster", "use_case": "private access to services", "switched_from": "", "story": "Cloudflare opens more Enterprise-only features to all customers"}, {"id": 798377202, "item_id": 49898575, "url": "https://news.ycombinator.com/item?id=49898575", "by": "simlevesque", "date": "2026-09-29", "stance": "recommend", "quote": "I use Claude Code + eternal terminal + tailscale + tmux", "excerpt": "I use Claude Code + eternal terminal + tailscale + tmux + some custom skills to get notifications through nfty.sh. I get the same UX on every platform, works perfectly on very low bandwith environments such as in a cabin, in the subway or in the middle of nowhere. I tried using other harness such as Pi and opencode but I did not like them. If Claude Code gets weird I can swap in an instant. You just need to follow th", "context": "", "use_case": "remote access", "switched_from": "", "story": "GPT 6.1 Sol: Near-Astra intelligence for a fifth of the price"}, {"id": 798141522, "item_id": 49883845, "url": "https://news.ycombinator.com/item?id=49883845", "by": "firelex", "date": "2026-09-28", "stance": "neutral", "quote": "all monitored from my phone over Tailscale", "excerpt": "Hi HN. Jeff is a set of small, open-weight Qwen3.5 and Gemma fine-tunes for zero-shot classification, with respectable out-of-the-box performance, meant to be slotted right into code (or fine-tuned further as needed). You give them a situation and a list of options; they return a calibrated probability for each, in one forward pass, with no text generation. The 2B scores 83.1% on a five-benchmark panel (Jev's publish", "context": "", "use_case": "remote monitoring of home setup", "switched_from": "", "story": "Jeff \u2013 Jev-compatible 0.8B decision models, trained at home, ~30 ms"}, {"id": 797989348, "item_id": 49874334, "url": "https://news.ycombinator.com/item?id=49874334", "by": "delis-thumbs-7e", "date": "2026-09-28", "stance": "neutral", "quote": "accessing it elsewhere with Tailscale", "excerpt": "Kagi is brilliant. I find the whole Yandex -thing silly (EU spending on liquefied gas etc. from Russia is more than Yandex\u2019s whole annual revenue) and only wish same scrutiny would be put on corporations funding Israel genocides. I use DDG at work on Firefox with all AI blocked. If I would apart from Kagi, I would use SearXNG locally accessing it elsewhere with Tailscale. I think Hister seems promising, but have not ", "context": "", "use_case": "remote access to SearXNG", "switched_from": "", "story": "When did Google get so weird?"}, {"id": 796173568, "item_id": 49760848, "url": "https://news.ycombinator.com/item?id=49760848", "by": "girvo", "date": "2026-09-18", "stance": "recommend", "quote": "I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now", "excerpt": "I love TailScale but was getting crazy battery drain on my iPhone with it installed and setup. Still use it, just not from my phone now", "context": "", "use_case": "private networking", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 796149025, "item_id": 49759314, "url": "https://news.ycombinator.com/item?id=49759314", "by": "drcongo", "date": "2026-09-18", "stance": "warn", "quote": "I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers", "excerpt": "I switched from Tailscale to Netbird purely because of Tailscale's bizarre pricing tiers - I wanted just the SSH features, with multiple users, but the paid tier up from free didn't include the SSH features.", "context": "", "use_case": "SSH access", "switched_from": "", "story": "Cloudflare Quick Tunnels"}, {"id": 793706145, "item_id": 49606634, "url": "https://news.ycombinator.com/item?id=49606634", "by": "vulkoingim", "date": "2026-09-08", "stance": "recommend", "quote": "coupled with Tailscale I can access everything on my Nas everywhere", "excerpt": "Yeaah, second that! I use it on the AppleTV and across the rest of my devices! Works like a charm, and coupled with Tailscale I can access everything on my Nas everywhere :) I have it configured to use Jellyfin as the source, runing on said nas", "context": "", "use_case": "remote access to NAS", "switched_from": "", "story": "Jellyfin 12.0"}, {"id": 792230416, "item_id": 49514401, "url": "https://news.ycombinator.com/item?id=49514401", "by": "CrimsonCape", "date": "2026-08-31", "stance": "recommend", "quote": "I've been running a home server and Tailscale is magic.", "excerpt": "I've been running a home server and Tailscale is magic. My firewalls have no open ports. The tailnet is a virtual network that assigns IP addresses to approved devices that you authenticate to join. I use it in 3 ways: 1. My phone connects to my home network by joining the tailnet. I can play music and movies from my home server when I am away. No struggles with configuration. 2. A dedicated mini pc at home is on a s", "context": "runs a home server", "use_case": "remote access to home server", "switched_from": "", "story": "Internet centralization and the original sin of NAT"}, {"id": 791026416, "item_id": 49439151, "url": "https://news.ycombinator.com/item?id=49439151", "by": "geophile", "date": "2026-08-25", "stance": "recommend", "quote": "Tailscale is wonderful magic. Free (for my usage), so easy to set up", "excerpt": "Slightly off-topic: I decided to go with a Mac Mini to start playing with AI. My daily driver is a Linux laptop (with a negligible GPU). I also have a few Raspberry Pi machines for backup, and a low-end AWS server. I was always cobbling together ad hoc network access, to get from one machine to another. Access to my Mac Mini while traveling was a pain. Bringing it with me is ridiculous, and network access was a PITA.", "context": "Linux laptop daily driver, Mac Mini for AI", "use_case": "remote access to Mac Mini", "switched_from": "", "story": "New Mac Studio with M5 Max and M5 Ultra"}, {"id": 788945664, "item_id": 49309104, "url": "https://news.ycombinator.com/item?id=49309104", "by": "hn_throw2025", "date": "2026-08-15", "stance": "recommend", "quote": "I ssh in via Tailscale.", "excerpt": "I agree with you. I\u2019m reading this thread and wondering if I\u2019m missing something, why people are still talking about port knocking, port obfuscation, and fail2ban. I use a cloud VPS. I ssh in via Tailscale. The cloud provider firewall blocks all incoming connections except traffic originating from Cloudflare IP ranges on port 443. My host plays dead to portscans. I check with nmap periodically. I have a break-glass b", "context": "runs a cloud VPS", "use_case": "SSH access to cloud VPS", "switched_from": "", "story": "I close SSH port 22 (and what I use instead)"}, {"id": 786048672, "item_id": 49128042, "url": "https://news.ycombinator.com/item?id=49128042", "by": "traceroute66", "date": "2026-07-31", "stance": "warn", "quote": "But for a security tool they need to up their game seriously.", "excerpt": "> I can \"trust\" that they know what they're doing I wish I could say the same. At $work we use Tailscale but only bare minimum and at arms length and only because we have to (people were having NAT issues with standard Wireguard). None of their code has had a security audit, let alone regular ones. Yes they make a big song and dance about SOC2/ISO27001 but that is NOT the same thing, that's just shiny tick-boxes for ", "context": "uses it at work only because they have to", "use_case": "VPN at work", "switched_from": "", "story": "Tailscale didn't stop the Hugging Face intrusion"}, {"id": 785501936, "item_id": 49093871, "url": "https://news.ycombinator.com/item?id=49093871", "by": "Lammy", "date": "2026-07-28", "stance": "warn", "quote": "Otherwise Tailscale (the company) will be collecting your behavioral metadata every time you use your Kindle", "excerpt": "You will probably also want to add `--no-logs-no-support` (don't mind the FUD-y argument name) to the scripted invocation of `tailscaled` here: https://github.com/victoria-riley-barnett/koreader-tailscale/blob/993642a/bin/start_tailscale.sh#L23 Otherwise Tailscale (the company) will be collecting your behavioral metadata every time you use your Kindle (what other hosts it connects to, on what ports, connection open a", "context": "", "use_case": "VPN on Kindle", "switched_from": "", "story": "More Tailscale tricks for your jailbroken Kindle"}, {"id": 782700992, "item_id": 48918812, "url": "https://news.ycombinator.com/item?id=48918812", "by": "traceroute66", "date": "2026-07-15", "stance": "warn", "quote": "But we don't trust Tailscale.", "excerpt": "At $work we use Tailscale mostly because we were running into too many random issues with NAT with our standard DIY Wireguard setup, especially when people were working from hotels and other places with half-ass network setups. But we don't trust Tailscale. Just look at the thousands of unresolved Github issues, many of which are actually quite important/useful but have been ignored for months and years. We very much", "context": "works at a company using it via hardened bastion hosts", "use_case": "VPN behind bastion hosts", "switched_from": "WireGuard", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}, {"id": 782669600, "item_id": 48916850, "url": "https://news.ycombinator.com/item?id=48916850", "by": "MobiusHorizons", "date": "2026-07-14", "stance": "recommend", "quote": "the main reason I use it over self hosting wireguard is the NAT busting it does", "excerpt": "I think Tailscale is popular because of how plug and play it is for most people. Although the main reason I use it over self hosting wireguard is the NAT busting it does, which has so far worked flawlessly for me with no setup aside from installing on both devices. There is nothing wrong with self hosting wireguard, but it doesn't actually do the same job as tailscale.", "context": "", "use_case": "NAT traversal between devices", "switched_from": "", "story": "TS-2026-009: Insecure argument handling in Tailscale SSH permitted root access"}]}