Top
Best
New

Posted by nderjung 11 hours ago

Tailcat – Like netcat, but over Tailscale’s data plane(github.com)
514 points | 95 comments
bradfitz 8 hours ago|
One fun use case: a coworker just whipped up this Minecraft mod using tailcat as its transport: https://github.com/tailscale/tailcat-for-minecraft

(just a cute demo, not intended for release or ongoing maintenance)

awakeasleep 8 hours ago|
It would be amazing to have something like this for bedrock so people with consoles without online subscriptions could join a self hosted bedrock mc server
unleaded 6 hours ago|||
https://geysermc.org/
nullsanity 7 hours ago|||
They can! They just need a real computer, the real Minecraft game (Java), and then they can! it's so easy when you don't play the shitty mobile clone.
tucnak 7 hours ago||
Why is this downvoted? Bedrock is literally dog shit clone for iPad kids. This is not even controversial, it's just fact.
Dylan16807 5 minutes ago|||
It has roughly the same features, much worse moddability, and better performance.

At some point it was a weaker clone, but it developed into a very high quality clone, and has graduated into being a co-production with the Java version.

Get a refund from wherever you got your facts.

I'll give you half a point for "iPad kids" since that term implies a lot of incorrect things but it does run on iPads.

cevn 6 hours ago||||
Maybe bc it completely sidesteps the question? I have a nephew who is 7yrs old who only has an iPad and i can play with him due to geysermc, which is the correct answer.
idiotsecant 4 hours ago||||
Yaaaa get those 9 year olds good stupid plebs can't even buy their own computer, you really gottem
jasonmp85 6 hours ago|||
You're defending a video game written in Java.
behringer 52 minutes ago||
It's almost like it should run on an iPad out of the box.
megamorf 10 hours ago||
So this is somewhat similar to Iroh?

https://github.com/n0-computer/iroh

genpfault 9 hours ago|
In particular:

https://github.com/n0-computer/dumbpipe

https://github.com/cablehead/pai-sho

Arqu 9 hours ago||
https://github.com/n0-computer/pigeons offers the same but with SSH. I use it in my homelab extensivelly for access, tunneling smb, postgres and some other minor bits.
mikepurvis 9 hours ago||
I enjoy that they supply a nix install/environment, similar to the main tailscale/tailscale repo. Is nix widespread or the standard dev environment at tailscale, or is it like a 10% option and most people just use Docker or whatever?
bradfitz 9 hours ago||
It's not our standard dev environment but some of us use Nix. We don't really use Docker much, though. Mostly just "go test" etc.
innocent_name 7 hours ago||
How do you guys deal with nix & go cache? i hate when nix cold starts builds, tests without go cache.
ronef 6 hours ago|||
Loving this. Honestly I keep encouraging folks to just TRY native Nix for dev environments. So easy to set up and get value on day 1 that you'd be shocked. Also models/LLMs have made lightyear strides in the last few months to help with everything around it. We've been building up Nix based skill systems into our Flox skill and it's been super meaningful both on adoption and when we need to scale it up. (disclaimer I do Flox.dev which is Nix based and we do cool Nix stuff)
aerzen 9 hours ago|||
I'd guess that there is an insignificant minority of people who strongly prefer nix over anything else.

And it might be because it is easy to provide and maintain compared to a .deb package.

swozey 9 hours ago||
When I was writing rust stuff a few years ago it seemed like nix was the hip cool thing all the up and coming rustaceans (mostly unemployed students trying to land faang jobs) were using. If you're not familiar with the rust community it's very different from other programming communities I've been in (python/go/ruby/etc). Almost felt like you'd be kicked out of their lunch table if you weren't using it, but I've only see it that ubiquitous there.

A lot of them, instead of learning the usual linuxii you'll be using in containers at work dive headfirst into nix.

cure_42 4 hours ago||
Always makes me chuckle when there's this uncountably large group of people, and someone meets a handful of them and then decides they can make broad, sweeping statements about the entire group, despite having not met 99.99...% of them XD
pbohun 8 hours ago||
This is so cool! I mean, we really wouldn't need it if we had 100% ipv6 (no cgnat), but this is the next best thing. I think people underestimate the innovation that could happen if we had trivial p2p.
spockz 7 hours ago||
How much Tailscale is this still if the transport is based on wireguard, the control plane is something new with the keys based on the wireguard keys? Genuinely confused.
zrail 7 hours ago|
I dug into it a bit because I had the same question. The network layer here is wrapping around the Tailscale daemon's magicsock, which is the thing that does all the DERPing and NAT hole punching. Tailcat builds sort of a fake control plane that does a one way key exchange over DERP (the Meow message type) between client and server, then both sides do the normal CallMeMaybe dance to connect.
aseipp 9 hours ago||
Just yesterday I was complaining that I wanted to SSH back to my homenet while at the office, on my office (not home) tailnet. I wrote something based on Iroh to do this, but it's one shot (ie not particularly generalized). Might be able to throw it away or redesign it with some inspiration from this! Thanks.
bradfitz 9 hours ago||
There's an example in the README how to do exactly that :)
maisem 8 hours ago|||
I solved this problem by building/running a custom tailscale client that connects to two tailnets at the same time (https://github.com/maisem/tailmix)
linsomniac 7 hours ago||
I was just wondering yesterday if it'd be possible to have a tailscale client, or multiple tailscale clients in their own network namespaces, that could connect to multiple networks.

The slightly tricky part would be managing a local NAT that blends the two networks, and also does MagicDNS to answer on those NATed IPs. If routes conflicted, I guess you'd have to pick one?

Seems very doable though.

maisem 6 hours ago|||
yeah that's kinda what it does. It sets up two tsnet servers connected to two different tailnets and exposes them through a shared TUN device. It does the magic of allocating safe IPs to each host so that they don't overlap and does some leasing so that IPs aren't accidentally reassigned. It also does the MagicDNS thing so that DNS returns the "effective IP".

I wanted it to work on macOS so couldn't rely on network namespaces.

linsomniac 5 hours ago||
That deserves it's own top-level discussion, for sure! https://news.ycombinator.com/item?id=49457539
linsomniac 7 hours ago|||
@bradfitz: Steal this idea ^^^ ;-)
codegladiator 9 hours ago|||
why not try out some existing project already on top of iroh ?

I see a bunch here on awesome-iroh page

https://github.com/n0-computer/awesome-iroh

dfish 9 hours ago||
you could try rayfish.xyz, it is compatible with tailscale nowadays so you can run both tailscale and rayfish
archietect 10 hours ago||
It looks like a direct competitor for the recently launched bitbang-cli

https://github.com/richlegrand/bitbang-cli

stillpointlab 5 hours ago||
I've spent time finally learning what tailscale is and how it works and I'm impressed. It's a rare thing in the technology world but I'm glad I finally took the time.

I literally just figured out how tsnet fits into the picture (an in-process Go based entire network stack that gets the process to act as a node in the tailnet) and so that helps me understand this (everything in tsnet excepting the control plane). It's very impressive that they can do this in a reliable way.

tptacek 9 hours ago||
This is smart. It's Magic Wormhole but for generalized connectivity, not just file transfer.
doomrobo 8 hours ago|
Yes, though MW has the important distinction that it uses short human-readable session identifiers. This means MW supports file transfer where the out-of-band channel is just a phone call. This is also why it needs PAKE as opposed to the simpler cryptography used in tailcat
tptacek 8 hours ago|||
Not a huge lift to stick a PAKE in this protocol, though I'm dubious that it'd be much of a win. The PAKE + nameplate system in Wormhole makes a lot of sense, because you're doing one very specific thing with that system (moving a file from point A to point B). Here you're booting up servers; you're almost always going to have a non-voice channel to set up with.
MajesticHobo2 5 hours ago||
You also don't want adversaries to be able to disrupt long-lived streams with bad password guesses, since I think part of Wormhole's security model is it will terminate the session if the other side gets it wrong.
ignoramous 7 hours ago|||
> This is also why it needs PAKE as opposed to the simpler cryptography used in tailcat

May be my idea of simpler cryptography is incorrect, but PAKEs like CPace do seem simpler than public key primitives in Noise.

tptacek 7 hours ago||
A PAKE is more complicated than Noise. Noise is fussy (for good reasons) but relatively simple.
1970-01-01 9 hours ago|
As 'cattail' is not officially taken, I have to assume they are oblivious to having a little fun.
kemotep 7 hours ago|
Keeps with the tradition of netcat alternatives like powercat, socat, cryptcat.
More comments...