Hacker News
points by selfmodruntime 1 day ago | 0 comments
No, it doesn't sound like it. Tailscale reduces complexity. It literally is key distribution with an ACL.

I work at a finance org with hundreds of engineers and thousands of technical users. You cannot be compliant with finance compliance frameworks using OpenSSH without audits and traceability and some source of identity management. That is exactly what Tailscale (or an alternative product) provides.

> and now, bugs

If you do it yourself, you now own that software entirely. Your comment lacks understanding of the complexity of real world scenarios.

[–] ferngodfather 1 day ago
You just need to implement an SSH CA. You can roll your own. Vault has an enterprise one. StepCA is suitable for smaller orgs.

All the benefit of the core SSH protocol as it's just key signing. It's honestly underrated.

[–] selfmodruntime 23 hours ago
How does having an SSH CA help you roll out detailed access to hosts/ports/services with fine grained permissions via access control lists derived from your identity provider? How do you make sure you're giving out least privileges with a compliant onboarding/offboarding and audit process? That is where the real meat is.

If you've solved all these problems yourself at your org: congrats, you re-implemented Tailscale with a bespoke solution that takes orders of magnitudes more $ to maintain and audit regularly than just buying an industry trusted solution.

Tailscale is, all things concerned, really cheap. It costs less at my large org than a single engineer. Doing it ourselves would take a team. Maybe two. Once again, HM primarily comments from a naive engineer's perspective, not from a leadership view.