Wireguard is both really useful and pretty frustrating as a user. As a developer it's amazing that you can do things like relay packets through a bouncer with authentication to get around NAT without ever having to think about the protocol level safety, as a user it's near impossible to configure without the confused "why are no packets working", and as you had here it just doesn't make it through a lot of restrictive networking conditions. I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.

The parent is obviously just Claude making a fancy website and some sort of unreviewed networking protocol that's dressed up to look as if it's a real project. Github really needs to start showing commit cadence and repo birthdates.

▲

joecool1029 2 hours ago | parent | next [-]

> I'd love some middle ground between wireguard and tailscale in terms of complexity, their clients have way too much stuff in them.

netbird's a thing to check out if you want an alternative to tailscale you can self-host.

▲

drum55 2 hours ago | parent | next [-]

Netbird also, at least to me, has much too much stuff in it, perhaps even more. I would love to be able to connect to everything reliably no matter the network, the daemon doesn't need a reverse proxy, Ai agent routing and billing, in browser SSH client, it's all just attack surface. Tailscale allows you to compile a lot of it out as of a couple of weeks ago, but it's still an awful lot of code.

	▲	theresanagent 43 minutes ago \| parent [-]
		[flagged]

▲

tamimio an hour ago | parent | prev [-]

Netbird doesn’t have proper network isolation, due to its shared policy space compared to one gateway interface per customer/organization. Which is not an issue if you are the only user, but if you are building a service for customers to use, and there’s a potential scale up, it will be an issue, either having multi account mode which will results in many resources you need to deploy or containers per customer, or, having them all shared policy that could potentially allow customer to customer access if misconfiguration happens, alternatively, building a gateway in the middle to broker it all but traffic must pass through which is operational cost plus extra latency, and even privacy concerns.

▲

tamimio 2 hours ago | parent | prev [-]

Which is why I am building my stuff around iroh instead.