<story><title>How our free plan stays free</title><url>https://tailscale.com/blog/free-plan/</url></story><parent_chain><item><author>aborsy</author><text>For me it’s the opposite: I actually don’t mind paying for a great product such as Tailscale (which I really like), but have security and privacy concerns!&lt;p&gt;Mesh VPNs have substantial control over networks that they manage (they bypass firewalls by having users instal agents from within).  They could add hidden nodes to networks, which is a major security concern, and see who is taking to who, how long, what service they are running, etc, which can be a privacy concern. They are targets.&lt;p&gt;Is there a way to address these concerns, and make them “really” (not just on website) zero trust or at least minimal trust? Will Wireguard preshared keys as an option help (a maliciously added public key lacks a secret key exchanged among peers out of band)?&lt;p&gt;What are the implications of the substantial control that Tailscale has?&lt;p&gt;Or we have no way, but to trust someone? Looking at events of the past decade, I don’t have a good feeling about this!</text></item></parent_chain><comment><author>tptacek</author><text>They&amp;#x27;re the same as the implications for using something like Okta as your source of truth for authentication, and Okta is ubiquitous in large enterprises.&lt;p&gt;It&amp;#x27;s not &lt;i&gt;not&lt;/i&gt; a concern, it is something you can think about and work out how to mitigate, but the benefits to their product of Tailscale hosting the control plane are going to outweigh the objections.</text></comment>
<story><title>How our free plan stays free</title><url>https://tailscale.com/blog/free-plan/</url></story><parent_chain><item><author>aborsy</author><text>For me it’s the opposite: I actually don’t mind paying for a great product such as Tailscale (which I really like), but have security and privacy concerns!&lt;p&gt;Mesh VPNs have substantial control over networks that they manage (they bypass firewalls by having users instal agents from within).  They could add hidden nodes to networks, which is a major security concern, and see who is taking to who, how long, what service they are running, etc, which can be a privacy concern. They are targets.&lt;p&gt;Is there a way to address these concerns, and make them “really” (not just on website) zero trust or at least minimal trust? Will Wireguard preshared keys as an option help (a maliciously added public key lacks a secret key exchanged among peers out of band)?&lt;p&gt;What are the implications of the substantial control that Tailscale has?&lt;p&gt;Or we have no way, but to trust someone? Looking at events of the past decade, I don’t have a good feeling about this!</text></item></parent_chain><comment><author>tmikaeld</author><text>There is also Cloudflare Zero Trust (Teams), which is free for 50 users and accomplish the same thing (Wireguard = Tunnels), with a lot more years of &amp;quot;trust&amp;quot; and security behind it.&lt;p&gt;However, it&amp;#x27;s very cumbersome to setup, nowhere near as easy as Tailscale.</text></comment>