Getting family members onboard with new technology can always be a bit hit or miss.
But setting up a #Synology server and using Synology Drive over Tailscale for all of our document management has been a big win. No more private docs on a megacorp cloud. And all our devices have access to it from anywhere, even though the server has no public facing IPs.
Isaac Ji Kuo
in reply to Kee Hinckley • • •How does this work if there are no public facing IPs? I feel like somewhere there needs to be something with a public facing IP. I'd rather never go through a VPN because the VPN service provider will always be a humongous single point of vulnerability snooping all of the traffic.
I just use rsync and sshfs and reverse ssh tunneling as needed. Simple tools for a simple me. I still need some server with a public facing IP, but I don't see a way around this.
JB Carroll
in reply to Isaac Ji Kuo • •Kee Hinckley
in reply to JB Carroll • • •Isaac Ji Kuo
in reply to Kee Hinckley • • •@jbcarroll Both proxy and VPN depend on (typically someone else's) server with a public facing IP.
Like I said, I don't see a way around a server with a public facing IP address.
Kee Hinckley
in reply to Isaac Ji Kuo • • •tailscale.com/blog/how-tailsca…
How Tailscale works
Avery Pennarun (tailscale.com)Isaac Ji Kuo
in reply to Kee Hinckley • • •@jbcarroll
As I noted, this requires a server with public facing IP address to work. And this is someone else's server in this case (as is typical).
Whether or not it's open source is pretty irrelevant as it's someone else's server.
And sigh ... sketchy mumbo jumbo about how most of the traffic doesn't go through their server. This is ... possibly true, but only if their sketchy NAT traversal techniques work. (All NAT traversal techniques are sketchy - they all circumvent the way
Isaac Ji Kuo
in reply to Isaac Ji Kuo • • •@jbcarroll the NAT networking hardware and software was intended to work.
It would be NICE if we could all just be open and honest about the dodginess of NAT traversal, but ... hey they've got a business to run and need to pretend it's all legit.
Anyway, I'm sticking with simple rsync, ssh, and sshfs tools. I don't get to "cheat" with NAT traversal, but I can still retain the benefits of end-to-end encryption to prevent man-in-middle compromises.
Isaac Ji Kuo
in reply to Isaac Ji Kuo • • •@jbcarroll So, I do have a (free to me) Ubuntu server out there on Microsoft Azure. I can use it for ssh tunnel and ssh reverse tunnel to get between computers behind NATs. But the Azure server stores neither of the endpoint private keys.
While I'm not super thrilled about the traffic going through a Microsoft server, at least the contents of the traffic itself are secured.
theothertom
in reply to Isaac Ji Kuo • • •There is a project called Headscale if you want to run your own control layer too. It works well, but I would suggest that for most people the complexity isn't worth it.
Isaac Ji Kuo
in reply to theothertom • • •theothertom
in reply to Isaac Ji Kuo • • •There is a lot to be said for "I put this app on your phone, and now you can easily use this thing to store your files" though.
Isaac Ji Kuo
in reply to theothertom • • •@tom @jbcarroll Ah, I don't use smart phones to access files (much less create them). Everything seems 10,000% more difficult on smart phones - even simple things like a basic text terminal. And I don't trust either Android or iOS smart phones with data anyway.
So there's no way I could support family/friends with some app on their phone, that in practical terms introduces yet another attack surface to an already untrustworthy device.
Isaac Ji Kuo
in reply to Isaac Ji Kuo • • •@tom @jbcarroll I'm comfortable with securing Linux adequately for my comfort. Thanks to work, I am also comfortable with securing Windows. But that's definitely a learning curve I wouldn't have taken on myself if I didn't already have a professional need.
Android or iOS? That's too much of a learning curve for me, and it seems hopeless anyway. Way too little control on my end and way too much control on the vendor end.
theothertom
in reply to Isaac Ji Kuo • • •Isaac Ji Kuo
in reply to theothertom • • •@tom @jbcarroll I don't know anyone who creates or explicitly saves files on their smart phone. Their data is in the form of saved account info (login ID and passwords for Facebook/Twitter/etc) and photos/videos taken by the default camera application.
If it's easy and seamless to change them to save to somewhere else instead, then that'd be cool. I'll admit I don't know how to do that.
As it is, I can barely provide any sort of "computer guy" support for their smart phones anyway.
JB Carroll
in reply to Isaac Ji Kuo • •JB Carroll
in reply to Isaac Ji Kuo • •Isaac Ji Kuo
in reply to JB Carroll • • •@jbcarroll I really don't care whether or not standard ports are used, but I do happen to use nonstandard a ssh port just to help deal with some firewalls.
I don't run my own VPN because I just don't have any particular need for it. Ssh tunneling and reverse tunneling does what I need them to do.
Kee Hinckley
in reply to Isaac Ji Kuo • • •@isaackuo Oh. Just saw this question. Tailscale creates a virtual distributed VON. Their servers (free at this level of use) server as a directory service providing a private DNS service of my machines. The machines run the VPN software on demand or all the time. So it acts like I have a private network with all my devices on it. I can run it split, or using an exit node like a traditional VPN. But there's no true server beyond the directory service.
Tailscale is open source except for the directory service (although I think folks are working on one). And it's layered on WireGuard. Since there's no server, it doesn't matter if some of my devices are offline sometimes.