When I saw the new round, I was instantly worried about change in direction that will most likely come with this, and effectively drive away regular users from a tool that seems universally loved.
Similar sentiment can be seen in the discussion from three years ago [1] when they raised $100M.
I've been tracking this space for a while just out of annoyance that Tailscale offers ssh on the free tier, then not on the "starter" paid tier. Netbird is by far the best of the alternatives that I've tried.
Well, it's important to start with saying I didn't like it as much as Tailscale, but I liked it a lot more than any of the others I tried. The UI for their dashboard is very good and getting it up and running was pretty trouble free though the docs could be a little better.
No their "real" backend is proprietary. Headscale is a separate implementation that they also maintain. It's intended for self-hosting your individual Tailnet. I'm assuming if you tried to use it as a corporate VPN you would run into limitations.
Their clients for proprietary OSs are at least partly proprietary too.
To be honest I find this all a very reasonable set of compromises. It means I'm comfortable using their proprietary service without feeling like I'm getting locked into a completely closed ecosystem.
When they raised the 100M three years ago, I'm pretty sure they said they didn't need it and were saving it for a rainy day (or words to that effect), always seemed very odd at the time. Two q's for anyone who cares to speculate: have they burnt the original investment already? And if not, why would they need more funding? AFAICS there's no real competition in the market place for their product today, the only thing I can conceive is that they have a secret 'tailscale 2' project in the wings which is massively developer or capital intensive. Let's hope it is nothing related to AI band wagoning :-)
Hm OK well thinking out loud, $100M / 3 is $33M / year?
I don't know much about Tailscale, nor about how much it costs to run a company, but I thought it was mostly a software company?
I would imagine that salaries are the main cost, and revenue could cover salaries? (seems like they have a solid model - https://tailscale.com/pricing)
I'm sure they have some cloud fees, but I thought it was mostly "control plane" and not data plane, so it should be cheap?
I could be massively misunderstanding what Tailscale is ...
Generally package is around half of what company spends per extra engineer. And $500k average for a tech heavy product company doesn't sound too far off.
The rule of thumb that employees actually cost a business roughly twice their salary is based on two things:
1. Retention. Hiring costs are “huge”, and so if you have a higher or lower average retention, may make up a disproportionate cost compared to salary. Ramp up time and institutional knowledge loss is no joke either.
2. A spread of average wages. 500k is not average, and a huge number of the costs are relatively fixed. $1,000 a month worth of software licensing isn’t an uncommon number and is fully 1/3 of the salary of a $3k a month or $36k/year junior clerk. It’s peanuts when you look at it next to a $500k/year salary. It may be that the clerk is, all in, costing the company 3x their salary after indemnity insurance and so on. The dev will never reach 10%.
It's really not at scale. It's on the order of 500$ a month per dev for "gold" level care for a company of 50 people. I'm sure it's less the larger you get.
It might depend on the state and the age pool but I have to pay a percentage and based on that it's more like $10k/year. So you are almost 2x undercounting
... But maybe if the average employee of a company is 25 they could get a better deal
When people say they get 500k they mean they get paid 200k in salary and got 300k in RSUs, with the details mixed around the edges. ICs aren't getting 500k salary except in a few rare cases.
You're not wrong to think Tailscale is primarily a software company, and yes, salaries are a big part of any software company's costs. But it's definitely more complex than just payroll.
A few other things:
1. Go-to-market costs
Even with Tailscale's amazing product-led growth, you eventually hit a ceiling. Scaling into enterprise means real sales and marketing spend—think field sales, events, paid acquisition, content, partnerships, etc. These aren't trivial line items.
2. Enterprise sales motion
Selling to large orgs is a different beast. Longer cycles, custom security reviews, procurement bureaucracy... it all requires dedicated teams. Those teams cost money and take time to ramp.
3. Product and infra
Though Tailscale uses a control-plane-only model (which helps with infra cost), there's still significant R&D investment. As the product footprint grows (ACLs, policy routing, audit logging, device management), you need more engineers, PMs, designers, QA, support. Growth adds complexity.
4. Strategic bets
Companies at this stage often use capital to fund moonshots (like rethinking what secure networking looks like when identity is the core primitive instead of IP addresses). I don't know how they're thinking about it, but it may mean building new standards on top of the duct-taped 1980s-era networking stack the modern Internet still runs on. It's not just product evolution, it's protocol-level reinvention. That kind of standardization and stewardship takes a lot of time and a lot of dollars.
$160M is a big number. But scaling a category-defining infrastructure company isn't cheap and it's about more than just paying engineers.
> but it may mean building new standards on top of the duct-taped 1980s-era networking stack the modern Internet still runs on.
That’s a path directly into a money burning machine that goes nowhere. This has been tried so many times by far larger companies, academics, and research labs but it never works (see all proposals for things like content address networking, etc). You either get zero adoption or you just run it on IPv4/6 anyway and you give up most of the problems.
IPv6 is still struggling to kill IPv4 20 years after support existing in operating systems and routers. That’s a protocol with a clear upside, somewhat socket compatible, and was backed by the IETF and hundreds of networking companies.
But even today it’s struggling and no company got rich on IPv6.
IPv6 has struggled in adoption not because it’s bad, but because it requires a full-stack cutover, from edge devices all the way to ISP infra. That’s a non-starter unless you’re doing greenfield deployments.
Tailscale, on the other hand, doesn’t need to wait for the Internet to upgrade. Their model sits on top of the existing stack, works through NATs, and focuses on "identity-first networking". They could evolve at the transport or app layer rather than rip and replacing at the network layer. That gives them way more flexibility to innovate without requiring global consensus.
Again, I don’t know what their specific plans are, but if they’re chasing something at that layer, it’s not crazy to think of it more like building a new abstraction on top of TCP/IP vs. trying to replace it.
There might be other things going on in the US that you could maybe possibly have heard about, and investors are looking for different places other than the US stock market to invest their money, and Tailscale is looking to have a war chest because of the exceedingly possible case that we're headed into a global recession.
That depends entirely on how you raise the funds. Yes, you can say "Here's the growth rate we'd get without your money - based on that, this investment gets you an ROI of x%."
With x% high enough, sure, you can get VC money without too many strings. (Also, reading the Series B post, they were planning to invest - just in organic growth instead of the usual growth hacking)
And if you read the Series C post, you'd know what they're spending on - GPU (and general) cloud interconnectivity.
There's really not much need to guess, Tailscale's financing announcements are about as open as you can get.
What is tailscale going to do with GPUs? It's about as far removed from NL interaction as you can get, I really don't see any sane AI fit. Maybe they are using them for AI driven dev work? Probably need to think more laterally.
The fine article seems to say lots of companies are using Tailscale to connect to servers with GPUs -- nothing in that implies that Tailscale would own the GPUs.
Not necessarily. You hear plenty of stories of companies who raised money they never ended up needing to touch.
What matters is why. Is it because growth is so bonkers that your burn stays minimal/zero despite increasing costs? Or is it because you don't spend anything and thus can get by with stable revenue. VCs are very happy with the first, less so with the second.
VCs would always prefer you get to megascale with less money - the less you raise, the less they get diluted.
Thank you. I’ve lost count of how many times I’ve had to write “we don’t need the money but are saving for a rainy day” CEO talking points and press releases for companies that were < 90 days from not being able to make payroll.
> AFAICS there's no real competition in the market place for their product today
What does this mean? They are competing with regular legacy VPNs for sure. Despite tailscale existing for the last 4 years, none of the large corporate clients even got closed to it. They were all on junk from Cisco, Palo Alto, to connect employees to corp net. A “cutting edge” one might use cloudflare warp.
You might be right that there isn’t much competition for pure distributed, but it turns out the market for that is actually quite small and it’s for people who can’t afford dedicated IPs or cloud instances.
Raising money here is a bad sign IMO unless it’s for a completely new product that requires servers at exchanges to eat CDNs like cloudflare’s lunch.
Their is tons of competition depending on how you want to attack the problem. Tailscale's problem imho is that their product does not scale well as required by large enterprises. One could argue nor do traditional VPNs, but they are already in place and workking so that product config already works, no need for change. The market is massive, but you need to be at a high abstration layer in my opinion, so that you can replace far more than just the VPN.
There is tons of competition for Tailscale. Its 'just' an easier to use VPN with a great GTM exceution. I think they need more money as they need to fundamentally re-architect their solution to sell into enterprise use cases they their valuation requires.
There are plenty of enterprises that will pay them to run their services and provide better integrations while allowing open source users to continue. Now people will get upset because some of these things will be for those customers only but it is very hard to keep developing these things and give them out for free. Partially open source still allows those to extend the work they give to the community and they will probably still continue to have a free tier to get more enterprise customers in the end.
This is mostly so that the founders can take some money off the table. The founders probably have $10 million cash after this and don't have to worry about rent ever again.
How is Tailscale going to achieve at least $1B in annual revenue? That’s the kind of promise that would have to be made to investors in order to raise funding of this magnitude.
$1B annual revenue is ~4m business users. This is considerably smaller than e.g. Zscaler or Okta. It's a big goal, but achieving it does not require them to sign a majority of businesses or build a monopoly.
As GP said, they have raised money before. So why are you now disappointed and think they "are selling out", when nothing has changed, and Tailscale has been a clear-cut for-profit startup from the start?
netbird looks like it would be a better option if open source is what youre after. theres a handful of others too, nebula, zerotier, netmaker just to name a few
Good. This lets them receive some of the value they’ve created (they should get paid!) and gives certainty they won’t go out of business. Which means more Tailscale now and in future!
If they turn evil (unlikely with the current folks there) they’ve written up / open sourced plenty of what got them to this point.
Don’t capture all the value you create. But you should try to capture some.
The same thing has been said about many other companies taking on VC Money. Someday, those investors are going to want to see a return on that investment. Its going to take focus and determination to not just ship enshittification as a feature..
it is a nice that they're a bit embarrassed about it and spend much of the post explaining why they took more money.
overall, they still seem to have their heads screwed on straight and have an actual business model, that is also pretty fair - charge enterprises per seat to solve their network identity problems.
Tailscale is a great. I think of it as a swiss army knife for easier routing and connectivity.
I use it in projects to stream internet / connectivity from my phone to the NVIDIA Jetson line, making my robotics projects easily accessible / debuggable:
Rerun co-founder here. Rerun doesn’t have replay in the sense of you send messages in and can play back the same messages in the same order later. We have playback in the sense that you can play it back in the viewer. We also have apis for reading back data but its more focused on dataframe use cases rather than sending you back messages
That was our initial use case for Tailscale as well. May 2020 we started growing a team and needed a really smooth remote access solution for a bunch of Xaviers... and we weren't allowed to be in the same room together :)
I don't probably use Tailscale to it's full potential but I love this tool. We have our small servers at our offices across the world and it has give us so much flexibility to access some of the files via shared drives or try out installing / testing stuff. Me and my wife also drop each other pictures of our kids using tailscale now.
As someone who currently has their photo on a company's 'About Us' page, I hate it. Why does anyone care who the nth developer is? Let me just do my job without forcing me to be publicly listed for spammers and scammers to target me.
It's super useful to potential hires about the kind of team you're building. Especially if there's some kind of niche you're in (product, tech, region, whatever). There are people who I would climb mountains to work with, and others within a niche whose very presence in a company is enough to steer me away. Another signal for me is the fraction of xooglers in the engineering team.
I think they might be operating at a scale that breaks those kinds of pages at this point? Not literally, of course, just they're past the point where the page makes sense.
I agree it's silly, but worth noting is that the target audience for those pages are usually:
1. Potential customers
2. Potential investors
Both groups are a lot more swayable by social proof from seeing the "investors" than the devs as they infer a lot of credibility based on who has funded you. Similarly that's why you often see big company logos on marketing pages because it makes other customers more likely to buy. "<xyz> is too big to be wrong about this product"
Eh. Investors/advisors don't change that frequently. And often people will go "oh? Sequoia generally invests in good companies, the invest in X? They might be worth while to buy/work for".
Putting people on the website is, very variable. Do you update the website every week or two when someone comes or leaves? Well that's awkward if someone is fired.
You get to 100 people, then 200 people. Now what do you do? Remove everyone? Only put people on above a certain level? What do you do when someone asks you not to be listed. Or when John becomes Jane, but doesn't want to be super duper public about it?
Or, when your company gets media attention and now the moment you add/remove someone from the website you get news or social media posts about it?
I think my employer decided to remove all non-executives at some point to ward off headhunters. Not sure how much it helps considering everyone's on LinkedIn.
This is a press release targeted by rapacious capitalists. By mentioning other big named investors, you keep the grift going and continue securing future funding until IPO.
TBF, the folks who get actual value out of knowing who works at Tailscale already know who works there :)
They're not exactly secretive, there's just little value to have it on the main company page. (And if you just want pictures, https://tailscale.com/careers has that too.)
Even if it could mean Tailscale enshittifies eventually, this is probably a good thing for the ecosystem.
As one example,
the bigger they get, the more likely operating systems will build better APIs to support what they do (for example maybe Apple will provide a way to do mDNS over Tailscale), and those APIs can be used by all.
There are plenty of open source alternatives cropping up[0]. I'm curious to see what Tailscale can do with a lot of resources.
Apple had a Tailscale-style feature called "Back to my Mac" that was part of MobileMe. They killed it off with the rest of MobileMe, presumably because they just wanted you to store everything in iCloud.
Does anybody encounter issues with DNS after installing tailscale with it's MagicDNS enabled? It drives me nuts because my entire network just stops working. I removed tailscale but still won't be able to connect to my Ubuntu server.
Yeah, you need to be conscious about your tailscale domain, your .home (or whatever your router or dhcp server advertises) and your .local hostnames. Even if you’re aware, things are sometimes wonky, IME primarily on macOS.
I've had issues with tailscale dns for a while where I'll wake my mac up and the dns will just not work until I disable tailscale. I can then re-enable it and everything continues to work.
I logged a bug about it and the latest versions this seems to have gone away. I also moved away from the mac store variant and into the standalone. Not sure if that helped either.
Yeah, I honestly couldn't get Tailscale to work reliably at all. DNS, routing, firewalls etc. My overall impression was it will work if either you go for it on your entire local subnet, or you have a very simple local network topology. Having local nodes inexplicably talking to each other via a cloud relay basically all the time just isn't acceptable. (And webrtc could always find the local candidates when doing ICE, so it's not that).
It's interesting because they have clearly demonstrated a demand for such a thing, but the "just works" pitch is a fantasy, at least today.
Sometimes I have issues like this.
It's related to my ISP not supporting IPv6. I don't have time to explain this in detail, but at least that's one angle of it that you might want to explore further.
Same. When my cell has an ip6 ip, I can’t get dns to resolve on my systems at home. I can still access everything by ip4 ip though. I haven’t had time to find a solution yet. I’m still trying to figure out if it’s nginx, pi-hole, router, or Tailscale config related… probably a combination.
I encountered a similar issue when I first started using Tailscale. My fix is simple: disable IPv4 inside Tailscale. Just use the v6 ULA address that begins with fd7a exclusively. This works even if your ISP doesn't support IPv6: the inner IPv6 packets can be encapsulated inside v4 packets. There's unfortunately no GUI to do this; you'll have to change the Tailscale ACL to disable IPv4.
> Just use the v6 ULA address that begins with fd7a exclusively.
perfect, this is exactly what I desired
(I'm having an increasingly high number of sad v4 only LAN devices and planned to move to a v4 block that sits way too close to the one Tailscale uses.)
> There's unfortunately no GUI to do this; you'll have to change the Tailscale ACL to disable IPv4.
I have this happen largely with Apple OS devices. Apple's DNS service can be notoriously persnickity (I've had issues with it outside of Tailscale as well), and I usually need to bounce interfaces or flush DNS cache (where I can on macOS) to resolve issues. WRT Tailscale, I also have issues with it on my phone. I currently have my phone configured to connect to my Tailnet when I leave networks I don't control so that I can maintain access to my personal cloud on the go, however after a few connections and disconnections, I have to bounce several interfaces in order to correct both DNS and routing.
Yes! I also experience this. I also had some weird interaction with another wireguard-based VPN and Tailscale, where it crashed my DNS so hard I had to reset my entire laptop.
I don't know how it works on Linux, but for Windows, the 'MagicDNS' just automatically adds a bunch of static entries to your hosts file to resolve the TS FQDNs and simple/machine names.
Tailscale is definitely more than "Wireguard with a GUI", but I don't think that diminishes your point that Tailscale, if they're not already, would be great stewards if they were contributing more than code back to the Wireguard project.
This is not correct. Wireguard establishes a tunnel between peer A and B, and its simplicity stops there. Tailscale does tons of complex networking, filtering, nat traversal, DNS, file sharing, etc. Wireguard is a small part of the codebase today, which has grown a lot.
It’s a bit like saying Dropbox is just a GUI on top of TLS.
Most of this was successfully done 20 years ago by tinc, which is a project written by a couple of European guys in their free time. It even supports routing traffic through other peers and does peer discovery just like BitTorrent (but before BitTorrent even existed) — there is no need for a central server.
What tailscale has over it is hype, lots and lots of hype. Also a much more well thought out, and arguably more secure VPN protocol underneath, which is why GP's comment is on point.
If it's hype, it's not hype the way you're thinking. I've shown Tailscale to a lot of people (this is less salient now, when pretty much everybody uses Tailscale) and the most common reaction I've gotten is "holy shit". It is spooky simple to get working, and it's spooky simple to go from a working installation to a VPN configuration that would take many many hours to replicate with pre-existing tools.
There may be VPN nerds out there who think there's nothing special happening with Tailscale, but I submit those nerds haven't spent a lot of time dealing with the median, replacement-level VPN configuration prior to Tailscale. I'm a pentester, and so I have had that pleasure. Tailscale is revolutionary compared to what it replaced.
My only technical complaint with Tailscale is that its hole punching doesn't seem to work with some common CGNATs/double NATs when both endpoints are using them, and then traffic ends up trickling through their public proxy servers, while running your own is kinda annoying and not recommended or documented.
Because you're delegating the control plane to Tailscale. Somehow we went decades without this being a thing for security reasons, dealt with the management of VPN appliances, and now suddenly everyone is OK with Tailscale owning the control plane of their VPN for the sake of convenience.
For a company this is probably okay: companies rely on other companies all the time, and can enforce contracts. I would gladly use tailscale at my company.
For an individual, heck no. Fortunately, headscale exists for individuals to use.
I think the parent commenter used "understood" to mean "recognized."
That said, I don't really understand the supposed misunderstanding you point out. It seems that dang argues that "the exchange was pleasant and successful." I've never seen someone claim otherwise.
Rather, I've seen it used as an example of how technical users can fail to recognize the complexity inherent in their workflows, and therefore may also fail to see the real-world business value in creating (and selling) simpler interfaces. See also a SMOP: https://en.wikipedia.org/wiki/Small_matter_of_programming
No, it's not that simple. This is an instance of context collapse; people dunk on that exchange because they believe it's an HN person belittling Dropbox as a product, when in fact it was an HN person helpfully offering notes on a YC application.
Whether the poster was "belittling Dropbox as a product" or "helpfully offering notes" seems like a judgment one can make about the exchange, regardless of poster's intent. I never understood this to be the reason it was referenced, more the SMOP thing. But I hear what you're saying about the details getting warped over time. (edit: And I do think people sometimes use it as a case of "if you listen to everyone's feedback..." but I think that still rings true: regardless of the judgment you place on it, it could have been demoralizing to Dropbox's founders.)
They dunk on it because the author didn't see the the benefit of the product over using FTP. And it's hard to say the usage of "quite trivially" isn't "belittling" in some form, although I don't think using a loaded word is useful here. Even the followup response shows the same issue with the commenter's thinking:
>You are correct that this presents a very good, easy-to-install piece of functionality for Windows users. The Windows shortcomings that you point out are certainly problems, and I think that your software does a good job of overcoming that. (emphasis added.)
They still fail to understand that this is not a Windows or Linux issue but a reliability and ease of use issue. Not to mention the fact that the desktop Linux marketshare was probably less than 1% and therefore irrelevant in this context to begin with.
a fun thought exercise - what would have to happen to HN for this to come true? basically all the old guard have to age out and not pass on the reference?
Tailscale did make a donation to WireGuard. They have regularly contributed to wireguard-go, including the complicated GRO/GSO bits.
"Tailscale made a donation during September 2022, as part of their business centered around WireGuard." https://www.wireguard.com/donations/ / https://archive.vn/MMAXO
> Tailscale is pretty much Wireguard with a GUI on top.
Jason Donenfeld is listed as a Technical Advisor on https://tailscale.com/company. Most companies pay their advisors something, so I assume something monetary is going on here for him.
When we started Tailscale in 2019, we weren't even sure we wanted to be a venture-backed company. We just wanted to fix networking. Or, more specifically, make networking disappear — reduce the number of times anyone had to think about NAT traversal or VPN configurations ever again.
If they had taken just say $40 million would they be able to sustain their project for the foreseeable future and perhaps not yield as much future product direction and equity?
I honestly don't know how this big dealmaking works but it strikes me that when you take out this big of an obligation that the obligation has a gravity that may drag you in a direction you (or consumers) do not want to go.
Love Tailscale as a product (as does everyone I talk to) but genuinely want to learn more about the trade-offs as usually when we see big dollar signs all we do is celebrate.
Equity investments like this don't need to be repaid, so there isn't a legal obligation to repay them. Of course, there is an obligation to maximize shareholder value — but that is totally independent of the dollar amount invested.
When founders raise this much money, it's because there's (1) a lot they want to do and hire for, or (2) they don't want to worry about monetizing the product for a significant period and focus on growth or product development.
GP didn't talk about "repaying" anything. Taking 160M instead of 40M at the same valuation means giving up 4x the shares, and that's going to result in a bigger voice for those investors at the table in making decisions about the future path of the company.
What if they were offered $160mm and Tailscale countered with 4X the valuation, lowering the number of shares by 75%? Similarly, what if they wanted $40mm but the only deal on the table was $160mm due to ownership targets of funds that can actually write $40mm+ checks? It's hard to play these armchair games, even less so when the terms aren't known.
You're right that we don't know all the terms, but $160M raised is not small and it is very reasonable to worry about what level of control will be given up long term because of it.
409a valuations are made up by independent appraisals, but it’d be quite strange for an investor to agree a share is worth 4 times the appraised value.
(3) investors offer the option for founders (and earlier investors) to take money off the table by buying up a percentage of their stake, essentially creating a mini-exit for the founder and earlier investors
> Equity investments like this don't need to be repaid
You are saying equity is not bonds.
However investors expect to be repaid in the future with control and exhorbitant interest rates (based on risk). VC invests to make money, but that money comes from future equity rounds or IPO.
If you didn't take the VC money (and the business achieved the same growth without the money) then you'd expect you would have been better off by at least the amount invested (investors don't invest with the expectation of only getting their money back).
If the business doesn't succeed then you are on the hook to pay the debt from your equity via liquidation preferences.
VC payment is expectation statistics, but the investors know that game and invest to make money. That money comes from the current equity owners making less in the future.
Not only the "expectation" but lots of VCs have preference built in that guarantees them huge returns on basically any liquidity event. It's probably not as likely in a Series C like this but 2-3x preference is not unheard of. There are few investment vehicles where for every $1 you put in you're guaranteed to get the first $3 made back first.
One of the main problems with raising too much is that you stop caring about product-market fit and can go on tangents that do not make you competitive. This is quiet common afaik.
Yes; you will burn through all the capital you raise in ~18 months. It is _extremely_ difficult to efficiently allocate large raises (100M+) in 18 months. In fact, I’m developing a pet thesis that no single human or business can efficiently allocate more than $100M. This would imply that any time a single raise is more than 100M, the investors always would have had a better return by splitting it into chunks of 100M or less. It’s not a _good_ thesis yet, just one I’m performing thought experiments with
Some business can certainly allocate more than $100M, but I could see that thesis for VC-backed tech-style product companies.
A few examples come to mind immediately: trading firms/hedge funds often have more capacity than that in their existing strategies; hardware businesses can have substantial up-front costs; companies with high COGS might need that much to just scale at the rate they're already moving, since each unit locks up a bunch of capital until it's sold.
You can’t be serious. Lots of businesses easily have that much just in cost of goods or marketing spend. $100M is not such a crazy amount especially considering the cost of hiring technical people.
Also note that the benchmark of “efficiency” should be a function of growth, not some absolute standard.
I think we are saying slightly different things. COGS are composed of many smaller capital allocations. According to this untested, pet thesis, putting on a report that $250M was spent on capex is just fine; but if you go to a single vendor and sign a $250M contract, you have wasted money by not being more careful about how that capital is allocated. $100M is _a lot_ of capital, and I think it’s easy to lose sight of how much stuff you can do with that much money when applied to industries that don’t pay tech salaries for speculative growth. As examples: how many pounds of food could you grow for 100M? How many doctors could we train for 100M?
I think the thesis is thought provoking. Not sure yet if it’s worth anything, but it also doesn’t preclude businesses from having massive cashflow.
I mean, it is obvious that you cannot sustain efficiency as you scale (Amdahl's law) but (1) $100M is not that crazy to be able to keep track of in your head, even for a single individual (I can imagine a successful real estate developer with a handful of ongoing projects and various other personal investments), and (2) in a high growth situation, it makes financial sense to sacrifice some economic gain for scale. In your original example, sure an investor would be better off, if they could actually find 10 good investments with zero cost, to spread their money, but very likely they'd be better off taking the big one and spend their energy raising more money.
Isn't it better to 1.5x in 6 months on 40 million than 3x in 2 years on 160?
By definition focusing on things that don't grow your business because you have way too much money in the bank is going to be worse for your business than being forced to focus because you've only got a year of runway.
I'd be curious how much of this $160 million is immediately allocated to bonuses, founders taking money off the table, increased salaries, employee option pools, etc.
Yeah I take this as bad news, as a user. I dread the inevitable enshittification. Hopefully open source UX over Wireguard is close-enough to as good by the time they drive me away that losing them isn't too painful.
Took a project I'd been putting off and putting off because I knew it'd eat half a Saturday, and made it a 20-minute affair from signup to having everything done, including adding some devices to the network that I wouldn't even have bothered to try adding on my own.
Depressing news, I have no hope that the countdown to Tailscale being unusable subscription trash has not started with this announcement.
I realize this is a very ironic place to make this statement, but I am utterly exhausted by VC money destroying all of the services I enjoy, like a slow disease spreading through a herd of livestock.
One gives up a decent amount of control for the first 12m, then a bunch more at 100m. Unless you work there, you frankly have no idea how much control the founders have.
Investors expect that Tailscale will extract many multiples of their contribution from users.
If you'd like to avoid this extraction, you can fork their command line client code (along with the open source headscale server) and run a mesh network across your linux machines with all the magic DNS and userspace-TCP/IP-stack goodness that you're used to. Tailscale has given away a lot of the engineering for free.
However, as soon as your fork becomes incompatible with Tailscale's stack, you lose a massive value-add: proprietary platform support. Today, you can add the sale's guy's iPhone to your tailnet in seconds. If Apple's capricious automated AppStore security pulls the Tailscale app from the AppStore, Tailscale Corp is big enough to get Apple's attention. A small FLOSS group with some forked clients on github won't be able to provide this same operational stability.
Tailscale has a single management engine. My understanding is that if the goes your existing traffic will still flow, but new connections won’t be made.
Everyone is commenting on the HN headline, no one on the actual post:
> Building the New Internet
(Insert mandatory reference to Silicon Valley here :))
> We think there’s a better way forward. We're calling it identity-first networking.
I would love to see this. Every day I have to stare at YAML files with IP addresses in them is a day I will never get back. I wish cjdns[0] had succeeded already but oh well, now I hope the Tailscale guys will!
1. Immutable Content Naming: In a data-centric system, content is addressed by its name, transcending geographical considerations. This circumvents the vulnerabilities associated with IP addresses, which can be spoofed or manipulated. By employing cryptographic techniques to validate the authenticity of content names, NDN establishes a robust layer of security that underpins the entire architecture.
2. Built-In Data Integrity: NDN employs built-in mechanisms to ensure the integrity of data. Content is signed by publishers and verified by consumers, preventing tampering or unauthorized alterations. This approach effectively mitigates data breaches, as any unauthorized modification is detected and rejected.
> NDN has its roots in an earlier project, Content-Centric Networking (CCN), which Van Jacobson first publicly presented in 2006.. NDN applications name data and data names will directly be used in network packet forwarding.. Its premise is that the Internet is primarily used as an information distribution network, which is not a good match for IP, and that the future Internet's "thin waist" should be based on named data rather than numerically addressed hosts.
353 comments
[ 3.5 ms ] story [ 323 ms ] threadSimilar sentiment can be seen in the discussion from three years ago [1] when they raised $100M.
[1] https://news.ycombinator.com/item?id=31259950
I was about to slog through AI search results looking for an alternative.
Would this service be comparable to Headscale[0]?
[0] https://github.com/juanfont/headscale
Their clients for proprietary OSs are at least partly proprietary too.
To be honest I find this all a very reasonable set of compromises. It means I'm comfortable using their proprietary service without feeling like I'm getting locked into a completely closed ecosystem.
I don't know much about Tailscale, nor about how much it costs to run a company, but I thought it was mostly a software company?
I would imagine that salaries are the main cost, and revenue could cover salaries? (seems like they have a solid model - https://tailscale.com/pricing)
I'm sure they have some cloud fees, but I thought it was mostly "control plane" and not data plane, so it should be cheap?
I could be massively misunderstanding what Tailscale is ...
Did the product change a lot in the last 3 years?
$33m/year is only 33 fully loaded software developers including all overhead like HR and managers and office space, and also a cloud hosting bill.
33 really isn't that many.
It seems on the high end, but not too unrealistic.
The rule of thumb that employees actually cost a business roughly twice their salary is based on two things:
1. Retention. Hiring costs are “huge”, and so if you have a higher or lower average retention, may make up a disproportionate cost compared to salary. Ramp up time and institutional knowledge loss is no joke either.
2. A spread of average wages. 500k is not average, and a huge number of the costs are relatively fixed. $1,000 a month worth of software licensing isn’t an uncommon number and is fully 1/3 of the salary of a $3k a month or $36k/year junior clerk. It’s peanuts when you look at it next to a $500k/year salary. It may be that the clerk is, all in, costing the company 3x their salary after indemnity insurance and so on. The dev will never reach 10%.
For a 500K dev GP is correct, additional expenses will never reach 50K for someone making 500K.
... But maybe if the average employee of a company is 25 they could get a better deal
Tailscale puts salary ranges on their job postings. The salaries aren’t bad, but no, they aren’t $500k.
A few other things:
1. Go-to-market costs
Even with Tailscale's amazing product-led growth, you eventually hit a ceiling. Scaling into enterprise means real sales and marketing spend—think field sales, events, paid acquisition, content, partnerships, etc. These aren't trivial line items.
2. Enterprise sales motion
Selling to large orgs is a different beast. Longer cycles, custom security reviews, procurement bureaucracy... it all requires dedicated teams. Those teams cost money and take time to ramp.
3. Product and infra
Though Tailscale uses a control-plane-only model (which helps with infra cost), there's still significant R&D investment. As the product footprint grows (ACLs, policy routing, audit logging, device management), you need more engineers, PMs, designers, QA, support. Growth adds complexity.
4. Strategic bets
Companies at this stage often use capital to fund moonshots (like rethinking what secure networking looks like when identity is the core primitive instead of IP addresses). I don't know how they're thinking about it, but it may mean building new standards on top of the duct-taped 1980s-era networking stack the modern Internet still runs on. It's not just product evolution, it's protocol-level reinvention. That kind of standardization and stewardship takes a lot of time and a lot of dollars.
$160M is a big number. But scaling a category-defining infrastructure company isn't cheap and it's about more than just paying engineers.
That’s a path directly into a money burning machine that goes nowhere. This has been tried so many times by far larger companies, academics, and research labs but it never works (see all proposals for things like content address networking, etc). You either get zero adoption or you just run it on IPv4/6 anyway and you give up most of the problems.
IPv6 is still struggling to kill IPv4 20 years after support existing in operating systems and routers. That’s a protocol with a clear upside, somewhat socket compatible, and was backed by the IETF and hundreds of networking companies.
But even today it’s struggling and no company got rich on IPv6.
Avery (Tailscale CEO) has actually written about IPv6 in the past:
IPv6 has struggled in adoption not because it’s bad, but because it requires a full-stack cutover, from edge devices all the way to ISP infra. That’s a non-starter unless you’re doing greenfield deployments.Tailscale, on the other hand, doesn’t need to wait for the Internet to upgrade. Their model sits on top of the existing stack, works through NATs, and focuses on "identity-first networking". They could evolve at the transport or app layer rather than rip and replacing at the network layer. That gives them way more flexibility to innovate without requiring global consensus.
Again, I don’t know what their specific plans are, but if they’re chasing something at that layer, it’s not crazy to think of it more like building a new abstraction on top of TCP/IP vs. trying to replace it.
Don't they host the relay servers that are the fallback if NAT hole punching and their other bag of tricks doesn't work?
Go Canada!
If you raise $100M you have to put $100M to work or you'll hear constant shit from your board over it.
If they raised $160M they're going to spend $160M on something. My guess would be a lot of enterprise features and product integrations.
With x% high enough, sure, you can get VC money without too many strings. (Also, reading the Series B post, they were planning to invest - just in organic growth instead of the usual growth hacking)
And if you read the Series C post, you'd know what they're spending on - GPU (and general) cloud interconnectivity.
There's really not much need to guess, Tailscale's financing announcements are about as open as you can get.
The. fine. article. seems. to. say. lots. of. companies. are. using. Tailscale. to. connect. to. servers. with. GPUs. -- nothing. in. that. implies. that. Tailscale. would. own. the. GPUs.
Besides my joke, you are bang on, nothing implies needing to buy GPUs and based on my knowledge of their product/the space, absolutely no reason to.
What matters is why. Is it because growth is so bonkers that your burn stays minimal/zero despite increasing costs? Or is it because you don't spend anything and thus can get by with stable revenue. VCs are very happy with the first, less so with the second.
VCs would always prefer you get to megascale with less money - the less you raise, the less they get diluted.
of COURSE you can raise money and not use it.
What does this mean? They are competing with regular legacy VPNs for sure. Despite tailscale existing for the last 4 years, none of the large corporate clients even got closed to it. They were all on junk from Cisco, Palo Alto, to connect employees to corp net. A “cutting edge” one might use cloudflare warp.
You might be right that there isn’t much competition for pure distributed, but it turns out the market for that is actually quite small and it’s for people who can’t afford dedicated IPs or cloud instances.
Raising money here is a bad sign IMO unless it’s for a completely new product that requires servers at exchanges to eat CDNs like cloudflare’s lunch.
Please no.
that was disappointing
at least the current software is open source, so others can fork it before it closes down on itself and enshittifies.
I'd sell out at $160M, too. I'm happy for them, and sad for everyone else.
Not the server.
headscale is nice, but it's not an official project.
If they turn evil (unlikely with the current folks there) they’ve written up / open sourced plenty of what got them to this point.
Don’t capture all the value you create. But you should try to capture some.
overall, they still seem to have their heads screwed on straight and have an actual business model, that is also pretty fair - charge enterprises per seat to solve their network identity problems.
anyway, keep up the good work, Avery and co.
I use it in projects to stream internet / connectivity from my phone to the NVIDIA Jetson line, making my robotics projects easily accessible / debuggable:
https://github.com/burningion/bicyclist-defense-jetson?tab=r...
They've since raised more funding recently, and have larger use cases in mind for robotics: https://rerun.io/blog/physical-ai-data
I've spoken with members of the team, and they're all great. Wouldn't hesitate to use the product / work with them anywhere.
What application are you using for that (on top of Tailscale, that is)?
https://tailscale.com/kb/1106/taildrop
That said, Tailscale is one of the products that just works.
Maybe a slight bias on my part as I'm a developer and not an investor.
And not that funding or advising is less important, but it's a nice feeling connecting a product I like to faces who make it happen.
In which direction?
https://www.cloudflare.com/people/
Names/photos are not even clickable. Just first names and a photo.
Thats so cloudflare.
1. Potential customers
2. Potential investors
Both groups are a lot more swayable by social proof from seeing the "investors" than the devs as they infer a lot of credibility based on who has funded you. Similarly that's why you often see big company logos on marketing pages because it makes other customers more likely to buy. "<xyz> is too big to be wrong about this product"
Putting people on the website is, very variable. Do you update the website every week or two when someone comes or leaves? Well that's awkward if someone is fired.
You get to 100 people, then 200 people. Now what do you do? Remove everyone? Only put people on above a certain level? What do you do when someone asks you not to be listed. Or when John becomes Jane, but doesn't want to be super duper public about it?
Or, when your company gets media attention and now the moment you add/remove someone from the website you get news or social media posts about it?
They're not exactly secretive, there's just little value to have it on the main company page. (And if you just want pictures, https://tailscale.com/careers has that too.)
There are plenty of open source alternatives cropping up[0]. I'm curious to see what Tailscale can do with a lot of resources.
[0]: https://github.com/anderspitman/awesome-tunneling?tab=readme...
I logged a bug about it and the latest versions this seems to have gone away. I also moved away from the mac store variant and into the standalone. Not sure if that helped either.
It's interesting because they have clearly demonstrated a demand for such a thing, but the "just works" pitch is a fantasy, at least today.
TIL this is a thing
> Just use the v6 ULA address that begins with fd7a exclusively.
perfect, this is exactly what I desired
(I'm having an increasingly high number of sad v4 only LAN devices and planned to move to a v4 block that sits way too close to the one Tailscale uses.)
> There's unfortunately no GUI to do this; you'll have to change the Tailscale ACL to disable IPv4.
ah that's why I missed it, thanks!
It’s a bit like saying Dropbox is just a GUI on top of TLS.
What tailscale has over it is hype, lots and lots of hype. Also a much more well thought out, and arguably more secure VPN protocol underneath, which is why GP's comment is on point.
Polish costs effort and money and it also really truly saves time and makes for a better product. So that matters.
There may be VPN nerds out there who think there's nothing special happening with Tailscale, but I submit those nerds haven't spent a lot of time dealing with the median, replacement-level VPN configuration prior to Tailscale. I'm a pentester, and so I have had that pleasure. Tailscale is revolutionary compared to what it replaced.
?? https://tailscale.com/kb/1118/custom-derp-servers
For an individual, heck no. Fortunately, headscale exists for individuals to use.
Well, it is. After all, for a Linux user, you can already build such a system yourself quite trivially...
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
That said, I don't really understand the supposed misunderstanding you point out. It seems that dang argues that "the exchange was pleasant and successful." I've never seen someone claim otherwise.
Rather, I've seen it used as an example of how technical users can fail to recognize the complexity inherent in their workflows, and therefore may also fail to see the real-world business value in creating (and selling) simpler interfaces. See also a SMOP: https://en.wikipedia.org/wiki/Small_matter_of_programming
>You are correct that this presents a very good, easy-to-install piece of functionality for Windows users. The Windows shortcomings that you point out are certainly problems, and I think that your software does a good job of overcoming that. (emphasis added.)
They still fail to understand that this is not a Windows or Linux issue but a reliability and ease of use issue. Not to mention the fact that the desktop Linux marketshare was probably less than 1% and therefore irrelevant in this context to begin with.
Us humans are kinda ok at preserving knowledge (and we're getting even better, but not in a good way).
Tailscale did make a donation to WireGuard. They have regularly contributed to wireguard-go, including the complicated GRO/GSO bits.
> Tailscale is pretty much Wireguard with a GUI on top.Well, isn't PUBG a GUI on top of Unreal?
https://github.com/tailscale/tailscale/tree/main/logtail
https://apenwarr.ca/log/20190216 / https://archive.vn/xlsA1
I honestly don't know how this big dealmaking works but it strikes me that when you take out this big of an obligation that the obligation has a gravity that may drag you in a direction you (or consumers) do not want to go.
Love Tailscale as a product (as does everyone I talk to) but genuinely want to learn more about the trade-offs as usually when we see big dollar signs all we do is celebrate.
When founders raise this much money, it's because there's (1) a lot they want to do and hire for, or (2) they don't want to worry about monetizing the product for a significant period and focus on growth or product development.
You are saying equity is not bonds.
However investors expect to be repaid in the future with control and exhorbitant interest rates (based on risk). VC invests to make money, but that money comes from future equity rounds or IPO.
If you didn't take the VC money (and the business achieved the same growth without the money) then you'd expect you would have been better off by at least the amount invested (investors don't invest with the expectation of only getting their money back).
If the business doesn't succeed then you are on the hook to pay the debt from your equity via liquidation preferences.
VC payment is expectation statistics, but the investors know that game and invest to make money. That money comes from the current equity owners making less in the future.
A few examples come to mind immediately: trading firms/hedge funds often have more capacity than that in their existing strategies; hardware businesses can have substantial up-front costs; companies with high COGS might need that much to just scale at the rate they're already moving, since each unit locks up a bunch of capital until it's sold.
Also note that the benchmark of “efficiency” should be a function of growth, not some absolute standard.
I think the thesis is thought provoking. Not sure yet if it’s worth anything, but it also doesn’t preclude businesses from having massive cashflow.
By definition focusing on things that don't grow your business because you have way too much money in the bank is going to be worse for your business than being forced to focus because you've only got a year of runway.
Took a project I'd been putting off and putting off because I knew it'd eat half a Saturday, and made it a 20-minute affair from signup to having everything done, including adding some devices to the network that I wouldn't even have bothered to try adding on my own.
I realize this is a very ironic place to make this statement, but I am utterly exhausted by VC money destroying all of the services I enjoy, like a slow disease spreading through a herd of livestock.
If you'd like to avoid this extraction, you can fork their command line client code (along with the open source headscale server) and run a mesh network across your linux machines with all the magic DNS and userspace-TCP/IP-stack goodness that you're used to. Tailscale has given away a lot of the engineering for free.
However, as soon as your fork becomes incompatible with Tailscale's stack, you lose a massive value-add: proprietary platform support. Today, you can add the sale's guy's iPhone to your tailnet in seconds. If Apple's capricious automated AppStore security pulls the Tailscale app from the AppStore, Tailscale Corp is big enough to get Apple's attention. A small FLOSS group with some forked clients on github won't be able to provide this same operational stability.
> Building the New Internet
(Insert mandatory reference to Silicon Valley here :))
> We think there’s a better way forward. We're calling it identity-first networking.
I would love to see this. Every day I have to stare at YAML files with IP addresses in them is a day I will never get back. I wish cjdns[0] had succeeded already but oh well, now I hope the Tailscale guys will!
[0]: https://github.com/cjdelisle/cjdns/
> NDN has its roots in an earlier project, Content-Centric Networking (CCN), which Van Jacobson first publicly presented in 2006.. NDN applications name data and data names will directly be used in network packet forwarding.. Its premise is that the Internet is primarily used as an information distribution network, which is not a good match for IP, and that the future Internet's "thin waist" should be based on named data rather than numerically addressed hosts.
NDN talk by Van Jacobson at Google (2006): https://www.youtube.com/watch?v=oCZMoY3q2uM