how to run signup and setupdomain for an upspin setup on a tailnet?
fge...@gmail.com
https://tailscale.com/kb/1136/tailnet ).
Iiuc I can't set a TXT record for myfunkypublicname.ts.net.
How to run signup and setupdomain in this case?
Eric Grosse
After a few messages back and forth off-list, here is my perspective on the question:
Upspin was designed for controlled sharing of files with family and friends, where you have different expectations of trust and skill for different people. Some of the sharing may even be incidental, say a person you just met at a conference and are wiling to give read-only access to just one file. When I've set up a VPN on the other hand, user access tends to be all-or-nothing, and with no overlapping use of other VPNs. So offhand a VPN doesn't seem like a good fit with our original intent with upspin; they're not opposed but you have to expect more than a few rough edges. For example, the globally visible list of identities at https://key.upspin.io/log likely does not appeal to a VPN administrator.
Ever since Plan 9 days, I've most liked systems that could safely live directly on the Internet with no firewall or VPN. It motivates me to work really hard to secure the system! Somebody has to know how to do this, else how do we get a secure firewall or a secure router? Anyway, that's what we were aiming for with gcp upspinserver. But maybe you don't have the authority or time to harden to that level or just want belt-and-suspenders, and then a VPN can be a good way to go.
The other reason a VPN would be desired is that our decade-old upspin design may be too vulnerable to a hypothetical future quantum computer. As you may know, the issue is "store now; decrypt later." That is, intelligence agencies are recording internet traffic today with the
plan that they will be able to cryptanalyze elliptic curve protocols in a few decades. With upspin and presumed future court warrants to cloud providers, you're even paying for their storage! NIST has finally standardized Kyber as ML-KEM, but what we need for the most direct update of upspin key wrapping is mKyber, which exists but has not had enough analysis and standardization.
So putting all of upspin behind your family VPN, including the keyserver and storage server, is not a crazy idea. But once the sharing is that narrowly restricted, maybe you're as well off simply using a NAS device or scp? I haven't a firm opinion yet.