You used AI to write that, didn't you? Please don't do that, it's disrespectful.

2) Tailscale's control plane model for peer distribution avoids every concern affecting IPsec in regard to protocol negotiation security and compatibility.

TL;DR, diverging from WireGuard & supporting AES (via protocol negotiation with hardware acceleration), would be relatively painless.

1) the WireGuard kernel implementation, despite not even being zero-copy, exceeds the performance of the userspace implementation

2) implementations utilizing the userspace network stack have a maximum potential performance (context switch + memcpy is very slow, and that affects UDP disproportionately). It's the wrong approach for meaningful improvement.

So it's not that simple: it's impossible for Tailscale to use any existing kernel or accelerated WireGuard implementation. They could derive inspiration, but a kernel module for Linux won't fix Windows & Mac. With that said, I feel they have enough funding to maintain a few platforms (:

It is slow. It cannot achieve speeds of greater than 1Gbps on clients systems (Windows & Mac), where you'd normally see it being used. On Linux, it struggles to achieve 10Gbps even when using a synthetic large packet benchmark [1]. With an IMIX benchmark, it would not be competitive whatsoever.

This problem is fixable. WireGuard achieves higher performance (Kernel vs Userspace implementation) and IPsec implementations can achieve 100Gbps/400Gbps (DPDK/XDP). Zero-copy networking.

From this blog post, I can say Tailscale still seems to not have the appetite for that, which is a shame.

[1] https://tailscale.com/blog/more-throughput

Etcd corruption and loss of quorum is extremely common in practice and the GitHub issues sit for years. The design is simple, the performance is modest, yet it still has still never been reliable, despite being marketed as so. I can't speak to whether this is specifically due to their Raft implementation, but I'd argue the entire codebase is over-engineered and questionable.

[1] https://elegantnetwork.github.io/posts/comparing-open-source...

The entire point of the iPhone Upgrade Program was to make it painless to swap to the newest iPhone every year. Without that, there's no value proposition.

If you are successfully baited and detected, you also get HWID banned, so it only takes once. This makes cheating via pixel bot unviable.

On the contrary, DMA is so desired because it eliminates this risk.

1) When DMA is fully blocked, Aimbot resorts to being a pixel bot.

2) Once you're relying on a pixel bot, all the anti-cheat has to do is "bait" the bot. After you click the bait a few times, you're banned. (:

RuneScape is actually the pioneer of this technique.