Secure and censorship-resistant connectivity is very hard. We should compartmentalise and not expect everything to reimplement and maintain their own version of it and focus on specialised solutions that actually work.

What all user-facing software should have is a minimal-overhead connection option to improve performance inside user's tunnel of choice.

Pure QUIC gets blocked easily, SSH requires wrapping, even Tailscale mimicry is basic and they still ignore simple protocol improvements available.

One of my primary use cases for tailscale/VPN is that I can happily run stuff (grafana, gitea, etc) and not have to be panicked about monitoring for CVEs - I serve it all over HTTPS but I don't want to put it on the public internet if I don't need to.

I'm also in favor of adding encrypted connections to RustDesk, not to replace tailscale, but as a part of this complete breakfast. Tailscale provides mutually authenticated, authorized L3 access. TLS can be configured to provide mutually authenticated L4 access. With a little OIDC/webauthn setup, both L3/L4 support device attestation, meaning there's no way to connect without e.g. a yubikey (or perhaps an enrolled TPM.)

Doesn't Iroh do that? It would be great to go back to the peer to peer days, but with security.

agreed, zero-trust solution with proper endpoint security and PKI is superior to transport encryption and insecure protocols

so without tailscale or any other intermediary turn service how does my computer behind a NAT connect to another computer behind another NAT

managing the certificates safely is too much of a hassle. especially if i dont want to accessible on public internet.

Tailscale also protects against login attempts.

So I'm supposed to set up PKI before I can open a remote console connection?

Please just make it work seamlessly with my existing SSH credentials. Like SFTP.