You’ve probably been there. You’re poking around GitHub, looking for a quick way to pipe some data between two machines. You stumble across Tailcat—billed simply as “like netcat, but over Tailscale’s data plane.”
Your first reaction is admiration. It’s neat. It’s clean. It brings back a wave of nostalgia for the days when TCP tools were simple, and you could just route traffic without fighting through seven layers of corporate NAT and firewall hell.
One commenter even pointed out how wild it is that the creator, Brad, is still making relevant tools a decade after those legendary HTTP/2 in Go videos. There’s a lot of love in the room.
But if you look past the clever engineering, a darker reality sets in.
Convenience is the most expensive thing in software engineering. You just don’t see the bill until later.
Here’s the twist: Tailcat isn’t just a neat utility. It’s a moat-building tactic.
By open-sourcing the client, Tailscale gives you a hit of transparency and control over the tunnel. You feel sovereign. You feel like you own the pipe. But while you’re admiring the open-source data plane, you are quietly normalizing your dependence on Tailscale’s proprietary coordination infrastructure.
The control plane—the brain that actually routes the traffic, manages identities, and authenticates devices—remains entirely locked down.
Openness at the edges is the perfect disguise for lock-in at the core.
The developers in the comments know something is up. One user proudly noted they’ve been doing the “homemade version” of this for years using SSH forwarding and nginx reverse proxy. They didn’t need Tailscale’s wrapper.
Another commenter hit the nail on the head: “I like that it removes tailscale proprietary… if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty? like netbird, openziti, zerotier, etc.”
Exactly. Why not go all the way? Because going all the way doesn’t capture your ecosystem.
Tailscale’s strategy is brilliant, but you have to recognize it for what it is. They are selling you the convenience of their network while ensuring you can never actually leave it. Half of modern software is just selling vendor lock-in disguised as “added value.”
When you choose an ecosystem tool today, you aren’t just picking a utility. You are picking a landlord. And eventually, the rent will come due.
If you don’t control the coordination layer, you don’t control the network. You’re just renting a lane on someone else’s highway.
Tailcat is a fantastic piece of engineering. Use it, enjoy it, but don’t confuse the tool for the chain. Ask who controls the critical path, because today’s convenience is always tomorrow’s constraint.
FAQ
Q: If the tool works and saves me time, why does the underlying business model matter?
A: Because the cost of switching ecosystems compounds over time. Today it's a handy CLI tool; tomorrow it's the foundational network architecture your entire infrastructure relies on. When the pricing changes or the terms shift, you're already locked in.
Q: What should I do if I actually want full network sovereignty?
A: Look at true end-to-end open source alternatives like Netbird, OpenZiti, or ZeroTier. Or do what one commenter did: build it yourself with raw SSH forwarding and nginx reverse proxies. It’s harder, but you own the keys.
Q: Isn't Tailscale just providing a service worth paying for?
A: Absolutely. Tailscale's coordination plane is excellent, and paying for convenience is a valid engineering choice. The danger isn't using it; the danger is using it while pretending you haven't sacrificed your architectural independence.