Tailcat – Like netcat, but over Tailscale’s data plane

Let's be real for a second: netcat is a miracle of minimalism, a Swiss Army knife that somehow also works as a butter knife, a screwdriver, and a bottle opener. But it's also a security liability wrapped in a convenience layer. Every time you fire up `nc -lvp 4444` to shove a file across, you're opening a hole in your firewall and praying the network gods don't smite you. Tailcat doesn't just patch that hole; it removes the concept of a hole entirely. You're not exposing a port; you're invoking a service that only exists for authenticated peers on your Tailnet. That's not an incremental improvement—that's a paradigm shift wrapped in a familiar CLI. What's genuinely clever here is how Tailscale keeps pulling this trick: take a boring, battle-tested Unix utility, reimagine it with identity-based networking baked in, and suddenly you've got a tool that makes SSH tunneling feel like carrier pigeons. Tailcat sits alongside Tailscale's SSH and Funnel features as yet another brick in the wall of "why would you ever expose a raw port again?" It's the kind of dogfooding that makes sysadmins' eyes light up because it solves a real, daily pain point: getting data between machines without babysitting firewall rules or praying to the NAT gods. The HN reception—572 points, 100 comments—tells you this isn't a niche toy. The comments are probably a mix of "this is cool" and "why does this exist when I can just use socat?" and honestly, both are valid. But the existence of socat as the answer to netcat's flaws has always been a band-aid. Socat is a monster of complexity that trades one set of footguns for another. Tailcat's bet is that the future of network tooling isn't more flags and more protocol gymnastics—it's leveraging the identity and encryption layer that already exists in your Tailnet. That's a bet I'd take. The bigger story here is the slow but steady death of the open-port model. Every Tailscale tool—Tailcat, Tailscale SSH, Funnel—is another nail in the coffin of "just open a port and hope for the best." For a community that's spent decades building elaborate firewall dance routines, that's not just convenient; it's a liberation. Source: https://github.com/tailscale/tailcat