docs: a why-not-tailscale note in see also

Author: cablehead

README.md

@@ -265,15 +265,48 @@ something you're working on.
 [SSH tunnels](https://www.ssh.com/academy/ssh/tunneling) need inbound access on at
 least one side. pai-sho works when neither machine has open inbound ports.
 
-[WireGuard](https://www.wireguard.com/), [Tailscale](https://tailscale.com), and
-[NetBird](https://netbird.io/) are mesh VPNs that put every machine on a virtual
-network. pai-sho is narrower: you expose specific ports, not the whole machine,
-which keeps it easy to reason about exactly what is reachable.
+[WireGuard](https://www.wireguard.com/) has no control plane at all. You put
+peers in a config file by public key, and a peer entry needs an `Endpoint` with
+a routable address, so someone has to solve reachability. If both machines are
+behind NAT, you are standing up a bounce host.
 
 [dumbpipe](https://github.com/n0-computer/dumbpipe) is the direct inspiration.
 [pigeons](https://pigeons.computer), SSH over iroh from the same team, is where
 pai-sho's connection handling comes from.
 
+### Why not Tailscale?
+
+You probably should use [Tailscale](https://tailscale.com). It solves this
+problem well, and there is a company behind it. Four things differ, and one is a
+point against pai-sho.
+
+**No account.** Both punch through NAT with help from third-party infrastructure:
+Tailscale's DERP relays, and n0's relays here. What differs is what that
+infrastructure is allowed to do. A Tailscale node registers with
+`controlplane.tailscale.com`, which decides membership and hands each node a
+filtered list of the peers it may see. Your box phones Tailscale, and Tailscale
+introduces the two of you. A pai-sho box dials your laptop by public key, with
+discovery as a lookup and the relay as a pipe that cannot read what it carries.
+Nothing in that path can add a peer to your set, and there is nothing to sign up
+for.
+
+**Specific ports, not a whole machine.** Tailscale gives a peer an IP, and
+everything listening on it is reachable unless an ACL says otherwise. Default
+allow, then narrow it. pai-sho grants one port at a time to one key, and a peer
+with no grants sees nothing. Day to day the two feel much the same, since you
+type a name and a port either way.
+
+**Less to install.** Without `--tun`, pai-sho binds loopback addresses. On Linux
+that needs no network device and no privilege, because `127.0.0.0/8` already
+routes to `lo`. Tailscale needs a tun device, or its userspace mode, which gives
+you a proxy rather than real listeners. This one is narrow: `--tun` puts pai-sho
+in the same position.
+
+**The ops story is worse.** Tailscale keeps one policy file for the whole
+tailnet, so who-can-reach-what is a thing you read in a single place. pai-sho's
+answer is "which command did you run on which machine," and there is no central
+view of it. A web UI would help. It does not exist.
+
 ## More
 
 [docs/scenarios.md](docs/scenarios.md) works two flows end to end: a shared build