I don't know squat about TFS, other than as a user who has performed simple check in/outs.

I just installed it locally and would like to do joint development with a friend.

I was having trouble making my TFS web site on port 8080 visible (the whole scoop is here if your interested) and I wonder if it could be related to the fact that TFS is probably using Windows Authentication to identify the user.

Can TFS be set up to use forms authentication?

We probably need to set up a VPN, though that's a learning curve too.

To use TFS, do our machines have to belong to a domain?

We're not admin types, though he is better than me, though I would be interested in any feedback or advice on which path is likely to pan out the best. I already got AxoSoft OneTime working in this type of an environment and it suits us well, but I am tempted at all the bells & whistles with TFS and the ability to tie tracked bug items to code changes.

As far as finding a good way to share code, do sites like SourceForge allow one to keep code secure among members only?