3 ms·

> Tailscale terminating the request, dumping ... For that they need a certificate. They have two options of obtaining that: a) They request one from a CA. Thi

by detaro 4y ago

> Tailscale terminating the request, dumping ... For that they need a certificate. They have two options of obtaining that: a) They request one from a CA. This will be logged in Certificate Transparency logs, and thus you could detect it by comparing the certs logged with the ones your local machine generated b) they could have their software upload the certificate from your machine. That would need effort to detect (deeply inspecting the software and/or its traffic), but if a whiff of such a "feature" were to be found by anyone it couldn't really be explained away. (and aren't their clients app open-source? then at least it'd be reduced to source inspection and compiling yourself, which makes hiding stuff harder)

notpushkin 4y ago
> and aren't their clients app open-source? Only for Linux. (On macOS I think the core CLI part is open source as well, but that's not what most people use I think.)
- dblohm7 4y ago
  (Tailscalar here) Most of the Tailscale client’s functionality is implemented as a daemon called tailscaled which is in the OSS repo. It’s the GUI front ends for Windows, MacOS and iOS that are not.
  - M4v3R 4y ago
    Any specific reason to why not? These are very simple GUI apps, I imagine there’s not much custom code apart from your usual view code written there.
    - dblohm7 4y ago
      https://news.ycombinator.com/item?id=32470615 https://news.ycombinator.com/item?id=32470615 https://news.ycombinator.com/item?id=32469581 https://news.ycombinator.com/item?id=32469581
  - notpushkin 4y ago
    Thanks, you're right yeah, I've oversimplified things a bit. Re: macOS and the Network Entitlements shenanigans: if I understand correctly, it is possible to just run tailscaled unsigned [1] via /dev/utun instead of Apple's APIs. Would it be possible to get this into the GUI so that if you want, you can compile it from source and don't have to do the Apple dance? [1]: https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS https://github.com/tailscale/tailscale/wiki/Tailscaled-on-ma...
    - notpushkin 4y ago
      As an exercise, I've implemented a basic (and very hacky) UI for tailscale(1) as an xbar [1] plugin: https://gist.github.com/notpushkin/aa36c2d34e3e7180aa66ed2a589afe05 https://gist.github.com/notpushkin/aa36c2d34e3e7180aa66ed2a5... [1]: https://xbarapp.com/ https://xbarapp.com/ tailscaled isn't particularly stable on my machine though, so I guess I'll roll back to the closed source version. However, this could be a starting point for a Linux client!

by detaro 4y ago

notpushkin 4y ago

> and aren't their clients app open-source? Only for Linux. (On macOS I think the core CLI part is open source as well, but that's not what most people use I think.)

dblohm7 4y ago
(Tailscalar here) Most of the Tailscale client’s functionality is implemented as a daemon called tailscaled which is in the OSS repo. It’s the GUI front ends for Windows, MacOS and iOS that are not.
- M4v3R 4y ago
  Any specific reason to why not? These are very simple GUI apps, I imagine there’s not much custom code apart from your usual view code written there.
  - dblohm7 4y ago
    https://news.ycombinator.com/item?id=32470615 https://news.ycombinator.com/item?id=32470615 https://news.ycombinator.com/item?id=32469581 https://news.ycombinator.com/item?id=32469581
- notpushkin 4y ago
  Thanks, you're right yeah, I've oversimplified things a bit. Re: macOS and the Network Entitlements shenanigans: if I understand correctly, it is possible to just run tailscaled unsigned [1] via /dev/utun instead of Apple's APIs. Would it be possible to get this into the GUI so that if you want, you can compile it from source and don't have to do the Apple dance? [1]: https://github.com/tailscale/tailscale/wiki/Tailscaled-on-macOS https://github.com/tailscale/tailscale/wiki/Tailscaled-on-ma...
  - notpushkin 4y ago
    As an exercise, I've implemented a basic (and very hacky) UI for tailscale(1) as an xbar [1] plugin: https://gist.github.com/notpushkin/aa36c2d34e3e7180aa66ed2a589afe05 https://gist.github.com/notpushkin/aa36c2d34e3e7180aa66ed2a5... [1]: https://xbarapp.com/ https://xbarapp.com/ tailscaled isn't particularly stable on my machine though, so I guess I'll roll back to the closed source version. However, this could be a starting point for a Linux client!