4 ms·

I think that by the sheer nature of Wireguard, it doesn't matter much. We don't send any readable data to Tailscale, they, for the greater part, handle plumbing

I think that by the sheer nature of Wireguard, it doesn't matter much. We don't send any readable data to Tailscale, they, for the greater part, handle plumbing between nodes. What goes in the pipes remains unnoticed and unknown to them. Their MagicDNS feature may raise different concerns though, but I'll let others comment on it.

edf13 4y ago
This new service allows them (or if they’re hacked - anyone)… to MitM your connections - they state themselves they could ssl terminate the connections as they own the ts.net level, they say they don’t but that’s now…
- ignoramous 4y ago
  > This new service allows them (or if they’re hacked - anyone)… to MitM your connections... TFA mentions that the immutable certificate logs reveal if something spooky is going on. Not enough of a guarantee since the tailscale client may siphon off certs from a local device to its servers anyway. But that's us being extremely paranoid about tailscale (in which case, why use it?). Second, most services are run behind reverse-proxying load balancers which invariably are setup to "MiTM" aka terminate TLS. The providers running those load balancers control IPs + DNS records too, for good measure. I guess, supporting a dizzying array of functionality makes Tailscale a decentralised cloud service provider themselves.