3 ms·

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping the

by tailspin2019 4y ago

> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and walking away.

bombcar 4y ago
Your username would have been a good option for a cutesy name for the vulnerability, however.
hellcow 4y ago
> Anything other than an immediate response would have been akin to lighting their company on fire and walking away. Have we forgotten Zoom, who reinstalled itself secretly on user machines with an RCE-vulnerable server, which they described as “working as intended?” They’re still wildly popular today with organizations despite the insane lack of regard for security and their users’ safety. Mistakes happen. I applaud Tailscale for moving so quickly and doing the right thing.
- xmodem 4y ago
  I would caution against grading on a curve
- bobbylarrybobby 4y ago
  The users of tailscale and of zoom expect very different things from their respective software vendors
deleted 4y ago
[deleted]
acuteaura 4y ago
As the reporting party of the much less severe (and much less interesting) TS-2022-003[1] I can confirm that vendor interaction is also swift when not responding would not light the company on fire. In fact there were several other vendors that were affected that have yet to mitigate it. [1]: https://notes.acuteaura.net/posts/github-enterprise-security/ https://notes.acuteaura.net/posts/github-enterprise-security...
loa_in_ 4y ago
> Anything other than an immediate response would have been akin to lighting their company on fire and walking away. Companies get away with sweeping customer security issues under the rug less and less, but still far too often. I honestly wish we as a people would put other players of this game in as high standards as you do here for this company here.

bombcar 4y ago

Your username would have been a good option for a cutesy name for the vulnerability, however.

hellcow 4y ago

> Anything other than an immediate response would have been akin to lighting their company on fire and walking away. Have we forgotten Zoom, who reinstalled itself secretly on user machines with an RCE-vulnerable server, which they described as “working as intended?” They’re still wildly popular today with organizations despite the insane lack of regard for security and their users’ safety. Mistakes happen. I applaud Tailscale for moving so quickly and doing the right thing.

xmodem 4y ago
I would caution against grading on a curve
bobbylarrybobby 4y ago
The users of tailscale and of zoom expect very different things from their respective software vendors

deleted 4y ago

[deleted]

acuteaura 4y ago

As the reporting party of the much less severe (and much less interesting) TS-2022-003[1] I can confirm that vendor interaction is also swift when not responding would not light the company on fire. In fact there were several other vendors that were affected that have yet to mitigate it. [1]: https://notes.acuteaura.net/posts/github-enterprise-security/ https://notes.acuteaura.net/posts/github-enterprise-security...

loa_in_ 4y ago

> Anything other than an immediate response would have been akin to lighting their company on fire and walking away. Companies get away with sweeping customer security issues under the rug less and less, but still far too often. I honestly wish we as a people would put other players of this game in as high standards as you do here for this company here.