4 ms·

> However, I'd say their security _posture_ is pretty good The clients for Windows, iOS and macOS are closed-source. As a general rule, a closed-source server

> However, I'd say their security _posture_ is pretty good The clients for Windows, iOS and macOS are closed-source. As a general rule, a closed-source server is bad, but ultimately it's somewhat tolerable. A closed-source client for a product or service that appears to have an acknowledged security posture is full-on unacceptable. I can't fanthom why they would shoot themselves in the foot like this.

danielheath 4y ago
Not clear on why they made that call, but those are incidentally the exact set of platforms where they can't rapidly ship security updates (it's dependent on the vagaries of the platforms store).
- EMIRELADERO 4y ago
  AFAIK they don't ship the Windows program through the Microsoft Store. Don't think the argument holds water.
  - bradfitz 4y ago
    We're working on getting it in the Microsoft Store. (as an option)
    - chipsa 4y ago
      Does this imply potentially automatically updating, instead of me remembering to go get the MSI?
- Operyl 4y ago
  From their FAQ[0]: > Is Tailscale open source? > Mostly. Tailscale daemon client code is open source. Where the operating system is open source, the daemon and GUI are open source, and where the operating system is closed, the daemon is open source and the GUI is closed source. You can run just the tailscaled daemons on Windows, it just wouldn't have a GUI, and that's fully open source[1]. Some more justification from Brad himself. [2] [0] https://tailscale.com/opensource/#:~:text=Is%20Tailscale%20open%20source%3F,the%20GUI%20is%20closed%20source https://tailscale.com/opensource/#:~:text=Is%20Tailscale%20o.... [1] https://news.ycombinator.com/item?id=28901253 https://news.ycombinator.com/item?id=28901253 [2] https://news.ycombinator.com/item?id=32470615 https://news.ycombinator.com/item?id=32470615
  - EMIRELADERO 4y ago
    Still pretty bad from a security perspective. Even if it's non-trivial for a developer to self-deploy, transparency is always a positive.
fastball 4y ago
The client daemon is open source. Generally you shouldn't be increasing attack surface with the introduction of a GUI (the closed-source part), so gonna have to strongly disagree with you here.

danielheath 4y ago

Not clear on why they made that call, but those are incidentally the exact set of platforms where they can't rapidly ship security updates (it's dependent on the vagaries of the platforms store).

EMIRELADERO 4y ago
AFAIK they don't ship the Windows program through the Microsoft Store. Don't think the argument holds water.
- bradfitz 4y ago
  We're working on getting it in the Microsoft Store. (as an option)
  - chipsa 4y ago
    Does this imply potentially automatically updating, instead of me remembering to go get the MSI?
Operyl 4y ago
From their FAQ[0]: > Is Tailscale open source? > Mostly. Tailscale daemon client code is open source. Where the operating system is open source, the daemon and GUI are open source, and where the operating system is closed, the daemon is open source and the GUI is closed source. You can run just the tailscaled daemons on Windows, it just wouldn't have a GUI, and that's fully open source[1]. Some more justification from Brad himself. [2] [0] https://tailscale.com/opensource/#:~:text=Is%20Tailscale%20open%20source%3F,the%20GUI%20is%20closed%20source https://tailscale.com/opensource/#:~:text=Is%20Tailscale%20o.... [1] https://news.ycombinator.com/item?id=28901253 https://news.ycombinator.com/item?id=28901253 [2] https://news.ycombinator.com/item?id=32470615 https://news.ycombinator.com/item?id=32470615
- EMIRELADERO 4y ago
  Still pretty bad from a security perspective. Even if it's non-trivial for a developer to self-deploy, transparency is always a positive.

fastball 4y ago

The client daemon is open source. Generally you shouldn't be increasing attack surface with the introduction of a GUI (the closed-source part), so gonna have to strongly disagree with you here.