5 ms·

> How did they react to Headscale? I must’ve missed the announcement. They hired the dev: https://tailscale.com/blog/opensource#the-open-source-coordination-se

by Lammy 1y ago

> How did they react to Headscale? I must’ve missed the announcement. They hired the dev: https://tailscale.com/blog/opensource#the-open-source-coordination-server https://tailscale.com/blog/opensource#the-open-source-coordi... Fun fact: Tailscale have an almost-assuredly-accurate count of Headscale users due to how few people disable the Tailscale client's telemetry which by default sends them real-time events about everything you do on a Headscale network. See KB1011: https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic “Each Tailscale agent in your distributed network streams its logs to a central log server (at log.tailscale.io). This includes real-time events for open and close events for every inter-machine connection (TCP or UDP) on your network.” It's possible to opt out of this spying on Unix/Windows/Mac by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment variable (see https://tailscale.com/kb/1011/log-mesh-traffic#opting-out-of-client-logging https://tailscale.com/kb/1011/log-mesh-traffic#opting-out-of...), but it is not currently possible to opt out in the Android/iOS clients: https://github.com/tailscale/tailscale/issues/13174 https://github.com/tailscale/tailscale/issues/13174 This is why they had the data telling them they should hire the Headscale dev to nip that competition in the bud before it had any chance to usurp their business by overtaking them in mindshare using their own client. Definitely a sound business decision, but it really really irked me when I realized I was feeding Tailscale detailed usage data for everything I did on my supposedly “““private””” Headscale network despite having no business relationship with them. For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326 https://github.com/tailscale/tailscale/issues/15326 The privacy-adversarial behavior made me switch from Headscale to NetBird for my personal network now that it's available in FreeBSD Ports: https://www.freshports.org/security/netbird/ https://www.freshports.org/security/netbird/

ElectricalUnion 1y ago
> For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326 https://github.com/tailscale/tailscale/issues/15326 18000 data points per week seems IMHO pretty low (only 1.7 requests per minute for a whole network? Unlikely, even my Android phone does way more that 1.7 requests per minute just to ad networks, nevermind everything else on the network summed), it's probably way more. 18000 data points is also a lie, that's a different issue - the issue of UDP DNS sucking in general so your average application/OS keeps reissuing requests if they think the UDP packet got dropped.
- Lammy 1y ago
  > only 1.7 requests per minute for a whole network? Connections != Requests Telemetry consisting of an open/close event pair would be, like, one entire SSH session, or one RDP session. Even HTTP has supported Keep-Alive since 1997.
  - ElectricalUnion 1y ago
    > Connections != Requests DNS lookups != Requests too...
mac-attack 1y ago
Randomly stumbled across this last week when I upgraded my DNS blocklist and saw all the tailscale logs. Definitely unexpected
eadmund 1y ago
That’s appalling. I really feel like a fool — I had thought the world of Tailscale but no longer. This needs to be more widely known.
- quectophoton 1y ago
  I always appreciate that Alpine Linux maintainers disable[1] these things by default. [1]: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/community/tailscale/tailscale.confd#L12 https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/c...
godelski 1y ago
> It's possible to opt out of this spying on Unix/Windows/Mac by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment variable Am I misreading the docs?[0] Network flow logs are available to help you understand which devices are connecting to one another over time, that is, the flow of traffic across your tailnet. These logs strictly do not contain any information about client operations or contents of network traffic. Network flow logs must be enabled[1]. This makes it look like they are disabled by default. [0] https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic [1] https://tailscale.com/kb/1219/network-flow-logs#enable-network-flow-logs https://tailscale.com/kb/1219/network-flow-logs#enable-netwo...
- Lammy 1y ago
  > Am I misreading the docs? Yes, but don't feel bad, because this seems designed to be confusing and easy to overlook. See the privacy policy: https://tailscale.com/privacy-policy#information-we-collect-through-automated-means https://tailscale.com/privacy-policy#information-we-collect-... “When you use the Tailscale Solution, we collect limited metadata regarding your device used to access the Tailscale Solution, such as: the device name; relevant operating system type; host name; IP address; cryptographic public key; user agent (where applicable); language settings; date and time of access to the Tailscale Solution; logs describing connections and containing statistics about data sent to and from other devices (“Inter-Node Traffic Logs”); and version of the Tailscale Solution installed.” (emphasis mine) Here's a Tailscale client startup with telemetry enabled, which is the silent default: 2025/04/13 17:02:07 logtail started 2025/04/13 17:02:07 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale"} 2025/04/13 17:02:07 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 17:02:07 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 17:02:07 dns: using dns.openresolvManager 2025/04/13 17:02:07 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 17:02:07 wgengine.NewUserspaceEngine(tun "tailscale0") ... Versus the same client with the `--no-logs-no-support` opt-out argument added, where the very first line (not to mention the argument name itself) is some FUD trying to scare one into reverting to anti-privacy mode: 2025/04/13 16:29:20 You have disabled logging. Tailscale will not be able to provide support. 2025/04/13 16:29:20 logtail started 2025/04/13 16:29:20 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale", "--no-logs-no-support"} 2025/04/13 16:29:20 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 16:29:20 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 16:29:20 dns: using dns.openresolvManager 2025/04/13 16:29:20 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 16:29:20 wgengine.NewUserspaceEngine(tun "tailscale0") ...
juanfont 1y ago
Headscale creator here. > Fun fact: Tailscale have an almost-assuredly-accurate count of Headscale users due to how few people disable the Tailscale client's telemetry which by default sends them real-time events about everything you do on a Headscale network. See KB1011: https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic That is not true. We actually instruct all the clients to send no logs - since at least three years: https://github.com/juanfont/headscale/blame/main/hscontrol/types/config.go#L325 https://github.com/juanfont/headscale/blame/main/hscontrol/t.... And also in the config example: https://github.com/juanfont/headscale/blob/main/config-example.yaml#L386 https://github.com/juanfont/headscale/blob/main/config-examp... That said, I would have loved to know how many nodes use Headscale... :)

by Lammy 1y ago

ElectricalUnion 1y ago

> For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326 https://github.com/tailscale/tailscale/issues/15326 18000 data points per week seems IMHO pretty low (only 1.7 requests per minute for a whole network? Unlikely, even my Android phone does way more that 1.7 requests per minute just to ad networks, nevermind everything else on the network summed), it's probably way more. 18000 data points is also a lie, that's a different issue - the issue of UDP DNS sucking in general so your average application/OS keeps reissuing requests if they think the UDP packet got dropped.

Lammy 1y ago
> only 1.7 requests per minute for a whole network? Connections != Requests Telemetry consisting of an open/close event pair would be, like, one entire SSH session, or one RDP session. Even HTTP has supported Keep-Alive since 1997.
- ElectricalUnion 1y ago
  > Connections != Requests DNS lookups != Requests too...

mac-attack 1y ago

Randomly stumbled across this last week when I upgraded my DNS blocklist and saw all the tailscale logs. Definitely unexpected

eadmund 1y ago

That’s appalling. I really feel like a fool — I had thought the world of Tailscale but no longer. This needs to be more widely known.

quectophoton 1y ago
I always appreciate that Alpine Linux maintainers disable[1] these things by default. [1]: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/community/tailscale/tailscale.confd#L12 https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/c...

godelski 1y ago

> It's possible to opt out of this spying on Unix/Windows/Mac by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment variable Am I misreading the docs?[0] Network flow logs are available to help you understand which devices are connecting to one another over time, that is, the flow of traffic across your tailnet. These logs strictly do not contain any information about client operations or contents of network traffic. Network flow logs must be enabled[1]. This makes it look like they are disabled by default. [0] https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic [1] https://tailscale.com/kb/1219/network-flow-logs#enable-network-flow-logs https://tailscale.com/kb/1219/network-flow-logs#enable-netwo...

Lammy 1y ago
> Am I misreading the docs? Yes, but don't feel bad, because this seems designed to be confusing and easy to overlook. See the privacy policy: https://tailscale.com/privacy-policy#information-we-collect-through-automated-means https://tailscale.com/privacy-policy#information-we-collect-... “When you use the Tailscale Solution, we collect limited metadata regarding your device used to access the Tailscale Solution, such as: the device name; relevant operating system type; host name; IP address; cryptographic public key; user agent (where applicable); language settings; date and time of access to the Tailscale Solution; logs describing connections and containing statistics about data sent to and from other devices (“Inter-Node Traffic Logs”); and version of the Tailscale Solution installed.” (emphasis mine) Here's a Tailscale client startup with telemetry enabled, which is the silent default: 2025/04/13 17:02:07 logtail started 2025/04/13 17:02:07 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale"} 2025/04/13 17:02:07 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 17:02:07 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 17:02:07 dns: using dns.openresolvManager 2025/04/13 17:02:07 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 17:02:07 wgengine.NewUserspaceEngine(tun "tailscale0") ... Versus the same client with the `--no-logs-no-support` opt-out argument added, where the very first line (not to mention the argument name itself) is some FUD trying to scare one into reverting to anti-privacy mode: 2025/04/13 16:29:20 You have disabled logging. Tailscale will not be able to provide support. 2025/04/13 16:29:20 logtail started 2025/04/13 16:29:20 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale", "--no-logs-no-support"} 2025/04/13 16:29:20 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 16:29:20 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 16:29:20 dns: using dns.openresolvManager 2025/04/13 16:29:20 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 16:29:20 wgengine.NewUserspaceEngine(tun "tailscale0") ...

juanfont 1y ago

Headscale creator here. > Fun fact: Tailscale have an almost-assuredly-accurate count of Headscale users due to how few people disable the Tailscale client's telemetry which by default sends them real-time events about everything you do on a Headscale network. See KB1011: https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic That is not true. We actually instruct all the clients to send no logs - since at least three years: https://github.com/juanfont/headscale/blame/main/hscontrol/types/config.go#L325 https://github.com/juanfont/headscale/blame/main/hscontrol/t.... And also in the config example: https://github.com/juanfont/headscale/blob/main/config-example.yaml#L386 https://github.com/juanfont/headscale/blob/main/config-examp... That said, I would have loved to know how many nodes use Headscale... :)