4 ms·

> It's possible to opt out of this spying on Unix/Windows/Mac by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment vari

> It's possible to opt out of this spying on Unix/Windows/Mac by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment variable Am I misreading the docs?[0] Network flow logs are available to help you understand which devices are connecting to one another over time, that is, the flow of traffic across your tailnet. These logs strictly do not contain any information about client operations or contents of network traffic. Network flow logs must be enabled[1]. This makes it look like they are disabled by default. [0] https://tailscale.com/kb/1011/log-mesh-traffic https://tailscale.com/kb/1011/log-mesh-traffic [1] https://tailscale.com/kb/1219/network-flow-logs#enable-network-flow-logs https://tailscale.com/kb/1219/network-flow-logs#enable-netwo...

Lammy 1y ago
> Am I misreading the docs? Yes, but don't feel bad, because this seems designed to be confusing and easy to overlook. See the privacy policy: https://tailscale.com/privacy-policy#information-we-collect-through-automated-means https://tailscale.com/privacy-policy#information-we-collect-... “When you use the Tailscale Solution, we collect limited metadata regarding your device used to access the Tailscale Solution, such as: the device name; relevant operating system type; host name; IP address; cryptographic public key; user agent (where applicable); language settings; date and time of access to the Tailscale Solution; logs describing connections and containing statistics about data sent to and from other devices (“Inter-Node Traffic Logs”); and version of the Tailscale Solution installed.” (emphasis mine) Here's a Tailscale client startup with telemetry enabled, which is the silent default: 2025/04/13 17:02:07 logtail started 2025/04/13 17:02:07 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale"} 2025/04/13 17:02:07 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 17:02:07 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 17:02:07 dns: using dns.openresolvManager 2025/04/13 17:02:07 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 17:02:07 wgengine.NewUserspaceEngine(tun "tailscale0") ... Versus the same client with the `--no-logs-no-support` opt-out argument added, where the very first line (not to mention the argument name itself) is some FUD trying to scare one into reverting to anti-privacy mode: 2025/04/13 16:29:20 You have disabled logging. Tailscale will not be able to provide support. 2025/04/13 16:29:20 logtail started 2025/04/13 16:29:20 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale", "--no-logs-no-support"} 2025/04/13 16:29:20 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 16:29:20 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 16:29:20 dns: using dns.openresolvManager 2025/04/13 16:29:20 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 16:29:20 wgengine.NewUserspaceEngine(tun "tailscale0") ...
- godelski 1y ago
  Ah thanks! For anyone wondering, Lammy provided the head of journalctl for tailscaled.service. I got similar results. I think my confusion comes down to there being two different types of logging. It is the network flow logs that are on the enterprise. Per the privacy policy statement, this does not set off any alarm bells for me. Reason being that the capacity to create logs would necessitate that language. But I definitely don't like that they are collecting that much information. Thanks, I'll change /etc/defaults/tailscaled

Lammy 1y ago

> Am I misreading the docs? Yes, but don't feel bad, because this seems designed to be confusing and easy to overlook. See the privacy policy: https://tailscale.com/privacy-policy#information-we-collect-through-automated-means https://tailscale.com/privacy-policy#information-we-collect-... “When you use the Tailscale Solution, we collect limited metadata regarding your device used to access the Tailscale Solution, such as: the device name; relevant operating system type; host name; IP address; cryptographic public key; user agent (where applicable); language settings; date and time of access to the Tailscale Solution; logs describing connections and containing statistics about data sent to and from other devices (“Inter-Node Traffic Logs”); and version of the Tailscale Solution installed.” (emphasis mine) Here's a Tailscale client startup with telemetry enabled, which is the silent default: 2025/04/13 17:02:07 logtail started 2025/04/13 17:02:07 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale"} 2025/04/13 17:02:07 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 17:02:07 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 17:02:07 dns: using dns.openresolvManager 2025/04/13 17:02:07 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 17:02:07 wgengine.NewUserspaceEngine(tun "tailscale0") ... Versus the same client with the `--no-logs-no-support` opt-out argument added, where the very first line (not to mention the argument name itself) is some FUD trying to scare one into reverting to anti-privacy mode: 2025/04/13 16:29:20 You have disabled logging. Tailscale will not be able to provide support. 2025/04/13 16:29:20 logtail started 2025/04/13 16:29:20 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale", "--no-logs-no-support"} 2025/04/13 16:29:20 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5 2025/04/13 16:29:20 logpolicy: using system state directory "/var/db/tailscale" 2025/04/13 16:29:20 dns: using dns.openresolvManager 2025/04/13 16:29:20 ifconfig destroy: exit status 1 ifconfig: interface tailscale0 does not exist 2025/04/13 16:29:20 wgengine.NewUserspaceEngine(tun "tailscale0") ...

godelski 1y ago
Ah thanks! For anyone wondering, Lammy provided the head of journalctl for tailscaled.service. I got similar results. I think my confusion comes down to there being two different types of logging. It is the network flow logs that are on the enterprise. Per the privacy policy statement, this does not set off any alarm bells for me. Reason being that the capacity to create logs would necessitate that language. But I definitely don't like that they are collecting that much information. Thanks, I'll change /etc/defaults/tailscaled