4 ms·
>No “vulnerabilities” in Tailscale were found or exploited, and that might make it even more uncomfortable for us. [...] But, we're a security tool. Their intru
by john_strinlai 3mo ago
>No “vulnerabilities” in Tailscale were found or exploited, and that might make it even more uncomfortable for us. [...] But, we're a security tool. Their intrusion is our intrusion, and it's our job to take it seriously.
im a happy customer of tailscale, so i am obviously biased, but i have a lot of respect for this. they could have just stayed quiet and i dont think anyone would have bat an eye.
- smb06 3mo agoGlad to see companies owning responsibility and putting out a message without corporate PR spin
- DC-3 3mo agoIf you can't see the spin on corporate messaging it means it's working (and consequently, to stretch the metaphor, your wicket is in danger).
- senordevnyc 3mo agoThis seems unfalsifiable :)
- fc417fc802 3mo agoDepends on if you can dredge up any examples of corporate statements authored without any intent to add spin.
- senordevnyc 3mo agoNo, according to them that just means I can’t see the spin because it’s working.
- fc417fc802 3mo agoThat's why I said "intent" as opposed to "perception". I'm implying that it's unfalsifiable not due to faulty construction but rather due to being inherently true. (Of course I realize that's technically an overgeneralization.)
- behnamoh 3mo agoTailscale as a company reminds me of Valve and other good old tech-oriented people that I can "trust" that they know what they're doing. I'm a happy customer too and I hope they retain the essence of what distinguishes Tailscale.
- traceroute66 3mo ago[flagged]
- aborsy 3mo agoIt does too many things, and the product has got too complex. I saw a year ago they were looking for someone just to help with complexity. I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it. Without taillock it makes no sense. Anyone on their coordination servers will be able to connect to your network.
- k8sToGo 3mo ago> I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it Doesn't this apply to any application you use? How would it be different with plain wireguard?
- traceroute66 3mo ago> How would it be different with plain wireguard? Seriously ? You do realise that of all the security tools on the planet, plain wireguard most likely has the smallest attack surface of them all, right ? The problem here is as the other poster said. Tailscale is a security tool and yet the guys at Tailscale seem to be insistent on dumping everything INCLUDING the kitchen sink into it as a "feature". That sort of attitude is not going to end well. You end up with a large bloated code base, which equals large attack surface.
- k8sToGo 3mo ago
- petesergeant 3mo agoThis article is just an ad / public-service-announcement for various paid Tailscale features, though?
- packetslave 3mo agoAnd you're under the impression that the purpose of a company blog is WHAT, exactly?
- petesergeant 3mo agoThe person I'm replying to says they deserve "a lot of respect for this"
- john_strinlai 3mo agoi said i have a lot of respect for this. whether you do or not is up to you. anything a company writes is an advertisement by the nature of being written by a company. i dont think that means anything a company writes is bad by default. there are many corporate blogs i enjoy reading, or learn from, etc., despite the fact that they are all technically advertisements. in this case, tailscale is setting a higher expectation for themselves when no one asked for it. i find that respectable.
- hatthew 3mo ago> tailscale is setting a higher expectation for themselves What exactly is the higher expectation? As someone with little expertise and no stake in any of this, the blog reads as "our products are great and could have solved this problem if they were being used correctly, so it's not our fault" with a few vague proclamations about how they will improve their UX. This isn't at all a bad thing, it just isn't very notable in my opinion.
- john_strinlai 3mo ago>What exactly is the higher expectation? better defaults, better documentation, better UX, and "But, we didn't stop it. Next time, we will." are all commitments that they didn't need to make, but now they need to follow through with or lose face. >it just isn't very notable in my opinion. i agree that this seems to be getting way more attention than i would have expected.
- johnbarron 3mo agoTailscale is responsible for designing a system whose convenient defaults allowed a stolen credential to have a very large blast radius. A marketing blog is not changing that.
- sneak 3mo ago“How can we make this thing, that has nothing to do with us, about us and how good we are?” (top story on HN) I get it, Tailscale is great and all, but, are we being serious right now?
- AbstractH24 3mo agoFlip side “get ahead of the narrative before we’re thrown under the bus”
- sandeepkd 3mo agoAgreed its a tool, and it does not looks like any vulnerability was exploited on their end. However part of the blog is confusing to me. Long lived keys vs short lived have their own space in discussion, there are use cases, pros & and cons for the same. However it is not very clear how a short lived credential would have prevented the exploit in this case?
- submitaticket 3mo agoIt would not have prevented the initial exploit. The agent gained access to the K8s cluster and read the Tailscale Auth Key from Cluster Secrets. A short-lived credential would reduce the risk that the key is still valid when an agent gains access.
- sandeepkd 3mo agoThats the point, the short lived credentials would have done much other than adding more step of getting the secrets again which is why I am questioning the discussion of that in a root cause analysis itself. Adding one more layer does not increases the security by default in every case.
- tremon 3mo agoA short-lived credential would reduce the risk that the key is still valid when an agent gains access How does that work? If the agent is reading the credential from the live configuration, how short does the lifespan of a key need to be to prevent it from being used by an unauthorized process?
- submitaticket 3mo agoLong enough to authenticate the node into the Tailnet. Short enough to revoke itself before the Agent can use it.
- itopaloglu83 3mo agoI read it as I should add new nodes with short lived keys and avoid long lived ones. Yes, this doesn’t solve the issue, but also adds one more step to the chain. The AI didn’t crack the encryption or managed to get arbitrary access. And also Tailscale makes things easier to manage than simple VPNs and firewall rules. But it still requires a decent amount of attention and careful configuration to make a perfect system.
- goolz 3mo agoNothing more to add than I echo it all and will continue being a happy customer after seeing this. A rarity in today’s world, kudos to them.