>No “vulnerabilities” in Tailscale were found or exploited, and that might make it even more uncomfortable for us. [...] But, we're a security tool. Their intrusion is our intrusion, and it's our job to take it seriously.

im a happy customer of tailscale, so i am obviously biased, but i have a lot of respect for this. they could have just stayed quiet and i dont think anyone would have bat an eye.

▲

guessmyname 37 minutes ago | parent | next [-]

Expect similar articles (cough, ads, cough) in the next couple of days from every single company whose software was involved in the incident.

	▲	andy99 21 minutes ago \| parent [-]
		Why not? If done right it’s a good way to talk about implications for those companies and provide some education like tailscale did here. We also saw Anthropic post about “our agent escaped too” and while I understand the incident caused them to review, they found something and needed to disclose, the whole thing came across much worse and largely they got mocked or accused of trying to piggyback, so obviously there are good and bad ways. If there are other providers with interesting takes, I think they would be worth hearing.

▲

behnamoh an hour ago | parent | prev | next [-]

Tailscale as a company reminds me of Valve and other good old tech-oriented people that I can "trust" that they know what they're doing. I'm a happy customer too and I hope they retain the essence of what distinguishes Tailscale.

▲

traceroute66 an hour ago | parent [-]

> I can "trust" that they know what they're doing

I wish I could say the same.

At $work we use Tailscale but only bare minimum and at arms length and only because we have to (people were having NAT issues with standard Wireguard).

None of their code has had a security audit, let alone regular ones. Yes they make a big song and dance about SOC2/ISO27001 but that is NOT the same thing, that's just shiny tick-boxes for compliance departments.

They seem to rely entirely on the random goodwill of others to do random audits of unknown coverage at random intervals, not exactly reassuring.

"Tailsale Lock" is, being polite, a hot mess. So many sharp edges and footguns.

Their introduction of TPM-by-default and then removing it a few weeks later because of a seemingly small number of edge-cases and very odd reasoning was just weird.

Yes they are nice guys to chat to and all that. But for a security tool they need to up their game seriously.

▲

apenwarr 23 minutes ago | parent | next [-]

(Tailscale CEO) You have posted here multiple times that "none of the code has had a security audit" and that the SOC2 audit "is not the same thing."

It's true that those two audits aren't the same thing. However, the SOC2 auditor confirms, in the published report, that Tailscale has regular and ongoing security audits including penetration tests and many kinds of code reviews.

The security audit report, which you perhaps imagine to be a long list of vulnerabilities... doesn't look like that. It says we don't have a long list of vulnerabilities. The security bulletins are all here: https://tailscale.com/security-bulletins

▲

traceroute66 18 minutes ago | parent | next [-]

The majority of your security bulletins are as the result of third-party reports to you.

Which, by definition, means they are not done by you, which means you don't know when they will be done or how much of your code base they are looking at.

I think you know full well what I mean by a security audit. If you don't, go look at, for example, the ones that Mullvad publish for their software https://mullvad.net/en/blog/tag/audits.

Please do not try to portray SOC2 as being the same thing as a code audit.

And IF you have regular code audits, then please publish suitably redacted reports in public on your website. Just like everyone else does !

▲

apenwarr 12 minutes ago | parent [-]

(Tailscale CEO) I don't know what to tell you. The problems that are found internally, or via security reviews and pentests we pay for, are ones that we fix before releasing.

Bugs that are found by other people are found, by definition, after release. They are therefore more likely to need a bulletin.

▲

traceroute66 7 minutes ago | parent [-]

But why should insecure argument handling bugs (as per your recent SSH bulletin) be found after release ?

Those are an ancient class of bugs that should be picked up by any competent security review.

	▲	apenwarr 3 minutes ago \| parent [-]
		Is your theory that "any competent security review" will find every security hole in a product? Because that sure would be great if it were true. Unfortunately it does not match my experience.

▲

r0b05 12 minutes ago | parent | prev [-]

That link is a list of incidents while the parent comment is referring to security audits of the code.

▲

aborsy an hour ago | parent | prev [-]

It does too many things, and the product has got too complex. I saw a year ago they were looking for someone just to help with complexity.

I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it.

Without taillock it makes no sense. Anyone on their coordination servers will be able to connect to your network.

▲

r0b05 7 minutes ago | parent | next [-]

The large attack surface is a good point. I started using it initially and the ease of setting up a vpn was nice, but then I came across few security vulnerability postings which led to concern so I went to Wireguard. I think they should reign in the features and treat it as a secure vpn first and foremost and remove unnecessary features to minimize the attack surface.

▲

k8sToGo 26 minutes ago | parent | prev [-]

> I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it

Doesn't this apply to any application you use? How would it be different with plain wireguard?

▲

traceroute66 22 minutes ago | parent [-]

> How would it be different with plain wireguard?

Seriously ?

You do realise that of all the security tools on the planet, plain wireguard most likely has the smallest attack surface of them all, right ?

The problem here is as the other poster said. Tailscale is a security tool and yet the guys at Tailscale seem to be insistent on dumping everything INCLUDING the kitchen sink into it as a "feature".

That sort of attitude is not going to end well. You end up with a large bloated code base, which equals large attack surface.

	▲	k8sToGo 18 minutes ago \| parent [-]
		I am talking especially about the LLM part. Also a kinder tone in your comments would be more appreciated.

▲

petesergeant 40 minutes ago | parent | prev | next [-]

This article is just an ad / public-service-announcement for various paid Tailscale features, though?

	▲	packetslave 22 minutes ago \| parent [-]
		And you're under the impression that the purpose of a company blog is WHAT, exactly?

▲

smb06 an hour ago | parent | prev [-]

Glad to see companies owning responsibility and putting out a message without corporate PR spin

	▲	DC-3 an hour ago \| parent [-]
		If you can't see the spin on corporate messaging it means it's working (and consequently, to stretch the metaphor, your wicket is in danger).