> I can "trust" that they know what they're doing

I wish I could say the same.

At $work we use Tailscale but only bare minimum and at arms length and only because we have to (people were having NAT issues with standard Wireguard).

None of their code has had a security audit, let alone regular ones. Yes they make a big song and dance about SOC2/ISO27001 but that is NOT the same thing, that's just shiny tick-boxes for compliance departments.

They seem to rely entirely on the random goodwill of others to do random audits of unknown coverage at random intervals, not exactly reassuring.

"Tailsale Lock" is, being polite, a hot mess. So many sharp edges and footguns.

Their introduction of TPM-by-default and then removing it a few weeks later because of a seemingly small number of edge-cases and very odd reasoning was just weird.

Yes they are nice guys to chat to and all that. But for a security tool they need to up their game seriously.

▲

apenwarr 24 minutes ago | parent | next [-]

(Tailscale CEO) You have posted here multiple times that "none of the code has had a security audit" and that the SOC2 audit "is not the same thing."

It's true that those two audits aren't the same thing. However, the SOC2 auditor confirms, in the published report, that Tailscale has regular and ongoing security audits including penetration tests and many kinds of code reviews.

The security audit report, which you perhaps imagine to be a long list of vulnerabilities... doesn't look like that. It says we don't have a long list of vulnerabilities. The security bulletins are all here: https://tailscale.com/security-bulletins

▲

traceroute66 19 minutes ago | parent | next [-]

The majority of your security bulletins are as the result of third-party reports to you.

Which, by definition, means they are not done by you, which means you don't know when they will be done or how much of your code base they are looking at.

I think you know full well what I mean by a security audit. If you don't, go look at, for example, the ones that Mullvad publish for their software https://mullvad.net/en/blog/tag/audits.

Please do not try to portray SOC2 as being the same thing as a code audit.

And IF you have regular code audits, then please publish suitably redacted reports in public on your website. Just like everyone else does !

▲

apenwarr 13 minutes ago | parent [-]

(Tailscale CEO) I don't know what to tell you. The problems that are found internally, or via security reviews and pentests we pay for, are ones that we fix before releasing.

Bugs that are found by other people are found, by definition, after release. They are therefore more likely to need a bulletin.

▲

traceroute66 8 minutes ago | parent [-]

But why should insecure argument handling bugs (as per your recent SSH bulletin) be found after release ?

Those are an ancient class of bugs that should be picked up by any competent security review.

	▲	apenwarr 4 minutes ago \| parent [-]
		Is your theory that "any competent security review" will find every security hole in a product? Because that sure would be great if it were true. Unfortunately it does not match my experience.

▲

r0b05 13 minutes ago | parent | prev [-]

That link is a list of incidents while the parent comment is referring to security audits of the code.

▲

aborsy an hour ago | parent | prev [-]

It does too many things, and the product has got too complex. I saw a year ago they were looking for someone just to help with complexity.

I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it.

Without taillock it makes no sense. Anyone on their coordination servers will be able to connect to your network.

▲

r0b05 7 minutes ago | parent | next [-]

The large attack surface is a good point. I started using it initially and the ease of setting up a vpn was nice, but then I came across few security vulnerability postings which led to concern so I went to Wireguard. I think they should reign in the features and treat it as a secure vpn first and foremost and remove unnecessary features to minimize the attack surface.

▲

k8sToGo 27 minutes ago | parent | prev [-]

> I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it

Doesn't this apply to any application you use? How would it be different with plain wireguard?

▲

traceroute66 22 minutes ago | parent [-]

> How would it be different with plain wireguard?

Seriously ?

You do realise that of all the security tools on the planet, plain wireguard most likely has the smallest attack surface of them all, right ?

The problem here is as the other poster said. Tailscale is a security tool and yet the guys at Tailscale seem to be insistent on dumping everything INCLUDING the kitchen sink into it as a "feature".

That sort of attitude is not going to end well. You end up with a large bloated code base, which equals large attack surface.

	▲	k8sToGo 19 minutes ago \| parent [-]
		I am talking especially about the LLM part. Also a kinder tone in your comments would be more appreciated.