There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set.

I use it extensively, and I would rather pay them a fee if they could review thr code.

A possibility is a lock down mode, disabling risky features.

I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node sharing, ...They are disabled in my admin console, but the code runs on my devices and they can be enabled by mistake.

A question. Taildrop enables unauthenticated input and doesn't even obey ACLs. I'm not quite sure about this, but couldn't malware in a low trust device send a file to my Synology NAS, which will then automatically process it for indexing things like thumbnail, leading to potential code execution? Why doesn't it obey ACLs, and why isn't the recipient approval needed before the file exits the sender's device? I use tags, but I'm the owner not the tag.

▲

drdexebtjl 3 hours ago | parent | next [-]

This is also how I feel about Tailscale and its popular alternatives. They do too much.

Does anyone know of a Tailscale alternative that sticks to the basics?

Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?

▲

sigbottle 2 hours ago | parent | next [-]

I've been toying around with nebula, self host your lighthouse on a cheap VPS (which even if it gets hacked, the most it can do is lie about traffic, not lie about node certs). Basically you're just paying for the punchthrough (you may even be able to do some duckdns shenanigans?) The main issue is that updating nodes is a pain in the butt, which is the main advantage of tailscale IMO - centralized control plane. Keeps it simple.

I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)

Fun foray but creating such a system requires a lot of expertise that I unfortunately lack

	▲	LeBit 2 hours ago \| parent [-]
		I used Nebula extensively. I really liked it. I like the idea of embedding firewall rules in a certificate. But , like you observed, it does not scale as well as tailscale.

▲

chasd00 2 hours ago | parent | prev | next [-]

You could just use IPsec. It’s been probably 20 years but look into SWAN. It’s just a vpn in the vpn sense.

▲

LeBit 2 hours ago | parent | prev [-]

No.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

▲

skowalak 2 hours ago | parent | prev [-]

Re: Your question. Taildrop only works between devices in the same account. So if you don't put low trust devices in the same account as your NAS this is mitigated.