News for hackers. Stuff that matters.

A comment on Tailscale SSH. Parent comment

Re:Tailscale SSH by tptacek on Thursday June 23, 2022 @01:15AM (#31845395)
If you're unwilling to trust Tailscale and their processes, you can't run Tailscale right now. That's obvious. It's part of the premise. The idea that ACLs "mean nothing" is risibly reductive; the ACLs protect our team members from each other and mistakes they might make with their environments.

(We don't use Tailscale SSH, and are unlikely ever to; we have a separate source of authentication truth for SSH, and a separate certificate-based access control system.)

[ Parent | on HN ]
Re:Tailscale SSH by mike_d on Thursday June 23, 2022 @04:01AM (#31846282)
They built a footgun into a toaster, and victim blame when people complain that they thought it was just supposed to make toast. Users should not be put into a situation where they need to configure ACLs in anticipation of undocumented features.

My hope was that with a little public prodding they would do better in the future. It is a product I want to like, maybe not for what you or I do, but lots of folks out there are slinging cat pictures where it will be a net benefit.

[ Parent | on HN ]
Re:Tailscale SSH by tptacek on Thursday June 23, 2022 @10:07AM (#31849324)
"Victim blame". They announced an opt-in feature.
[ Parent | on HN ]
Re:Tailscale SSH by mike_d on Thursday June 23, 2022 @04:17PM (#31854619)
Ah, I see the part you are missing. It was rolled out before it was announced or documented. We found it during a pentest.
[ Parent | on HN ]