"allowing them access into my personal network"

In what form? The private keys never leave the nodes, hence there shouldn't by any access per se (see https://tailscale.com/security/). Of course TS has insights into your networks, i.e. what servers it is installed on, what you connect to - so metadata.

They can add a node and connect to whatever other node they want.

Haven't thought about that and this should certainly be addressed - especially if I'd use Tailscale for business.

This seems solvable. They talk about that here: https://tailscale.com/kb/1099/device-authorization/

But it still seems like they could flip that feature off if they got compromised. To remedy that, feels like they could support a preshared secret that they don't control / see being shared as a first step: https://tailscale.com/kb/1099/device-authorization/#generate...

I think the Tailscale part that actually knows what auth keys look like is proprietary, but at least for Headscale they seem to be just unguessable database row identifiers: https://github.com/juanfont/headscale/blob/ade4e23e149e7846b...

Nothing in the Tailscale design has ever pointed to features that would guard your infrastructure from them.

Yeah, they control this setting so they can just disable it, or override it.

Since Headscale exists, though, this problem is solved quite neatly.

You can't generate a secret with a webapp they control without them controlling the secret too.

I assume the notion was that the nodes will all know the secret but the control server won't.

Exactly. Pre-shared secret out of band.

This is precisely my worry. I do use tailscale but I have this itch in the back of my mind... I have a lot of sensitive and personal stuff in my machines, and even though it would be hard for someone to get into my VPN, tailscale themselves could easily add a node and join my VPN without me even noticing.

For enterprises, they do offer self-hosted control servers, but for personal use, something like headscale will put you in more control: https://news.ycombinator.com/item?id=28574477

I don't really understand how self-hosting headscale is actually any more secure. The control server needs a stable IP address, so I'd need to run it on a VPS or something, which means I'm still trusting a third-party to not mess with my network.

My home machine has a static IP, so I run it there. Does it need a static IP, or just a hostname?

I guess it probably only needs a hostname. Although I'd still feel uneasy about running it at home, because I don't want any incoming connections to my home network unless it's over Tailscale, and headscale would need some kind of firewall exception.

Maybe headscale could run at home, served over a tunnel[1] to a VPS. But honestly, if I ever lost confidence in the trustworthiness of Tailscale the company, I would just connect my devices with some other overlay network like Yggdrasil[2] or Tor.

[1]: https://github.com/anderspitman/awesome-tunneling [2]: https://yggdrasil-network.github.io/

I think Nebula is the current favorite, but it's not as plug and play as Tailscale.

You can mitigate potential risks by configuring your OS firewall to only allow independently encrypted and authenticated traffic through Tailscale. SSH and TLS covers most needs anyways, so it doesn't require additional work.

Eh, sure, but if I'm going to reimplement a VPN, why use Tailscale?

Not sure what you mean by reimplementing a VPN. I was talking about restricting the type of traffic that flows through Tailscale. Tailscale is still the only software responsible for handling external traffic in this scenario.

I mean if I'm going to encrypt and authenticate my own traffic, it makes the VPN redundant. Is that what you meant? I might be confused.

I use Tailscale as a reasonably secure and hassle-free entrypoint into my own network. I could alternatively just expose my SSH / HTTPS servers to the internet, but that would require much more effort to maintain. Not to mention that it would expose my network to even more attackers, not just theoretical ones.

I also believe that traffic inside homes should be secured regardless since routers can be hacked. So in my case, I didn't consider it a duplicated effort. I had my traffic already encrypted and authenticated when I started using Tailscale.