News for hackers. Stuff that matters.
Re:Tailscale Is Pretty Useful by frenchtoast8 on Wednesday March 05, 2025 @06:39PM (#43274323)
> What Tailscale doesn't solve is access to the data that web app serves if the user's machine is compromised, as tailscale is just determining "can the user hit the webserver on port 443?" and does nothing to evaluate the state of the user's host.

Tailscale has some cybersecurity integrations to configure access depending on the device posture. For example, blocking access to a webserver if the device is out of date, or if malware is detected, or if the firewall is disabled, etc. But I don't use any of those integrations and can't speak to them.

Re:Tailscale Is Pretty Useful by jychang on Wednesday March 05, 2025 @06:56PM (#43274452)
I don't think most users use those integrations, they're mostly just a feature bullet point.
Re:Tailscale Is Pretty Useful by ehutch79 on Wednesday March 05, 2025 @07:39PM (#43274723)
SO those features are unusable?
Re:Tailscale Is Pretty Useful by joneskoo on Wednesday March 05, 2025 @11:51PM (#43276544)
Most users (tailnets) are not an enterprise. Most users not using a feature doesn’t mean it’s not useful or valuable.
Re:Tailscale Is Pretty Useful by cjcampbell on Wednesday March 05, 2025 @09:27PM (#43275673)
The posture implementation is quite easy to work with. There’s a growing list of integrations, and you can also roll your own with the posture API. I’ve used Kolide so far and will be integrating with Kandji on another tailnet. They also have Intune, JAMF, Crowdstrike, and SentinelOne.

The same posture API can be used to restrict access to devices in your inventory or to set up just-in-time access to a sensitive asset. For the latter, you can use a Slack app provided by Tailscale or integrate with an identity governance workflow to set a posture attribute with a limited TTL. Your tailscale policy just needs to condition the relevant access on the attribute.