I wish I could say the same.

At $work we use Tailscale but only bare minimum and at arms length and only because we have to (people were having NAT issues with standard Wireguard).

None of their code has had a security audit, let alone regular ones. Yes they make a big song and dance about SOC2/ISO27001 but that is NOT the same thing, that's just shiny tick-boxes for compliance departments.

They seem to rely entirely on the random goodwill of others to do random audits of unknown coverage at random intervals, not exactly reassuring.

"Tailsale Lock" is, being polite, a hot mess. So many sharp edges and footguns.

Their introduction of TPM-by-default and then removing it a few weeks later because of a seemingly small number of edge-cases and very odd reasoning was just weird.

Yes they are nice guys to chat to and all that. But for a security tool they need to up their game seriously.

I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it.

Without taillock it makes no sense. Anyone on their coordination servers will be able to connect to your network.

If you layer and segment correctly you can build atop a secure core and have some decent security.

Doesn't this apply to any application you use? How would it be different with plain wireguard?

Seriously ?

You do realise that of all the security tools on the planet, plain wireguard most likely has the smallest attack surface of them all, right ?

The problem here is as the other poster said. Tailscale is a security tool and yet the guys at Tailscale seem to be insistent on dumping everything INCLUDING the kitchen sink into it as a "feature".

That sort of attitude is not going to end well. You end up with a large bloated code base, which equals large attack surface.

Also a kinder tone in your comments would be more appreciated.

There is formal verification of the protocol and aspects of code:

https://www.wireguard.com/formal-verification/

The code is small enough that can be reviewed.

It's true that those two audits aren't the same thing. However, the SOC2 auditor confirms, in the published report, that Tailscale has regular and ongoing security audits including penetration tests and many kinds of code reviews.

The security audit report, which you perhaps imagine to be a long list of vulnerabilities... doesn't look like that. It says we don't have a long list of vulnerabilities. The security bulletins are all here: https://tailscale.com/security-bulletins

Which, by definition, means they are not done by you, which means you don't know when they will be done or how much of your code base they are looking at.

I think you know full well what I mean by a security audit. If you don't, go look at, for example, the ones that Mullvad publish for their software https://mullvad.net/en/blog/tag/audits.

Please do not try to portray SOC2 as being the same thing as a code audit.

And IF you have regular code audits, then please publish suitably redacted reports in public on your website. Just like everyone else does !

Bugs that are found by other people are found, by definition, after release. They are therefore more likely to need a bulletin.

Those are an ancient class of bugs that should be picked up by any competent security review.

But things like insecure argument handling are low-hanging fruit for security auditors.

Insecure argument handling is not like the more advanced subtle vulnerabilities that we are seeing in some LLM-assisted reports these days. Insecure argument handling is 1990's security.

The fundamental problem remains that Tailscale has too many new "features" being added to it the whole time. New features means a whole bunch new code. Which increases bloat and exponentially increases the attack surface.

It would be really nice if you could stop shoehorning in every new feature you can think of. Remove some of the existing ones that don't really need to be there. And get your codebase back to a more focused state, get back to your roots as a VPN product.

Stop trying to be all things to all men, as the old saying goes.

If you are motivated to build a much less featureful client, it is easier now than it has ever been, and this work is ongoing.

The post you replied you clearly asked why insecure argument handling should be discovered after release. You widened that to mean “every security hole must be discovered prior to release” which made it a much easier argument to attack.

The point stands that the insecure argument handling could’ve been discovered by a security audit even when every security hole may not have been found.

Either you didn't mean what you wrote, or you are saying that you never find problems internally after release.

I understand why. The modern internet has turned advertising into a morass of constant bombardment and the only sane response is to block as much as possible and ignore as much else as possible.

But it's unfortunate because, in some sense, ever single thing that a company every says that is not legally mandated in some way is a form of advertising.

And in many cases, that "advertising" contains true, useful information that can be helpful.

What is important isn't whether or not something is an "ad", but instead, whether or not it contains true information that is helpful in some way.

Many ads don't reach this bar. They are either misleading, straight up lying, or information that is almost completely useless.

But when I'm searching for a particular product, about the only source of information at all is some form of advertising, and I almost always find at least some amount of it to be helpful in making a product decision.

Ads are more often than not polluting to the informational ecosystem, but that's not because they are ads.

anything a company writes is an advertisement by the nature of being written by a company. i dont think that means anything a company writes is bad by default. there are many corporate blogs i enjoy reading, or learn from, etc., despite the fact that they are all technically advertisements.

in this case, tailscale is setting a higher expectation for themselves when no one asked for it. i find that respectable.

What exactly is the higher expectation? As someone with little expertise and no stake in any of this, the blog reads as "our products are great and could have solved this problem if they were being used correctly, so it's not our fault" with a few vague proclamations about how they will improve their UX. This isn't at all a bad thing, it just isn't very notable in my opinion.

better defaults, better documentation, better UX, and "But, we didn't stop it. Next time, we will." are all commitments that they didn't need to make, but now they need to follow through with or lose face.

>it just isn't very notable in my opinion.

i agree that this seems to be getting way more attention than i would have expected.

The issue is acting like their response is 'brave' in anyway, or altruistic. It can be considered admirable only to the extent any company doing a good job running its business can be.

This is a good, smart response to what happened. They are approaching this incident as a way to improve their product and offer a better service to their customers. That is good, and it is fine to reward them with your business in response. There is nothing wrong with making good business decisions, but it isn't something that we need to unduly respect.

All these incidents are scarce on technical details. Honestly, IMHO, OpenAI and Anthropic are now actively pushing for AI regulation, as a defence mechanism.

These are false flag operations.

I think the case is Tailscale is saying, "It's technically not our fault, but we still should've stopped it."

The level of "I need to be the smartest person in the room" bullheaded skepticism on Hacker News has always been bad, but now with these latest LLM developments it is just completely out of control. A company is reporting an intrusion and how they plan to address the vulnerabilities it exposed in the future, and you're here going "seems shopped, I can tell from the pixels".

For Tailscale, this may very well be marketing, but it would be strangely self defeating for OpenAI to do something like what is being suggested. Showing that you failed to govern your model is a pretty poor way to say "We're the only ones who should be trusted to govern frontier models".

Honestly, this is a crime in the UK, and I'm sure a number of other places globally.

The stupidity lies in not accepting that everyone has an agenda.

Yes, a chance for mere mortals to touch the fingertips of god–er, chat. Same thing.

We also saw Anthropic post about “our agent escaped too” and while I understand the incident caused them to review, they found something and needed to disclose, the whole thing came across much worse and largely they got mocked or accused of trying to piggyback, so obviously there are good and bad ways.

If there are other providers with interesting takes, I think they would be worth hearing.

Then everyone coming out with humbled determination about working together to responsibly use and contain this powerful technology for the greater good (and profit margin).

I will not believe marketing gimmickry is not a large part of what's going on with every one of these "incidents".

At the end of the day the probability that an AI gets out is unity, what it does while out is far more important. The fact they are hacking into systems at superhuman levels, or writing cryptominers on their own hacked internal systems is a much more interesting and telling story of what the future will look like.

It was told via the prompt to act like a hacker and "solve" hacking problems, so treating every obstacle it faced as part of the problem isn't a wild tangent.

If it had been told to do something innocent, and decided the best way to succeed was the maliciously compromise other companies then I'd be more interested and worried.

In the case of this incident, I struggle to see the clear upshot for OpenAI. It seems pretty unlikely they'd ever okay this intentionally as some sort of marketing.

For one, it'd be pretty damning when it leaked that this was a setup, and it would 100% leak at some point. But more importantly, it really flies in the face of the general argument frontier labs have been putting forth around the dangers of "ungovernable" open models and the role of frontier labs as responsible custodians. Members of OpenAI's leadership team were actually in the middle of a Twitter spat with HuggingFace employees/open model advocates about open models being generally decel and bad when this happened.

HF immediately got to show that they were only able to respond to the incident because of open models, that we can't rely on labs to be our sole source of stewardship, etc as a result of this.

The point of these campaigns is to eventually invoke some sort of response from the government, such as banning open models, which OpenAI (and Anthropic) stand to benefit from.

Plenty of shady stuff goes on in marketing, and I'm sure that OpenAI is going to opportunistically grab any potential upside from this (and any other situation, generally). But it is hard to imagine that this is part of a premeditated master plan that went something like:

- Advocate that open models are ungovernable and that frontier labs should be trusted to safeguard autonomous agents

- Immediately fail to safeguard their autonomous agent

- Intentionally hack the company who is most publicly critical of their view, and who happens to be the center of the open model universe

- Collaborate with said company on reports that show that open models were in fact critical to mitigating their rogue agent

- So tightly control access to this plan at their 8,000 employee company that it never leaks

All in the hopes of generally getting the attention of the government, who would then hopefully (and inexplicably, given the details here) decide to give OpenAI more power?

There are probably easier ways to lobby politicians.

they are a company, therefor anything they write is an advertisement of sorts, but that doesn't make it bad by default. cloudflare and netflix (among others) also write blog posts that i find interesting and enjoy reading, despite being ads at their core.

(top story on HN)

I get it, Tailscale is great and all, but, are we being serious right now?

How does that work? If the agent is reading the credential from the live configuration, how short does the lifespan of a key need to be to prevent it from being used by an unauthorized process?

Yes, this doesn’t solve the issue, but also adds one more step to the chain.

The AI didn’t crack the encryption or managed to get arbitrary access. And also Tailscale makes things easier to manage than simple VPNs and firewall rules. But it still requires a decent amount of attention and careful configuration to make a perfect system.