I think you've just explained why people rent infrastructure.

This is probably correct if you aren’t a target at all, e.g. you aren’t running a business

Tailscale got hacked recently as well, didnt they (?). I think they did, the whole system is poisoned, because I believe one of the vectors had to do with eMudhra certs, which again, is not an issue specific to them, or something they had any say on it... there is literally no escape these days it would seem.

tailscale got hacked recently? sources?

they had a priviledge escalation vulnerability that requires the attacker to already be a part of the tailnet, and more specifically allows a user-to-root escalation devices the attacker can tailscale ssh to.

> Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is. [1]

eMudhra/TLS certificates have nothing to do with this (?).

[1] https://news.ycombinator.com/item?id=50266179

That was Tailscale SSH and it’s not on by default

It also was not related to the mentioned CA, and was not "hacked".

Or do onprem or selfhosted. Surface area reduces drastically.

I was also referencing that using commercial software usually brings features you probably don’t use. Those features probably require new NPM packages so by building a bespoke software, you only build features you need.

this is often a worse time-to-patch

The tradeoff is that you become your own ops team and need to monitor and respond to cves in real time.

I don't see bespoke software as a viable alternative because probing for vulnerabilities is both getting cheaper by the day, and also massively parallelizable.

Someone will inevitably spin up a large swath of agents running an abliterated pareto curve model and point them at the internet.

Not to mention your bespoke tool is likely way less hardened than the existing player in the space.

Agree in don't ever expose if not needed.

And keep private and public personal hosted services in different contexts.