ewindisch

It was reported but not coordinated.

I am Erica Windisch, the original researcher that published this report.

The primary finding relevant to most users is the privilege escalation vulnerability in the opensource tailscale ssh server, when port forwarding is enabled (default), users may escalate privileges to root on the destination server.

The secondary finding is the ability to route to arbitrary subnets accessible via a host offering an App Connector. This is the one that really worries me, in regard to impact.

The third most important finding may be the `tailscale serve` authz bypass opportunity, but I suspect this may not impact many users. It may be significant in unlucky configurations.

Much of the report focuses on the security model and architecture of the software, with explanations of live scenarios conducted in our lab. Our concern is that an attacker could establish a foothold via something like a PHP exploit or supply chain exploit on a host, then `tailscale ssh` to another host and escalate, or route through an App Connector. They may even leverage the tailscale serve authz mechanism for an app-level privilege escalation for lateral movement. It is true that well managed policies mitigate some of these risks.

This report was called Tailworm because the research focused on the threat of a worm against an opensource headscale+tailscale network, and the capabilities of our agentic systems to defend autonomously against lateral movement across our systems. Our lab focuses on building secure infrastructure for recursive self improving intelligence, and this was the report from the red side of the experiment.

Finally, I believe we live in an age of continuous disclosure, continuous development, continuous integration, and continuous deployment. That's how we get through this.

Running 24/7 multi-agent autonomous devops and training a fruit fly brain to power an autopilot system.

>300 merged PRs/week

I'm using a lot of gpt-5.6-Luna and glm-5.3-flash. Astra is really fantastic but it's too expensive. I average about 50-90B/tok/mo.

How are you managing your tokenomics so well?

Astra low on the $200/mo "20x Pro" plan gets me through a single day.

SSH over tor from your browser. Connect to .onion addresses or use exit nodes to the internet. Encrypted local vault. Arti (WASM) to Snowflake rendezvous servers over WebRTC.

git on my personal account (not an official Tor project):

https://gitlab.torproject.org/ewindisch/the-onion-shell

Wow. I'm not sure what to say. She and I had a lot in common, both personally and in our interests. I hope she's at rest.

AWS Serverless Community Hero and CTO/Co-founder of IOpipe here.

AMA!

Humans are more expensive than infrastructure!

IOpipe | distributed remote | www.iopipe.com

IOpipe provides tools for developers of serverless applications, helping devs and operators deliver and run with confidence. We are seeking to grow our team with strong candidates with a comfort in remote work, collaborative and product-driven development.

Our stack is built on AWS Lambda, Kinesis, Elasticsearch, React, and AWS Fargate.

Roles: Site Reliability Engineer (SRE) Solutions Architect

Hiring portal: https://hire.withgoogle.com/public/jobs/iopipecom

There's a free tier and we're happy to discussing pricing privately. Startups, individuals, open source projects are dear to our hearts and we want to make the product accessible to those that need it.

I'm excited because this makes it so much easier to get started with Greengrass. Java, NodeJS, and Python with a full IoT service behind it... and compatible with AWS Lambda. Seems likely they'll add Go soon too.

Systematic oppression makes ignoring ToS the default. Businesses choose not to cater to sex workers and such workers find themselves in the situation where there's no option but to ignore the ToS. You find that when services you take for granted aren't available, things get... harder. So you do what everyone else does to the best of your ability even if you are an "undesirable" that has been asked to stay outside the group, even when that's illegal. So yeah, sex workers are going to do what they need to do to survive and make ends meet, the terms of service for websites is the very least of their concerns when they don't know if they'll make rent this month.

The Yubikey is great and has uses outside of U2F, which I've never had much faith in.

Vint Cerf started in 1965. He's moved into positions that are more management oriented, but I believe he's deeply involved in technology decisions.

We have code that you can run on your AWS account for more accurate information from servers.lol based on Cloudwatch metrics. Latency and coldstart information would be totally interesting, I'll suggest it to our team!

My team uses the Serverless Framework (serverless.com), git-with-github, and automate deployments from CI/CD.

AWS also offers some of these pieces fully integrated via CodeDeploy (which we do not ourselves use).

At Re:Invent last month, AWS introduced per-function concurrency limits that users can set. It can still rack up charges, but it offers a bit more control than before!

On AWS Lambda you could copy the Powershell Linux binary into your project and call it from wrapper code in NodeJS, Python, Java, C#, or Go.

Over in Microsoft land, Azure Functions natively supports Powershell according to this blog post: https://david-obrien.net/2016/07/azure-functions-PowerShell/

lambda would be a good way of scaling this without improving the architecture otherwise :)

No.

http://www.foxnews.com/world/2016/03/31/north-korea-warns-ne...

https://www.theguardian.com/world/2015/jun/19/north-korea-fe...

https://www.nytimes.com/2014/03/08/opinion/pyongyangs-hunger...

https://en.wikipedia.org/wiki/North_Korean_famine

you know because they let you access and replay the recordings from their app.

The Snowball ships bare, without packing materials. You receive it, plug it in, transfer data / run code, and ship it.

Still, you're right that there's a logistic issue of physically locating, networking, and powering these devices.

IOpipe (Techstars NYC'16) | REMOTE | Full-time

IOpipe is seeking SENIOR candidates for remote, full-time positions:

- Senior Frontend Engineer: you will work on our real-time dashboard building the visual and interactive elements of our service. Seeking candidates with experience in React and charting / visualizations using D3.

- Senior Backend Engineer: You live in NodeJS and/or Go and want to build a great API that processes lots of data, really fast. The ideal candidate will have experience with Kafka, Kinesis, and/or Cassandra.

About IOpipe - we offer application performance monitoring (APM) for serverless applications. We are a Techstars company and have just completed the Summer'16 program in NYC.

Contact [email protected]!

I only do steps 3-5 here. I no longer find any value from Chef/Puppet/Salt/Anisble or Vagrant.

Lambda does not bill on these, nor do they provide you with these metrics out of the box. This is something that 3rd-parties can provide, however... it's something that we collect with IOpipe[1] (disclaimer: I'm CTO & founder)

[1] https://www.iopipe.com