Viewing profile — cronos

There are some forks that are not compatible with regular wireguard, for example from wolfssl. Or just classic mTLS.

The macOS client uses the keychain by default, that's not changed here .

Good to know, my understanding of the macOS system APIs is fairly limited. I'm sure it's doable, with some elbow grease and CGO. We just haven't prioritized that variant of the cli…

Ah, looks like another KB update is needed, thanks for calling it out!

On macOS we have 3 ways to run Tailscale: https://tailscale.com/kb/1065/macos-variants Two of them have a GUI component and use the Keychain to store their state. The third one is …

IIUC, it's a bit more nuanced: TPM stores hashes of various things like firmware in PCRs, and when creating keys in the TPM you can optionally bind the key to specific PCR values. …

Not even that. An attacker with local root can just extract the wireguard keys from process memory, or use the TPM to decrypt the state file like Tailscale would. The only scenario…

Nope, only Windows/Linux where TPMs exist.

There are two new-ish features in Tailscale that use TPMs: node state encryption ( https://tailscale.com/kb/1596/secure-node-state-storage ) and hardware attestation keys. Hardware…

Yes, we use github.com/google/go-tpm/tpm2

Windows uses TPM for Bitlocker. A very common scenario where TPMs get reset is BIOS updates (when a TPM is implemented in firmware). AFAIK, Windows cheats here because it also mana…

I'm one of the Tailscale engineers who built node state encryption initially (@awly on Github), and who made the call to turn it off by default in 1.92.5. Another comment in this t…

The tailscale client generates WireGuard key pairs, but only sends public keys to the control plane. The private keys remain on the device only. With only the public keys, tailscal…

Want to donate to help Ukraine but there are too many options? A group of volunteers (including myself) put together this aggregator site with structured organization info and some…

You can un-register any of the keys when you're logged in. So if you lose one key, log in using the others and remove it. No need for a master key.

PKCS#11 is a C API. It does not describe the wire format for talking to the actual hardware. To use PKCS#11 for a particular device, you need a module (shared library) to translate…

Mostly yes. It's a niche product with low demand and relatively high R&D costs, so margins have to offset that. There's probably also a bit of psychological biases at play, like: "…

A "ton" of work may have been an exaggeration. Maintaining a CA (and dealing with cert rotation) is some work. Other things are indeed just a flag or config option (like jumphosts)…

There are a few differences between an OpenSSH jump host and Teleport: - you have to actively manage authorized_keys for every person using openssh; Teleport manages a PKI and can …

Yes, but it's rarely how companies use OpenSSH because it takes a ton of work to set up. Teleport gives you all this functionality by default out of the box. So it's not inventing …

The NATted device dials out to the bastion (a.k.a. proxy) and maintains a persistent tunnel. The proxy then sends all the connections to this device inside that tunnel.

Without IPFS, pretty sure authorities can order to take down the repository and all of the forks.

It seems like the author was in this thread. But you're right, re-posted my comment in a less aggressive form on the post itself.

The code examples are quite non-idiomatic and have lots of issues, to be honest. - constant strings (defined as vars) as return values instead of the standard error type - not form…