81–90 of 147 posts
I'm not sure I've ever seen a detailed technical writeup of a vulnerability before that started with such clear and concise instructions on the exact steps needed to defend against it at the start of the article before. In particular, making clear the priority of what to patch is excellent. If I'm a user of a product where a bug was found, I'm definitely interested in learning about what the bug was, how it was disco…
I'm not sure I've ever seen a detailed technical writeup of a vulnerability before that started with such clear and concise instructions on the exact steps needed to defend against it at the start of the article before. In particular, making clear the priority of what to patch is excellent. If I'm a user of a product where a bug was found, I'm definitely interested in learning about what the bug was, how it was disco…
[deleted]
Super interesting article, and TIL Firefox does not implement PNA (Private Network Access). Does anyone know why? It seems like an obviously good thing to have. https://wicg.github.io/private-network-access/
Super interesting article, and TIL Firefox does not implement PNA (Private Network Access). Does anyone know why? It seems like an obviously good thing to have. https://wicg.github.io/private-network-access/
But even if browsers now implement PNA the tailnet itself is public address space, so that vector still exists. I wonder if browsers (and eventually standards) will be pressured to treat those blocks as private.
> The speed and quality of Tailscale's response to our report is unlike any vendor interaction I have experienced, and suggests a deep commitment to keeping their customers safe. I have mixed feelings here as a Tailscale customer. Yes a quick response is great, but this actual security issue is pretty terrible IMHO. Anything other than an immediate response would have been akin to lighting their company on fire and w…
Companies get away with sweeping customer security issues under the rug less and less, but still far too often. I honestly wish we as a people would put other players of this game in as high standards as you do here for this company here.
> In theory, there is no path for a malicious Tailscale control plane to remotely execute code on your machine, unless you happen to run network services that are designed to allow it, like an SSH server with Tailscale-backed authentication. Now I feel less crazy for not using Tailscale SSH for similar reasons. I'd like to see a security evaluation of Tailscale, on a per feature basis. I'd like to see tailscaled run…
I really wish there was a NAT traversal protocol or library that wasn't overly complex and focused on the 90% cases. It would help not just tailscale's but anyone building p2p tech.
Super interesting article, and TIL Firefox does not implement PNA (Private Network Access). Does anyone know why? It seems like an obviously good thing to have. https://wicg.github.io/private-network-access/
The usual incompetence. It would break some existing use etc.
Super interesting article, and TIL Firefox does not implement PNA (Private Network Access). Does anyone know why? It seems like an obviously good thing to have. https://wicg.github.io/private-network-access/
Related: note also that tailscale's tailnet 100.* subnet is som form of CGNAT public ip block. I think Tailscale thought long and hard about this, and landed on it because it was a path of lesser resistance to break fewer things. And if you squint they fit the stated purpose. But even if browsers now implement PNA the tailnet itself is public address space, so that vector still exists. I wonder if browsers (and event…
If your private net is full of trivial to access things with no access control or horribly insecure services, that's a huge problem. There are many many many ways to hop over firewalls. Hostile JS on web sites is just one.
Network boundaries are only first lines of defense in what should be a defense in depth strategy. Never depend on any one single boundary completely.
My personal criteria is: if it's not secure enough to be connected directly to the Internet with no firewall, it's broken. Make it that secure and then put it on a secure network.
I... didn't get an email? Very cool to find out by looking at hn
Technical write up by the security researcher at https://emily.id.au/tailscale ps. she's looking an employer rn // hire her!
Then again it does seem like the entire universe applies "eh probably nobody will try and hack it" to services listening on local TCP interfaces.
They certainly don't care about multi-user machines, though I suppose there are so many local root exploits these days you're basically trusting your users anyway in that situation.