5 ms·
Tailscale likely deals with a lot of security-sensitive traffic, given the nature of the service. I'm guessing one of the requirements they were given was to ha
by waterTanuki 1mo ago
Tailscale likely deals with a lot of security-sensitive traffic, given the nature of the service. I'm guessing one of the requirements they were given was to have a tiny blast radius in case encryption keys got leaked, and that meant isolating each customer's tailnet (meta)data to it's own sqlite db rather than letting everyone share a postgres cluster.
- inigyou 1mo agoHow about having devices generate and not share their private keys, instead?
- waterTanuki 1mo agoThat's already how it works at the data-plane layer. I'm talking about the control-plane layer where tailscale needs to maintain a server that gets its state from somewhere (they need to know where to route your data, what your permissions ACLs are, device names, etc.). If everyone shared the same db cluster accessed over the network there is a real risk of an accident leaking the encryption keys (of the database itself, not your tailnet) to the db they would have to maintain, and leaking semi-sensitive info like these device names and IP addresses. Using sqlite means each tailnet's metadata is isolated to the container running it.
- inigyou 1mo agoIs it? They're backing them all up to S3 so what if the S3 keys leak?
- deleted 1mo ago[deleted]
- waterTanuki 1mo agoIt's harder to leak multiple S3 keys than a single postgres key.