apenwarr

5 ms·

1.
by apenwarr 2mo ago
Is your theory that "any competent security review" will find every security hole in a product? Because that sure would be great if it were true. Unfortunately it does not match my experience.
2.
by apenwarr 2mo ago
(Tailscale CEO) I don't know what to tell you. The problems that are found internally, or via security reviews and pentests we pay for, are ones that we fix before releasing. They don't need bulletins. Bugs that are found by other
3.
by apenwarr 2mo ago
(Tailscale CEO) You have posted here multiple times that "none of the code has had a security audit" and that the SOC2 audit "is not the same thing." It's true that those two audits aren't the same thing. Howev
4.
by apenwarr 6mo ago
I’m glad you liked it!
5.
by apenwarr 6mo ago
Japanese manufacturing addressed this too! There’s a whole branch of Deming’s work around supply chains and how it’s often worth working with “more expensive” suppliers when their quality is consistently high, because compensating for low q
6.
by apenwarr 7mo ago
(Tailscale founder here) Two main differences: first, every DERP server used by your tailnet must be accessible by every node on your tailnet at all times, otherwise you get hard-to-debug netsplits. That's a very high bar to maintain s
7.
by apenwarr 8mo ago
[Tailscale CEO here] I see a lot of comments asking why Tailscale would branch away from our "core product" and build this thing that seems unrelated at first. One answer is that just about every single Tailscale customer (or home
8.
by apenwarr 11mo ago
(I'm a Tailscale employee) The recent versions of the Tailscale k8s operator actually used a pre-release of the Services feature to do exactly that. So, not much difference. The official Services release is making that functionality av
9.
by apenwarr 1y ago
You’re right except in the very specific case of the App Store purchase or download process. You only get one chance at FaceID and then it demands a password. But, if you cancel and do it again, you get another chance at FaceID. It’s mystif
10.
by apenwarr 3y ago
(Tailscale cofounder here) Tailscale already gives every node on every tailnet a globally unique internal IPv6 address, that is reachable even if you don't have IPv6 on the "outside" network. If your apps and OSes are all wil
11.
by apenwarr 3y ago
It’s possible to build a cache without any insight, but to make a cache that works well in a given domain requires knowledge from outside the world of caching itself. The same is true of summarization and compression.
12.
by apenwarr 3y ago
Tailscale now supports custom OIDC providers. But if you already have the ability to host one, you won’t benefit from what’s in the above article (which is about hosting stuff at home even without a public IP address). https://ta
13.
by apenwarr 4y ago
I recommend against using Funnel for this use case (because it exposes your server to everyone in the world, not just your trusted users). Tailscale node sharing is free and secure for private networks of friends, and there are lots of peop
14.
by apenwarr 4y ago
(Interviewee here) WireGuard itself barely touches DNS, and tailscale as far as I know doesn’t have any code that would change how your external DNS resolution works. What you’re seeing might be a misdiagnosis. If you email tailscale suppor
15.
by apenwarr 4y ago
Exit nodes are usually still behind your firewall and have no open incoming ports. If you're willing to reconfigure your firewall to open incoming ports, you probably didn’t need Funnel in the first place.
16.
by apenwarr 4y ago
I haven't played with OpenWRT SQM for a while, but if it's easy to reproduce with gfblip, it might be a simple matter of telling them your exact SQM settings and the URL to try. Chances are changing the SQM backend (eg. between fq
17.
by apenwarr 4y ago
In general, the load generated by a series of these pings is so low as not to matter, unless a whole ton of people start doing it at once. But in that case, gfblip's trivial backend code will ask the frontends to slow down so that aggr
18.
by apenwarr 4y ago
I've been on the Internet for a long time, including doing Debian stuff (popularity contest!) back in the 1990s. I don't know what attrition.org is though.
19.
by apenwarr 4y ago
Oh neat! If you see occasional red blips, you have probably found a bug (or misconfiguration) in your OpenWRT SQM. gfblip doesn't lie. In fact, I created it to find annoying router bugs like this. If you click the "DNS" check
20.
by apenwarr 4y ago
However, the preflight check is sufficient to check latency :) "Preflight check" is such a wrong analogy, since with CORS you fly all the way to the destination to check if you're allowed to fly to the destination.
21.
by apenwarr 4y ago
You might mean if you turn "on" HTTPS-only mode? The silly trick blip uses involves pinging non-encrypted HTTP web servers, which is not allowed from an encrypted web page. So you really have to load blip from a non-encrypted serv
22.
by apenwarr 4y ago
When you ping to the phone, you're probably running into the phone's power saving feature. When the phone generates the request, it stays powered up for a bit until the answer comes back, which is why you're not seeing the
23.
by apenwarr 4y ago
"https with auth" is fine and good, and obviously the world has been heading in this direction. But I secretly suspect this is because 90%+ of developers nowadays don't know how to hack on any layer below http. Tailscale is n
24.
by apenwarr 4y ago
(I'm a tailscale cofounder) I think of Tailscale more like a set of tools that lets you do any architecture you want. Nobody has to use Tailscale ssh console, but if you believe in the future of wasm -> apps -> web console ->
25.
by apenwarr 4y ago
Alas, the real “telnet” protocol has considerably more fanciness than nc. It’s just that the telnet cli command degrades into a simple line-oriented mode if it doesn’t see the telnetd init sequence.
26.
by apenwarr 5y ago
Note that you can create a (public) Github org nowadays for free, then use it with Tailscale. This is a pretty smart move on Github's part.
27.
by apenwarr 5y ago
(I wrote the article.) You're not that unusual, we just haven’t had time to address that use case directly yet. I expect an ecosystem of MSPs may arise to offer physical boxes, or some such thing, since the tailscale client is open sou
28.
by apenwarr 5y ago
This article was me trying to write down my internal notes on the topic at the time, after having dived very deeply into problems with the set of interlocking network queues inside embedded wifi devices we were working on. I was probably no
29.
by apenwarr 5y ago
You might like the Tailscale Machine Key approval feature. If enabled for your domain, no device can join your tailscale network unless they’re manually approved by your network’s admin or the API.
30.
by apenwarr 5y ago
Someone else mentioned that basically malware on your machine is expected to bypass all security layers. So we’re basically saying “the ‘new’ network layer is now as trustworthy as the app layer” rather than claiming everything is perfect,

More ›