Hacker News: tailscaletom

New comment by tailscaletom in "Mullvad on Tailscale: Privately browse the web"

tailscaletom — Thu, 07 Sep 2023 17:49:26 +0000

Yepp! Strong recommend on using systemd-resolvd, we've observed the least bugs and issues there.

New comment by tailscaletom in "Mullvad on Tailscale: Privately browse the web"

tailscaletom — Thu, 07 Sep 2023 17:41:39 +0000

Userspace mode might be an option (runs without a TUN or doing any system network wiring, at the expense of performance): https://tailscale.com/kb/1112/userspace-networking/

Running Tailscale without privileges is a challenge because tailscaled needs to be able to configure your network, and if you enable Tailscale SSH it also needs to be able to create sessions for configured users. For people who dont need SSH and accept this challenge + maintenance burden, it is possible: https://tailscale.com/kb/1279/security-node-hardening/

New comment by tailscaletom in "Tailscale bug allowed a person to share nodes from other tailnets without auth"

tailscaletom — Wed, 18 Jan 2023 17:34:10 +0000

Yes. Peers added in this fashion would not have been signed by a trusted tailnet-lock key, so clients would refuse to trust them.

New comment by tailscaletom in "Tailscale bug allowed a person to share nodes from other tailnets without auth"

tailscaletom — Wed, 18 Jan 2023 04:56:53 +0000

If you're excited about tailnet lock and want to get on the alpha sooner rather than later, feel free to drop me an email. As Dave mentioned we are slowly crunching through the waitlist to get some miles in, but I'm also happy to take on enthusiastic testers ahead of that!

You can email me at tom@ (tailscale dot com)

New comment by tailscaletom in "Tailnet Lock"

tailscaletom — Thu, 15 Dec 2022 17:08:25 +0000

(Tailscalar and a tailnet lock author here)

If you're okay with trusting Tailscale's control plane, we have a feature for exactly this use case! Its called Device Authorization: https://tailscale.com/kb/1099/device-authorization/

You could also use tailnet lock in this fashion, by issuing a `tailscale lock sign` command for the new node once you've verified the provenance of the new device. Because it involves signatures with keys on your device it could never be as simple as a REST API, but maybe we could offer a more easy to automate command or better client library support (suggestions welcome!)

New comment by tailscaletom in "Tailnet Lock"

tailscaletom — Thu, 15 Dec 2022 16:52:17 +0000

(Tailscalar and a tailnet lock author here)

Thanks for the feedback!! Writing the documentation for how this worked was a challenge, and its good to hear what pieces we need to call out more strongly in the future.

If you're interested in gory details around tailnet lock internals, we have the beginnings of a whitepaper here: https://tailscale.com/kb/1230/tailnet-lock-whitepaper/