Thanks for linking that. The debate about these issues will rage on, but I do wonder whether giving Tailscale two hours of notice before public release was the right call? The arguments from the post are that "rapid awareness of these flaws will expediate remediation" and that they were "discovered with low effort". Does the author mean that simply pointing Claude at Tailscale identified (a non-trivial subset) of these vulnerabilities, and did the author not feel that Tailscale had a track record of responding to vulnerabilities, via a coordinated disclosure, in a timely manner? I would personally have liked to see a bit more of a justification of the almost-immediate publication against the potential risks to users, vs. e.g. waiting a day or two.
It's so unusual that I'm starting to wonder if this was intended to harm Tailscale's public image. These don't appear to be major flaws, and if the purpose of publishing was to get them fixed there's a well known process for responsible disclosure. Sounds like they didn't even attempt to follow that.
