There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set.
I use it extensively, and I would rather pay them a fee if they could review thr code.
A possibility is a lock down mode, disabling risky features.
I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node sharing, ...They are disabled in my admin console, but the code runs on my devices and they can be enabled by mistake.
A question. Taildrop enables unauthenticated input and doesn't even obey ACLs. I'm not quite sure about this, but couldn't malware in a low trust device send a file to my Synology NAS, which will then automatically process it for indexing things like thumbnail, leading to potential code execution? Why doesn't it obey ACLs, and why isn't the recipient approval needed before the file exits the sender's device? I use tags, but I'm the owner not the tag.
This is also how I feel about Tailscale and its popular alternatives. They do too much.
Does anyone know of a Tailscale alternative that sticks to the basics?
Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?
It is massively more complex than say Wireguard, because it was developed with "everything and kitchen sink approach", and even the standard de facto authors, Cisco, took good 20 years to stop having IPSec related vulnerability every few months (hell we just had one this year in Linux IIRC)
That doesn’t really help much if you want to connect an arbitrary number of nodes to eachother (each of which is potentially on an entirely different LAN), does it? That’s really the whole point of Tailscale.
I've been toying around with nebula, self host your lighthouse on a cheap VPS (which even if it gets hacked, the most it can do is lie about traffic, not lie about node certs). Basically you're just paying for the punchthrough (you may even be able to do some duckdns shenanigans?) The main issue is that updating nodes is a pain in the butt, which is the main advantage of tailscale IMO - centralized control plane. Keeps it simple.
I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)
Fun foray but creating such a system requires a lot of expertise that I unfortunately lack
Taildrop only works with devices that are yours, i.e. you can't send or receive anything from a device that's either tagged or owned by someone else. The only way malware is getting onto your NAS (via Taildrop) is if you're the one sending it there.
My Tailscale RCE[1] in 2022 involved forcing a device onto an attacker-controlled control plane, at which point your device is no longer "yours", and the fact that Taildrop is implemented in your client binary can be exploited. Chaining the bug to RCE would not have been possible against an ideal Tailscale with only the core feature set.
This was(/is?) a great write-up. Would the vulnerability enabled through Taildrop still work if the compromised machine was tagged or would the attacker's control of the... control plane make this additional safeguard redundant?
As a indie hacker(viber :) ) built mutiple tailscale based stuffs dated to the early days of tailscale, I like it but actually I do agree with you
There are too much features added now, perhaps some related to enterprise features because that must drive the revenue
Sometimes I am thiking perhaps they provide a light tailscale version but that seems not viable given the complexity now, headscale is great, but the OSS client still have plenty features, though they are gradually added feature based switch in the client source which I think is great, perhaps we can build a light version over it
This is also I do not think the tailscale-rs(which aim to rewrite tailscale with rust) will not be ready in a short time because too much (feature + cross platform) need to be tested
Re: Your question. Taildrop only works between devices in the same account. So if you don't put low trust devices in the same account as your NAS this is mitigated.
Tailnet owner may not trust all their devices to the same extent. Here is a concrete example.
I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable. If I do, there is still a window that this node can send me files until I tag it (I can't install tailscale to a tag).
Sending a file otherwise normally requires an app listening to a port, so taildrop permissions should be same as network permissions set by ACL.
BTW, last year or so tailscale advertised a position for someone to manage complexity of tailscale. Founder was talking about this issue. They seem to be aware of the problem.
Tags are a key part of managing ACLs. If you're concerned about an untrustworthy node on your tailnet, use tags. Even if you forget to add a tag to a newly added node (API keys can be set to automatically assume a tag when used fwiw), if your other devices are tagged then they're ineligible for taildrop.
% go run ./cmd/featuretags --min
ts_omit_ace,ts_omit_acme,ts_omit_advertiseexitnode,ts_omit_advertiseroutes,ts_omit_androidbin,ts_omit_androiddns,ts_omit_appconnectors,ts_omit_aws,ts_omit_bakedroots,ts_omit_bird,ts_omit_c2n,ts_omit_cachenetmap,ts_omit_captiveportal,ts_omit_capture,ts_omit_cliconndiag,ts_omit_clientmetrics,ts_omit_clientupdate,ts_omit_cloud,ts_omit_colorable,ts_omit_completion,ts_omit_completion_scripts,ts_omit_conn25,ts_omit_connreject,ts_omit_dbus,ts_omit_debug,ts_omit_debugeventbus,ts_omit_debugportmapper,ts_omit_desktop_sessions,ts_omit_dns,ts_omit_dnsresolvecache,ts_omit_doctor,ts_omit_drive,ts_omit_exitnodehealth,ts_omit_favorites,ts_omit_flashappliance,ts_omit_gro,ts_omit_health,ts_omit_hujsonconf,ts_omit_identityfederation,ts_omit_ipnbus,ts_omit_iptables,ts_omit_kube,ts_omit_linkspeed,ts_omit_linuxdnsfight,ts_omit_listenrawdisco,ts_omit_logtail,ts_omit_nattraversal,ts_omit_netlog,ts_omit_netstack,ts_omit_networkmanager,ts_omit_oauthkey,ts_omit_osrouter,ts_omit_outboundproxy,ts_omit_peerapiclient,ts_omit_peerapiserver,ts_omit_portlist,ts_omit_portmapper,ts_omit_posture,ts_omit_qrcodes,ts_omit_relayserver,ts_omit_remoteconfig,ts_omit_resolved,ts_omit_routecheck,ts_omit_runtimemetrics,ts_omit_sdnotify,ts_omit_serve,ts_omit_serviceclientprefs,ts_omit_ssh,ts_omit_synology,ts_omit_syslog,ts_omit_syspolicy,ts_omit_systray,ts_omit_taildrop,ts_omit_tailnetlock,ts_omit_tap,ts_omit_tpm,ts_omit_tundevstats,ts_omit_udptransport,ts_omit_unixsocketidentity,ts_omit_useexitnode,ts_omit_useproxy,ts_omit_usermetrics,ts_omit_useroutes,ts_omit_wakeonlan,ts_omit_webbrowser,ts_omit_webclient
> FWIW you can rebuild tailscaled to omit all the optional stuff:
It would also cost Tailscale nothing to build and ship a minimised version alongside the bloated version. Thereby making it officially supported option.
Because you just know support will start finger-pointing and asking you to install the bloated version if you tell them you're having an issue with your home-compiled minimised version ....
I use it extensively, and I would rather pay them a fee if they could review thr code.
A possibility is a lock down mode, disabling risky features.
I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node sharing, ...They are disabled in my admin console, but the code runs on my devices and they can be enabled by mistake.
A question. Taildrop enables unauthenticated input and doesn't even obey ACLs. I'm not quite sure about this, but couldn't malware in a low trust device send a file to my Synology NAS, which will then automatically process it for indexing things like thumbnail, leading to potential code execution? Why doesn't it obey ACLs, and why isn't the recipient approval needed before the file exits the sender's device? I use tags, but I'm the owner not the tag.