undefined

points

[-]

(Tailscale CEO) I don't know what to tell you. The problems that are found internally, or via security reviews and pentests we pay for, are ones that we fix before releasing. They don't need bulletins.

Bugs that are found by other people are found, by definition, after release. They are therefore more likely to need a bulletin.

by traceroute661 hours ago|

parent|

[-]

But why should insecure argument handling bugs (as per your recent SSH bulletin) be found after release ?

Those are an ancient class of bugs that should be picked up by any competent security review.

by apenwarr1 hours ago|

parent|

[-]

Is your theory that "any competent security review" will find every security hole in a product? Because that sure would be great if it were true. Unfortunately it does not match my experience.

by inigyou18 minutes ago|

parent|

[-]

I thought it was funny that you dropped the (Tailscale CEO) tag once you were talking about a specific flaw in your product.

by john_strinlai10 minutes ago|

parent|

[-]

i think its probably okay to drop it when you are this far deep into a conversation and the affiliation has already been stated multiple times in the existing comment chain.

by traceroute6653 minutes ago|

parent|

prev|

[-]

Every security hole ? No, of course not.

But things like insecure argument handling are low-hanging fruit for security auditors.

Insecure argument handling is not like the more advanced subtle vulnerabilities that we are seeing in some LLM-assisted reports these days. Insecure argument handling is 1990's security.

The fundamental problem remains that Tailscale has too many new "features" being added to it the whole time. New features means a whole bunch new code. Which increases bloat and exponentially increases the attack surface.

It would be really nice if you could stop shoehorning in every new feature you can think of. Remove some of the existing ones that don't really need to be there. And get your codebase back to a more focused state, get back to your roots as a VPN product.

Stop trying to be all things to all men, as the old saying goes.

by TheTaytay11 minutes ago|

parent|

[-]

It appears that you have a major bone to pick with Tailscale and direct replies to your concerns do not seem to matter. They have a good security track record and are extremely widely deployed. I don’t see the evidence for your assertions that it is bloated and insecure.