That said, these vulnerabilities aren't that significant.
Meh.
to be fair, config choices like tailnet lock and ephemeral keys can be used to mitigate.
however, the enumeration of the entire tailnet leading to one compromised node providing the whole map (e.g. hugging face) is inherent in their architecture. that one can be mitigated by ACLs for small networks, but that is unwieldy at scale.
i do have to agree that tailscale is a vpn - which is not easily reconfigured to follow more zero trust principles. so their zero trust washing marketing is disingenuous. they could stick with their strength: an easy to use version of a great vpn (wireguard).
trimming is a neat feature - thanks for that - thought the ACLs are often not there to begin with because configuring off the full node level access defaults of the vpn is difficult, at least at scale.
not specific to ts - all vpns and firewalls have the same intrinsic issue.
iancarroll•57m ago
Seems like they responded on Reddit: https://www.reddit.com/r/Tailscale/comments/1xekjpd/tailworm...