Hacker News

points by aborsy 2 days ago | 0 comments

There are too many features, and lines of code (probably more than OpenVPN). I'm pretty sure there are all kinds of zero days in it, with this attack surface and feature set.

I use it extensively, and I would rather pay them a fee if they could review thr code.

A possibility is a lock down mode, disabling risky features.

I just want a VPN for connrctiviy, no taildrop, taildrive, SSH, funnel, services, DNS, node sharing, ...They are disabled in my admin console, but the code runs on my devices and they can be enabled by mistake.

A question. Taildrop enables unauthenticated input and doesn't even obey ACLs. I'm not quite sure about this, but couldn't malware in a low trust device send a file to my Synology NAS, which will then automatically process it for indexing things like thumbnail, leading to potential code execution? Why doesn't it obey ACLs, and why isn't the recipient approval needed before the file exits the sender's device? I use tags, but I'm the owner not the tag.

[–] drdexebtjl 2 days ago

This is also how I feel about Tailscale and its popular alternatives. They do too much.

Does anyone know of a Tailscale alternative that sticks to the basics?

Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?

[–] sigbottle 2 days ago

I've been toying around with nebula, self host your lighthouse on a cheap VPS (which even if it gets hacked, the most it can do is lie about traffic, not lie about node certs). Basically you're just paying for the punchthrough (you may even be able to do some duckdns shenanigans?) The main issue is that updating nodes is a pain in the butt, which is the main advantage of tailscale IMO - centralized control plane. Keeps it simple.

I was trying to do some kind of insane workflow where you as the operator have a privileged hardware yubikey that admins the nodes when you plug it in, and the point is the nodes would self-propogate the changes outwards. I immidiately ran into classic issues with distributed security in distributed systems (even with only one central operator trying to admin everything). Tailscale is also a bit more secure in its oauth layer - with this architecture, you need to set proper time limits for expiring so one node compromise doesn't get access to the whole fleet. Couldn't really come up with better ideas than forcing the operator to reuse some kind of hardware key (the idea trying to be avoiding maintaining a cloud control plane as much as possible)

Fun foray but creating such a system requires a lot of expertise that I unfortunately lack

[–] LeBit 2 days ago

I used Nebula extensively.

I really liked it. I like the idea of embedding firewall rules in a certificate.

But , like you observed, it does not scale as well as tailscale.

[–] Yasuraka 2 days ago

https://github.com/netbirdio/netbird

Bit more than the basics, but not as much as tailscale.

[–] plextoria 22 hours ago

Is ZeroTier something you considered? I’m not sure if it’s built on WireGuard, but I’ve been using it on some of my personal devices for a while.

[–] huslage 2 days ago

You can run Tailscale in this mode just fine, or use Tailcat if you want.

[–] drdexebtjl 2 days ago

The point, in the context of this thread, is that the attack surface is huge.

[–] LeBit 2 days ago

No.

{tail,head}scale is the best there is for wireguard at more than 3 nodes.

[–] chasd00 2 days ago

You could just use IPsec. It’s been probably 20 years but look into SWAN. It’s just a vpn in the vpn sense.

[–] InsidiousWombat 1 day ago

IPSec is horrid. Please, don't

It is massively more complex than say Wireguard, because it was developed with "everything and kitchen sink approach", and even the standard de facto authors, Cisco, took good 20 years to stop having IPSec related vulnerability every few months (hell we just had one this year in Linux IIRC)

[–] sgerenser 1 day ago

That doesn’t really help much if you want to connect an arbitrary number of nodes to eachother (each of which is potentially on an entirely different LAN), does it? That’s really the whole point of Tailscale.

[–] ctippett 2 days ago

Taildrop only works with devices that are yours, i.e. you can't send or receive anything from a device that's either tagged or owned by someone else. The only way malware is getting onto your NAS (via Taildrop) is if you're the one sending it there.

[–] JJJollyjim 2 days ago

My Tailscale RCE[1] in 2022 involved forcing a device onto an attacker-controlled control plane, at which point your device is no longer "yours", and the fact that Taildrop is implemented in your client binary can be exploited. Chaining the bug to RCE would not have been possible against an ideal Tailscale with only the core feature set.

[1]: https://web.archive.org/web/20221222120703/https://emily.id....

[–] ctippett 2 days ago

This was(/is?) a great write-up. Would the vulnerability enabled through Taildrop still work if the compromised machine was tagged or would the attacker's control of the... control plane make this additional safeguard redundant?

[–] aborsy 2 days ago

See my comments in this thread.

[–] mintflow 2 days ago

As a indie hacker(viber :) ) built mutiple tailscale based stuffs dated to the early days of tailscale, I like it but actually I do agree with you

There are too much features added now, perhaps some related to enterprise features because that must drive the revenue

Sometimes I am thiking perhaps they provide a light tailscale version but that seems not viable given the complexity now, headscale is great, but the OSS client still have plenty features, though they are gradually added feature based switch in the client source which I think is great, perhaps we can build a light version over it

This is also I do not think the tailscale-rs(which aim to rewrite tailscale with rust) will not be ready in a short time because too much (feature + cross platform) need to be tested

[–] skowalak 2 days ago

Re: Your question. Taildrop only works between devices in the same account. So if you don't put low trust devices in the same account as your NAS this is mitigated.

[–] aborsy 2 days ago

Tailnet owner may not trust all their devices to the same extent. Here is a concrete example.

I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable. If I do, there is still a window that this node can send me files until I tag it (I can't install tailscale to a tag).

Sending a file otherwise normally requires an app listening to a port, so taildrop permissions should be same as network permissions set by ACL.

BTW, last year or so tailscale advertised a position for someone to manage complexity of tailscale. Founder was talking about this issue. They seem to be aware of the problem.

[–] ctippett 2 days ago

Tags are a key part of managing ACLs. If you're concerned about an untrustworthy node on your tailnet, use tags. Even if you forget to add a tag to a newly added node (API keys can be set to automatically assume a tag when used fwiw), if your other devices are tagged then they're ineligible for taildrop.

[–] bradfitz 2 days ago

(Tailscalar)

FWIW you can rebuild tailscaled to omit all the optional stuff:

https://github.com/tailscale/tailscale/tree/main/feature#mod...

e.g.

  % go run ./cmd/featuretags --min
  ts_omit_ace,ts_omit_acme,ts_omit_advertiseexitnode,ts_omit_advertiseroutes,ts_omit_androidbin,ts_omit_androiddns,ts_omit_appconnectors,ts_omit_aws,ts_omit_bakedroots,ts_omit_bird,ts_omit_c2n,ts_omit_cachenetmap,ts_omit_captiveportal,ts_omit_capture,ts_omit_cliconndiag,ts_omit_clientmetrics,ts_omit_clientupdate,ts_omit_cloud,ts_omit_colorable,ts_omit_completion,ts_omit_completion_scripts,ts_omit_conn25,ts_omit_connreject,ts_omit_dbus,ts_omit_debug,ts_omit_debugeventbus,ts_omit_debugportmapper,ts_omit_desktop_sessions,ts_omit_dns,ts_omit_dnsresolvecache,ts_omit_doctor,ts_omit_drive,ts_omit_exitnodehealth,ts_omit_favorites,ts_omit_flashappliance,ts_omit_gro,ts_omit_health,ts_omit_hujsonconf,ts_omit_identityfederation,ts_omit_ipnbus,ts_omit_iptables,ts_omit_kube,ts_omit_linkspeed,ts_omit_linuxdnsfight,ts_omit_listenrawdisco,ts_omit_logtail,ts_omit_nattraversal,ts_omit_netlog,ts_omit_netstack,ts_omit_networkmanager,ts_omit_oauthkey,ts_omit_osrouter,ts_omit_outboundproxy,ts_omit_peerapiclient,ts_omit_peerapiserver,ts_omit_portlist,ts_omit_portmapper,ts_omit_posture,ts_omit_qrcodes,ts_omit_relayserver,ts_omit_remoteconfig,ts_omit_resolved,ts_omit_routecheck,ts_omit_runtimemetrics,ts_omit_sdnotify,ts_omit_serve,ts_omit_serviceclientprefs,ts_omit_ssh,ts_omit_synology,ts_omit_syslog,ts_omit_syspolicy,ts_omit_systray,ts_omit_taildrop,ts_omit_tailnetlock,ts_omit_tap,ts_omit_tpm,ts_omit_tundevstats,ts_omit_udptransport,ts_omit_unixsocketidentity,ts_omit_useexitnode,ts_omit_useproxy,ts_omit_usermetrics,ts_omit_useroutes,ts_omit_wakeonlan,ts_omit_webbrowser,ts_omit_webclient

[–] traceroute66 1 day ago

> FWIW you can rebuild tailscaled to omit all the optional stuff:

It would also cost Tailscale nothing to build and ship a minimised version alongside the bloated version. Thereby making it officially supported option.

Because you just know support will start finger-pointing and asking you to install the bloated version if you tell them you're having an issue with your home-compiled minimised version ....

[–] infogulch 1 day ago

What about mobile apps?