An AI agent used a stolen Tailscale auth key at Hugging Face. Workload identity federation, flow logs, and safer defaults could have reduced the risk.
  • Fiery@lemmy.dbzer0.comEnglish
    5·
    8 days ago

    Very non exhaustive list (just things I personally use), all of these are configurable (globally or per device/group/tag)

    • NAT traversal (no open ports)
    • mesh-routing, any device can connect to any device as soon as its added to the tailnet (configurable of course)
    • 'magic’DNS, route to any node based on name in your tailnet. E.g. ping homepc in my terminal connects just like that
    • ssh auth via tailnet, can just `ssh accountname@homelab to get a shell on my homelab
    • taildrop, think localsend over your tailnet
    • subnet routing, expose a subnet to any node, e.g. i can ping 192.168.0.123 from any device via my tailscale node running on 192.168.0.50
    • exit nodes, route all traffic from a device through another device that advertises itself as an exit node. (Basically classic VPN)
    • funnel, expose a service to the internet (haven’t used that one in a while since I got my own domain and reverse proxy etc set up

    They offer so much more though

    • hirihit640@sh.itjust.worksEnglish
      1·
      7 days ago

      I see. Some of these are possible through wireguard btw. Subnet routing and exit nodes are pretty easy. Funnel would require some firewall rules, so not wireguard but still easy. For SSH using names, and “magic dns”, you could just modify the hosts file. Taildrop is localsend.

      But NAT traversal and automatic re-configuration of clients sound like the main benefits here.

      • Fiery@lemmy.dbzer0.comEnglish
        3·
        7 days ago

        Seeing as tailscale is using wireguard as the underlying protocol I’d imagine most of what they do is possible with wireguard + small extra app :).

        Its indeed the zero config mesh with NAT traversal and the fact that all of these just work OOTB that make it great