>Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.>Researcher Erica Windisch bypassed coordinated disclosure by publishing 11 unpatched Tailscale flaws. Her findings showed that Tailscale SSH race conditions allow a compromised device to gain root access on other servers and add rogue nodes.
What would motivate someone to jeopardize entire ecosystems ? Here's a video of her btw :https://youtu.be/ve8Mq6ASWy4
>no bug bountyseems like you get what you pay for
>>110158736>race conditions
>>110158748>ad hominem
>>110158736Fucking based.
>>110158748Race to get recognition for finding vulnerabilities in the AI age.
>>110158736>EricaThat's a man
>>110158805out of 10 or something
>>110158748*him or it
>>110158762That's not her name
>>110158818ew i googled nvm
>>110158748>herthat's an "it".
>>110158736dont forget to install the purple monkey intent router on your tailnet
I never understood why anyone would ever use tailscale, seems like it's a huge potential security risk.
>>110159104Its just a wireguard mesh
>>110158736>EricaThat's a nigga.
>>110159104Because it's probably the easiest way to leverage wireguard when your IP pulls some bullshit and rents your ip4 addr out to multiple people.1. Turn on tailscale2. Your road warrior devices fires packet to tailscale server3. Your home network fires packet to tail scale server4. Your IP is forced to make a table entry routing any traffic from your IP to tailscale to your and only your router5. Now tailscale server can bridge the traffic of road warrior to them and them to your home routerIP6 fixes this, but people see hex characters and they get angry, so instead we get this.
>>110159217>people see hex characters and they get angrythose are not people desu
>>110158736>>110158748>Tailscale is anti-trooncodedhuh
>>110159294IPv6 is retarded. It should have been two more octets of dotted decimal.
>>110159357it's future proofed for a world with hundreds of billions of IoT devices.anyway death to these men pretending to be women. it's tiresome. after a certain age you need to grow up an accept you have a cock and balls. that guy looks gross.
>>110158736>requires an accountdeserved
>>110159217>using forced relays instead of iroh or something similar>>110159104 proven right.iroh-relay exists btw. but people are not forced into using it.
>>110158736>tfw use tinc as my p2p VPN cuz I don't trust SaaS nonsenseI won.
>>110158748
https://www.reddit.com/r/Tailscale/comments/1xeoj1l/recent_tailscale_vulnerability_reports/VP of Engineering already confirmed it is a nothing burger from an attention whore troon
>>110159543nope, you lost. tinc doesn't even try to protect against those alleged tailscale flaws but advertises it as a feature:https://www.tinc-vpn.org/documentation-1.1/How-invitations-work.html
>>110159669>1.1I use 1.0 though.
>>110159629>TRUST US, GOY!
>>110159217A 1core 500mb ram rented VPS for $1/mth can do this btw. No need to use gaylescale
>>110159830you don't need a VPS or any relaying. you can just use pkarr or iroh or whatever, depending on the SPECIFIC use-case.
>>110158748Of course.
>itt:
>>110159217ipv6 is trash which is why it hasnt been adopted for longer than gayland
>>110158736daily reminder to put an http bridge on the x session on your desktop and a http bridge on your phone then connect them with tailscale
>>110160834>ipv6 is trash>gaylandcontrarian level: demon
>>110160807It should be buttplug-shaped.
>>110159629>all those fake commentslmaogood thing r*ddit is mostly bots and jeets nowadays
>>110158762>Ad hominem, short for argumentum ad hominem ('argument directed at the person'), is a rhetorical tactic of attacking the character, motive, or some other attribute of the person making an argument rather than the substance of the argument itself.Please quote where in that post there is a rebuttal about any argument OP made
>>110158736>proprietary slop
>>110160935my network is not slaved to the busmasters of iana. no one but me knows how many devices i have here and you do not speak to my device unless spoken to.ipv6 is trash because it forgets that the internet is a series of bridges and gayland is trash because it forgets that a display server is a session bus. thats why do nothing group builds bridges between session devices to carry channelized packets and blobs https://do-nothing-group.github.io
>>110158736Another vibeGOD victory
>>110158748>her
>>110158736I have no idea what tailscale is or does, sorry.I will assume that it is yet another corpo SaaS product and therefor i am glad that it happened and the victims deserved it.
>>110158748LMAO it's just like this recent gem:https://x.com/tldraw/status/2105003566351908892
>>110158748>Only one comment>"revolting"Kekd
>>110158736Why do we need this gay corpo bullshit when we already have OpenVPN and OpenSSH?
>>110158748>herwhat causes this?
>>110158736>>110158748What the fuck is wrong with trannies? Seriously asking at this point.
>>110159217Kek. Does tailshit not support ipv6 as well? Why the fuck would anyone want a point-to-point VPN that uses IPs that can conflict with any enterprise network? >B-but 100.64/10>B-but 240/4>B-but *insert all the abused privately set aside subnets*Clearly you guys haven't seen crazy shit. ULAs alone means IPv6 won.
>>110158749lol this. deserved
>>110159629>guys this is a nothing burger just a double privilege escalation>those comments
>>110160861>http bridge on the x session on your desktop and a http bridge on your phoneplz elaborate, also in that one panel it should have 128GB
>>110158736Kinda based desu. Fuck "responsible" disclosure. If the tranny did the "responsible" thing, tailscale niggers would be still there jerking themselves off talking about the "best approach" or argue whether the vulnerability is an "actual" vulnerability instead of solving the problem. Just force the hand of maintainers by dumping the vulnerabilities in public.
>>110161787What the fuck am I hearing LMAO please tell me this is a joke
>>110162988Informing the public about dangerously incompetent at best, malicious at worst, scam artists is responsible disclosure.
>>110161796TOPKEK
>>110161796lmao
>>110158748I think you know why.
>>110158736based
NothingburgerYou need to enable SSH on Tailscale (which is disabled by default)
>>110158736hate this closed-source normalfag wrapper for wireguard.
>>110158757uh purely socioeconomical factors, ok
>>110162673* a windowing system is a session bus and shared database* channelization is a fact of life, either you listen on your channel or you listen to everything, its not just for multiplexing or just for crossing bridges* numa nodes and dma is a fact of life. blobs need to be dma'd between numa nodesthe neat thing is, whatever its called, personal distibuted computing will be done using something equivalent to x11
>>110158736so should i disable tailscale on all of my devices or not
>>110158805kek, came to say that
>>110163894wait, I have to enable it? I've been ssh'ing into my server's Tailscale IP this whole time
>>110165401You're just using Tailscale over SSH, you can let Tailscale itself handle SSH connections, certificates etc. This is where the vuln is, if you didn't know about it you're not using ithttps://tailscale.com/docs/features/tailscale-ssh
>>110165401that's a different thing. tailscale's SSH (the feature you have to enable) uses tailscale's existing auth mechanisms to decide who gets access to what machine.what you did was probably just talking do the SSH daemon on whatever machine using keys unrelated to tailscale
>>110165416>You're just using Tailscale over SSHI mean SSH over Tailscale
>>110158748>herof course the troon did the whoopsie
>>110159217Sell me on IPv6. I've never gotten over how it puts every device publicly on the internet without a NAT. I know that's its purpose, but isn't that a loss of control for the firewall/router? Is IPv6 slower than IPv4? Hasn't it had quite a few leaks and vulns?
>>110165493you can still use a firewall with IPv6. The packets do go via your router after all. NAT was never a security feature.
>>110165566Yeah people say this, but it kind of is. At least, it's a slight privacy feature. With a NAT your router obfuscates which devices exactly are doing what.
>>110158736it's only a vulnerability because it got caught :^) -1 feature for the glowniggers :skull:
>>110165566>NAT was never a security featurenat means iana doesnt address every device in my network
>>110158736I never trusted thus shit that's why I never used it. diy
>>110158736>herfuck off degenerate tranny
>>110165493With IPv6, you want to make a voice call to a friend, your computer connects to their computer and you exchange data. Routers in between you can see your machine IP addresses.With IPv4, since you're both behind NAT and CG-NAT and other bullshit, your voice data is now going through a central server run by Microsoft or something, setting up sessions to track you, probably requiring a login to prevent abuse of the relays, etc.How is the former better privacy?
>>110165566>NAT was never a security feature.You IPv6 ball washers always say this and it makes you sound so fucking incredibly stupid. It's like saying car frames aren't about safety since they were just designed to hold the engine and the wheels so you can drive.Consumer routers stopped all sorts of annoying drive by bullshit attacks by locking everything down behind a NAT and since most people have no need to port forward or fiddle with anything the default is safe. It's easy to understand. It's graceful. Having your entire shit locked down to 1 physical location is an amazing default behavior.>BUT YOU CAN DO THAT WITH UP IPvSHIT Oh wow great. So none of the "benefits" of IPv6 and now you're just reimplementing a perfectly functioning system but with an absurdly long address space and absolutely no tangible benefits while adding on layers of complexity. Awesome thanks.
>>110165927>your voice data is now going through a central serveryou need a channel and it has to be brokered by a server with a name> give all devices namesno>run by Microsoftit could be your aws server of course, but you "got a server from discord"
I use tailscale, headscale, matrix synapse like a boomer. am I in troubles? I want to try OpenZiti + nyn + Synapse and do an out of band thing. i want everything to be peer to peer while I shitpost with my agent
>>110166119openziti is not peer to peertake a look at tailcat, it's tailscale lite and doesn't even require an account while giving you convenient p2p between your devices. depends on why you're using tailscale in the first place. for me personally it's only their nat hole punching.
>>110165941you really have no idea how anything works do you?
>>110166165>IPvShitter can't disbunk my points>Cries and shits his diaper and asks vague question insteadLmao. You lost.IPv4 wom.
>>110158736>literally no sourceThis board, man
>>110167938Sorry, here :https://bfy.tw/UYEk
>>110158736I just checked and it turned out tailscale ssh was disabled on my machines so it means it's disabled by default. I didn't even know tailscale had built in ssh, i just used openssh over tailscaled ip address.
>>110158736>Researcher Erica WindischThat's a long way of saying claude code.
>>110165941>absolutely no tangible benefitsCome on, bro. ISPs forcing you to address share due to ip4 is a pretty big tangible bullshit move ip6 can dodge. I also don't understand this fucking "put it on the public network." Who the hell is asking for that? I fully agree with you that we learned the hard way over the last 30 years why private networks weren't just a way around limited public IP space.
>>110169352>so it means it's disabled by defaultIt is.
>>110165493I dunno about "sell" but there are some nice things outside the increased address space.SLAAC means no more DHCP. This sounds good at first, until you realize that DHCP was handing out more than just IP addrs. Still, before, if the DHCP server got fucked, no new devices could connect. Just be damn sure you aren't letting any chucklefucks connect on your publicly available vlans.No more broadcast over .255 or ARP. There's basically an observer pattern for hosts that want to subscribe to broadcast packets with NDP, so switches can be more efficient and only route broadcast packets to hosts that give a shit.Addresses are big enough, and with SLAAC, I think you can just shove the fucking VLAN frame ID into the god damn IP6 addr, so routing/firewall tables get a lot easier to read, but I haven't tried this yet.
>>110169865Router Advertisement handles a few of the DHCP options such as DNS (you don't need the rest)
>>110170346>you don't need the restDisagree. There were DHCP integrations that turned up A/PTR records as new VMs came online and were issued an IP from DHCP server. It was also handy from a security layer to deny unregistered MAC ADDRs from getting an IP, so much so that we have 802.1X at the switch level, or DHCP6 for the poors.
>>110158736 >Erica WindischNot a woman
>>110170520No shit. People would be ignoring them if they were biologically female. But since it's a trans woman, they have to go check in case the fucker did find something real. The progammer socks meme isn't a meme for nothing.
>>110161796there's 3
>>110170759>But since it's a trans woman, they have to go check in case the fucker did find something realkek you're right can't even say anything back
>>110158736You know that a software is bad when it's shilled everywhere on Reddit
>>110158748>Haha ywnbaw>Haha IDC if you're a highly respect professional that does serious and edge research>Bro lol you're a dude, who cares if you make vastly more than me>Pfffft look at those shoulders, like I care that you have an infinitely more intriguing and interesting personal and worn life than me >Lol bro I don't even wanna work in big tech or any real company, I love coding websites for my local tire shop!
>>110172611You're a dude, tho.
>>110172611Yeah it's a dude who's a cyber security expert.
>>110158736I'd wager it'll turn out to be a nothingburger, just like when some tranny announced some lifedestroying bugs with a CVSS of 9.x and it was just some printer bug on a driver that wasn't enabled by default
>>110161549that is what a firewall, not nat, does
>>110172611>ignoring vuln disclosuresit will likely get fired and blacklisted if it has a job.
>>110161549>ipv6 is trash because it forgets that the internet is a series of bridgesIt still is. No one even knows how to get to your public IP addresses anyway until your edge gateway tells them if they want to talk to your CIDR they route to your edge gateway. You've still got your layer 2 switches behind that router.
>>110159104it’s not you’re just low iq and easily filtered
>>110159453yeah kind of like email, retard
>>110158762Did they send this out on your chat app as the new talking point? I've seen this a few times today
>>110159432>292 trillion ips isn't enough for muh sci fi nanomachines>let's make the most bullshit over-engineered addressing scheme that no one wants to useIPv6 is the product of pure autism, a hyper fixation on optimization and peak theoretical performance without a single thought given to usability.
>>110174139What exactly is unusable about it
>>110165941Imagine being this much of a retard and a cuck. Consumer routers behave exactly the same with IPv6. There is this thing called a firewall. Enjoy your CG-NAT hell though, cuckboy.
>>110161549>Do Nothing Group>AI slopFitting.
>>110158736>coordinated vulnerability disclosureold shit that is getting in the way of cyber security, it's essentially the same thing as gun controlcriminals dont use responsible disclosure, theres no reason to punish good people
>>110174253it's impossible for a human to memorize more than a few addresses? fuck you for making me reply to bait
>>110174428How? You can even pick vanity shit like CAFE::BABE and you have zero compressor.
>>110172965No one cares
Security by obscurity is dead. Public disclosure is in the interest of everyone.
What do I use now, all my shit is through tailscale
>>110158736So troons hate tailscale, and passing Chadettes love it?
>>110174428Why the fuck do you need to memorize IP addressesWhat do you think DNS is forHow many IPv4 addresses do you remember
>>110158736>Erica WindischI am 95% confident it's a tranny
>>110158736i remember linux nig/g/ers militantly shilling this to me a year ago
>>110169510ISPs forcing me to address share is based and makes me even harder to trace
>faggy closed source network tool for normalfags who saw their favorite techtuber talk about vpns but were filtered gets hacked by a man named ericalmaoing my awss off
>>110161937>Why do we need this gay corpo bullshit when we already have OpenBSD?
What's the best alternative for cgnat-cgnat bridge if I do not want to pay anything?Hard mode: as tight as possible - pre-shared keys, hwid whitelists on endpoints, anything else that stops unauthorized devices, all at the same time. No fucking public web admin panels where anyone with credentials can just add a device to network.
>>110175954https://tailscale.com/docs/features/tailnet-lock
>>110172611tl;dr>IT'S MA'AM
>>110158736>>110158748more like Eric
>>110158736Use Yggdrasil:https://yggdrasil-network.github.io/>It's free>Has an Android app>IPv6!>No complicated onboarding. Just generate a public/private key and add some peers: https://github.com/yggdrasil-network/public-peers>Password protection if you don't want to participate in the public mainnet>Works in a browser with web sockets!
>>110175698The shilling was and still is everywhere. No thank you, I'll build my own overlay networks.
>>110165941>Consumer routers stopped all sorts of annoying drive by bullshit attacks by locking everything down behind a NATNo they didn't. Just look at the bugs involving SIP and FTP:https://vandis.com/insights/nat-slipstream-what-it-is-and-how-to-protect-your-organizationThis was a huge issue when it was announced and NAT did fuck all to protect you. NAT is not some magical "keep all the niggers out" system. Far from it.
>>110180125>Huge issue>Look inside>Barely any impact>Requires visiting a compromised website to begin with >Browsers already fixed it 6 years agoGot anything else loser? IPv4 and NAT won.
>>110180219>But they already fixed this critical issue from six years ago that meant any tards Geocities blog could hack you I should think so.How do you explain NATJACK?https://natjack.io/
>NAT is good actuallyYou know you can setup NAT on your own router right
>>110180394They don't know that because they know fuck all about networking. They've just been brainwashed into thinking that every thing they don't like is worse than the magic NAT black box they don't understand.
>>110180286>NatjackRequires the attacker to already be on your local network, it's an attack through a NAT.We can do this all of the day IPvShitter, but IPv4 and NAT won. You lost.
>>110158736If you didn't clock immediately that "she" was a a tranny after reading the post you're at least 2 standard deviations below 100IQ
>>110180502It's still an issue. You can handwave all day long if you want to.
IPv6 is easily the worst technology conceived by humans.
>>110180950Skill issue. Just say you got filtered by the letters and colons
>>110181059It isn't shit because of the letters and colons, it's shit because they went with 128 bit instead of 256.The address space isn't large enough to avoid collisions within a subnet.
>>110180558It's not an issue. If you're on my local network already then just put your gun to my head and make me suck your cock. You've already won.
>>110172611I have some amount of respect for trannies that are good at their job. This one isn't.
>>110181156There's no way 128-bit isn't enough to avoid collisions. Do you have any real examples of a collision? Compared to how trivial things like DHCP pool exhaustion are on IPv4 it literally doesn't happen.
>>110181237You don't get the full 128 bit space when allocating an address for a subnet bro. Do you even know how IPv6 works or do you just LARP?You get 64bit for the network, 64 bit for the address.2^64 is absolutely not enough bits at all to avoid collisions.
>>110181280You have multiple of these subnets unless you have a shitty ISP that gives you only a single /64.If you have a /56 as is standard that's 256 different /64's. What sort of botnet are you running at home that that's not enough?
>>110181306>you have multiple of these subnetsI don't want multiple subnets. I want one universally addressable shared common net. I want my addresses to be randomly generatable without risk of collision.With 2^64 I don't have enough range to guarantee no collisions after enough samples. In fact it's only 5 billion addresses before the probability of a collision occuring is 50%.If I wanted subnets and central allocation I would just stick with ipv4 and nat. Ipv6 is a gay half measure.The next protocol better be at least 256bits.
>>110181331>I don't want multiple subnets. I want one universally addressable shared common net.Then it doesn't matter how big you make the address space an attacker can always force a collision by observing IPv6 neighbours and then deliberately colliding with one of them.Most managed switches already have protections against this though. Just turn on its MAC learning feature.
>>110181331and I want a fully loaded bentley torcal with spinnerstake your 5 billion devices and shove them ALL up your ass because there's no system with zero risk of collision. subnets exist among other things so you can resolve the extremely unlikely collisions on the local link without polluting the world with packets when your retarded self-selected ip happens to collide because your name is prahdeep sukdesh and you chose the number 4
Why don't we just use our MAC addresses instead?
>>110181396We do. Link local addresses are awesome and actually usable unlike in IPv4
>>110181368>>110181363kill yourself, niggersYou come around to these threads, you shit on IPv4, you tout all the great benefits of IPv6, but then as soon as I come along and criticize your dandy little baby and say that in fact it does actually suck ass. You suddenly get all defensive in the exact same way that the IPv4 retards get defensive. If I wanted to fiddle around with subnets and centralized collision rejection, then I would just stick with IPv4.Do you have 5 billion devices? Does anyone have 5 billion devices?Will anyone ever have 5 billion devices?What does the concept of 5 billion devices even mean in the future?Why the fuck did they go with 128 bits and then split it 64-64, assuming that that made any fucking sense at all?
>>110181414If you have 5 billion devices you should be shot for existing. You're literally a waste of oxygen. What are you doing with yourself?I can maybe perhaps understand some very large organisation running into limits (some big banks for example have taken out large IPv6 allocations) but they aren't ever going to run one single network with no subnetting. You seriously need to consider killing yourself if you think anyone has this problem.
>>110181331>In fact it's only 5 billion addresses before the probability of a collision occuring is 50%.>5,000,000,000 VMs or containersMan, what in the hell are y'all running over there?
>>110181479He is head Pajeet at Amazon AI and pissed the 5 billion 5090s sitting in his warehouse aren't going to be able to have a direct DMA link to the NIC with a single contiguous IPv6 range without subnetting now.
>>110181479>>110181454>NOOOO you have too many devices!!! Now you just sound exactly like the IPv4 retards. Fuck off.
>>1101815665 BILLION devices is too much. Stop buying e-waste trash and kill yourself
>>110158736it's updoooot time!!https://tailscale.com/blog/tailscale-ssh-findings-fixes>fixes are now available in Tailscale v1.104.4
>>110159217do thirdies genuinely only get assigned ipv6 addresses? it costs like 50p to add an ipv4 addressmy isp doesnt even have ipv6, and they wont ever implement it either
>>110184089A lot of first-world ISPs that are incumbents too. Starlink does CGNAT, for example.If your ISP wasn't around at the beginning of the Internet then they are highly unlikely to have a very large pool of IPv4 addresses to hand out to everyone.They can give you IPv6 for nothing though and you can do everything you did over IPv4 via IPv6 but better.Okay, it costs 50p for you to get a public address now what if you need another because you have multiple servers on the same port and don't want to use crap like Haproxy?Can your ISP give you a whole range of IPv4 addresses for you to use? Most can't or want to charge a lot extra for that privilege.
>>110158757Kel
>>110158762More like ad homomanit's always troons causing a mess
>>110185178starlink just expects you to pay for the privilege i dont see whats wrong with thatthe starlink poverty plan isnt that expensive granted you care massively about bandwidth over latency
>>110158736Good. "Responsible" disclosure is a glowie psy-op.
>>110185930Yes, a lot of ISPs take that approach including mine. I don't bother paying because I don't play shitty multiplayer video gaymes and everything I care about works with IPv6.Have a home server like me? Put it behind Cloudflare and let them proxy to you over IPv6 (Or use Cloudflared if you're schizo and don't want to open up firewall traffic, etc).
>>110159134This, just skip the middleman and use wireguard by itself.
>>110187168ok so whats the problem
>>110158736where did this idea come from that you NEED to give everybody 69 months of time to patch their shit before dropping your PoC?fuck you if you dont want to be embarrassed maybe dont publish shit code in the first place
>>110158736Reminder that Slopscale can at anytime breaks into your machines whenever they want to just by injecting their public key into your machine from their proprietary coordination server. It's really that trivial.
>>110159629It's nothing burger, just all the previous ones :^)https://www.reddit.com/r/Tailscale/comments/1ksy3xy/someone_just_randomly_joined_my_tailnet/
>>110188052There isn't one. I'm not sure where you got that idea.
>>110189335Although I guess there would be a problem if they didn't do IPv6 and only did CGNAT for IPv4 like some shitty providers.
>>110188808Dropping an exploit without giving upstream package maintainers time to get time for patches out in front is fine if you don't ever want to work in the industry. But listen, I don't know if you've ever been labeled an actual shirtbird professionally, but it fucking sucks, and that shit can follow you.If you're hot shit or rich enough, you don't have to give a fuck. I wasn't.
>>110189009hahah wtf they thought they would just special case every single shared email host when they came across it???how does anyone trust these clowns
>>110189009>>110191993WTF that's retarded
Coordinated vulnerability disclosure is dead. It's like companies write viruses and dont tell antivirus companies they exist until there is a fix.
>>110192025>Coordinated vulnerability disclosure is dead.And that is a good thing
>>110158736just setup your own wg server fucking retarded jeets
>>110158748Lol, somehow I just knew beforehand.
>>110193420>muh wg serverOkay but it doesn't do: ACL policies, taildrop, device posture, tailscale funnel or serve, service segmentation, identity for sso, exit nodes, magicdns, https certs, or privileged access management
>>110195957you don't need any of those things if you're not a corporation, and if you're a corporation you shouldn't use a two-bit operation like tailscale
>>110198250>No non-corpo admin needs TLS certs>Kubernetes admins right now
>>110158748holy shit i just knew the moment i read the OP. trannies will do anything for clout.
>>110158736>Erica
>>110198266if you fell for the Kubernetes meme, you already lost
>>110173507tailscale is literally for low iq people filtered from using wireguard
>>110163894thanks, now I can close the thread
>>110166185IPv6 is still winning
yeah im just not going to stop using tailscalei know i know but im just not haha
>>110181331>it's only 5 billion addressesStaggering levels of mental illness.
