Hacker News Reader

Comment by aborsy | Hacker News Reader

It does too many things, and the product has got too complex. I saw a year ago they were looking for someone just to help with complexity.

I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it.

Without taillock it makes no sense. Anyone on their coordination servers will be able to connect to your network.

View on HN

The large attack surface is a good point. I started using it initially and the ease of setting up a vpn was nice, but then I came across few security vulnerability postings which led to concern so I went to Wireguard. I think they should reign in the features and treat it as a secure vpn first and foremost and remove unnecessary features to minimize the attack surface.

If you want a hard-to-use VPN with minimal features and minimal surface area, as you said, Wireguard is right there. Tailscale is convenient Wireguard.

I use Wireguard for several site-to-site VPNs. It just works. I never have to worry about it, and there are very few configuration settings to mess up (unlike, say, IPsec, which is a nightmare.)

Yes, for a permanent site-to-site link. Now try configuring 300 nodes in a mesh, where nodes are coming and going every half hour.

If you architect properly it doesn’t necessarily follow that more features means more attacks, or certainly not more system wide attacks.

If you layer and segment correctly you can build atop a secure core and have some decent security.

> I use it but feel uncomfortable, that it has large attack surface and LLMs will find exploits in it

Doesn't this apply to any application you use? How would it be different with plain wireguard?

> How would it be different with plain wireguard?

Seriously ?

You do realise that of all the security tools on the planet, plain wireguard most likely has the smallest attack surface of them all, right ?

The problem here is as the other poster said. Tailscale is a security tool and yet the guys at Tailscale seem to be insistent on dumping everything INCLUDING the kitchen sink into it as a "feature".

That sort of attitude is not going to end well. You end up with a large bloated code base, which equals large attack surface.

I am talking especially about the LLM part.

Also a kinder tone in your comments would be more appreciated.

No. If software is small enough, it can be proven.

There is formal verification of the protocol and aspects of code:

https://www.wireguard.com/formal-verification/

The code is small enough that can be reviewed.

That makes sense. Thanks!

Reply on news.ycombinator.com