Executive TL;DR:

• Tailscale did not stop the Hugging Face intrusion despite no vulnerabilities in the system.
• The breach occurred due to a reusable auth key being written in an environment file.
• Tailscale is taking the intrusion seriously and reviewing its security measures.

The Buzz Score

The Internet’s Verdict: 60% Concerned, 40% Supportive

Forum Reactions

Users are divided on the issue, with some praising Tailscale’s transparency and others criticizing the company’s security measures.

> No “vulnerabilities” in Tailscale were found or exploited, and that might make it even more uncomfortable for us. […] But, we’re a security tool. Their intrusion is our intrusion, and it’s our job to take it seriously.

Others are highlighting the importance of security best practices, such as not writing reusable auth keys in environment files.

> One of those 136 credentials was a reusable Tailscale auth key, used to create new Tailscale CI (continuous integration, used for automated testing) nodes in their tailnet.

Lessons Learned

The incident highlights the need for robust security measures and user awareness. Tailscale is expected to review its security features and provide guidance on best practices.

Focus Keyword: Tailscale Security