November 2022 Summaries

Tailscale has introduced golink, an open-source private URL shortener service, designed for use within tailnets, allowing users to create and share memorable links without needing browser extensions or DNS modifications. This service integrates seamlessly with Tailscale, ensuring privacy and security by limiting access to users within the tailnet without requiring additional login credentials or security policies. Inspired by a similar tool developed at Google in 2006, golink provides a simple way to access frequently used resources with short and memorable URLs, such as go/name for easy navigation. Built to run anywhere, golink does not require a Tailscale client installation, thanks to tsnet, which handles Tailscale connections. The service features templated links, facilitating flexible URL redirection based on user-defined parameters, and offers basic statistics tracking for link usage. Golink has been in experimental use for several months within Tailscale, proving to be a versatile and lightweight tool for managing internal links efficiently.

In the November Tailscale newsletter, the company highlights several updates and community contributions. Tailscale addresses security vulnerabilities in its Windows client by recommending users upgrade to the latest versions, while also announcing the launch of Tailscale Funnel, which simplifies routing internet traffic to nodes within a tailnet. The newsletter details community-driven projects, such as building a Tailscale exit node using firewalld and creating virtual networks with Pulumi. It also discusses Tailscale's presence on the Fediverse and introduces features like webhooks and tsnet for enhancing user experience. Additionally, Tailscale is actively hiring and building a learning library to assist users at various career stages while emphasizing the importance of VPNs in remote work environments.

Tailscale organized a unique three-day co-work event called "Tailscale Runs Anywhere I Need (TRAIN)" to demonstrate their remote work capabilities by traveling on the Amtrak Coast Starlight line from Emeryville, CA to Seattle, WA. The event provided opportunities to strengthen and form friendships among the team through shared experiences, laughter, and games, while also focusing on work by shipping new features and addressing critical vulnerabilities. The journey included work sessions in various locations, such as a shared workspace in Berkeley, an overnight train ride, and a day working from a scenic Airbnb in Seattle's Queen Anne neighborhood. The experience highlighted Tailscale's commitment to a flexible, remote working culture, and the company is actively hiring individuals interested in this dynamic work environment.

Tailscale has identified security vulnerabilities in its Windows client that allow a malicious website to alter the Tailscale daemon configuration and access information through the Tailscale local and peer APIs. These vulnerabilities, which involve DNS rebinding attacks due to cleartext communication and lack of Host header verification between the local API and the Windows client GUI, can potentially enable attackers to change the coordination server and access environment variables. Although there is no evidence of these vulnerabilities being exploited, users are urged to upgrade their Windows clients to version 1.32.3 or later, or the unstable version 1.33.257 or later, to ensure protection. Affected users have been notified via email, and administrators can monitor impacted devices through the admin console. Instructions for obtaining the latest stable release are provided for users who may not yet see the update available on their devices.

Tailscale Funnel is a new feature introduced by Tailscale that allows users to expose services from their private tailnet to the public internet without needing a publicly routable IP address. This feature is designed to enable users to receive webhooks, host websites, or run services like personal blogs or Mastodon servers directly from their devices. Tailscale Funnel operates by setting up public DNS records and using Funnel ingress nodes that connect to users' Tailscale nodes via Tailscale's inter-node "peerapi" mechanism. The system ensures security by not providing packet-level access but rather offering TCP connections that the user's node can accept or reject based on its configuration. Users can either pass the TCP connection to a local webserver to handle HTTPS or have the Tailscale daemon terminate TLS and proxy the HTTP requests internally. Currently in alpha, Tailscale Funnel is being gradually rolled out to testers, with plans for broader availability in future stable releases.

Tailscale has established a presence on the Fediverse by creating a corporate account on Hachyderm, aiming to maintain a positive and mutually beneficial corporate presence. Recognizing the novelty and potential resistance from the core Fediverse community regarding corporate involvement, Tailscale seeks to engage with users directly and calmly, avoiding traditional marketing tactics seen with other brands. With a history of personal engagement on the Fediverse, the author, Xe Iaso, emphasizes the company's commitment to setting a standard for corporate participation while planning to develop tools and integrations that benefit the community. Tailscale invites users to follow their account for updates and encourages interaction through mentions and hashtags.

Tailscale offers a versatile virtual private network solution that enables secure connections between devices on a network, referred to as a tailnet, allowing users to access services like NAS, RDP, and SSH from anywhere. The tool extends its functionality through a library called tsnet, which can be embedded in Go programs, enabling the creation of virtual private services that operate within the same system without requiring root permissions or exposing services to the public internet. These services, each with their own IP address and DNS name, benefit from Tailscale's encrypted tunnels and can obtain HTTPS certificates from Let’s Encrypt. This setup allows hosting multiple services with different confidentiality levels on the same machine, simplifying access control and enhancing security. The blog post details the process of setting up a basic "hello" server using tsnet and provides examples of its practical applications, such as supporting team operations and integrating with tools like Grafana or Minecraft, illustrating the flexibility and security of using tsnet in various contexts.

Tailscale has introduced a new feature allowing users to configure webhooks to receive notifications on specific events within their tailnet, such as the addition of new nodes or authorization needs. Developed by Laura Florea during her internship, this feature enables users to set up a webhook endpoint from the admin console and subscribe to desired notification events, which triggers a sequence of operations that culminate in an HTTP POST request delivering event data. To address security concerns, Tailscale has implemented measures such as using a proxy server to prevent server-side request forgery, verifying event authenticity with a shared secret key, and ensuring all webhook endpoints are HTTPS. The introduction of webhooks aims to improve user experience by providing timely alerts and enhancing system security and scalability.