June 2025 Summaries

Tailnet Lock is now generally available, offering a Trust On First Use (TOFU) model to ensure security for users of Tailscale's networking solutions by allowing administrators to control node access with admin-controlled keys before granting network connectivity. Tailnet Lock enhances security by enabling users to move Tailscale’s coordination server out of their center of trust, thus reducing potential risks associated with Tailscale acting as a threat actor. It employs a cryptographically verifiable chain to manage node signing and includes safeguards to prevent accidental removal of all signing nodes. New features such as webhook events have been introduced to facilitate automation and alerting for node signing processes, and users can maintain privacy by holding onto their disablement secrets, with the option to share them with Tailscale for support if desired. Tailnet Lock is suitable for various users, from startups to enterprises, who seek to maintain control over their network's trust boundaries, with options for self-hosting or using Tailscale’s SaaS model for additional benefits.

In June, Tailscale introduced several significant updates to enhance network reliability, management, and security, including the general availability of grants and app connectors. Grants now provide unified access controls across network and application layers with syntax improvements, while app connectors securely route traffic to external applications over the Tailscale network, replacing traditional cloud gateways and modernizing VPN architecture. The company also made refinements to the Tailscale admin console and released updates across client apps, including fixes for Windows, macOS, iOS, Android, Docker, Kubernetes, and tsrecorder. These updates aim to improve functionality, user experience, and configuration clarity, with detailed instructions available in their update guide and documentation.

TSFlow is a real-time network visualizer developed by Raj Singh, a Customer Success Engineer at Tailscale, designed to transform Tailscale network logs into interactive insights for users on Premium and Enterprise plans. As traditional network monitoring tools struggle with Tailscale's dynamic and identity-based networking, TSFlow offers a solution by providing visualizations that clarify network activity, support access control list (ACL) verification, pinpoint performance bottlenecks, and offer security insights. Built with a Go backend and React frontend, TSFlow allows users to easily understand their network's topology through interactive graphs, live traffic animations, and customizable analytics dashboards. It simplifies network management by enabling real-time monitoring and problem-solving without the need for additional infrastructure or advanced expertise. Although TSFlow is a community-maintained open-source project, it integrates seamlessly with existing Tailscale environments, enhancing network visualization and operational efficiency.

In a discussion with Ben Thompson of Stratechery, Tailscale CEO Avery Pennarun argues for outsourcing authentication in modern apps, highlighting the inefficiency and security risks of managing usernames and passwords in-house. He points out that open standards like OpenID, OAuth, and OIDC have transformed authentication by allowing users to log into multiple services with a single identity, reducing the need for each service to create its own login system. Professionally managed identity providers (IdPs) offer enhanced security, seamless user experiences, and simplified account recovery, which most companies cannot match. Despite concerns about centralization, these IdPs are likened to high-security vaults, providing superior protection and reliability. Pennarun introduces Tailscale's tsidp, an open-source OIDC server, which allows companies to maintain control over their authentication policies while leveraging the security expertise of major identity providers. He emphasizes the benefits of focusing on core competencies, suggesting that companies should let specialists handle authentication to improve security and efficiency.

The Tailscale GitHub Action has been updated to provide secure connectivity for CI/CD pipelines, now supporting Windows and macOS alongside Linux. This enhancement addresses the previous limitations faced by developers who had to resort to insecure or cumbersome workarounds to connect their pipelines. With the support for all three major operating systems, developers can securely deploy applications to internal servers, debug private test runners via SSH, and connect runners to test databases and internal monitoring tools without exposing them to the public internet. Tailscale's features, such as ephemeral nodes and tags, enhance the security and efficiency of CI/CD pipelines by enabling automatic cleanup of nodes and simplified access control. Setting up Tailscale with GitHub Actions involves creating OAuth clients and secrets, allowing for seamless integration and management of secure connections. This update aims to improve security while easing the workload of Engineering and DevOps teams by providing a unified solution for secure pipeline connectivity.

Frequent reauthentication processes, often seen as a security measure, can ironically weaken security by creating user frustration and increasing vulnerability to phishing attacks, as explained by Avery Pennarun. Traditional beliefs that frequent logins enhance security are outdated, as modern security should focus on effective access management, rapid policy updates, and device possession verification rather than arbitrary login cycles. Pennarun argues that security should be seamless and adaptive, utilizing continuous verification methods and real-time security checks, such as those offered by Tailscale, to ensure robust protection without disrupting user experience. By moving away from frequent logins and towards intelligent, background security measures, organizations can enhance security while reducing user inconvenience and risk exposure.

Web Summit 2025 in Vancouver offered a vibrant mix of futuristic cityscapes and significant discussions on AI and networking, with Tailscale's CEO, Avery Pennarun, actively participating in panels focused on AI security and infrastructure challenges. Pennarun highlighted the need for secure AI adoption through network isolation and cautious permissions, comparing AI to an eager intern requiring structured guidance. The event also emphasized the complexities of multicloud environments due to GPU shortages, stressing the importance of seamless connectivity, which Tailscale aims to address. Besides engaging with industry leaders and hosting networking events, the team noted widespread AI fatigue, with a demand for genuine, secure solutions. The summit underscored the importance of privacy and security amidst global tensions and left participants inspired by the potential of AI to offer real value.

Tailscale recently held its first-ever meetup in Seattle, drawing a full house and featuring talks from notable speakers such as Wes Payne and Brad Fitzpatrick, alongside engaging discussions that left attendees eager for more. The event celebrated the Tailscale community with custom swag and a playful atmosphere, culminating in plans to organize similar meetups globally. Concurrently, Tailscale launched the Tailscale Insiders program, which received an overwhelming response, welcoming 17 diverse members into its inaugural cohort. These Insiders contribute by writing blogs, speaking at events, testing features, and offering feedback, fostering a collaborative environment that aims to include voices from varied backgrounds. With ongoing applications and active participation on platforms like Reddit, the Tailscale community continues to grow, reflecting a commitment to inclusivity and innovation in networking and access control solutions.