[{"data":1,"prerenderedAt":256},["ShallowReactive",2],{"project-46501137":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":29,"sentiment":30,"stance_mix":31,"scored_comments":35,"aspects":36,"strip":42,"post_text":44,"what":45,"said":68,"maker_in_thread":135,"shape":146,"grid":150,"attempts":218,"same_week":219,"maker_shows":33,"maker_hidden":248,"reader_version":249,"card":250},"46501137","Tailsnitch","A security auditor for Tailscale","title","Show HN: Tailsnitch – A security auditor for Tailscale","https:\u002F\u002Fgithub.com\u002FAdversis\u002Ftailsnitch","github.com","thesubtlety",1767631643,2026,280,28,163,4366,4,"legend","security_privacy","security auditing","cli",[24,25,26,27,28],"tailscale","acl audit","tailnet security","zero trust","access control","curious",0.136,{"positive":18,"neutral":32,"mixed":33,"critical":34},8,1,2,15,{"idea":37,"design":39,"execution":41},{"positive":38,"critical":33},3,{"positive":40,"critical":40},0,{"positive":40,"critical":33},[38,40,40,38,38,40,40,38,40,40,38,43,40,40,40,43,38,38,38,40,33,40,40,43,38,40,33,43],5,null,{"problem":46,"audience":58,"pricing":44,"motivation":44,"time_to_build":44,"stack":66,"openness":67,"stage":67,"team_size":67},{"value":47,"source":48,"evidence":49},"Hard to verify Tailscale ACL and tailnet configuration is safe as it grows","commenter",[50,54],{"id":51,"by":52,"text":53},"46502278","Fiveplus","This is what I've been looking for. I love Tailscale, but as our tailnet has grown from \"just me and a few servers\" to \"entire engineering team + prod\u002Fstaging\u002Fdev environments,\"…",{"id":55,"by":56,"text":57},"46502111","dpoloncsak","Maybe a dumb question, but is there any reason or incentive for Tailscale to not run something like this for every user, or atleast offer a \"scan now\" button or something? I love…",{"value":59,"source":48,"evidence":60},"Teams running Tailscale, especially growing engineering teams",[61,62],{"id":51,"by":52,"text":53},{"id":63,"by":64,"text":65},"46503505","Operyl","This tool makes providing evidence for SOC2 slightly easier, and I do wish I had had this when I started my SOC2 journey at $dayJob.",[],"unknown",{"praise":69,"objections":79,"requests":93,"questions":109,"alternatives":124},[70,75],{"value":71,"source":48,"evidence":72},"Useful for checking large ACL files and reducing anxiety about misconfiguration",[73,74],{"id":51,"by":52,"text":53},{"id":63,"by":64,"text":65},{"value":76,"source":48,"evidence":77},"Could run in CI\u002FCD",[78],{"id":51,"by":52,"text":53},[80,86],{"value":81,"source":48,"evidence":82},"Distributed as an unsigned macOS binary requiring quarantine removal",[83],{"id":84,"by":64,"text":85},"46501933","Hahaha, I love it. But also, a security tool you're going to be using against your core infrastructure should probably not be a random binary that you also tell users to strip…",{"value":87,"source":48,"evidence":88},"Only a configuration linter, not live access auditing",[89],{"id":90,"by":91,"text":92},"46502673","mikepurvis","So this is a configuration linter; what I was hoping it might be is something that provides live auditd notices for when a tailscale user connects by SSH to a common \"admin\"…",[94,98,102],{"value":95,"source":48,"evidence":96},"Custom user-defined checks",[97],{"id":84,"by":64,"text":85},{"value":99,"source":48,"evidence":100},"Live audit logging of SSH logins to admin accounts",[101],{"id":90,"by":91,"text":92},{"value":103,"source":48,"evidence":104},"Support for Headscale",[105],{"id":106,"by":107,"text":108},"46502466","toomuchtodo","Will this also work with Headscale [1]? [1] https:\u002F\u002Fheadscale.net\u002F | https:\u002F\u002Fgithub.com\u002Fjuanfont\u002Fheadscale",[110,117],{"value":111,"source":48,"evidence":112},"Does it check a specific Tailscale ACL issue (issue 11717)?",[113],{"id":114,"by":115,"text":116},"46501902","mrbluecoat","Very cool! Does it check for https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Fissues\u002F11717 ?",{"value":118,"source":48,"evidence":119},"Is it not supposed to use tags for user devices?",[120],{"id":121,"by":122,"text":123},"46510034","moontear","Very nice! As a two-user household I was surprised I am not supposed to use tags for user devices: https:\u002F\u002Ftailscale.com\u002Fkb\u002F1068\u002Ftags How am I supposed to work with user devices…",[125],{"value":126,"source":48,"evidence":127},"Teleport",[128,132],{"id":129,"by":130,"text":131},"46504362","aberoham","It sounds like you want the sort of logs that Teleport captures https:\u002F\u002Fgithub.com\u002Fgravitational\u002Fteleport",{"id":133,"by":91,"text":134},"46504768","I guess so, yeah, though that sounds like that's a whole separate ecosystem, and positions itself as a direct competitor: https:\u002F\u002Fgoteleport.com\u002Fcompare\u002Ftailscale-alternative\u002F…",{"comments":38,"answered":34,"key":136},[137,140,143],{"id":138,"text":139},"46503307","Oh that's a cool idea. Super useful for detection and response teams, guessing they're able to get some of that by standard OS telemetry via agents\u002FEDR.",{"id":141,"text":142},"46502341","Ha, I wrote `sketchy` for that.. Agreed though. Not a bad idea, will add it to the list.",{"id":144,"text":145},"46502374","It's checking ACLs via API but not sure about this, I'll have to dig into it a bit.",{"commenters":147,"max_depth":18,"maker_replies":38,"first_comment_mins":148,"lifespan_hours":149},18,48,20,[151,153,155,158,159,160,163,167,171,174,177,178,180,183,186,188,189,191,193,195,197,201,203,205,209,211,212,216],[90,40,38,152,91,40],"project\u002Fneutral\u002Fidea",[138,40,40,154,11,33],"maker\u002Fpositive\u002Fidea",[156,40,40,157,91,40],"46503602","other\u002Fneutral\u002Fnone",[129,40,38,152,130,40],[133,40,38,152,91,40],[161,40,40,157,162,40],"46505034","debarshri",[164,40,40,165,166,40],"46508068","commenter\u002Fneutral\u002Fnone","tptacek",[168,40,38,169,170,40],"46507385","project\u002Fneutral\u002Fnone","raggi",[172,40,40,173,91,40],"46507756","commenter\u002Fpositive\u002Fnone",[175,40,40,173,176,40],"46509544","sbinnee",[106,33,38,169,107,40],[51,34,43,179,52,40],"project\u002Fpositive\u002Fidea",[181,34,40,157,182,40],"46504028","agartner",[184,34,40,157,185,40],"46511150","cedws",[187,34,40,157,185,40],"46511160",[55,38,43,179,56,40],[190,38,38,152,107,40],"46502674",[121,18,38,192,122,40],"project\u002Fneutral\u002Fdesign",[84,43,38,194,64,40],"project\u002Fmixed\u002Fexecution",[141,43,40,196,11,33],"maker\u002Fneutral\u002Fnone",[198,43,33,199,200,40],"46504197","project\u002Fcritical\u002Fexecution","Havoc",[202,43,40,165,185,40],"46511169",[204,43,40,165,64,40],"46511616",[206,207,43,179,208,40],"46510003",6,"Barathkanna",[114,210,38,169,115,40],7,[144,210,40,169,11,33],[213,32,33,214,215,40],"46502863","project\u002Fcritical\u002Fidea","lysace",[63,32,43,217,64,40],"project\u002Fpositive\u002Fnone",[],[220,225,230,234,239,244],{"id":221,"name":222,"points":223,"category":224},"46454693","OpenWorkers",500,"infrastructure",{"id":226,"name":227,"points":228,"category":229},"46491749","taws",390,"dev_tools",{"id":231,"name":232,"points":233,"category":229},"46511469","Prism.Tools",380,{"id":235,"name":236,"points":237,"category":238},"46499646","DoNotNotify",347,"productivity",{"id":240,"name":241,"points":242,"category":243},"46488654","how browsers work",302,"learning_science",{"id":245,"name":246,"points":247,"category":229},"46449852","Enroll",265,false,"v2",{"id":251,"name":5,"line":6,"ai":248,"cat":20,"year":13,"points":14,"comments":15,"rec":29,"s":252,"top":18,"kw":253,"maker":11,"domain":10,"tier":19,"attempts":40,"strip":254,"url":9,"mix":255,"praise":71,"objection":81,"sub":21},46501137,0.14,[24,25,26,27,28],"3003300300350005333010053015",[18,32,33,34],1794036689574]