Exploring the Security of Mesh Systems and TailScale's Smart VPN Service

Show notes:
Links:
Tailscale
Ubiquity hack
Front
Write for Honeybadger

Full transcript:
Ben:
The struggle is real when it comes to WiFi here. Because until two weeks ago you could've said, "Yeah, use Ubiquiti, it's all great." Now, there's this big disruption that they're having this attack that they didn't want to admit to.

Josh:
Yeah. I didn't hear about this.

Ben:
Yeah. So the thing that was terrible was that they said, "Oh, there was a leak at our third-party vendor." Well, the third party vendor is Amazon Web Services. If you're going to pin the blame on AWS for your lack in security, that's pretty ridiculous. So there was some whistleblower that came out and say, "No, they're really idiots. They're not logging access to the databases."

Ben:
Their press release was like, "Well, we don't have any evidence of access to your data." The whistleblower was like, "Well, they don't have any evidence of access to your data because they don't do any logging to their database." So they have no idea who's been querying what. It's like, oh, yeah, that's not great.

Josh:
That's cool. That's a good excuse.

Ben:
Sure, yeah. So the vagueness plus the misdirection stuff and it's just like, "Okay, my opinion of them just went through the floor."

Josh:
You never track it, you never know.

Ben:
That's right. Exactly.

Starr:
Yeah. It seems like the, I don't know, it seems like you just got to take the hit. Whenever something like that happens, you just got to suck it up and take the hit.

Ben:
Just like YOLO, "Yeah, well-"

Starr:
Yeah. YODO, you only die once.

Ben:
Well, you have to figure also my dad has probably been breached five or six different times from five or six different large companies. So it's like, who even cares anymore? I'll just spray my social security number and my birth date anywhere. I'll just put it on my billboard in my front yard. Yeah, have at it.

Josh:
Yeah. Publish it online.

Ben:
The dark web is like a light gray web now. There's just so much data out there. But it's Ubiquiti or do you buy, I have a really small house so I don't really need these mesh systems which promise this outrageous speed for outrageous amounts of money. So I don't need the great or whatever. And then if you don't go with those options, then all that's left really is TP-Link or NETGEAR. It's like, "Well, okay." But like, fine. It just doesn't seem like there's a really great quality product from a great quality company. I don't know. Maybe I'm just-

Starr:
Yeah. There was a couple of weeks ago.

Ben:
Yeah. They wisened up weeks ago.

Josh:
Yeah. I'd probably still just buy the Ubiquiti gear to be honest. Because they're all leaking your data.

Ben:
That's what I'm saying.

Josh:
Like, yeah, who's better?

Starr:
Yeah. That's why you use TLS.

Ben:
For real. Yeah, can you imagine we actually lived at a time when you would just not even use TLS to log into your websites or no WiFi?

Starr:
I know. I know.

Ben:
Can you remember those days?

Starr:
So unsafe.

Ben:
It's amazing. I had a friend who was all anti WiFi because, this is over 20 years ago, because he's like, "You just take all your secrets and throw them out the window so anybody can get at them." Yeah. It's remarkable to think that we lived that way. Speaking of security though, I was... I don't know why I was looking at this. But for some reason, this morning I looked at Tailscale again. I don't know if you're familiar with Tailscale.

Josh:
Yeah, what's that?

Ben:
It's a startup that they provide basically a smart VPN. It's like a vpn with some magic sprinkles on top. Basically they take a WireGuard which is a late generation VPN product. So you might be familiar with stuff like OpenVPN or even way back in the day Cisco stuff that was done on hardware. But WireGuard is the latest generation of VPN software which is actually not crazy to setup. It's actually reasonably easy to use.

Ben:
And then Tailscale took that to the next level with making it super easy to just connect to whatever. So basically you run their little agent and you can VPN into your network without even having to worry about the stuff. They do the authentication for example, through Google Login or through Octa or whatever. So you don't have to hop on a box and create keys and send out stuff to people one on one. It's basically all just magic.

Ben:
So I was playing with that this morning and it's really quite neat. I was like, "Okay." Well, I'm on my iPad reading about it and I'm like, "Well, just install this iOS." I'm like, "Great." So now I have a in thing. Then it gives you IP addresses for all your internal stuff. It's really cool. We already have VPN for our stuff but I thought that was, well, do a switch.

Josh:
Yeah. At this rate we wouldn't even need to pass our those OpenVPN files or whatever. That would be nice.

Ben:
Yeah. And they have ECLs and stuff. So you can say, "Oh well, the marketing person gets access to the internal dashboard but doesn't get access to SSH to these servers." And then of course there's audit trails and stuff.

Josh:
That's pretty cool.

Starr:
That's really cool.

Ben:
Yeah. It's pretty handy.

Starr:
Yeah. On their features it says magic DNS. I think we need a little more magic in our lives. So I'm going to... Yeah. But that would be useful even if you are... I don't know. I can imagine it being useful if you are traveling and you want to go on your home network even. That would be pretty nice.

Ben:
Yeah, I was thinking about replacing my laptop with a Mac Mini and just leaving it in my office and then using Tailscale to hop in if I ever needed it to do anything. Most of the stuff is getting whatever. It's like I just do it at home from a different machine. But I was just like, "Well, maybe there is that one thing that I'm going to have on my machine at work and I want to have at night." So I was like, "Oh, Tailscale." Put that on there and, yeah. Fun toys.

Starr:
Yeah. It's pretty neat. 

Ben:
Not where they do security though. I have been spending all week on customer stuff like sales stuff, marketing stuff.

Starr:
How's that thing going?

Ben:
Well, I've been floundering a little bit. It's not my background and so everything is more difficult that it seems like it should be. There seems like there's a lot of friction there. Like for example, the early part of the week, we had some suggestions from Harris about some changes that we could make to the website. And-

Starr:
Yeah. Harris is a sales consultant guru guy. Okay.

Ben:
And then we had some other suggestions from another good friend of ours that we can make. So I was looking at the home page and it's like, "Man, copyrighting is hard." It's like getting into that mindset of, okay, what's your customer perspective? When they come to this page and you have a candidate here who's interested, what do they want to see? And then trying to get in that mindset and then come up with some copy that speaks to that mindset.

Ben:
I know that there's this notion of, you go get your customer's voice from reviews and things like that. But sometimes you just got to create stuff. I don't know. So I've been doing that and it's not a skill that I have worked on developing and so it feels very painful to try and come up with it. It's like, "Oh really, this stuff is taking a lo...