How to mitigate the risk of malicious devices added to a network?

[33b5e5]

Hi. Just wanted to point out another recent thread on this topic. In particular, @danderson’s reply here:

Secure way to use Tailscale without injection risk of new network members?

Right now, you’re pretty much right. The coordination server is currently part of the trusted envelope for a network, in that it controls what your machines are willing to talk to. If that’s a deal-breaker for you, right now there’s not much we can do, but I’ll mention a couple of options: For enterprise users, we offer an on-premises deployment option. In that setup, you run your own coordination server, which we don’t get access to, and all your Tailscale clients talk directly to it. This is…