gz5

appreciate your hard work and ts in general.

trimming is a neat feature - thanks for that - thought the ACLs are often not there to begin with because configuring off the full node level access defaults of the vpn is difficult, at least at scale.

not specific to ts - all vpns and firewalls have the same intrinsic issue.

there are fair and not fair points in all this (too much AI?).

to be fair, config choices like tailnet lock and ephemeral keys can be used to mitigate.

however, the enumeration of the entire tailnet leading to one compromised node providing the whole map (e.g. hugging face) is inherent in their architecture. that one can be mitigated by ACLs for small networks, but that is unwieldy at scale.

i do have to agree that tailscale is a vpn - which is not easily reconfigured to follow more zero trust principles. so their zero trust washing marketing is disingenuous. they could stick with their strength: an easy to use version of a great vpn (wireguard).

good points and all the more reason to monitor in reliable, safe manner?

fridges are very reliable. but let's IoT them anyways so they can theoretically notify us if there is a problem.

so of course that creates/enables the problem and doesn't notify us.

deliciously ironic and rottingly sad.

this case was egregious - built-in backdoor pw - but that is downstream of the decisions to IoT them and to default them to listen on the network.

>If AI automatically places orders on Amazon's site, tomorrow it could place the order on another company's site, and the user won't know the difference.

Agree that is a big-time longer-term threat but "user won't know the difference" means the user gets the order with parity in delivery time, product quality, returns experience, etc...that won't be replicated overnight, at least not at scale (interesting to think what products could be done first...similar to Amazon starting with books).

Meanwhile ads made Amazon $19.8 billion last quarter alone, even while detracting from our user experience. Can't rip that business away overnight either, but it is less of a lift imo.

Can't comment on the legal basis in the eyes of CFAA or DAFA, but from a business perspective AI is a legit threat to Amazon because headless Amazon makes it more difficult for Amazon to sell ads, which is a large part of their revenue.

Meaning, even if merchants would have a difficult time moving from Amazon to an AI native version of Amazon, this is still a threat.

Dario/Anthropic cites 3 domains: 1. cyberattacks 2. bioterror 3. global economy chaos

So, the first set of questions is would 'exponentially better LLMs' dramatically increase the probability of any of the above, or domains that Dario is not citing? That assumes that exponential improvements will happen if there is not 'pacing'.

IF answers to above are 'yes', then we need to question if 'pacing' is viable. To use a different domain, regulating 95% of vehicles to a max speed would likely save 100s of 1000s of lives, but is not perceived to be viable. In other examples, regulation has unintended consequences in the opposite direction (e.g. some 'rent control' efforts and arguably some drug/alcohol laws).

Interesting juxtaposition with Dario's/Anthropic's 'we must pace the frontier' missive today

i like that it removes tailscale proprietary.

if that is goal then why not go 100% open source to eliminate the ts derp control as well and get full sovereignty?

like netbird, openziti, zerotier, etc.