Tailscale replied on Reddit: Hi folks, Mike Shaver here, VP of Engineering at Tailscale. We've seen the concerns about Tailscale SSH and wanted to share what we know so far. If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected. A bit of technical context: Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do. While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not. Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. In the meantime, there are a few precautions you can take: •Review your SSH access policies. Make sure only the people and devices that need access have it. •Review SSH forwarding permissions and remove access you don't need. •Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access. •Enable automatic updates where supported so you can pick up fixes when they're released. For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect. We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up. If we find anything that changes our assessment or requires immediate customer action, we'll communicate that. We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet. We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team tailscale.com/contact/suppor…

Did you read the vulnerability report? Tailscale, the vpn, isn’t affected. If tailscale, the vpn, isn’t affected how can you say Levels has given bad advice here when the vulnerability is for a product he has never advocated for?

A 135K-star GitHub repo is built around one painfully obvious idea: Your coding agent should map the codebase once, not grep it forever. Graphify turns an entire project into a persistent, queryable knowledge graph that AI coding agents can use to understand how different parts of the system connect. Functions, classes, files, SQL schemas, infrastructure configurations, documentation, PDFs, images and videos can become connected nodes instead of isolated pieces of context the agent has to rediscover. So instead of: → Search for authentication → Open twelve files → Follow imports and function calls → Lose the trail as the context fills up The agent can ask: > What connects authentication to the database? > Trace the path from UserService to DatabasePool. > Explain RateLimiter. > Which components are central to this architecture? Graphify returns relevant graph relationships and paths, rather than another collection of keyword matches. For source code, the implementation is particularly interesting. It uses tree-sitter to parse approximately 40 programming languages locally, extracting functions, classes, imports, calls, inheritance and cross-file relationships. No embeddings, vector database or LLM calls are needed to construct the code graph. Document and media processing works differently. PDFs, images and other non-code content can go through an optional semantic extraction step using a configured model. Every relationship carries a confidence label: → EXTRACTED: Explicitly present in the source → INFERRED: Derived through analysis or resolution → AMBIGUOUS: Uncertain and flagged for review Graphify also uses community detection to identify related subsystems and highlights highly connected nodes that may be important to the overall architecture. But the part that makes this useful for coding agents is what happens after the graph is built. Graphify integrates with Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot and more than 20 other assistants. Depending on the platform, it installs hooks or persistent instructions that encourage the agent to query the existing graph before repeatedly searching and reading source files. The graph can be committed to Git, updated incrementally as files change, and exposed through MCP. There's also support for examining pull requests against the graph, including identifying PRs that touch related graph communities and may need closer review. The local tool produces three useful artifacts: an interactive HTML graph, a Markdown architecture report and a reusable graph.json. Long context windows help coding agents read more code. A persistent knowledge graph gives them a way to navigate what they've already analyzed. And as coding agents spend more time working inside large repositories, avoiding repeated discovery of the same architecture becomes increasingly useful. Here's the GitHub Repo: github.com/Graphify-Labs/gra…

I’m going to hang the alien brain in the world coin scanner and give all the goys pink eye

Lmao @ levels giving bad security advice again and again and again and again and again and again and again

‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws. In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.

ever since i moved to sf, my world has been all work. talking about agents all day and spending 90% of my time with my engineers. i wanted more girl friends in that world, so today i built bay area bestie: a way for young, ambitious girls in the bay to find each other. a new platonic match every wednesday at 7pm. for the girlies who want to build big things and have friends to do life with. Bayareabestie.com

The levels of third world scamming on Airbnb are totally unreal. I booked a listing in Beverly Hills and the actual place is in NoHo 💀 I guess we’re doing gay stuff tonight