Comment by aborsy
10 hours ago
Tailnet owner may not trust all their devices to the same extent. Here is a concrete example.
I install tailscale on my cloud vps which I use for downloading torrents. I want my laptop to talk to this node, but I don't want this vm talk to my laptop, which is the whole purpose of ACLs. My ACL is deny by default, so that is great and easy to set. But now this node can still send arbitrary files to my laptop. If I don't remember to tag it, I'm vulnerable. If I do, there is still a window that this node can send me files until I tag it (I can't install tailscale to a tag).
Sending a file otherwise normally requires an app listening to a port, so taildrop permissions should be same as network permissions set by ACL.
BTW, last year or so tailscale advertised a position for someone to manage complexity of tailscale. Founder was talking about this issue. They seem to be aware of the problem.
Tags are a key part of managing ACLs. If you're concerned about an untrustworthy node on your tailnet, use tags. Even if you forget to add a tag to a newly added node (API keys can be set to automatically assume a tag when used fwiw), if your other devices are tagged then they're ineligible for taildrop.