Comment by brof

Thanks for linking that. The debate about these issues will rage on, but I do wonder whether giving Tailscale two hours of notice before public release was the right call? The arguments from the post are that "rapid awareness of these flaws will expediate remediation" and that they were "discovered with low effort". Does the author mean that simply pointing Claude at Tailscale identified (a non-trivial subset) of these vulnerabilities, and did the author not feel that Tailscale had a track record of responding to vulnerabilities, via a coordinated disclosure, in a timely manner? I would personally have liked to see a bit more of a justification of the almost-immediate publication against the potential risks to users, vs. e.g. waiting a day or two.