Hacker News Reader

> For an example of how invasive this is for the average user, this person discovered Tailscale trying to collect ~18000 data points per week about their network usage based on the number of blocked DNS requests for `log.tailscale.com`: https://github.com/tailscale/tailscale/issues/15326

18000 data points per week seems IMHO pretty low (only 1.7 requests per minute for a whole network? Unlikely, even my Android phone does way more that 1.7 requests per minute just to ad networks, nevermind everything else on the network summed), it's probably way more.

18000 data points is also a lie, that's a different issue - the issue of UDP DNS sucking in general so your average application/OS keeps reissuing requests if they think the UDP packet got dropped.

> only 1.7 requests per minute for a whole network?

Connections != Requests

Telemetry consisting of an open/close event pair would be, like, one entire SSH session, or one RDP session. Even HTTP has supported Keep-Alive since 1997.

> Connections != Requests

DNS lookups != Requests too...

Headscale creator here.

> Fun fact: Tailscale have an almost-assuredly-accurate count of Headscale users due to how few people disable the Tailscale client's telemetry which by default sends them real-time events about everything you do on a Headscale network. See KB1011: https://tailscale.com/kb/1011/log-mesh-traffic

That is not true. We actually instruct all the clients to send no logs - since at least three years:

https://github.com/juanfont/headscale/blame/main/hscontrol/t....

And also in the config example:

https://github.com/juanfont/headscale/blob/main/config-examp...

That said, I would have loved to know how many nodes use Headscale... :)

That’s appalling. I really feel like a fool — I had thought the world of Tailscale but no longer.

This needs to be more widely known.

I always appreciate that Alpine Linux maintainers disable[1] these things by default.

[1]: https://gitlab.alpinelinux.org/alpine/aports/-/blob/master/c...

  > It's possible to opt out of this spying on Unix/Windows/Mac by starting Tailscale with `--no-logs-no-support` or `TS_NO_LOGS_NO_SUPPORT=true` environment variable

Am I misreading the docs?[0]

  Network flow logs are available to help you understand which devices are connecting to one another over time, that is, the flow of traffic across your tailnet.

  These logs strictly do not contain any information about client operations or contents of network traffic.

  Network flow logs must be enabled[1].

This makes it look like they are disabled by default.

[0] https://tailscale.com/kb/1011/log-mesh-traffic

[1] https://tailscale.com/kb/1219/network-flow-logs#enable-netwo...

> Am I misreading the docs?

Yes, but don't feel bad, because this seems designed to be confusing and easy to overlook. See the privacy policy: https://tailscale.com/privacy-policy#information-we-collect-...

“When you use the Tailscale Solution, we collect limited metadata regarding your device used to access the Tailscale Solution, such as: the device name; relevant operating system type; host name; IP address; cryptographic public key; user agent (where applicable); language settings; date and time of access to the Tailscale Solution; logs describing connections and containing statistics about data sent to and from other devices (“Inter-Node Traffic Logs”); and version of the Tailscale Solution installed.” (emphasis mine)

Here's a Tailscale client startup with telemetry enabled, which is the silent default:

  2025/04/13 17:02:07 logtail started
  2025/04/13 17:02:07 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale"}
  2025/04/13 17:02:07 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5
  2025/04/13 17:02:07 logpolicy: using system state directory "/var/db/tailscale"
  2025/04/13 17:02:07 dns: using dns.openresolvManager
  2025/04/13 17:02:07 ifconfig destroy: exit status 1
  ifconfig: interface tailscale0 does not exist
  2025/04/13 17:02:07 wgengine.NewUserspaceEngine(tun "tailscale0") ...

Versus the same client with the `--no-logs-no-support` opt-out argument added, where the very first line (not to mention the argument name itself) is some FUD trying to scare one into reverting to anti-privacy mode:

  2025/04/13 16:29:20 You have disabled logging. Tailscale will not be able to provide support.
  2025/04/13 16:29:20 logtail started
  2025/04/13 16:29:20 Program starting: v1.82.0, Go 1.24.2: []string{"/usr/local/bin/tailscaled", "-port", "41641", "-tun", "tailscale0", "-statedir", "/var/db/tailscale", "--no-logs-no-support"}
  2025/04/13 16:29:20 LogID: b933623d2f5012930c72af6593b1a94f36749b5495076c937bde51dd620d21e5
  2025/04/13 16:29:20 logpolicy: using system state directory "/var/db/tailscale"
  2025/04/13 16:29:20 dns: using dns.openresolvManager
  2025/04/13 16:29:20 ifconfig destroy: exit status 1
  ifconfig: interface tailscale0 does not exist
  2025/04/13 16:29:20 wgengine.NewUserspaceEngine(tun "tailscale0") ...

Ah thanks!

For anyone wondering, Lammy provided the head of journalctl for tailscaled.service. I got similar results.

I think my confusion comes down to there being two different types of logging. It is the network flow logs that are on the enterprise.

Per the privacy policy statement, this does not set off any alarm bells for me. Reason being that the capacity to create logs would necessitate that language. But I definitely don't like that they are collecting that much information. Thanks, I'll change /etc/defaults/tailscaled

Randomly stumbled across this last week when I upgraded my DNS blocklist and saw all the tailscale logs. Definitely unexpected