Engineering Leader. Currently @Tailscale. Previously @GitHub, @Wingocard, @InVisionApp and @Cloudflare. Views expressed are my own
Canada
Joined May 2008
- Tweets12K
- Following1.1K
- Followers442
- Likes6.8K
Salvatore D'Agostino retweeted
They shall grow not old, as we that are left grow old:
Age shall not weary them, nor the years condemn.
At the going down of the sun and in the morning
We will remember them.
Salvatore D'Agostino retweeted
Today, we Remember those who served and sacrificed for Canada. We wear our Poppies in their honour. We pause in gratitude. We promise never to forget. And through your generosity, we can continue to support Veterans and their families who need our help. Remember their sacrifice. Honour their service. Make a difference. There's still time to support the Poppy Fund. Donate: legion.ca/donations Lest We Forget.
Salvatore D'Agostino retweeted
@bot can now connect to private MCP servers on your tailnet without exposing them to the public internet.
Powered by Tailscale OAuth apps, now GA, so you can build secure agent integrations, too.
Read more here: buff.ly/U1J9By1
Challenge accepted, I think they’re on to us @apenwarr 🚀
I think @Tailscale could be 100x larger than it is today in just a few years.
The open internet is dying. Agents will turn it into a toxic wasteland. UniFi, Tailscale, Discord, and AWS all win in that scenario.
Call of Duty lobbies are a good analogy. When games are overrun by cheaters (humanoids), humans retreat to private, high-trust lobbies.
The same thing happened with the Facebook Wall (blast from the past): people retreated to group chats.
Besides not being a cozy place to hang out it’s also dangerous to advertise your existence (dark forest theory of the internet)…
🔐🕸️
1
340
This shouldn’t be shocking lol. Do less of something and it will atrophy.
Critical thinking has been on the overall decline in our society. We are lazy by nature. The dopamine hit of doing something with little to no effort is addictive.
If AI writes and speaks for humans, what will society look like in the future?
HOLY: Anthropic's Claude Code engineer Addy Osmani is warning about a brutal AI paradox: the more coding you hand to agents, the more you risk losing the very skills needed to supervise them.
He calls it "cognitive surrender." AI-generated code looks pristine, tests pass, and engineers start approving work they no longer understand.
Anthropic's own research warns: "supervising Claude requires the very coding skills that may atrophy from AI overuse."
Osmani makes a striking observation: "When you're producing more than you can stand behind, you're no longer reviewing. You're hoping."
34
Salvatore D'Agostino retweeted
Le 10 novembre, venez célébrer l'intronisation de Carey Price au Temple de la renommée du hockey au Centre Bell! Soyez des nôtres pour une soirée mémorable en l'honneur du gardien le plus victorieux de l'histoire de la franchise
Billets ↓ #GoHabsGo
Salvatore D'Agostino retweeted
If you use taicscale please check this out:
reddit.com/r/Tailscale/comme…
Salvatore D'Agostino retweeted
Feeling really bad for the @Tailscale folks
Lots of people have no idea how it works, that it's more than just Wireguard, the policy and ACL capabilities, that SSH isn't even on by default...
It is wonderful software that someone crapped on, and now everyone wants to roll in it
if you install Tailscale and your impression of it is "wow this is cool!" and not "oh shit, this is just a centralized SSH honeypot?" you're ngmi
Readers added context they thought people might want to know
Tailscale is a peer-to-peer WireGuard mesh VPN; its control server coordinates keys/policies only and sees no traffic. Tailworm report details bugs in optional SSH after prior authorized compromise, not a "honeypot".
tailscale.com/docs/concepts/…
tailworm.com
thehackernews.com/2026/10/unpatc…
tailscale.com/docs/features/…
Salvatore D'Agostino retweeted
Tailscale is great software, so it's unfortunate to see so many people sharing this as "Tailscale got hacked.", which is misleading.
This is not about unauthenticated attackers breaking into random Tailscale nodes. It's what attackers can do after gaining authorized SSH access or compromising an already trusted device.
If I understand correctly, you are secure if you only use Tailscale for your own devices and don't grant anyone else access, which is how many people use it.
Salvatore D'Agostino retweeted
I suspect the real reason eMudhra is exiting the SSL business is Google indicated it is most likely going to drop eMudhra from being trusted by Chrome AT ALL, after observing inexplicable incompetence in how they mis-generated their private key for the CA certificate.
Salvatore D'Agostino retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Salvatore D'Agostino retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Salvatore D'Agostino retweeted
A very very interesting and recent book by Dr Cat Hicks (@grimalkina): Pyschology of Software Teams
She makes a good case on how most companies/teams don’t understand how devs operate and think of devs as “brains in jars.” And now we have AI suddenly enter the room…
Salvatore D'Agostino retweeted
Sovereign AI shouldn’t mean building everything yourself. It means choosing your models, compute, data, and infrastructure, with the freedom to change them.
We’re investing millions to make that practical, led by our new GM Patricia Prewitt.
buff.ly/7cdpTp6
Salvatore D'Agostino retweeted
We are excited to announce that Deno is joining Cloudflare!
deno.com/blog/cloudflare
