[lukeschlather]

> they also show that someone at huggingface made a very stupid thing by writing a reusable auth key in an env file

I don't see where it says that. The Tailscale key specifically it says was stored in the kubernetes secret manager, and obtained once the attacker already had root on the k8s cluster, so would've had full access to all the secrets stored in a sensible fashion.

They did get root by dumping the environment for a process, but "don't store secrets in environment variables" while it is a valid bit of hardening advice, I wouldn't call it stupid to store a secret in an environment variable.

[itopaloglu83]

> How did you get past security? His fortress is impenetrable. > > Door was unlocked.

Once you’re a root at a system that has the ability to add and remove nodes to a network, it’s pretty much over, at least for being able to add a Tailscale node.