@VagabondTruffle add friends, and then set up a few non default ssh access settings for them. this is the most far fetched attack. Reply to @VagabondTruffle: It's basically the new equivalent of "attacker with physical control gets root" but not necessarily impossible to patch. Pretty much reveals some people had no opsec, but you CAN add friends to your tailnet and that's where this gets messy