Releasing a patch and a detailed write-up on the same day seems like a bit of an unfortunate choice, especially for a WTF!! vulnerability like this. In software that doesn't auto-update, no less...
Looking at the timeline, it looks like Tailscale opted to allow for public release on the day of the patch:
> Sat 19 November: Coordinated Disclosure time proposed by Tailscale, accepted by us, Tailscale shares planned Security Bulletins and blog post
> Tue 22 November, 5:06AM: Blog draft shared with Tailscale (a bit last minute, sorry!!!)
> Tue 22 November, 7:00AM: Coordinated disclosure time
Because the code is open source anyway, I'm guessing they assume attackers would see the announcement of a vulnerability, browse the recent pull requests and figure it all out themselves anyway. Delaying publishing of the details saves maybe a few days of exposure to risk for motivated attackers, especially as the author seems to have done her work together with one other person in just over a week.
They've also sent out emails it seems, so people know they should update ASAP and why. With the extremely limited amount of people running Tailscale (and the even smaller subgroup running it on Windows specifically) I don't think it's an attack hackers will rush to roll out. Mitigations also exist (i.e. block access from the browser to 100.100.100.100) so even in situations where you cannot update you can protect yourself.
Especially as the fixes seemingly have been going into their public GitHub branch for days, since the report. I wonder if that was a conscious choice or negligience, maybe I'm missing something? I would expect these to be released as patches/merged in when the vulnerability is published, like a lot of other security-critical open source software does it.
Malicious actors will monitor patches and reverse-engineer them anyway, so probably better to make some noise in this case and make sure people update as fast as possible.
