if your article is about how your product was insufficient to protect against something, you get a pass i guess

And I have no problem with this. Infact it would be nice to be a point of pride to be there to say how your security is handled.

Why not? If done right it’s a good way to talk about implications for those companies and provide some education like tailscale did here.

We also saw Anthropic post about “our agent escaped too” and while I understand the incident caused them to review, they found something and needed to disclose, the whole thing came across much worse and largely they got mocked or accused of trying to piggyback, so obviously there are good and bad ways.

If there are other providers with interesting takes, I think they would be worth hearing.

If they take actions that would have further prevented or limited this attack then it seems like a good form of advertising to me.

i doubt it. it's pretty risky to set higher expectations for yourself when no one was really asking.

they are a company, therefor anything they write is an advertisement of sorts, but that doesn't make it bad by default. cloudflare and netflix (among others) also write blog posts that i find interesting and enjoy reading, despite being ads at their core.

All aboard the public relations hype train! choo choo!

Oh no! An advertisement! Whatever shall we do‽

This is the kind of ad that may be opportunistic but sort of speaks for itself: they're not going to make excuses. I've been happy with Tailscale for years and this is part of why.