5 ms·

If they're doing this for China, what do you figure they've been doing for the US government?

by swombat 10y ago

tptacek 10y ago
You mean apart from the fact that the US Government doesn't operate a "Great Firewall of the United States"?
- sitkack 10y ago
  Doesn't it? It is just transparent and the traffic shaping is self enforced.
  - tptacek 10y ago
    No, it doesn't.
    - manicdee 10y ago
      You ate correct of course. Five eyes is not a firewall. Tapping into fibre optics, spying on civilian satellite communications, and keeping tabs on everyone's phone calls, emails and web browsing s not a firewall either. But it is an invalid comparison snce it isn't the GFW that is gettng people killed, it's the packet inspection and traffic monitoring.
    - peteretep 10y ago
      I sincerely thank you for pushing back on all the crap in this particular thread. HN seems to have devolved in to "well the world SHOULD work the way I want it to" recently, and you're doing sterling work here being the voice of reason.
  - djrogers 10y ago
    That's not a firewall any more than a river is a damn.
- bcook 10y ago
  No, we only have the NSA that can archive days (weeks?) worth of the United States internet traffic, seamlessly MITM 0days, or tons of other frightening things... I guess a transparent firewall is not a firewall?
  - tptacek 10y ago
    We don't have anything like a "transparent firewall", either.
    - bcook 10y ago
      Unless you are fully aware of NSA activities, you cannot be sure of that statement. Here's an excerpt from Cisco: [0]“Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices.” I dunno if our disagreement is about the semantics of what a "transparent firewall" is, but the NSA has been shown to filter a majority of the traffic that traverses the USA, so your statements that the USA has nothing like the GFW seems a bit off... [0]: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/fwmode.html http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/conf...
      - tptacek 10y ago
        The NSA "filters" a majority of the traffic that traverses the USA? What site can't I get to because of those filters?
        bcook 10y ago
        I guess my criticism is that stopping communication (GFW) and monitoring communication (NSA) are very similar, therefore we do have our own GFW.
        10y ago
- jonathankoren 10y ago
  No, but what if there is some sort of NSA backdoor? I have no evidence of one, but if they're willing to build special hardware for another country's secret police, why not?
  - tptacek 10y ago
    That's a legit question. If you'll design software specifically to help China persecute a religion, it's hard to imagine pushing back too hard on a lawful request from your own government.
- swombat 10y ago
  Walls are so passé. Panopticons have been the modern way to keep people in check since sometime back in the 18th/19th Century in Europe. After all, when you have nothing to hide, you are nothing to fear...
  - tptacek 10y ago
    You're suggesting that there are straightforward comparisons to be drawn between the Communist Party of China and the United States Government? That sounds like something that's especially fun to argue on an Internet message board and not all that illuminating anywhere else.
    - Zigurd 10y ago
      Just a moment ago you argued that China is a nation of laws and Cisco didn't break them, so they are not criminals. Now you question the ability to make "straightforward comparisons." Which is it? Or are we getting at the essence of American exceptionalism here?
      - tptacek 10y ago
        I did not claim that China is a nation of laws. But even if I had, I still wouldn't understand this objection. Could you try to make it clearer?
- alanwatts 10y ago
  Of course, there are many much more subtle and effective ways to stifle free speech and human rights than a big firewall which can easily be circumvented with a VPN. MITM attacks, botnet troll armies, astroturfing, etc. etc. Good luck finding proof of that though.
  - tptacek 10y ago
    "I can't find proof of this, therefore it must be happening" is very popular message board logic.
    - alanwatts 10y ago
      As are appeals to authority. i.e.: "I can't find proof of this, therefore it must not be happening Let me ask you this, what precisely would suffice as proof, in your opinion, of such activities? On the internet, maybe there really is no such thing as undeniable "proof" that anyone did anything, considering how easy it is to fabricate evidence. [1] [1]https://news.ycombinator.com/item?id=11440594 https://news.ycombinator.com/item?id=11440594
      - tptacek 10y ago
        Pointing out that you've presented no evidence for an argument is not an "appeal to authority".
        alanwatts 10y ago
        >Argument from ignorance (from Latin: argumentum ad ignorantiam), also known as appeal to ignorance (in which ignorance represents "a lack of contrary evidence"), is a fallacy in informal logic. It asserts that a proposition is true because it has not yet been proven false (or vice versa). This represents a type of false dichotomy in that it excludes a third option, which is that: there may have been an insufficient investigation, and therefore there is insufficient information to prove the proposition be either true or false. https://en.wikipedia.org/wiki/Argument_from_ignorance https://en.wikipedia.org/wiki/Argument_from_ignorance Open and shut case, Johnson!
- vacri 10y ago
  > You mean apart from the fact that the US Government doesn't operate a "Great Firewall of the United States"? So, basically you're saying that even though Cisco has shown a willingess to work with a corrupt government in China, that willingness to work with corruption does not translate to the US, simply because the US doesn't run a 'great firewall'?
- mirimir 10y ago
  The NSA would rather collect data ;) But there is some blocking. It's mostly been DNS poisoning, against "piracy" and such. I don't recall specifics, but at times there have been sites that were reachable with IP addresses, but not using public DNS servers. There have been, for example, Firefox plug-ins with hard-coded lookups.
mtgx 10y ago
Cisco created the "lawful intercept" protocol for routers, for starters...which of course can now be used by hackers as well. https://tools.ietf.org/html/rfc3924 https://tools.ietf.org/html/rfc3924 https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-wp.pdf https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl...
- signa11 10y ago
  > Cisco created the "lawful intercept" protocol... That's not correct, csco _implemented_ lawful-intercept, the protocol is an integral part of 3gpp spec I.e. All companies playing in the epc/telecom market would most likely support this e.g Ericsson, Nokia (nsn), Alcatel-lucent etc etc

If they're doing this for China, what do you figure they've been doing for the US government?

by swombat 10y ago

If they're doing this for China, what do you figure they've been doing for the US government?

tptacek 10y ago

You mean apart from the fact that the US Government doesn't operate a "Great Firewall of the United States"?

sitkack 10y ago
Doesn't it? It is just transparent and the traffic shaping is self enforced.
- tptacek 10y ago
  No, it doesn't.
  - manicdee 10y ago
    You ate correct of course. Five eyes is not a firewall. Tapping into fibre optics, spying on civilian satellite communications, and keeping tabs on everyone's phone calls, emails and web browsing s not a firewall either. But it is an invalid comparison snce it isn't the GFW that is gettng people killed, it's the packet inspection and traffic monitoring.
  - peteretep 10y ago
    I sincerely thank you for pushing back on all the crap in this particular thread. HN seems to have devolved in to "well the world SHOULD work the way I want it to" recently, and you're doing sterling work here being the voice of reason.
- djrogers 10y ago
  That's not a firewall any more than a river is a damn.
bcook 10y ago
No, we only have the NSA that can archive days (weeks?) worth of the United States internet traffic, seamlessly MITM 0days, or tons of other frightening things... I guess a transparent firewall is not a firewall?
- tptacek 10y ago
  We don't have anything like a "transparent firewall", either.
  - bcook 10y ago
    Unless you are fully aware of NSA activities, you cannot be sure of that statement. Here's an excerpt from Cisco: [0]“Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices.” I dunno if our disagreement is about the semantics of what a "transparent firewall" is, but the NSA has been shown to filter a majority of the traffic that traverses the USA, so your statements that the USA has nothing like the GFW seems a bit off... [0]: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/fwmode.html http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/conf...
    - tptacek 10y ago
      The NSA "filters" a majority of the traffic that traverses the USA? What site can't I get to because of those filters?
      - bcook 10y ago
        I guess my criticism is that stopping communication (GFW) and monitoring communication (NSA) are very similar, therefore we do have our own GFW.
        10y ago
jonathankoren 10y ago
No, but what if there is some sort of NSA backdoor? I have no evidence of one, but if they're willing to build special hardware for another country's secret police, why not?
- tptacek 10y ago
  That's a legit question. If you'll design software specifically to help China persecute a religion, it's hard to imagine pushing back too hard on a lawful request from your own government.
swombat 10y ago
Walls are so passé. Panopticons have been the modern way to keep people in check since sometime back in the 18th/19th Century in Europe. After all, when you have nothing to hide, you are nothing to fear...
- tptacek 10y ago
  You're suggesting that there are straightforward comparisons to be drawn between the Communist Party of China and the United States Government? That sounds like something that's especially fun to argue on an Internet message board and not all that illuminating anywhere else.
  - Zigurd 10y ago
    Just a moment ago you argued that China is a nation of laws and Cisco didn't break them, so they are not criminals. Now you question the ability to make "straightforward comparisons." Which is it? Or are we getting at the essence of American exceptionalism here?
    - tptacek 10y ago
      I did not claim that China is a nation of laws. But even if I had, I still wouldn't understand this objection. Could you try to make it clearer?
alanwatts 10y ago
Of course, there are many much more subtle and effective ways to stifle free speech and human rights than a big firewall which can easily be circumvented with a VPN. MITM attacks, botnet troll armies, astroturfing, etc. etc. Good luck finding proof of that though.
- tptacek 10y ago
  "I can't find proof of this, therefore it must be happening" is very popular message board logic.
  - alanwatts 10y ago
    As are appeals to authority. i.e.: "I can't find proof of this, therefore it must not be happening Let me ask you this, what precisely would suffice as proof, in your opinion, of such activities? On the internet, maybe there really is no such thing as undeniable "proof" that anyone did anything, considering how easy it is to fabricate evidence. [1] [1]https://news.ycombinator.com/item?id=11440594 https://news.ycombinator.com/item?id=11440594
    - tptacek 10y ago
      Pointing out that you've presented no evidence for an argument is not an "appeal to authority".
      - alanwatts 10y ago
        >Argument from ignorance (from Latin: argumentum ad ignorantiam), also known as appeal to ignorance (in which ignorance represents "a lack of contrary evidence"), is a fallacy in informal logic. It asserts that a proposition is true because it has not yet been proven false (or vice versa). This represents a type of false dichotomy in that it excludes a third option, which is that: there may have been an insufficient investigation, and therefore there is insufficient information to prove the proposition be either true or false. https://en.wikipedia.org/wiki/Argument_from_ignorance https://en.wikipedia.org/wiki/Argument_from_ignorance Open and shut case, Johnson!
vacri 10y ago
> You mean apart from the fact that the US Government doesn't operate a "Great Firewall of the United States"? So, basically you're saying that even though Cisco has shown a willingess to work with a corrupt government in China, that willingness to work with corruption does not translate to the US, simply because the US doesn't run a 'great firewall'?
mirimir 10y ago
The NSA would rather collect data ;) But there is some blocking. It's mostly been DNS poisoning, against "piracy" and such. I don't recall specifics, but at times there have been sites that were reachable with IP addresses, but not using public DNS servers. There have been, for example, Firefox plug-ins with hard-coded lookups.

mtgx 10y ago

Cisco created the "lawful intercept" protocol for routers, for starters...which of course can now be used by hackers as well. https://tools.ietf.org/html/rfc3924 https://tools.ietf.org/html/rfc3924 https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/BlackHat-DC-2010-Cross-Attacking-LawfulI-Intercept-wp.pdf https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl...

signa11 10y ago
> Cisco created the "lawful intercept" protocol... That's not correct, csco _implemented_ lawful-intercept, the protocol is an integral part of 3gpp spec I.e. All companies playing in the epc/telecom market would most likely support this e.g Ericsson, Nokia (nsn), Alcatel-lucent etc etc