4 ms·

No, we only have the NSA that can archive days (weeks?) worth of the United States internet traffic, seamlessly MITM 0days, or tons of other frightening things.

• tptacek 10y ago
  We don't have anything like a "transparent firewall", either.
  • bcook 10y ago
    Unless you are fully aware of NSA activities, you cannot be sure of that statement. Here's an excerpt from Cisco: [0]“Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices.” I dunno if our disagreement is about the semantics of what a "transparent firewall" is, but the NSA has been shown to filter a majority of the traffic that traverses the USA, so your statements that the USA has nothing like the GFW seems a bit off... [0]: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/fwmode.html http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/conf...
    • tptacek 10y ago
      The NSA "filters" a majority of the traffic that traverses the USA? What site can't I get to because of those filters?
      • bcook 10y ago
        I guess my criticism is that stopping communication (GFW) and monitoring communication (NSA) are very similar, therefore we do have our own GFW.
        • tptacek 10y ago
          What the US does is not even remotely similar to what the GFW does. And, by the way, the idea that you can trivially evade the GFW using a VPN? That's an extremely dangerous assumption.
          • bcook 10y ago
            I see monitoring and blocking to be part of the same machine. We apparently disagree. :) >And, by the way, the idea that you can trivially evade the GFW using a VPN? That's an extremely dangerous assumption. I think that part of your reply was meant for someone else. (I agree with the part I quoted.)
            • kbenson 10y ago
              I think a big problem with your argument is your assumption that the US government does, or even can, monitor to the same degree that China does. The amount of interconnections and peering between networks makes this near impossible in practice in the US. If they could, there would have been no need for them to try to tap directly into Google's datacenter-to-datacenter lines. The internet is a mesh, not a star. Monitoring can get far by picking the largest entities and trying to insert themselves at those points, but there's plenty of traffic that goes directly between entities that isn't monitored. This works for monitoring, because it's passive, but once we're talking about a firewall and something is blocked, traffic will just shift to routes that aren't blocked if they exist. The GFW is a firewall because they actually have control of all the routes.
      • grecy 10y ago
        A massive wall with a gate in it that allows everyone through is still a wall. Everyone going through that gate can be monitored, recorded, held for questioning, etc. And jumping out of the metaphor, every packet passing through the gate can be copied and stored for later.