6 ms·

It might weaken TLS, but it also stops the 3000 head of cattle I managed from being able to watch porn (6 incidents) and torrent movies (47 copyright notices).

It might weaken TLS, but it also stops the 3000 head of cattle I managed from being able to watch porn (6 incidents) and torrent movies (47 copyright notices). If their internet banking, which they're not supposed to be doing at work, gets compromised then I really couldn't care less.

plugger 10y ago
Instead couldn't you just whitelist the online banking sites and intercept everything else?
- jaimex2 10y ago
  he just said he doesn't care :P
- synicalx 10y ago
  That would defeat the whole point of a proxy, if I can't see what they're doing and report on people who are doing the wrong thing (according to their employment contract), then why bother?
  - mulmen 10y ago
    Because if you block it then they can't do it and you have nothing to report. Everyone wins.
    - jupp0r 10y ago
      That's one way to see it. In my experience, those proxies in schools are a great way to motivate students to self-educate about how the internet works and about online privacy tools like TOR...
      - mulmen 10y ago
        Why is a proxy necessary for a student to self-educate? Are you just saying this is a lesson they learn the hard way once they have been spied on?
  - Jonnax 10y ago
    So what are you going to report on if someone visits a banking website?
  - thehardsphere 10y ago
    "The whole point of a proxy" isn't to spy on people, even if that's the only reason you use it. For instance, you could block lots of crap with the proxy, thus increasing your organizations security. Does your need to spy on employees watching porn outweigh the potential benefit of not having to deal with porn viruses? You could also use the proxy to cache pages, so that your thousands of users don't waste bandwidth downloading the same pages over and over again. You can do this without harming your ability to spy on people.
deleted 10y ago
[deleted]
duskwuff 10y ago
You don't need HTTPS interception to block sites. Passive observation of the negotiation is sufficient for most purposes, much simpler, and much less risky.
philbert 10y ago
> If their internet banking, which they're not supposed to be doing at work, gets compromised then I really couldn't care less. That's exactly why these systems are a danger to everyone and why you shouldn't be trusted to handle them.
spacemanmatt 10y ago
This makes me feel nostalgic for the custom IT job I did at this oil-patch vendor a while back. They had a failing Win2k server and a SonicWall residential-class router "securing" their business. I replaced it with a linux based firewall and a linux based file/app server. We basically had to protect the executive network/fileserver from outside and inside threats, keep porn/facebook/twitter off the production floor, and the rest was my design to streamline development/production operations. I've never had so much fun writing iptables rules. It's probably swiss cheese by today's security standards and known vulnerabilities, but it was hot stuff in 2008. :) I guess I cared an awful lot about users of my infrastructure. Now people consumer my relational schemas but I still care.
mlindner 10y ago
1. Snooping on their internet banking is ILLEGAL for you to do and puts YOU in hot water. You realize you could be put out of business by lawsuits right?
- synicalx 10y ago
  Really, got any references for that? Specifically Australian law please.
yrro 10y ago
You need to re-read the standard sudo lecture.

plugger 10y ago

Instead couldn't you just whitelist the online banking sites and intercept everything else?

jaimex2 10y ago
he just said he doesn't care :P
synicalx 10y ago
That would defeat the whole point of a proxy, if I can't see what they're doing and report on people who are doing the wrong thing (according to their employment contract), then why bother?
- mulmen 10y ago
  Because if you block it then they can't do it and you have nothing to report. Everyone wins.
  - jupp0r 10y ago
    That's one way to see it. In my experience, those proxies in schools are a great way to motivate students to self-educate about how the internet works and about online privacy tools like TOR...
    - mulmen 10y ago
      Why is a proxy necessary for a student to self-educate? Are you just saying this is a lesson they learn the hard way once they have been spied on?
- Jonnax 10y ago
  So what are you going to report on if someone visits a banking website?
- thehardsphere 10y ago
  "The whole point of a proxy" isn't to spy on people, even if that's the only reason you use it. For instance, you could block lots of crap with the proxy, thus increasing your organizations security. Does your need to spy on employees watching porn outweigh the potential benefit of not having to deal with porn viruses? You could also use the proxy to cache pages, so that your thousands of users don't waste bandwidth downloading the same pages over and over again. You can do this without harming your ability to spy on people.

deleted 10y ago

[deleted]

duskwuff 10y ago

You don't need HTTPS interception to block sites. Passive observation of the negotiation is sufficient for most purposes, much simpler, and much less risky.

philbert 10y ago

> If their internet banking, which they're not supposed to be doing at work, gets compromised then I really couldn't care less. That's exactly why these systems are a danger to everyone and why you shouldn't be trusted to handle them.

spacemanmatt 10y ago

This makes me feel nostalgic for the custom IT job I did at this oil-patch vendor a while back. They had a failing Win2k server and a SonicWall residential-class router "securing" their business. I replaced it with a linux based firewall and a linux based file/app server. We basically had to protect the executive network/fileserver from outside and inside threats, keep porn/facebook/twitter off the production floor, and the rest was my design to streamline development/production operations. I've never had so much fun writing iptables rules. It's probably swiss cheese by today's security standards and known vulnerabilities, but it was hot stuff in 2008. :) I guess I cared an awful lot about users of my infrastructure. Now people consumer my relational schemas but I still care.

mlindner 10y ago

1. Snooping on their internet banking is ILLEGAL for you to do and puts YOU in hot water. You realize you could be put out of business by lawsuits right?

synicalx 10y ago
Really, got any references for that? Specifically Australian law please.

yrro 10y ago

You need to re-read the standard sudo lecture.