5 ms·

Could you elaborate?

by d33 9y ago

dvfjsdhgfv 9y ago
The Internet is the infrastructure plus a set of protocols, with HTTP being just one of them. The protocols the most heavily used tend to be regulated (at least in the EU...), the rest - not so much. So each time I hear someone talking about "the death of the Internet" when they mean regulation related to the WWW, I feel at least we as "hackers" should remember this important distinction because sooner or later, once the web becomes even more regulated, we might want to turn to these remaining protocols in order to communicate more freely, and without the blessing of people who create web browsers (that became so complex you practically can't compete here unless you have tons of money).
- loup-vaillant 9y ago
  There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network. I can see this becoming so bad that the only way to communicate freely would be to tunnel our stuff through TLS on port 443. (That is, doing what looks like HTTPS.)
  - dvfjsdhgfv 9y ago
    That's true. Fortunately, if everything else fails, we should always be able to connect on 443 via stunnel for example, no matter what protocol we use. That's the price to pay for the net getting more complex and more abused.
    - blobwalker 9y ago
      Unfortunately, that's not true. Corporate networks got rid of plain old proxies that just passed anything SSL on 443 many years ago. In order to meet regulatory requirements to record employee communications, pretty much every US company of any decent size uses a proxy (blue coat, zscaler, palo alto, etc.) that executes MiTM attacks on all SSL traffic. If it's something other than HTTP over SSL, or if it's to a blocked hostname, it won't go through.
      - loup-vaillant 9y ago
        We can go one step further, and put our payload into an encrypted body in an innocent looking HTTP request. Thus begins the game of cat and mouse…
      - iamatworknow 9y ago
        The sad part is that a lot of people don't even seem to care. When my relatively small company announced that they were installing a Palo Alto firewall and that everyone needed to install client side certificates in order for web browsers to continue working, it set off major alarm bells in my head that led to one conclusion -- "No more non-work related web browsing at the office. No exceptions." Most of my coworkers (albeit mostly those in support and not developers, but still people at least somewhat familiar with the way computers work) only cared that they'd still be allowed to visit Facebook during the day. I was assured that "nobody was actively looking at employee web traffic" but that doesn't matter. They didn't even think it was a big deal to put this new monitoring in writing until I made a big stink out of it, and they added this to the employee handbook: >Each of these communication avenues are subject to monitoring by the IT Security Manager, a supervisor, or the President. When using any of these communications, be aware that a business record is made, which is retained by the company and becomes the company's property. This business record may potentially contain sensitive personal information related to the sites you are viewing and into which you are logging on, including user/password information. If you do not wish to share such information, it is suggested you do not access those items using [employer]'s network.
  - zrm 9y ago
    > There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network. That is definitely not the result of a lack of regulation. The networks doing that are predominantly not public networks like Comcast, they're private internal corporate networks. The issue is they're a large enough minority that they can't be ignored. But that can't be fixed with regulation of public networks. In fact, it's caused by certain regulations and pseudo-regulations like PCI-DSS, which require the default-deny policies you're referring to.
    - loup-vaillant 9y ago
      I stand corrected, thanks.

Could you elaborate?

by d33 9y ago

Could you elaborate?

The Internet is the infrastructure plus a set of protocols, with HTTP being just one of them. The protocols the most heavily used tend to be regulated (at least in the EU...), the rest - not so much. So each time I hear someone talking about "the death of the Internet" when they mean regulation related to the WWW, I feel at least we as "hackers" should remember this important distinction because sooner or later, once the web becomes even more regulated, we might want to turn to these remaining protocols in order to communicate more freely, and without the blessing of people who create web browsers (that became so complex you practically can't compete here unless you have tons of money).

loup-vaillant 9y ago
There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network. I can see this becoming so bad that the only way to communicate freely would be to tunnel our stuff through TLS on port 443. (That is, doing what looks like HTTPS.)
- dvfjsdhgfv 9y ago
  That's true. Fortunately, if everything else fails, we should always be able to connect on 443 via stunnel for example, no matter what protocol we use. That's the price to pay for the net getting more complex and more abused.
  - blobwalker 9y ago
    Unfortunately, that's not true. Corporate networks got rid of plain old proxies that just passed anything SSL on 443 many years ago. In order to meet regulatory requirements to record employee communications, pretty much every US company of any decent size uses a proxy (blue coat, zscaler, palo alto, etc.) that executes MiTM attacks on all SSL traffic. If it's something other than HTTP over SSL, or if it's to a blocked hostname, it won't go through.
    - loup-vaillant 9y ago
      We can go one step further, and put our payload into an encrypted body in an innocent looking HTTP request. Thus begins the game of cat and mouse…
    - iamatworknow 9y ago
      The sad part is that a lot of people don't even seem to care. When my relatively small company announced that they were installing a Palo Alto firewall and that everyone needed to install client side certificates in order for web browsers to continue working, it set off major alarm bells in my head that led to one conclusion -- "No more non-work related web browsing at the office. No exceptions." Most of my coworkers (albeit mostly those in support and not developers, but still people at least somewhat familiar with the way computers work) only cared that they'd still be allowed to visit Facebook during the day. I was assured that "nobody was actively looking at employee web traffic" but that doesn't matter. They didn't even think it was a big deal to put this new monitoring in writing until I made a big stink out of it, and they added this to the employee handbook: >Each of these communication avenues are subject to monitoring by the IT Security Manager, a supervisor, or the President. When using any of these communications, be aware that a business record is made, which is retained by the company and becomes the company's property. This business record may potentially contain sensitive personal information related to the sites you are viewing and into which you are logging on, including user/password information. If you do not wish to share such information, it is suggested you do not access those items using [employer]'s network.
- zrm 9y ago
  > There's a flip side to this: in part thanks to this lack of regulation, anything outside the popular protocols tend to be blocked in an increasing number of network. That is definitely not the result of a lack of regulation. The networks doing that are predominantly not public networks like Comcast, they're private internal corporate networks. The issue is they're a large enough minority that they can't be ignored. But that can't be fixed with regulation of public networks. In fact, it's caused by certain regulations and pseudo-regulations like PCI-DSS, which require the default-deny policies you're referring to.
  - loup-vaillant 9y ago
    I stand corrected, thanks.