4 ms·
The real reason they opted to do this, is make mobile firewalling more of a pain. If each application talked to the specific (types of) google services they nee
by cik 8y ago
The real reason they opted to do this, is make mobile firewalling more of a pain. If each application talked to the specific (types of) google services they needed, firewalling would be easier.
Instead, users cannot have a global rule to block .1e100.net across their devices, due to this choice. In my case, this results in having literally dozens of rules - really one per application, in order to ensure that applications that are granted upstream internet access, are not granted .1e100.net access unless I explicitly feel that they need access to Google Services.
- sigjuice 8y agoHow is this specific to “mobile firewalling”? Wouldn’t my computer have to undergo the same pain?
- thanatropism 8y agoThere should be a market for devices that sit between your wi-fi modem and the ethernet cable that fulfill these firewalling needs. For security + convenience, they could be set up so that the internet can't update or configure it -- rather, you have to insert SD cards to upgrade or change rules. (Maybe the device already comes with "Full paranoia", "Dissident blogger", "All-family", etc. cards in different colors; updates are downloaded from the internet otherwise).
- jkaplowitz 8y agoNo such conspiracy theory needed: I don't think Google always uses separate IPs for each Google service. Their infrastructure is too large-scale, containerized and dynamic for that to be efficient.
- imglorp 8y agoSo, it's basically domain fronting. It's okay for them, when they do it to shroud their individual services and keep you from blocking one. If I want to pass Mail and block Adsense, no dice for me. But if I want to domain front, because I need to pass through a third party censor, tough darts for me.
- cik 8y agoExactly this, exactly my issue.
- ryanobjc 8y agoNo, this isn't domain fronting. This has to do with PTR records, reverse DNS. Domain fronting is all about the forward lookups, normally you wouldn't be making PTR requests in a normal web request. Putting all your infrastructure under a single utility domain is very common, all the ISPs do it. It's good practice for reasons listed elsewhere in here. Bringing in the practice of domain fronting into this conversation is technically irrelevant, but it does advance an agenda, relying upon the less-than-technically literate HN audience from being confused between reverse DNS, domain fronting, and firewall rules.
- walrus01 8y agoThis has nothing to do with domain fronting at all, this is industry standard reverse DNS and PTR records for ARIN, RIPE, APNIC, AFRINIC, etc IP space.
- fl0wenol 8y agoAll of their services and ad networks use the "regular" names (like youtube.com and google-analytics.com) for these services and webpages, so any browser or mobile device will be looking up IPs via those names. And it's not like they're using CNAMEs that point to mixed-in names either. You can block them selectively using proxies without issue. As far as 1e100.net goes, I'm not sure where that would be applicable or why it's an issue. Now, if you're looking to do that kind of selective blocking at the IP/netblock layer... good luck. That's a nearly impossible task since large network service providers like Google have so many network spaces coming and going and can move around their services as demand dictates. It's a core competency. And that wouldn't matter whether they were all part of one domain or all kept separate. Unless your strategy was to work out which netblocks each business unit's domains were authoratitive for on reverse lookup and then blocking all of that. But that's ... making a lot of assumptions.
- btian 8y agoI don't understand anything you said. Can you explain?
- deleted 8y ago[deleted]